River v0.1.0-alpha.10 — Safer Git reads and responsive navigation

River 0.1.0-alpha.10

Safer Git content reads, responsive folder switching, and clearer loading and recovery states. The interface is currently in Korean.

Download the Apple Silicon DMG · All release assets

Changes

• Isolate working-folder status, Diff and Git hygiene checks in private Git metadata/configuration and an exact index copy with frozen applicable attributes. External clean/process definitions cannot enter these content processes, including when configuration changes after validation. Original index and working-folder bytes are preserved. This requires Apple Git 2.43 or later.
• Cancel obsolete client read waits when switching folders and let the current folder begin validation immediately. Old responses and old cleanup cannot replace its state. An engine read already started can continue within its server budget.
• After capability discovery, refresh rich task information with one dedicated RPC and publish only changed values. Older-engine fallback, unsaved drafts and confirmed-save revision protection remain.
• Distinguish initial loading from a confirmed clean folder, preparation-pending folders and lookup failure. Coherent cached Diff remains visible and read-only while validation is pending or failed. A failed initial branch lookup also says it failed.
• Preserve task-form inputs when an execution preview expires and require a fresh explicit preview. Preparation source drift or branch collision directs the user to a new plan; existing branches, folders and completed sibling repositories are retained.
• Carry preparation read deadlines and cancellation into enumeration, byte hashing, trust/inspection/postcondition reads and process waits. Already-admitted writes retain their independent bounded outcome handling; cancellation does not roll back Git or certify the outcome of an interrupted write.
• Reject release builds when any tracked source has Git assume-unchanged or skip-worktree flags. Check both before and after provenance capture without clearing flags or changing source/index bytes.

Install and compatibility

Alpha.6 and later can use River → 업데이트 확인…. Earlier versions require one manual installation. Open the DMG, drag River.app into Applications, eject the image and launch River. Download, installation and restart require user action. Save session drafts first; active work postpones restart.

Item	This release
Architecture	Apple Silicon, arm64
Declared minimum	macOS 14
Tested runtime	macOS 27.0.1; macOS 14–26 remains unverified
Bundle version	0.1.0, build 11; full version 0.1.0-alpha.10
Updates	Sparkle 2.10.0; signed feed/archive; user-controlled installation
Git	Apple command-line Git 2.43+ for working-folder status, Diff and Git hygiene checks

Update Xcode or Apple's Command Line Tools if River reports an older Git. River uses /usr/bin/git; a Homebrew-only installation is not selected. The built-in example additionally needs python3.

The app, embedded updater/engine and DMG are Developer ID-signed with hardened runtime and secure timestamps. Apple notarization is not completed, so first launch may be blocked. Review Apple's Open Anyway instructions if you choose to trust this alpha.

The alpha.8 workflow-data compatibility boundaries remain: do not run different engine versions concurrently against one journal. A legacy-engine rewrite can require an explicit context reset; past history remains preserved. See the task workflow guide.

Verification and limits

244 Swift tests, 192 Rust tests and 62 Python tests pass, including real Cargo executable-bundling and CryptoKit signature checks. Rust formatting and strict Clippy pass. All 12 changed/new Swift files have clean actual SourceKit-LSP diagnostics with in-memory positive error controls and unchanged source bytes. CLI and native Swift-client scenarios pass against the real Rust service with independent Git cross-checks. Synthetic tests cover late clean/process installation, source-index preservation/racy timestamps, conversion parity, preparation cancellation/deadlines, draft/recovery races and packaging provenance flags.

Native selection states are rendered offscreen with real SwiftUI/AppKit views and a private synthetic service at the minimum 1100×720 size in light/dark appearances. These checks are not OS-input, keyboard, clipboard or VoiceOver certification. Package/feed checks and an information-only Sparkle probe do not establish an OS-driven installation or relaunch. User projects and the running user app are not used for mutation tests or replacement.

A local comparison used the same owned repository with 2,000 synthetic files and two persistent optimized services, alternating six calls per method/build (five warm samples). Warm medians were 226 → 294 ms for status and 159 → 242 ms for Diff, alpha.9 → alpha.10. Read isolation therefore still adds about 69/84 ms per request on this fixture; this is not a backend speedup claim. UI navigation no longer waits for the obsolete client read, and rich task polling removes one overlapping RPC after discovery. Large-repository latency, idle/active energy and multi-workspace RSS remain unverified.

• Content-read isolation does not isolate all Git commands. Worktree materialization, commit and checkout retain preflight checks against live Git configuration; concurrent configuration edits at those write boundaries remain a limitation. Configured external filters, including unused global LFS definitions, remain unsupported.
• Isolated reads cap the index and split dependency at 64 MiB each, individual config/attribute/ignore inputs at 1 MiB, collected auxiliary sources at 8 MiB, and applicable directory depth/count. Unsupported configurations are rejected; the original index is never normalized to make a read pass.
• Preparation reads check deadlines/cancellation between bounded chunks. Slow OS filesystem calls need not stop immediately. Ready siblings, checkpoints and conservative unknown outcomes remain; no automatic rollback/retry is added.
• Staging, remote transport, evidence history bounds and report authority retain their documented limits. River does not invoke AI tools, infer criterion fulfillment, certify AI-DLC phases or approve integration. See limitations. The license remains undecided (UNLICENSED).

Verify the download

Download the DMG and matching checksum into the same folder:

shasum -a 256 -c River-0.1.0-alpha.10-macos-arm64.dmg.sha256

The manifest records packaging metadata. Checksums do not replace signature or notarization checks.