Okra for Mac v1.0.0-rc.55

Okra for Mac 1.0.0-rc.55

RC.55 restores the RC.53 workspace after regressions reported in RC.54. The native reader, existing editing controls, OCR and extraction panel, and instant thumbnail-sidebar page moves and PDF drops return to their RC.53 behavior. Verified saves, Undo, source-linked output and explicit parsing remain.

The document-tool expansion, optional Bates module and model-picker artwork introduced in RC.54 are removed. The earlier okra bates command returns to its RC.53 behavior without the optional-feature toggle.

This is a normal forward update: RC.55 has a higher updater build number than RC.54. Original documents and existing extraction output are not rewritten by this release. PDF copies exported using RC.54 remain ordinary files. RC.54-only operations are unavailable after updating. Save ongoing edits and let active work finish before installing.

The app and installer are Developer ID signed, Apple notarized and stapled. Current repository and public-update-feed routing are retained.

Validation

All 351 application/runtime files were compared with RC.53; the only differences are the current public-feed repository URL and two end-of-file whitespace cleanups. Mac CI passes 876 Swift tests in 131 suites, release build, packaged app/CLI launch and bundled workspace qualification. The restored workspace service passes its typecheck, 120 tests, build and packaged-runtime smoke. The Python suite passes 229 checks with one skip.

The immutable RC.55 release repeated qualification and passed Developer ID signing, app and DMG notarization/stapling, Gatekeeper, packaged launch and source provenance. Build: 202609302331. An actual installed RC.54-to-RC.55 upgrade and saved-state walkthrough has not been performed. Full native document-tool acceptance remains open.

Okra for Mac v1.0.0-rc.54

Okra for Mac 1.0.0-rc.54

This release adds optional Bates Stamping and expands the native document workspace with reading/search controls, image stamps, reviewed edits to existing PDF content, page organization and splitting, and supported form filling/reset/flattening.

Bates Stamping is off by default. Enable it in Settings → General → Optional Features, preview the numbering, then save a separate copy. The source remains unchanged.

Document edits require review before saving a copy. Unsupported PDF structures stop with a review message rather than silently dropping fields or navigation. Times-family multiline forms are currently refused because the reopened native widget can omit a line. Complex form families, broader font/script coverage, accessibility, and cross-reader checks remain in progress. This candidate does not claim the full DOC-01–05 acceptance matrix is complete.

The installer is signed and notarized; the release assets include its SHA-256 checksum. See the repository's versioned release record for qualification details.

Bates preview

Okra for Mac v1.0.0-rc.53

Okra Desktop 1.0.0-rc.53

Rearranging pages and dropping PDFs into the thumbnail sidebar now happens
instantly, the way it does in Preview.

Before, nothing on screen moved until the whole edit had round-tripped
through the document service: a new worker process per step (a Finder drop
into the middle of a PDF started about eleven), several full-file SHA-256
passes, a rewrite and download of the whole PDF, a fresh PDFDocument, and
every thumbnail rendered again from scratch. Further drags were refused
until all of that finished.

• Moves, deletes and drops show at once. The open PDF's pages are
  rearranged in memory as soon as you drop, as Preview does. Pages keep
  their rendered tiles, so there is no reload or blank flash.
• The saved result is still verified. The document service still builds
  and checks the new revision in the background, and Save, Save a Copy,
  export and Undo still read only that verified file. When it arrives, the
  window adopts it without reloading the pages already on screen.
• Failures put pages back. If the service refuses the edit (for example,
  a dropped page with form fields) or a newer revision wins, the original
  page order comes back and the status line explains why.
• Thumbnails follow the pages. Existing thumbnails move with their
  pages. Only newly dropped pages render, straight from memory, and none
  re-render when the verified revision is adopted.

Page edits from the Pages sheet, rotation, cropping, blank-page insertion and
cross-window page drags still wait for the verified result, as before.

Validation

• swift test: page-organization, insertion, thumbnail, edit-refresh,
  native-worker and app-launch suites pass (104 tests). New tests cover
  in-place arrangement with its page map, the instant reorder/drop preview,
  reverting after a failed job, and adopting the verified merge without
  replacing the displayed document. The full suite (876 tests) passed
  except five timing checks in the callback, launcher, session and
  command-runner suites, which pass when run alone.

Okra for Mac v1.0.0-rc.52

Okra Desktop 1.0.0-rc.52

Open With → Okra in Finder now opens the PDF the way Preview does: the window
that shows the PDF comes to the front, and no empty "PDF Workspace" window is
left behind. A PDF that is already open only brings its window forward.

