0.1.0 independent release-blocker review

0.1.0 independent release-blocker review

Date: 2026-08-02.

An independent read-only OpenCode review inspected the current Android lifecycle, persistence, OAuth, Media3, release workflow, changelog, and roadmap boundaries.

Conclusion

No release-blocking correctness, security, release-engineering, or truthfulness defect was found.

The review confirmed:

• the release language distinguishes deterministic validation from unavailable live pCloud account validation;
• OAuth results are encrypted and host constrained;
• signed stream links are runtime capabilities rather than durable state;
• release metadata and tag checks fail closed;
• the GitHub release publishes an explicitly debug-signed demo APK rather than claiming production signing;
• queue and progress persistence contain stable references, not credentials.

Low-severity findings resolved before tag

1. Clearing the app queue did not explicitly clear Media3’s playlist. The PlaybackController now stops playback and calls clearMediaItems() before persisting the empty queue.
2. PCloudSession is a data class containing the OAuth token. Its explicit toString() now renders accessToken=<redacted>, with a regression test.

Residual external gates

The review correctly treated unavailable live credentials as a documented external gate rather than simulated evidence. The remaining maintainer checklist is in docs/pcloud-setup.md and includes US/EU accounts, large folders, codecs, expired-link renewal, revocation, physical-device accessibility, and process-death validation.