River v0.1.0-alpha.10 — Safer Git reads and responsive navigation

River 0.1.0-alpha.10

Safer Git content reads, responsive folder switching, and clearer loading and recovery states. The interface is currently in Korean.

Download the Apple Silicon DMG · All release assets

Changes

• Isolate working-folder status, Diff and Git hygiene checks in private Git metadata/configuration and an exact index copy with frozen applicable attributes. External clean/process definitions cannot enter these content processes, including when configuration changes after validation. Original index and working-folder bytes are preserved. This requires Apple Git 2.43 or later.
• Cancel obsolete client read waits when switching folders and let the current folder begin validation immediately. Old responses and old cleanup cannot replace its state. An engine read already started can continue within its server budget.
• After capability discovery, refresh rich task information with one dedicated RPC and publish only changed values. Older-engine fallback, unsaved drafts and confirmed-save revision protection remain.
• Distinguish initial loading from a confirmed clean folder, preparation-pending folders and lookup failure. Coherent cached Diff remains visible and read-only while validation is pending or failed. A failed initial branch lookup also says it failed.
• Preserve task-form inputs when an execution preview expires and require a fresh explicit preview. Preparation source drift or branch collision directs the user to a new plan; existing branches, folders and completed sibling repositories are retained.
• Carry preparation read deadlines and cancellation into enumeration, byte hashing, trust/inspection/postcondition reads and process waits. Already-admitted writes retain their independent bounded outcome handling; cancellation does not roll back Git or certify the outcome of an interrupted write.
• Reject release builds when any tracked source has Git assume-unchanged or skip-worktree flags. Check both before and after provenance capture without clearing flags or changing source/index bytes.

Install and compatibility

Alpha.6 and later can use River → 업데이트 확인…. Earlier versions require one manual installation. Open the DMG, drag River.app into Applications, eject the image and launch River. Download, installation and restart require user action. Save session drafts first; active work postpones restart.

Item	This release
Architecture	Apple Silicon, arm64
Declared minimum	macOS 14
Tested runtime	macOS 27.0.1; macOS 14–26 remains unverified
Bundle version	0.1.0, build 11; full version 0.1.0-alpha.10
Updates	Sparkle 2.10.0; signed feed/archive; user-controlled installation
Git	Apple command-line Git 2.43+ for working-folder status, Diff and Git hygiene checks

Update Xcode or Apple's Command Line Tools if River reports an older Git. River uses /usr/bin/git; a Homebrew-only installation is not selected. The built-in example additionally needs python3.

The app, embedded updater/engine and DMG are Developer ID-signed with hardened runtime and secure timestamps. Apple notarization is not completed, so first launch may be blocked. Review Apple's Open Anyway instructions if you choose to trust this alpha.

The alpha.8 workflow-data compatibility boundaries remain: do not run different engine versions concurrently against one journal. A legacy-engine rewrite can require an explicit context reset; past history remains preserved. See the task workflow guide.

Verification and limits

244 Swift tests, 192 Rust tests and 62 Python tests pass, including real Cargo executable-bundling and CryptoKit signature checks. Rust formatting and strict Clippy pass. All 12 changed/new Swift files have clean actual SourceKit-LSP diagnostics with in-memory positive error controls and unchanged source bytes. CLI and native Swift-client scenarios pass against the real Rust service with independent Git cross-checks. Synthetic tests cover late clean/process installation, source-index preservation/racy timestamps, conversion parity, preparation cancellation/deadlines, draft/recovery races and packaging provenance flags.

Native selection states are rendered offscreen with real SwiftUI/AppKit views and a private synthetic service at the minimum 1100×720 size in light/dark appearances. These checks are not OS-input, keyboard, clipboard or VoiceOver certification. Package/feed checks and an information-only Sparkle probe do not establish an OS-driven installation or relaunch. User projects and the running user app are not used for mutation tests or replacement.

A local comparison used the same owned repository with 2,000 synthetic files and two persistent optimized services, alternating six calls per method/build (five warm samples). Warm medians were 226 → 294 ms for status and 159 → 242 ms for Diff, alpha.9 → alpha.10. Read isolation therefore still adds about 69/84 ms per request on this fixture; this is not a backend speedup claim. UI navigation no longer waits for the obsolete client read, and rich task polling removes one overlapping RPC after discovery. Large-repository latency, idle/active energy and multi-workspace RSS remain unverified.

• Content-read isolation does not isolate all Git commands. Worktree materialization, commit and checkout retain preflight checks against live Git configuration; concurrent configuration edits at those write boundaries remain a limitation. Configured external filters, including unused global LFS definitions, remain unsupported.
• Isolated reads cap the index and split dependency at 64 MiB each, individual config/attribute/ignore inputs at 1 MiB, collected auxiliary sources at 8 MiB, and applicable directory depth/count. Unsupported configurations are rejected; the original index is never normalized to make a read pass.
• Preparation reads check deadlines/cancellation between bounded chunks. Slow OS filesystem calls need not stop immediately. Ready siblings, checkpoints and conservative unknown outcomes remain; no automatic rollback/retry is added.
• Staging, remote transport, evidence history bounds and report authority retain their documented limits. River does not invoke AI tools, infer criterion fulfillment, certify AI-DLC phases or approve integration. See limitations. The license remains undecided (UNLICENSED).

