Build Rock Music as a native Android music platform

[SayanthRock]

Goal

Build Rock Music as a professional native Android music platform using Kotlin, Jetpack Compose, Material 3, Media3, MVVM/Clean Architecture, Hilt, Retrofit/OkHttp, Kotlin Serialization, Room, DataStore, WorkManager, Paging 3, Coil, and Android Keystore.

Licence

Rock Music is licensed under GPL-3.0-only. Binary releases must provide the corresponding source and retain applicable third-party notices.

Compliance requirements

• Do not remove or bypass advertisements.
• Do not extract protected streams, signatures, ciphers, tokens, or media segments.
• Do not bypass DRM, subscriptions, geographic restrictions, integrity checks, or provider download controls.
• Use official YouTube/YouTube Music playback or deep-link integrations only.
• Import Spotify playlist metadata through OAuth PKCE; never copy protected Spotify audio.
• Permit offline storage only when the selected source explicitly allows downloading.
• Require every Listen Together participant to have legal access to the selected source.
• Request microphone access only while Echo Find is actively used.
• Never show fake connection, recognition, room, import, download, or sharing success states.

Provider-backed options

Foundations, capability contracts, configuration keys, and explicit unavailable states are merged. The following remain incomplete until real licensed services, authentication, transport, policy routing, tests, and fallbacks work end to end:

• Spotify Authorization Code with PKCE callback and playlist-metadata import
• Licensed Echo Find recognition provider and consent-first sample handling
• Listen Together REST and authenticated WebSocket backend
• Officially supported Discord activity connection
• Real licensed catalogue APIs with per-item entitlement checks
• Real synchronized-lyrics provider
• Real podcast-search provider
• Provider-permitted item-level download grant and revalidation endpoints
• User-authorised cloud-storage OAuth and file client
• Official YouTube/YouTube Music Android intent/deep-link resolution with device tests

When configuration, authentication, connectivity, legal access, or provider support is missing, the app must show an explicit Unconfigured, AuthenticationRequired, Offline, Unsupported, or Error state instead of pretending the option worked.

Delivery phases

• Phase 1 — Native foundation, background playback, navigation, local scan, security, CI, provider contracts, policy engine, configuration registry, and Connections UI
• Phase 2 — Complete local library, folders, metadata, playlists, audio effects, persistent queue, Android Auto, and full coverage
• Phase 3 — Podcasts and provider-permitted offline downloads
• Phase 4 — Synchronized lyrics and battery-aware canvas visuals
• Phase 5 — Spotify migration, licensed services, official YouTube links/playback, cloud storage, and Discord
• Phase 6 — Licensed Echo Find recognition and Listen Together backend
• Phase 7 — Full accessibility, privacy controls, backup/restore, signed releases, and release hardening

Definition of done

Every feature must have a real connected implementation plus loading, empty, offline, error, retry, permission, accessibility, unit-test, UI-test, privacy, analytics-boundary, provider-capability, action-policy, and external-service fallback coverage.

A screen, button, configuration key, interface, placeholder, sample response, generated room code, fake OAuth code, stubbed provider result, or direct provider call that bypasses MediaActionPolicyEngine is not complete.

Detailed requirements:

• docs/ROADMAP.md
• docs/INTEGRATIONS.md
• docs/COMPLIANCE.md

[SayanthRock]

Operating model refactor

PR #4 changes Rock Music from feature-specific compliance exceptions to one mandatory source-aware action pipeline.

Every play, download, share, recognition, official-provider handoff, and Listen Together action must pass through MediaActionPolicyEngine. The engine resolves source, configuration, authentication, connectivity, local cache state, region, entitlement, capability, item-level download permission, consent, and participant access before returning one executable plan.

Provider-controlled playback/offline access is handed to the official provider. Downloads remain denied by default. Direct provider calls that bypass the policy engine no longer meet the definition of done.

PR: #4

[SayanthRock]

Provider adapter foundations are now in PR #5: #5

This adds configuration keys, typed definitions/capabilities, runtime readiness states, an in-app Connections screen, service contracts for all ten requested integrations, Spotify PKCE request generation, validated official YouTube/YouTube Music routing, tests, and setup documentation.

Real third-party credentials, hosted services, OAuth callback/token exchange completion, production provider clients, and licensed catalogue access remain open and are not marked complete.

[SayanthRock]

Downloaded-audio playback and UI redesign ready in PR #6

PR: #6

Implemented:

• direct Android file picker for downloaded audio;
• broader MediaStore detection for playable downloads;
• persistent document-URI read handling;
• queued playback while Media3 connects;
• MIME-aware playback and visible player errors;
• tests for common audio MIME types/extensions;
• persistent System, Light, Dark, and AMOLED appearance modes;
• Android dynamic system colour;
• optional blur-frame navigation;
• responsive rounded bottom navigation and tablet rail;
• redesigned Home, Library, mini player, Now Playing, Settings, and Appearance surfaces.

Final clean Android CI passed lint, unit tests, debug APK assembly, verification-log upload, and APK artifact upload:
https://github.com/Sayanthrock-Developer/Rock-music/actions/runs/30148988068