RiderPilot Android

RiderPilot is a privacy-first decision-support companion for Indian delivery and mobility riders. It works beside official partner apps. It does not replace them, authenticate to them, call their private APIs, or perform synthetic taps.

• Explicit installed-app detection for Zomato, Swiggy, Instamart, Blinkit, Zepto, Rapido, Porter, Shadowfax, Amazon Flex, Ola, Uber, CityMall, JioMart, and BigBasket.
• NotificationListenerService capture with reconnect and backlog handling.
• Read-only AccessibilityService capture limited to the supported package allowlist, password-field exclusion, node/depth budgets, event coalescing, and duplicate suppression.
• India-format deterministic parsing: NFKC, Devanagari digits, ₹/Rs/INR variants, distance, order IDs, pickup/drop hints, and expiry timers.
• Explainable net-profit scoring: fuel, maintenance, net ₹/km, net ₹/hour, and accept/consider/decline/stack reasoning.
• Exact precedence-aware route-chain optimizer for up to six active legs, with pickup-before-drop constraints, ready times, deadlines, and hysteresis.
• Maps handoff using exact coordinates when available or captured address/zone waypoints otherwise.
• Local SQLite shift, offer, decision, and platform-hour intelligence; raw notification/screen text is never stored.
• Optional Gemini enrichment through an authenticated HTTPS proxy. No Gemini key exists in Android source, resources, settings, logs, or APK.
• Android Keystore encryption for the runtime proxy access token.
• Rider-started specialUse foreground service with a persistent stop control.
• Hinglish/Hindi-capable TTS that speaks only a short recommendation.
• Dark, high-contrast, single-activity Compose UI with 48–64 dp action targets.

• Three channels: quiet ongoing shift, standard insights, and urgent/high-value offers.
• Native count-down chronometer to the parsed expiry time.
• Automatic urgency escalation at ten seconds remaining.
• Grouped live-offer cards with a ranked summary.
• Recommendation color, confidence, net ₹/km, net ₹/hour, distance, and explainable reasons.
• Private lock-screen visibility with a redacted public version.
• Actions: open the official app, mark accepted, or decline.
• “Mark accepted” records only the rider’s explicit confirmation. “Open official app” never claims that acceptance occurred.
• Notification cleanup on expiry, decision, source removal, or shift end.

Automatic: capture, parsing, deduplication, AI fallback, scoring, expiry monitoring, notification escalation, voice guidance, re-ranking, route sequencing, and local analytics.

Rider-controlled: starting/stopping a shift, granting special access, accepting/declining in an official partner app, confirming an accepted offer, enabling AI, and deleting history.

Not implemented: partner API interception, request replay, credential/session sharing, root access, synthetic taps, AccessibilityNodeInfo actions, dispatchGesture, silent acceptance, or guaranteed-earnings claims.

• app/src/main/java/com/riderpilot/app/domain — parser, scorer, dedupe, route optimizer, state machine, notification policy.
• app/src/main/java/com/riderpilot/app/capture — notification and read-only accessibility capture.
• app/src/main/java/com/riderpilot/app/monitor — foreground shift, notification system, actions, TTS.
• app/src/main/java/com/riderpilot/app/data — settings, encrypted token, SQLite, repositories.
• app/src/main/java/com/riderpilot/app/ui — rider UI.
• worker/ — Cloudflare Gemini proxy template.
• scripts/security_check.py — forbidden-pattern and manifest security gate.
• docs/ — privacy, threat model, Play declarations, notification design, and device test plan.

Kotlin namespace is com.riderpilot.app; Android application ID remains in.riderpilot.app.

Requirements: JDK 17 and Android SDK Platform 36 / Build Tools 36.0.0. A verified project-local Temurin JDK is recorded in .toolchain/jdk.path on this machine.

Run from PowerShell:

powershell -ExecutionPolicy Bypass -File .\scripts\build.ps1

The script runs the security gate, JVM tests, lint, APK assembly, signing when the local competition key exists, signature verification, and SHA-256 generation.

Manual Gradle verification:

.\gradlew.bat :app:testDebugUnitTest :app:lintDebug :app:assembleDebug :app:assembleRelease

Live offer parsing defaults to gemini-3.5-flash-lite because the supplied empirical research measured it substantially faster than 3.7. Post-shift summaries are configured for gemini-3.7-flash.

Before deployment, revoke every key previously pasted into chat or documents. Deploy worker/ with fresh keys stored only as Cloudflare secrets and a random access token. Enter only the /parse URL and access token in RiderPilot. The app works without AI.

The JVM test suite, Android lint, security gate, debug build, release shrinker, and APK signature are automated. Physical-device validation is still required for OEM background behavior, real notification shapes, per-platform accessibility trees, TTS voice availability, route handoff, and outdoor/gloved usability. Partner UIs and terms can change; re-verify before public release.