Verify the download

Download the DMG and matching checksum into the same folder:

shasum -a 256 -c River-0.1.0-alpha.10-macos-arm64.dmg.sha256

The manifest records packaging metadata. Checksums do not replace signature or notarization checks.

River v0.1.0-alpha.9 — Clear staging and guided AI workflows

River 0.1.0-alpha.9

Clearer staging and a guided path from task intent to AI-assisted work, verification evidence and a commit. The interface is currently in Korean.

Download the Apple Silicon DMG · All release assets

Changes

• Stage or unstage the selected file with a visible button above its Diff, including new files. The lists now read Before staging (스테이징 전) and Included in commit (커밋에 포함). These switch the displayed list; the Diff buttons perform the action. Supported text hunks remain available through Stage this change only (이 변경만 스테이징).
• Explain what the next commit includes and why a staging action is unavailable. Whole-file unstaging removes that file's entire staged selection while preserving its working-folder content. Leaving the last file on a source list clears its old Diff.
• Open Task & AI guidance (작업·AI 안내) to follow four steps in the existing task pane: purpose and criteria, preview/copy a request into an external AI tool, record actual results and evidence, then review files and commit. An existing checkout works directly; creating a Task or worktree is optional.
• Put the observed behavior, results and evidence first in the report form. Optional provider/model and claimed reviewed-code values sit in a named disclosure; unknown values stay empty and incomplete/tool-error warnings remain visible.
• Include the work instruction in the work-context request and keep collected observations separately quoted. Requests remain editable previews for manual copying; River does not invoke AI tools or transmit their contents.

Try one small change using the real-project getting-started guide (한국어). The task workflow guide explains condition history and evidence boundaries. This release connects human decisions, code and evidence for AI-assisted development; it does not certify AI-DLC stages or criterion fulfillment. No new external-advisor consensus is claimed.

Install and compatibility

Alpha.6 and later can check River → 업데이트 확인…. Earlier versions need one manual installation: open the DMG, drag River.app into Applications, eject the image, then launch River. Download, installation and restart require user action. Save session drafts first; active work postpones restart.

Item	This release
Architecture	Apple Silicon, arm64
Declared minimum	macOS 14
Tested runtime	macOS 27.0.1; macOS 14–26 remains unverified
Bundle version	0.1.0, build 10; full version 0.1.0-alpha.9
Updates	Sparkle 2.10.0; signed feed/archive; user-controlled installation
Git	Apple command-line Git; remote operations require 2.41+, regular-file whole-file staging requires 2.42+

The app, embedded updater/engine and DMG are Developer ID-signed. Executables use hardened runtime and secure timestamps. Apple notarization is not completed, so first launch may be blocked. Review Apple's Open Anyway instructions if you choose to trust this alpha. The built-in example additionally needs python3.

File staging is capability-gated: an older connected engine shows an update/reconnect explanation instead of receiving a substitute write command. Git older than 2.42 cannot isolate attribute conversion for regular-file staging; unstaging, deletion and symlink staging do not need that conversion. Unsupported conversion attributes are rejected.

The alpha.8 workflow-data compatibility boundaries remain: do not run different engine versions concurrently against one journal. Legacy-engine rewrites can require an explicit context reset; existing history remains preserved. See the task workflow guide before resetting.

Verification and limits

235 Swift tests and 169 Rust tests pass, together with Rust formatting and strict Clippy checks. Native synthetic scenarios exercise the real Rust service. Coverage includes selected-file stage/unstage, new files, stale state, target changes, concurrent index writes, index-lock ownership, sibling preservation, bounded file reads and strict request decoding. AI guidance checks cover draft instructions, quoted observations, report input and action availability. The unchanged package/updater Python code retains alpha.6's 56-test validation; the changed native preview runner is checked separately.

Native screens are rendered offscreen with SwiftUI/AppKit and synthetic repositories. These checks are not OS-input/clipboard/VoiceOver certification, older-macOS testing or large-repository benchmarks. Update feed/archive checks do not certify an OS-driven installation/relaunch. Real user projects are not used for staging probes.

