M464 loudness leveling (steps 4–8), APK distribution and security baseline adoptions #136

Merged

bvandeusen merged 12 commits from dev into main 2026-10-06 23:11:36 -04:00

Conversation 0 Commits 12 Files Changed 95

+4196 -92

bvandeusen commented 2026-10-06 23:11:32 -04:00

Owner

Copy Link

Copy Source

Everything on dev since #135. CI green on the head, b28cbe06 (run 8463).

Loudness leveling (M464)

• #4998 Per-user leveling preference, synced across devices: off/track/album/auto, target −18/−16/−14 LUFS, headroom or limiter.
• #4999 Web player levels by it. Cuts use element volume; boosts go through Web Audio.
• #5000 Android levels with a gain processor in the audio sink (Media3 1.11). Room migration 9→10 adds the gain columns and resets the sync cursor, so the first sync after updating is a full one.
• #5001 Server leveled FLAC stream for Sonos/UPnP: rendered to a cache (admin "Speaker cache (MB)"), Range, tags stripped. Migration 0068.
• #5002 The Android Sonos queue plays leveled URLs and renders the next track ahead (2 at a time at most).

Fixes

• #5139 MBID backfills skip tracks whose files are missing. Stops the "open failed" flood on every scan.
• Integration suite gets a 20m package timeout.

APK distribution (family idea #5103, #5116)

• The release build never falls back to the debug key; main no longer uploads a debug APK.
• CI checks the APK's signer against the pinned release certificate digest and blocks the publish otherwise.
• Debug builds don't offer server updates.

Security baseline (family idea #5105, #5111)

• The Android app refuses plain http:// to the Minstrel server when the connection lands on a public address. LAN, Tailscale and UPnP are unchanged. Anyone signing in over plain http to a public address must switch to https://.

Live checks are in reviews #5076 and #5161 (dated).

🤖 Generated with Claude Code

Everything on dev since #135. CI green on the head, b28cbe06 (run 8463). **Loudness leveling (M464)** - #4998 Per-user leveling preference, synced across devices: off/track/album/auto, target −18/−16/−14 LUFS, headroom or limiter. - #4999 Web player levels by it. Cuts use element volume; boosts go through Web Audio. - #5000 Android levels with a gain processor in the audio sink (Media3 1.11). Room migration 9→10 adds the gain columns and resets the sync cursor, so the first sync after updating is a full one. - #5001 Server leveled FLAC stream for Sonos/UPnP: rendered to a cache (admin "Speaker cache (MB)"), Range, tags stripped. Migration 0068. - #5002 The Android Sonos queue plays leveled URLs and renders the next track ahead (2 at a time at most). **Fixes** - #5139 MBID backfills skip tracks whose files are missing. Stops the "open failed" flood on every scan. - Integration suite gets a 20m package timeout. **APK distribution (family idea #5103, #5116)** - The release build never falls back to the debug key; main no longer uploads a debug APK. - CI checks the APK's signer against the pinned release certificate digest and blocks the publish otherwise. - Debug builds don't offer server updates. **Security baseline (family idea #5105, #5111)** - The Android app refuses plain `http://` to the Minstrel server when the connection lands on a public address. LAN, Tailscale and UPnP are unchanged. Anyone signing in over plain http to a public address must switch to https://. Live checks are in reviews #5076 and #5161 (dated). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

bvandeusen added 12 commits 2026-10-06 23:11:32 -04:00

feat: per-user volume leveling preference, synced across devices (M464 #4998) ... af36b2f24a

Mode (off, auto, track, album), target (-18, -16, -14 LUFS) and boost
(within headroom, or fully with a limiter), stored per user on the server
so the web player, the Android app and casts apply the same one.

- Server: user_normalization_prefs (migration 0067), GET/PUT
  /api/me/normalization; a whole-body PUT, validated, last write wins.
- Web: Settings > Playback > Volume leveling. Saves at once, restores the
  old choice if the save fails, and caches the value for the player.
- Android: Settings card. The device keeps a copy for offline playback
  (Room v9 with an explicit migration, so the upgrade wipes nothing).
  Writes are offline-first: shown at once, PUT best effort, queued on
  failure (NORMALIZATION_SET, collapsed to the newest). A refresh never
  overwrites a change still queued.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix: boost control is a switch; MutationQueue keeps one enqueue per kind (M464 #4998) ... d5dfcf5b7c

The ListenBrainz settings test finds the page's one checkbox, and the
boost control is a toggle anyway. detekt counts MutationQueue's enqueue
functions; suppressed as the replayer's dispatchers already are.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ci(integration): give the suite a 20m package timeout ... 2a7eb3dd19

internal/api takes ~6.5 min under -race on an idle runner; with a second
run on the same runner it crossed go test's default 10m (run 8368: FAIL
at 600.016s with the running test 2s old, so load, not a hang).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

feat(web): level playback by the user's normalization preference (M464 #4999) ... 38290bf8f9

Cuts go through element.volume. Boosts route the element through a Web
Audio GainNode and a DynamicsCompressor (a -1 dBFS limiter in limiter
mode, a pass-through otherwise), built only when a track wants a boost
and only once an AudioContext is confirmed running; iOS never gets the
graph. Auto mode takes album gain when a queue neighbour is from the
same album in track order. Gains are fetched for the next 50 tracks as
the queue moves, with a 10s deadline. The prefetch element is untouched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

feat(android): level playback with a gain processor in the audio sink (M464 #5000) ... 1013c283da

Media3 1.10.1 -> 1.11.0, the version Renovate proposes; 1.11 flushes the
sink's audio processors at every item boundary with the playlist timeline
and the new item's period. GainAudioProcessor uses that to find the track
and its play-order neighbours (auto mode's album rule) and applies the
gain from the first sample, gapless transitions included, with a -1 dBFS
peak limiter in limiter mode and a full-scale clamp otherwise.