The thumbnail sidebar now rearranges pages and merges other PDFs into the open
PDF for real documents, as Preview does. Since RC.46, a drag or a drop was
accepted but every PDF exported by a word processor or browser answered
"This page edit requires a reviewed workflow", because the native engine
refused any PDF with tagged structure, outlines, links or form fields. The
open PDF is now edited in place, so those stay attached to their pages.

Launch polish from a hands-on review of RC.51 against the launch film:

• Redact shows its work. Looking for personal details now shows a
  spinner, a note that the first check after launch can take up to a minute
  while the detector loads, and a Cancel button. Before, the panel repeated
  "Detecting PII with Presidio…" for about 45 seconds with no sign of life.
• Fewer, better candidates. The detector drops "dates" that are street
  numbers, ZIP codes or phrases like "90 days", and joins an address split in
  two ("Portsmouth" + "New Hampshire 03801") into one candidate.
• Approve by type. Candidates are grouped (People, Places and addresses,
  Dates, Account numbers…) with Approve All / Clear per group. The per-row
  "85%" is gone: the language model gives every name and place that same
  score, so it said nothing. Only weaker pattern matches say "Less certain".
• Plain words. "Positioned parse", "positioned extraction blocks" and
  "Detect PII" are replaced by what the person does: "Find Personal Details",
  "Find Again", "Runs on this Mac". The settings link uses the app's green.
• Export stays responsive and refuses partial redactions. Export Redacted
  Copy rasterizes off the main thread (#109). An approved box on a page the
  PDF lacks, or with no usable area, now stops the export with nothing
  written, instead of saving a copy that still shows the value (#110).
• Quieter reading. A reopen from Recents no longer says "Document
  reopened. Completed edits were preserved." unless edits were restored.
  Launch shows a small spinner while the document service starts, instead of
  "Connecting… Reconnect". The empty window no longer shows the model picker
  twice. The window and menus say "Okra", "New Window" and "Open…".
• Output you can keep using. The Preview / Tags / JSON / CSV switcher and
  its Copy / Save / Reveal buttons stay pinned while blocks scroll. Tags rows
  keep the block type in one line (the page header already names the page),
  so more blocks fit. Selecting a block centers its source box on the page
  instead of pinning it under the toolbar.
• No accidental second click. Parse becomes Cancel, and Cancel becomes
  Redact…, in the same spot; a click within half a second of that change is
  ignored, so a double click on Parse no longer cancels the parse.
• A Finder open fills the window you already have. With Okra open on its
  empty window, Open With → Okra now shows the PDF in that window and closes
  the scene SwiftUI spawned for the event, instead of leaving the empty
  window behind the document.
• The disk image is named Okra, matching the app inside it.

Launch-polish validation (local, this source): 874 Swift tests in 130 suites
pass with --no-parallel; the Presidio worker, DMG packaging and
release-notes checks pass; the 4 release_workflow_tests failures occur
identically on the unchanged base. An ad-hoc --app-only build was driven
through System Events: empty launch then Finder open → one window; a second
file → two; the same file again → no new window; cold launch with a file →
one window. In Presidio simulation mode, Redact shows candidates grouped as
"Account number · 1", "Phone number · 1", "Email address · 1" with the new
copy. Real Presidio precision is covered by worker unit tests, not by a
recall benchmark.

Release contract

Goal: D.6.38. Make Finder opens land in one document window, and make the
thumbnail sidebar rearrange and merge real PDFs.

Before this build, every Finder open (Open With, a double click when Okra is
the default PDF app, a drop on the Dock icon), every open -a Okra file.pdf,
and every hand-off from a second app copy created two windows: an empty
"PDF Workspace" window in front and the document window behind it. The person
saw the empty window and concluded the open had failed.

The app delegate now receives these files and asks the workspace host to
place each PDF once, instead of SwiftUI's URL routing, which opened an empty
scene per event: a file already on screen only comes forward; an empty window
(the key window first) shows the file itself; any other file opens in its own
window. Files that arrive before a window exists (a cold launch) wait and open
in order. PDF paths on the command line, the CLI's okra open and the
okra:// callbacks follow the same path. Opening never parses.

The native worker's page edits (reorder, delete, extract and blank insertion)
edit the loaded document in place. Its merge edits the target document in
place too: the service names the target as the base input, so a drop before,
between or after pages keeps the target's outlines, internal links, form
fields and tagged structure (verified on a Word-style tagged fixture and on
two real tagged PDFs). A page copied in from another PDF keeps its notes and
web links but loses links to that PDF's other pages, which PDFKit would
otherwise point at the wrong pages. A page with form fields cannot be copied
in from another PDF or duplicated with Option-drag; the sidebar reports
"Pages with form fields can only move within their own PDF" and nothing
changes. PDFKit's writer does not keep page labels or named destinations on
any save, as before for rotation and markup. Redaction keeps its stricter
structure guard. Sources stay unchanged, and a refused edit publishes no
output. See the sidebar document.