• Whole-file staging is limited to 32 MiB per file and a 64 MiB index. Conflicts, submodules/nested repositories, special files, unsafe paths, external filters and unsupported conversion attributes are rejected. Working-folder bytes and HEAD are preserved; only the selected index entry changes. Text-hunk support has narrower limits.
• Selected-file conversion uses an isolated Git configuration and attributes context. General status/diff reads retain a preexisting probe-then-execute boundary; concurrent edits to Git configuration are not isolated from those reads. That shared read boundary still needs hardening.
• Recent evidence contains at most 50 records across the task; history summaries contain the latest 10 versions. Missing recent evidence does not establish absence across all history.
• Criterion links, result status and claimed examined states are author-supplied reports. River does not infer fulfillment, observe external AI execution, or approve integration.
• Guide reads accept regular UTF-8 .md, .txt, .mdc and .rst files up to 64 KiB inside the selected repository/worktree. Includes, commands, URLs and document instructions are not followed. Pins compare bytes only when explicitly read again.
• App Git checks cover tracked hygiene/conflicts/in-progress state, not build/test success, untracked content or submodules. No automatic AI execution, merge or deployment is added. Existing limitations remain. The project's license is undecided (UNLICENSED).

Verify the download

Download the DMG and matching checksum into the same folder:

shasum -a 256 -c River-0.1.0-alpha.9-macos-arm64.dmg.sha256

The manifest records packaging metadata. Checksums do not replace signature or notarization checks.

River v0.1.0-alpha.8 — Criterion history, report links and verification guides

River 0.1.0-alpha.8

Completion-criterion history, explicit report links and repository verification guides for River’s native macOS app. The interface is currently in Korean.

Download the Apple Silicon DMG · All release assets

Changes

• Give each completion criterion a durable ID. Reordering preserves identity, editing advances its revision, and duplication creates a new ID. Deleted criteria retain their earlier history and report bindings.
• Link human or AI reports to explicitly selected criteria. Keep copied criterion text and revision, report completion/tool status, provider/model and literal artifact references. Historical reports and app Git checks stay unlinked.
• Separate recording-time code observations from the HEAD or change snapshot a reviewer says they examined. Missing claims stay unknown; incomplete reports, tool errors and changed or deleted criteria remain visible. Matching hashes do not certify execution, criterion fulfillment or approval.
• Register repository verification procedures or feature-map references. Read one document explicitly as bounded plain text, optionally pin its SHA-256, then compare it on a later read. Documents are not executed or automatically included in AI handoffs.
• Keep the normal task pane compact with expandable criterion links, guide references and report details. Retrieve recent records through one indexed query rather than a query for every report. This is a query-count improvement, not a large-repository latency benchmark.

These implement the first three priorities from the earlier AI-DLC/pstack research and advisor discussion. No new provider consensus is claimed for this implementation. See the task workflow guide and research and boundaries.

Install and compatibility

Alpha.6 and later can check River → 업데이트 확인…. Earlier versions need one manual installation: open the DMG, drag River.app into Applications, eject the image, then launch River. Download, installation and restart require user action. Save session drafts first; active work postpones restart.

Item	This release
Architecture	Apple Silicon, arm64
Declared minimum	macOS 14
Tested runtime	macOS 27.0.1; macOS 14–26 remains unverified
Bundle version	0.1.0, build 9; full version 0.1.0-alpha.8
Updates	Sparkle 2.10.0; signed feed/archive; user-controlled installation

The app, embedded updater/engine and DMG are Developer ID-signed. Executables use hardened runtime and secure timestamps. Apple notarization is not completed, so first launch may be blocked. Review Apple’s Open Anyway instructions if you choose to trust this alpha. Apple command-line Git is required; remote operations require Git 2.41 or later. The built-in example additionally needs python3.

Legacy persisted context and receipt bodies remain unchanged; v2 data uses separate tables and RPCs. After upgrade, the new engine rejects legacy context saves. A sequential legacy-engine rewrite is shown as a compatibility conflict; explicit reset creates fresh IDs while preserving earlier history. Do not run different engine versions concurrently against one journal. The guide explains the recovery path.

Verification and limits

219 Swift tests and 141 Rust tests pass, along with Rust formatting and Clippy checks. Coverage includes duplicate/reordered/deleted criterion identity, immutable report bindings, stale and concurrent writes, compatibility conflicts, report completion/basis separation, guide repository targeting, bounded text reads, unsafe paths, symlink races and special files. Unchanged Python sources retain alpha.6’s 56 Python test validation.

Native synthetic scenarios use the real Rust service for saving, guide reading and pinning, report linking, edits and reconnects. Screens are rendered offscreen with SwiftUI/AppKit. These are not OS-input/clipboard/VoiceOver certification, older-macOS testing or large-repository benchmarks. Update feed/archive checks do not certify an OS-driven installation/relaunch.

• Recent evidence contains at most 50 records across the task; history summaries contain the latest 10 versions. Missing recent evidence does not establish absence across all history.
• Criterion links and claimed examined states are author-supplied reports. River does not infer fulfillment, observe external AI execution, or approve integration.
• Guide reads accept regular UTF-8 .md, .txt, .mdc and .rst files up to 64 KiB inside the selected repository/worktree. Includes, commands, URLs and document instructions are not followed. Pins compare bytes only when explicitly read again.
• App Git checks cover tracked hygiene/conflicts/in-progress state, not build/test success, untracked content or submodules. No automatic AI execution, merge or deployment is added. Existing limitations remain. The project’s license is undecided (UNLICENSED).