Gains come from the library cache first (sync now carries track and album
ReplayGain values; Room v10 adds the columns and rewinds the sync cursor
so an existing cache re-pulls them), then GET /api/tracks/replay-gain,
then none. The player service refreshes the leveling preference at start.

Web: a same-album neighbour without a track number no longer counts as
in-order album play, matching Android.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(android): look gains up by key, not value (M464 #5000) ... 92c3f9bdb8

`id in map` on a ConcurrentHashMap resolves to its legacy contains(),
which tests values (KT-18053); the compiler refuses it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

feat: leveled FLAC stream for Sonos/UPnP speakers (M464 #5001) ... f34423a0e0

Speakers fetch their own audio, so the phone cannot level it. A cast
token minted with level=true (and the client's asAlbum, which only the
queue holder knows) now returns GET /api/tracks/{id}/leveled.flac: the
track rendered by ffmpeg at the user's gain (volume=XdB, plus
alimiter at -1 dBFS for a limiter-mode boost), metadata stripped, FLAC
at 16 or 24 bits and at most 48 kHz. The gain is computed server-side
from the user's preference and the stored loudness, carried as
?g=<centi-dB>&lim=0|1 and signed into the token, so an edited URL does
not verify. Unity gains get the plain stream.

Renders are written beside the cache file and renamed in, keyed by the
source's size and mtime, coalesced per file (singleflight, detached
from the requesting speaker so a retry finds the render running),
started at mint time so the fetch finds them ready, and evicted least
recently used past leveled_cache_mb, a new admin setting (migration
0068, Loudness analysis card).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

feat(android): Sonos/UPnP queue plays leveled URLs, rendered a track ahead (M464 #5002) ... 2e36e70268

Every URL the Sonos queue loader sends is minted with level=true and
the track's album-play verdict from its neighbours in the queue; the
server returns the plain stream when leveling is off or changes
nothing. The playing track and the one after it are rendered ahead,
and each time the renderer moves on, the next is.

Server: a mint no longer prerenders on its own. A queue load mints
every track, which would have started an ffmpeg render per track at
once. The request now carries prerender, and at most two prerenders
run at a time; past that they are dropped, since a fetch renders on
demand anyway.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(library): MBID backfills skip tracks whose files are missing (#5139) ... 13a7a3629a

The track backfill listed every track with a NULL mbid, missing or
not, so each scan tried to open every missing file and logged an
"open failed" warning per track. Nothing ever healed. The album
backfill could pick a missing track as the one to read, and since
that pass is capped per scan, albums stuck that way were retried
ahead of the rest every time.

Both now read only tracks still on disk; an album with none left is
skipped until a scan finds its files again.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ci(android): never ship a debug-signed APK; check the signer (#5116) ... a1e9de2c84

Adopts the rest of family idea #5103 (distributing your own APK):

- Practice 2: build.gradle.kts no longer falls back to the debug key
  when ANDROID_KEYSTORE_PATH is unset; the release build is signed with
  the release key or left unsigned. Main no longer builds and uploads a
  debug-signed app-debug.apk, which no install could ever update.
- Practice 3: android-release runs apksigner on the built APK, prints
  the signer's DN and SHA-256 digest, and fails on a debug signer.
  An unsigned build fails the same step, since there is no
  app-release.apk to verify.
- Practice 9: debug builds offer no server update. The banner does not
  poll and the About card says updates come from Android Studio, since
  the release-signed APK cannot install over a debug-signed app.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ci(android): pin the release certificate in the signer check (#5116) ... 40dd5bb52c

The check failed only on a debug signer, so an APK signed by any other
wrong key (a regenerated keystore, a swapped secret) would publish and
then reach no installed phone: Android updates in place only when the
signer matches. The step now requires exactly one signer whose
SHA-256 digest is the release certificate's (CN=Minstrel,
O=FabledSword, read from run 8446), and names a debug key or the
digest it got when it fails. Rotating the key on purpose changes the
digest in the same commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

feat(android): refuse plain http:// to a public server address (#5111) ... b28cbe0600

Cleartext stays permitted app-wide for LAN servers and UPnP (#2439),
but a password or session cookie sent over plain HTTP to a public
address can be read by anyone on the path. A network interceptor now
refuses a cleartext request to the Minstrel server when the connection
lands on a public address, before any request byte is written.

Checked per connection, on the address actually reached, rather than
when the URL is typed: a name that resolved to the home network at
entry resolves to a public address once the phone leaves home.
Allowed: loopback, 10/8, 172.16/12, 192.168/16, link-local, 100.64/10
(Tailscale and other overlay VPNs) and fc00::/7. Only requests
BaseUrlInterceptor tagged as server-bound are checked; external
fetches and UPnP are untouched. The refusal has its own message.

Family baseline #5105, practice 13.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

bvandeusen merged commit c83670d216 into main 2026-10-06 23:11:36 -04:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

deps

Dependency update (Renovate)

deps:major

Major dependency bump — held for manual review

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

renovate-bot bvandeusen

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bvandeusen/minstrel#136