Where signatures come from

Rules

1. Every signature records its source, source URL, source type, licence, whether it has been independently verified, the hardware and iOS versions it was tested on, first and last verification dates, notes, and an enabled flag.
2. Production signatures are those that are enabled, independently verified, and not derived from reference-only or unknown sources. The validator additionally requires tested hardware, iOS versions and dates whenever a signature is marked verified. Production eligibility is computed from these flags; it is never set by hand.
3. Research signatures (used only in our internal test harness) are enabled signatures from acceptable source types, verified or not.
4. A community submission can never be flipped to verified in place. Confirming one creates a new signature of type independent test with the exact observed values, which keeps the audit trail honest.
5. Demo mode uses a fictional signature under company identifier 0xFFFF, which the Bluetooth SIG reserves, and is never part of the catalogue file.
6. Nothing is copied from AGPL or non-commercial sources. Two public projects in this space were checked on 16 September 2026 and found to be licensed AGPL-3.0 and CC BY-NC-SA 4.0 respectively; neither was opened beyond the licence check and neither is used.

Identifiers we are researching

All values were read from the official Bluetooth SIG assigned-numbers files on 16 September 2026; a snapshot is kept in the repository. Registration establishes which company owns an identifier. It does not establish which product uses it, whether glasses advertise it, in which states, or whether other products of the same company advertise it too.

Not included yet, all Bluetooth SIG company identifiers that are too broad on their own: Xiaomi 0x038F (plus several member UUIDs), TCL 0x0BC6 (RayNeo's parent), GoerTek 0x05AC (a manufacturer for many wearables). Rokid was not found under that name in the SIG list on 16 September 2026 and needs further research.

What the SIG data does and does not establish

• Establishes: which company registered an identifier.
• Does not establish: which product uses it, whether glasses advertise it, in which states, or whether other products of the same company advertise it too.

Everything in the second list must come from independent tests on our hardware, with the scenario, iOS version and export file recorded in the signature's notes.

Promotion workflow

1. Run the scenarios in the validation protocol and export the harness data.
2. File the exports under a dated, per-device folder with the completed test template.
3. Add or modify the signature with source type independent test, verified flag, hardware, iOS versions, dates and notes pointing at the export.
4. Run the validator; the production count changes and a unit test that asserts "nothing is production-eligible before hardware validation" has to be updated deliberately.
5. Add a decision-log entry.

Related pages

• How Bluetooth detection works
• False positives and false negatives
• Device database, which lists these identifiers per product