Verify the download

Download the DMG and matching checksum into the same folder:

shasum -a 256 -c River-0.1.0-alpha.8-macos-arm64.dmg.sha256

The manifest records packaging metadata. Checksums do not replace signature or notarization checks.

River v0.1.0-alpha.7 — Evidence summaries and verification requests

River 0.1.0-alpha.7

Current-folder evidence summaries and verification-request drafts for River’s native macOS app. The interface is currently in Korean.

Download the Apple Silicon DMG · All release assets

Changes

• Show current-folder evidence gaps and the next useful check in task information. Distinguish missing intent, unavailable observations, failed or uncertain checks, and changed code or requirements. Use journal order even if the clock moves backwards.
• Keep recent recorded failures visible when their current applicability needs rechecking. Display the recent-record scope and separate author reports from app-observed Git checks. Expand the history only when needed.
• Include the same summary and next check for each repository in handoff, preserving unknown and unprepared sibling states.
• Choose 인수인계 or 검증 요청 from the existing draft action. Verification requests ask for actual behavior, inspectable evidence and explicit unexecuted checks. Preview and edit before copying; changing location discards the old preview. River does not invoke AI or execute draft commands.

These changes follow primary-source AI-DLC/pstack research and actual Claude, Grok and Devin discussion. Agy calls were quota-blocked and did not produce advice. See workflow direction and boundaries.

Install and compatibility

Alpha.6 users can check River → 업데이트 확인…. Alpha.5 and earlier need one manual installation: open the DMG, drag River.app into Applications, eject the image, then launch River. Download, installation and restart require user action. Save session drafts first; active work postpones restart.

Item	This release
Architecture	Apple Silicon, arm64
Declared minimum	macOS 14
Tested runtime	macOS 27.0.1; macOS 14–26 remains unverified
Bundle version	0.1.0, build 8; full version 0.1.0-alpha.7
Updates	Sparkle 2.10.0; signed feed/archive; user-controlled installation

The app, embedded updater/engine and DMG are Developer ID-signed. Executables use hardened runtime and secure timestamps. Apple notarization is not completed, so first launch may be blocked. Review Apple’s Open Anyway instructions if you choose to trust this alpha. Apple command-line Git is required; remote operations require Git 2.41 or later. The built-in example additionally needs python3.

Verification and limits

190 Swift tests pass, including evidence scope/freshness, clock reversal, recorded-failure visibility, quoted request content and ServiceClient handoff regressions. Unchanged Python and Rust sources retain alpha.6’s 56 Python and alpha.5’s 119 Rust test validation. Native synthetic checks use the real Rust service and offscreen SwiftUI/AppKit rendering. These are not OS-input/clipboard/VoiceOver certification, older-macOS testing or large-repository benchmarks. Update parser/feed checks do not certify an OS-driven installation/relaunch.

• Evidence queries contain the latest 50 records across the task. A missing recent match does not establish absence across all history.
• App checks cover tracked Git hygiene/conflicts/in-progress state, not build/test success, untracked content, submodules, criterion fulfillment or merge readiness.
• Criteria remain author text; per-criterion evidence links and actually examined-state report fields are not implemented. Drafts contain collected observations, not a live integration approval.
• Existing Git/remote and late-update-cancellation reconnect limits remain in current limitations. No automatic AI execution, merge or deployment is added. The project’s license remains undecided (UNLICENSED).

Verify the download

Download the DMG and matching checksum into the same folder:

shasum -a 256 -c River-0.1.0-alpha.7-macos-arm64.dmg.sha256

The manifest records packaging metadata. Checksums do not replace signature or notarization checks.

River v0.1.0-alpha.6 — Signed native app updates

River 0.1.0-alpha.6

Native in-app updates for River. The interface is currently in Korean.

Download the Apple Silicon DMG · All release assets

Changes

• Check for new releases daily, or use River → 업데이트 확인…. Native Settings provides the automatic-check preference and last-check time.
• Download and install updates from inside River using Sparkle 2.10.0. Both feed and archive signatures are required. Installation and restart require user action; silent automatic installs are disabled.
• Postpone update restart while Git requests, clone, Task preparation or Task-information writes remain active, including work in previously visited locations.
• Confirm session draft loss and uncertain write outcomes before restart. Choosing Later keeps the app open and leaves installation reachable from the menu/Settings. Existing Git notices and engine ownership protections remain intact.
• Publish signed appcasts on a separate metadata branch after verifying immutable release downloads. Future update order uses increasing numeric build numbers.

Alpha.5 and earlier do not contain an updater. Install alpha.6 manually once; future releases can then be installed in the app. See the update guide.

Install and compatibility

Open the DMG, drag River.app into Applications, eject the image, then launch River. Apple command-line Git is required; remote operations require Git 2.41 or later. The built-in example additionally needs python3.