Validation: Swift tests cover the routing rule, the cold-launch buffer and
file-URL identity across /tmp, ./, .. and percent-encoded spellings.
The single-instance guard and app launch suites still pass. A local packaged
smoke of this build records cold and warm Finder-style opens, a repeated open
of the same file, and a two-file open in the qualification evidence below.
Native worker tests cover in-place extract, reorder and delete with form
fields, outlines and internal links attached to the right pages; tagged
structure and outlines through reorder, delete, extract and blank insertion;
sidebar insertion before, between and after pages with the target's
structure retained; dropped cross-page links on copies; refused form-field
copies with no output; and base-input validation. The service suite pins the
base input on sidebar insertions. Full CI and signed release qualification
gate publication. No provider quality or timing change is claimed.

Rollout: Signed, notarized Apple-silicon DMG and signed Sparkle update through
the immutable desktop-v1.0.0-rc.52 tag after required checks pass.

Rollback: Retain previous installers and fix forward with a new immutable tag.

Owner: Desktop / Steven Tsao.

Qualification evidence

Local packaged smoke (ad-hoc signed scripts/build-dmg.sh … --app-only
build of this source, installed RC.50 quit, open -a build/Okra.app …
against copies of one PDF, windows listed through System Events):

Case	Windows after	Front window
Cold launch with one PDF	1	the PDF
Warm open of a second PDF	2	the second PDF
Warm open of the same PDF again	2 (no new window)	that PDF
Warm open of two PDFs at once	4	the first of the two
Warm open with a spawned scene discarded	logged discard unused spawned scene	the PDF

Before this source, each of these left one extra empty "PDF Workspace"
window in front. The unified log category external-open records the
delegate event, the routing decision and any refused open. A PDF path given
through --args still fails inside the sandbox (invalidDestination): no
LaunchServices grant exists for it, as before; the CLI uses open -a.

Sidebar page edits, local packaged check of this source (the same ad-hoc
signed build, installed RC.50 quit, the bundled okra workspace CLI opening
copies of the two real PDFs whose RC.50 jobs failed with "requires a reviewed
workflow": a 9-page tagged accessibility report with a linked table of
contents, and a one-page tagged résumé with eight web links; plus two plain
4-page PDFs as donors):

Edit through the workspace service	Result	Kept in the output
Reorder the report, last page first	succeeded	StructTreeRoot, MarkInfo; contents links moved with their pages
Insert two donor pages after the résumé page	succeeded	StructTreeRoot, MarkInfo, all eight web links
Insert one donor page before the report's first page (donor listed first, report as base)	succeeded	StructTreeRoot, MarkInfo; contents links moved with their pages
Delete the report's second page	succeeded	StructTreeRoot, MarkInfo; contents links moved with their pages

Both source files kept their SHA-256. Each edit published one new artifact
and revision; no job failed. The same four operations on the same two files
had failed in RC.50 (service state, 2026-09-20). Polling workspace snapshot
once per second during the third edit drew HTTP 429 from the loopback host's
rate limit; the job itself completed. Native drag gestures in the sidebar
were not driven in this check; the sidebar's drag, drop and paste paths
submit these same commands.

Local suites on this source: 869 Swift tests in 129 suites pass with
--no-parallel (the parallel run overlaps timing-sensitive AppKit suites, as
the CI comment warns); 1...

Okra for Mac v1.0.0-rc.51

Okra Desktop 1.0.0-rc.51

Stopping the local Presidio redaction worker can no longer hang the app.
Shutdown now takes at most four seconds, also when the worker ignores the
stop request.

Release contract

Goal: D.6.38. Make Presidio worker teardown bounded (#297).

The app registers the worker's exit signal before launch. To stop the worker,
it sends TERM, waits two seconds, then sends KILL and waits two more seconds.
It no longer calls Process.waitUntilExit(), which could wait forever when
the exit of an already-reaped worker was not reported. A worker that fails to
announce its port stops through the same bounded path. Detection,
anonymization, loopback rules and redacted export do not change.

Validation: Focused tests cover an already-exited worker, a worker that obeys
TERM and a worker that ignores TERM and is killed. Full CI and signed release
qualification gate publication. No provider quality or timing change is claimed.