Item	This release
Architecture	Apple Silicon, arm64; no Intel/universal2 artifact
Declared minimum	macOS 14
Tested runtime	macOS 27.0.1; macOS 14–26 remains unverified
Bundle version	0.1.0, build 7; full version 0.1.0-alpha.6
Updater	Sparkle 2.10.0; signed feed and archive; manual installation/restart consent

The app, embedded updater/helper code and DMG are Developer ID-signed with hardened runtime and secure timestamps. Apple notarization is not completed, so macOS may block first launch. Review Apple's Open Anyway instructions if you choose to trust this alpha.

Verification and limits

Regression checks cover update policy, postponed/resumed restart, hidden-location work, unknown outcomes, nested signatures, framework provenance and feed/archive verification. Developer validation passes 168 Swift and 56 Python tests; unchanged Rust sources retain alpha.5’s 119-test validation. Public-key CryptoKit checks include real signed-feed/archive round trips and tamper rejection. Release records distinguish native/public checks from source tests. Parser/information checks do not certify an OS-driven installation/relaunch, VoiceOver, older macOS or large-repository performance.

Git operations retain the current limits, including no general checkout/merge/rebase/conflict-resolution UI, discard, stash apply or provider PR APIs. Existing session drafts remain session-only. Busy/borrowed engines are preserved rather than forcibly terminated. The project license remains undecided; bundled Sparkle retains its own included license.

Verify the download

Download the DMG and matching SHA-256 sidecar, then run:

shasum -a 256 -c River-0.1.0-alpha.6-macos-arm64.dmg.sha256

The manifest records clean source provenance, update configuration and payload hashes. Hashes and signatures are separate from Apple notarization.

River v0.1.0-alpha.5 — Git safety and navigation fixes

River 0.1.0-alpha.5

Git-safety and keyboard-navigation fixes for River’s native macOS app. The interface is currently in Korean.

Download the Apple Silicon DMG · All release assets

Changes

• Require an exact file scope for hunk staging and reject multi-file patches. A directory request can no longer apply another file’s hunk under the first file’s header. Existing deleted-file, quoted-name and UTF-8 protections remain covered by regression tests.
• Preserve filename whitespace when reading Git repository paths, common directories and worktree control files. A neighboring directory with the trimmed name cannot become the repository identity.
• Deliver the explicit busy response while a client is still sending its request, with bounded request draining and no extra dispatch or handler admission.
• Allow more preflight time for staging and commits while retaining the existing client timeout and bounded Git-write budget. This is a deadline-policy correction, not a large-repository benchmark.
• Serialize recent-menu updates across app instances so opening different repositories cannot lose an entry. Corrupt-menu recovery rechecks the file while holding the same lock.
• Preserve original-folder versus task-worktree selection when switching repositories, including folder-specific drafts and task context.
• Make pane tab titles native buttons and add a keyboard-accessible Select Tab (탭 선택) menu. Selecting a tab keeps its arrangement and does not add an undo step.
• Keep an editor focused while returning from panel enlargement. Hidden-editor and hidden-commit protections remain in place.
• Show control and directional characters consistently in hunk headings, previous-reading snapshots, AI-request previews and split-diff accessibility labels. Copied source, stored checkpoints and staging bytes remain unchanged; altered previews explain that distinction.

Install

1. Open River-0.1.0-alpha.5-macos-arm64.dmg.
2. Drag River.app into Applications, replacing an older River installation if desired.
3. Eject the disk image, then open River from Applications.

The download includes the app and Rust engine. Apple command-line Git is required; remote operations need Git 2.41 or later. If /usr/bin/git --version fails or is older, install/update Apple's Command Line Tools or Xcode. The built-in example additionally needs python3. No source build is required.

Compatibility and verification

Item	This release
Architecture	Apple Silicon, arm64; no Intel or universal2 artifact
Declared macOS target	macOS 14 or later
Tested runtime	macOS 27.0.1 only; macOS 14–26 compatibility remains unverified
Bundle version	0.1.0, build 6; full version 0.1.0-alpha.5

The app, bundled engine and DMG are Developer ID-signed. Executables use the hardened runtime. Packaging verification mounts the DMG read-only, copies the app and checks signatures, architecture and payload hashes. Apple notarization is not completed. Apple's Open Anyway instructions describe how to proceed if you choose to trust this alpha.

Developer checks passed 119 Rust tests, 146 Swift tests and 17 Python tests. The Python total includes 15 packaging tests. Regression coverage includes real Git index preservation, whitespace-bearing paths, bounded overload handling, native-window keyboard routing, repository navigation, cross-instance recent-menu updates and raw-copy preservation. Deadline tests model elapsed preflight without a real 20-second delay. Native rendering checks use owned offscreen windows. These checks are not OS-input/VoiceOver certification, older-macOS validation or large-repository performance measurements.

Known limits

• No provider PR APIs, general branch checkout, merge/rebase/conflict-resolution UI, discard, stash apply or automatic updates.
• Hooks, external signing programs and external content filters remain disabled/rejected. LFS, submodules and special files retain the limits described in the README.
• Lost replies and timeouts require checking local/server state before repeating a write. Closing a client does not prove that an engine write stopped.
• Entering panel enlargement still resets keyboard focus to prevent hidden input; a visible editor may need to be selected again. Hidden mounted branch panes may continue polling. See current limits.
• The license is undecided; Cargo metadata declares UNLICENSED.

Verify the download

Download the DMG and matching SHA-256 file to the same folder, then run:

shasum -a 256 -c River-0.1.0-alpha.5-macos-arm64.dmg.sha256

The manifest records packaging metadata. A checksum does not replace signature or notarization checks.

River v0.1.0-alpha.4 — Personal layouts

River 0.1.0-alpha.4

Personal workspace controls for River’s native macOS interface. The interface is currently in Korean.

Download the Apple Silicon DMG · All release assets

Changes

• Save up to 20 named layouts, preview the actual dock tree, and explicitly rename, overwrite or delete a saved snapshot.
• Restore the full screen configuration: nested splits, ratios, tabs, hidden panels, repository navigation and Diff style. Undo restores that same scope.
• Temporarily enlarge a panel while retaining the original mounted tree; return using the visible action, Escape or the View menu.
• Separate screen configuration into Layout, Panels, and Reading/Color. Keep Stash and branches directly accessible.
• Use the native View menu for panel visibility, workspace-edge placement, saved layouts, configuration undo and discoverable shortcuts.
• Adjust code size from 11–20 pt and code/file-list spacing independently of layouts and appearance.
• Keep unreadable preference bytes in a one-time backup and recover valid entries without silently replacing their siblings.

Actual Claude, Devin and Grok design advice and peer discussions informed this slice. Design advice does not certify implementation or performance. Read the customization guide for the exact saved scope and shortcuts.

Install

1. Open River-0.1.0-alpha.4-macos-arm64.dmg.
2. Drag River.app into Applications, replacing an older River installation if desired.
3. Eject the disk image, then open River from Applications.

The download includes the app and Rust engine. Apple command-line Git is required; remote operations need Git 2.41 or later. If /usr/bin/git --version fails or is older, install/update Apple's Command Line Tools or Xcode. The built-in example additionally needs python3. No source build is required.

Compatibility and verification

Item	This release
Architecture	Apple Silicon, arm64; no Intel or universal2 artifact
Declared macOS target	macOS 14 or later
Tested runtime	macOS 27.0.1 only; macOS 14–26 compatibility remains unverified
Bundle version	0.1.0, build 5; full version 0.1.0-alpha.4

The app, bundled engine and DMG are Developer ID-signed. The executables use the hardened runtime. Packaging validation mounts the DMG read-only, copies the app and verifies its signature and architecture. Apple notarization is not completed. If macOS blocks opening, review the release status and source; Apple's Open Anyway instructions describe how to proceed if you choose to trust this alpha.

The developer run passed 135 Swift tests and 15 packaging tests. Rust sources are unchanged from alpha.3, retaining its 102-test validation. Native mounted checks verify saved-layout application and full undo, pane enlargement and exact restoration without preference writes, review-filter/draft/selection preservation, and unchanged independently observed Git snapshots. Renders cover the configuration sections, light/dark workspaces, compact large code and minimum-width layouts. Production-view AppKit regressions also verify that hidden commit controls and editors cannot receive keyboard actions, while restored controls and unrelated windows keep working. These are developer checks, not OS-input/VoiceOver certification or large-repository benchmarks.

Known limits

• No provider PR APIs, general branch checkout, merge/rebase/conflict-resolution UI, discard, stash apply or automatic updates.
• Hooks, external signing programs and external content filters remain disabled/rejected. LFS, submodules and special files retain the limitations described in the README.
• Clone/fetch/pull/push are bounded. After a lost response or timeout, inspect local/server state before repeating a write. Closing the client is not confirmed engine cancellation. Recovery notices last for the app session.
• Layouts are global, with up to 20 named snapshots. Undo is session-only; save a named layout before experimenting if you need to recall it after quitting. Per-repository automatic layouts, import/export and arbitrary theme editing are not included.
• The license is undecided; Cargo metadata declares UNLICENSED.

Verify the download

Download the DMG and matching SHA-256 file to the same folder, then run:

shasum -a 256 -c River-0.1.0-alpha.4-macos-arm64.dmg.sha256

The manifest records packaging metadata. A checksum does not replace signature or notarization checks.

River 0.1.0-alpha.3

River 0.1.0-alpha.3

Reliability and review-continuity improvements for River's native macOS workspace. The interface is currently in Korean.