Rollout: Signed, notarized Apple-silicon DMG and signed Sparkle update through
the immutable desktop-v1.0.0-rc.51 tag after required checks pass.

Rollback: Retain previous installers and fix forward with a new immutable tag.

Owner: Desktop / Steven Tsao.

Okra for Mac v1.0.0-rc.50

A green connector now links the active source box in your PDF to its matching Tags card, just like the launch video.

• Hover or select a block to see the matching pair.
• The connector follows scrolling, zoom and panel resizing.
• Offscreen blocks and other output tabs hide the connector.

Apple silicon · macOS 13 or later. Developer ID signed and notarized by Apple.

Okra for Mac v1.0.0-rc.49

Okra for Mac 1.0.0-rc.49

This release brings the document workspace closer to the launch film, from opening a file and choosing a model to checking source tables and reviewing redactions.

• Choose a model from the compact Parse with picker. See which models are ready, require setup, or cannot run on your Mac. Opening a file or changing models never starts a parse or download.
• Open into a clearer ready state and inspect parsed output in Tags, with compact source cards, preserved table columns, and green selection on the page. Preview, JSON, CSV, and their copy/save actions remain available.
• Inspect and approve redaction candidates individually. New detections start with zero approvals, and approvals are not restored from disk. Selecting a candidate only locates it. Approved candidates appear in green. Scanned or ambiguous text may require reviewing a complete source block.
• Export a separate redacted copy. The app refuses to overwrite the original PDF, including through a symlink or hardlink.

If you automate redaction with the CLI, explicitly approve candidates before exporting. No document or settings migration is required.

Requires an Apple silicon Mac with macOS 13 or later. Models have their own setup and hardware requirements. Apple Vision needs no model download. Local models keep processing on your Mac; the optional Gemini integration sends selected pages to Google when you explicitly use it. This remains a release candidate.

The app and installer are Developer ID signed, hardened, notarized by Apple, and stapled. The accompanying SHA-256 file can verify your download.

Okra for Mac v1.0.0-rc.48

Okra for Mac 1.0.0-rc.48

Changes

• Dropping PDFs into the thumbnail sidebar and rearranging pages updates the working document, including after using Pen.
• Unsaved work keeps the original document name with an Edited indicator until Save.
• Closing or quitting with unsaved work presents native Save, Don't Save and Cancel choices. Discarded edits do not reappear through Open Recent.
• Command-R rotates right and Command-L rotates left. Supported navigation and zoom shortcuts follow Preview conventions.
• An actionable Update Available indicator replaces the extraction-model label in the bottom-right status area.
• The quiet, aligned empty workspace and functional document placeholders remain unchanged.

Installation

For Apple silicon Macs running macOS 13 or later. Download the DMG, drag Okra
to Applications, then open it normally. The installer is Developer ID signed,
notarized by Apple and stapled. Existing installations using the public update
feed can receive the release through Sparkle.

Opening a PDF never starts parsing. The first save still creates a working
copy instead of overwriting the original PDF. This is a release candidate;
complete Preview parity and older-macOS/accessibility qualification remain in
progress. The previous RC.47 installer remains available.

okraPDF for Mac v1.0.0-rc.47

okraPDF for macOS 1.0.0-rc.47

The empty workspace keeps its centered opening area and aligned recent-document list, with less visual noise:

• No large brand illustration or repeated logos.
• Neutral file placeholders for recent PDFs, with compact locations and last-opened dates.
• Native Open PDF action, quiet row menus and contextual source recovery.

This includes RC.45 alignment improvements and RC.46 thumbnail-sidebar page organization. Opening remains local and never starts OCR automatically; original PDF bytes remain unchanged. No migration is required.

Apple silicon, macOS 13 or later. Developer ID signed and notarized. Verify the installer with the accompanying SHA-256 file. Prior public candidates remain available for rollback.

okraPDF for Mac v1.0.0-rc.46

Organize pages in the thumbnail sidebar

• Drop PDFs or images between thumbnails to insert them.
• Drag selected pages to reorder; Option-drag copies them.
• Select multiple pages with Command or Shift, then copy, cut, paste, delete or rotate them.
• Use the page context menu to export selected pages or open crop options. The plus button inserts a file or blank page.
• New windows show thumbnails by default. Page edits support Undo/Redo and Save Copy while preserving original PDFs.

Opening a PDF or editing pages never starts OCR. Existing limits for protected PDFs and unsupported document structures still apply.

This release includes the recent empty-workspace and document-list improvements. Download the signed, notarized installer below, or use Check for Updates in okraPDF.