Download the Apple Silicon DMG · All release assets

Changes

• Preserve origin-project warnings when a commit or hunk-staging response is lost, without automatically replaying a write.
• Show embedded line controls and bidirectional controls visibly in diffs, retain combining characters and explicit split-diff signs, and keep previous-reading sheets pinned to their captured snapshot.
• Keep cached review content read-only through metadata/reconnect failures; restore the selected staged file after reading Stash and defer scroll restoration until layout is ready.
• Serialize first-time repository registration across app instances and preserve an existing example engine after a failed lookup.
• Keep submitted commit messages exact, make remote/upstream configuration edits atomic, and enforce fast-forward pull even with unusual valid branch names and inherited Git settings.
• Isolate transient IPC connection failures, preserve existing socket-parent permissions, and clean up interrupted recipe waits.
• Bundle the engine reported by the actual Cargo build and reject provenance redirected through inherited Git environment or untracked Cargo configuration.
• Make remote errors visible inside the disclosure, gate new plans during active Git mutations, and expose all recent projects through the application menu.

SSH/HTTPS remote operations and their authentication boundaries remain described in the remote guide.

Install

1. Open River-0.1.0-alpha.3-macos-arm64.dmg.
2. Drag River.app into Applications, replacing an older River installation if desired.
3. Eject the disk image, then open River from Applications.

The download includes the app and Rust engine. Apple command-line Git is required; remote operations need Git 2.41 or later. If /usr/bin/git --version fails or is older, install/update Apple's Command Line Tools or Xcode. The built-in example additionally needs python3. No source build is required.

Compatibility and verification

Item	This release
Architecture	Apple Silicon, arm64; no Intel or universal2 artifact
Declared macOS target	macOS 14 or later
Tested runtime	macOS 27.0.1 only; macOS 14–26 compatibility remains unverified
Bundle version	0.1.0, build 4; full version 0.1.0-alpha.3

The app, bundled engine and DMG are Developer ID-signed. The executables use the hardened runtime. Packaging validation mounts the DMG read-only, copies the app and verifies its signature and architecture. Apple notarization is not completed. If macOS blocks opening, review the release status and source; Apple's Open Anyway instructions describe how to proceed if you choose to trust this alpha.

The integrated developer run passed 102 Rust tests, 100 Swift tests and 15 packaging tests. Focused regressions reproduce lost replies, registration races, Git configuration effects, cached review failures and stale build artifacts. Synthetic tests also cover remote configuration, scope and locks, endpoint drift, fetch/prune, fast-forward and rejected pull, exact-branch and rejected push, clone publication, unsafe configuration, late replies and unknown outcomes. Native rendering checks cover the new remote disclosure in light/dark at reference and minimum widths. These are developer checks, not OS-input/VoiceOver certification or large-repository benchmarks.

Known limits

• No provider PR APIs, general branch checkout, merge/rebase/conflict-resolution UI, discard, stash apply or automatic updates.
• Hooks, external signing programs and external content filters remain disabled/rejected. LFS, submodules and special files retain the limitations described in the README.
• Clone/fetch/pull/push are bounded. After a lost response or timeout, inspect local/server state before repeating a write. Closing the client is not confirmed engine cancellation. Recovery notices last for the app session.
• The license is undecided; Cargo metadata declares UNLICENSED.

Verify the download

Download the DMG and matching SHA-256 file to the same folder, then run:

shasum -a 256 -c River-0.1.0-alpha.3-macos-arm64.dmg.sha256

The manifest records packaging metadata. A checksum does not replace signature or notarization checks.

River 0.1.0-alpha.2

River 0.1.0-alpha.2

Provider-neutral remote Git operations for River's native macOS workspace. The interface is currently in Korean.

Download the Apple Silicon DMG · All release assets

Changes

• A compact Remote (원격) control beside the current folder, with fetch/push URLs, fetched branches, upstream counts and remote configuration.
• Clone SSH/HTTPS repositories into a new folder and open them in River. Existing destinations are preserved.
• Fetch branch heads, pull with fast-forward integration, and push the reviewed commit to one branch. Pull/push confirmation identifies the exact folder, local branch, URL and remote branch.
• Detect changed endpoints and local state before submission, preserve commit drafts, and retain an origin-project notice when a write's outcome is unknown.
• GitHub, GitLab, Bitbucket and self-hosted servers use the same Git protocols. Public GitHub and GitLab clone/fetch were exercised read-only in temporary folders; this does not establish every provider/authentication combination.

Authentication uses existing SSH agent/default identities and known-host files, or Apple's Git keychain helper for HTTPS. Provider OAuth/token-entry UI, custom SSH configuration, arbitrary credential helpers, filesystem remotes, URL rewrites, multiple endpoints, partial clones and force push are outside this version. See the remote guide.

Install

1. Open River-0.1.0-alpha.2-macos-arm64.dmg.
2. Drag River.app into Applications, replacing an older River installation if desired.
3. Eject the disk image, then open River from Applications.

The download includes the app and Rust engine. Apple command-line Git is required; remote operations need Git 2.41 or later. If /usr/bin/git --version fails or is older, install/update Apple's Command Line Tools or Xcode. The built-in example additionally needs python3. No source build is required.

Compatibility and verification

Item	This release
Architecture	Apple Silicon, arm64; no Intel or universal2 artifact
Declared macOS target	macOS 14 or later
Tested runtime	macOS 27.0.1 only; macOS 14–26 compatibility remains unverified
Bundle version	0.1.0, build 3; full version 0.1.0-alpha.2

The app, bundled engine and DMG are Developer ID-signed. The executables use the hardened runtime. Packaging validation mounts the DMG read-only, copies the app and verifies its signature and architecture. Apple notarization is not completed. If macOS blocks opening, review the release status and source; Apple's Open Anyway instructions describe how to proceed if you choose to trust this alpha.

Synthetic tests cover remote configuration, scope and locks, endpoint drift, fetch/prune, fast-forward and rejected pull, exact-branch and rejected push, clone publication, unsafe configuration, late replies and unknown outcomes. Native rendering checks cover the new remote disclosure in light/dark at reference and minimum widths. These are developer checks, not OS-input/VoiceOver certification or large-repository benchmarks.

Known limits

• No provider PR APIs, general branch checkout, merge/rebase/conflict-resolution UI, discard, stash apply or automatic updates.
• Hooks, external signing programs and external content filters remain disabled/rejected. LFS, submodules and special files retain the limitations described in the README.
• Clone/fetch/pull/push are bounded. After a lost response or timeout, inspect local/server state before repeating a write. Closing the client is not confirmed engine cancellation. Recovery notices last for the app session.
• The license is undecided; Cargo metadata declares UNLICENSED.

Verify the download

Download the DMG and matching SHA-256 file to the same folder, then run:

shasum -a 256 -c River-0.1.0-alpha.2-macos-arm64.dmg.sha256

The manifest records packaging metadata. A checksum does not replace signature or notarization checks.

River 0.1.0-alpha.1

River 0.1.0-alpha.1

An early testing release of River, a native macOS Git app for reviewing work across repositories and worktrees. The interface is currently in Korean.

Download the Apple Silicon DMG · All release assets

Install

1. Open River-0.1.0-alpha.1-macos-arm64.dmg.
2. Drag River.app into Applications.
3. Eject the disk image, then open River from Applications.
4. Choose Explore the example (예제로 먼저 둘러보기) to try synthetic repositories.

This download contains the native app and its Rust engine. Apple command-line Git is required; if /usr/bin/git --version does not work, install Apple's Command Line Tools. The built-in example additionally needs python3 for its preparation recipes. No source build is needed.

Compatibility and verification

Item	This release
Architecture	Apple Silicon, arm64; no Intel or universal2 artifact
Declared macOS target	macOS 14 or later
Tested runtime	macOS 27.0.1 only; macOS 14–26 compatibility remains unverified
Bundle version	0.1.0, build 2; full release version 0.1.0-alpha.1

The app, bundled engine, and DMG have verified Developer ID Application signatures with secure timestamps. The app and engine enable the hardened runtime. The DMG was mounted read-only, its app copied and revalidated, and the relocated bundled engine passed startup scenarios with a minimal system PATH. Apple notarization is not completed; Gatekeeper assessment reports Unnotarized Developer ID.

Apple has not notarized this alpha. If macOS blocks opening because it cannot verify the developer or check the app, review this status and the download source. If you choose to continue, attempt to open River, then use System Settings → Privacy & Security → Open Anyway and confirm Open. See Apple's instructions.

What ships

• A native SwiftUI/AppKit workspace with configurable panes and light, dark, and system appearance.
• Tasks that prepare branches and linked worktrees across configured repositories while keeping the original checkout in place.
• Changed files, unified or split diffs, text-hunk staging and unstaging, and commits of staged changes.
• Branch and recent-history browsing, linked worktree locations, and read-only stash browsing.
• A built-in synthetic example, task intent and verification records, and copyable requests for external AI tools.

Known limits

• No fetch, pull, push, general branch checkout, merge/rebase UI, discard, stash apply, or automatic updates.
• Opening a repository through the GUI registers a single-repository workspace. GUI editing/import of multi-repository and recipe configurations is not implemented.
• App-created commits skip Git hooks and are unsigned. External Git filters, including configured global LFS filters, cause affected operations to be rejected.
• Graph/history views show up to 80 commits; diff display is limited to 5,000 lines and 512 KiB. Large-repository performance and VoiceOver behavior remain unverified.
• The license is undecided; Cargo metadata declares UNLICENSED.

See the README and detailed limitations (Korean) before using your own repository.

Verify the download

Download the .dmg and matching SHA-256 file into the same folder. From that folder, run:

shasum -a 256 -c River-0.1.0-alpha.1-macos-arm64.dmg.sha256

The result should be River-0.1.0-alpha.1-macos-arm64.dmg: OK. The SHA-256 file checks that the download matches the published artifact; it does not replace Developer ID or Apple notarization checks. The accompanying manifest records packaging metadata.