Refactor volume table handling and Bluetooth connection logic

- Updated `uninstall_cinderhome.sh` to remove specific Cinder directories during uninstallation.
- Modified `fake_pst.cpp` to change Bluetooth address format in connection requests for consistency.
- Enhanced `cinder-voltable.c` to implement a more robust method for installing volume tables from predefined directories, ensuring proper checks for Sony's files.
- Adjusted `main.cpp` to reflect updated Bluetooth connection request logging.
- Improved `test_launcher.sh` to verify the presence of volume tables and log appropriate messages based on their availability.
- Expanded documentation to clarify the process of obtaining and using volume curve tables, emphasizing the need for user-provided files.
- Added a new raw HCI snoop capture file for Bluetooth analysis, ensuring sensitive data is redacted.

Author: superwilso

.github/release-notes.md

@@ -102,6 +102,16 @@ On Windows:
 Get-FileHash .\cinder-installer-windows-x64.exe -Algorithm SHA256
 ```
 
+Every file above also has a GitHub build attestation. With the [GitHub CLI](https://cli.github.com):
+
+```
+gh attestation verify cinder-installer-windows-x64.exe -R superwilso/Cinder
+```
+
+A pass means the file was built by this repository's release workflow from the tagged commit, and
+is signed in a way an uploaded replacement cannot fake. The checksums say the file is intact; the
+attestation says where it came from.
+
 The installer is unsigned, so SmartScreen will warn about an unknown publisher — that
 is expected for an unsigned binary and is not itself evidence of anything. Check the
 hash if you want more than my word for it.

.github/workflows/release.yml

@@ -124,6 +124,13 @@ jobs:
     needs: [build, build-linux]
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/')
+    # Job-level permissions REPLACE the workflow's, so contents: write is restated. id-token lets
+    # the job ask GitHub's OIDC issuer for the short-lived identity Sigstore signs with;
+    # attestations lets it store the result against this repository.
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
     steps:
       - uses: actions/checkout@v7
 
@@ -140,6 +147,20 @@ jobs:
           # A published binary nobody can verify is a binary nobody should run.
           ( cd dist && sha256sum -- * | tee SHA256SUMS )
 
+      # BUILD PROVENANCE (docs/SHORTCOMINGS.md D7). SHA256SUMS proves a download matches what this
+      # job published; it cannot prove this workflow, from this commit, produced it — anyone able to
+      # replace a file could replace the sums beside it. An attestation is signed through Sigstore
+      # with the run's own OIDC identity (repository, workflow file, commit), so it can be checked
+      # with `gh attestation verify <file> -R superwilso/Cinder` and cannot be minted outside a run.
+      #
+      # One step over SHA256SUMS rather than one per build job: every published file, the two
+      # .UPGs included, is covered by the same list the release body inlines. It says nothing about
+      # where the committed ARM payload came from — that is D4's manifest, checked above.
+      - name: Attest build provenance for every published file
+        uses: actions/attest-build-provenance@v4
+        with:
+          subject-checksums: dist/SHA256SUMS
+
       # The sums are INLINED INTO THE RELEASE PAGE, not merely attached. Verifying a download
       # against a checksum file fetched from beside it is close to circular: whoever could swap
       # one could swap the other. The release body is the rendered record of what the workflow

CHANGELOG.md

@@ -109,11 +109,10 @@ level the commit history supports; from `v0.1.6` onward, entries are written as
   confirm. The claim came from a reference device an earlier session had copied the files onto.
   Once they were gone, every boot logged `volume curve: cinder-voltable wm1a FAILED — stock curve
   stays` — to logcat, where nobody would see it — and the player quietly kept the stock curve.
-  Cinder does not ship Sony's files, so on a stock player those two choices still do nothing — but
-  now visibly. The installer's description says so; the install log warns when the chosen table is
-  missing; and at boot `cinderhome.log` says `volume curve: 'wm1a' needs …/ov_127x.tbl, which is not
-  part of the stock firmware and is not on this player — stock curve stays` instead of a bare
-  FAILED in logcat.
+  Cinder cannot ship Sony's files, so the two choices now work from a table the user brings (see
+  Added) and say so when there is none: the install log warns, and at boot `cinderhome.log` says
+  `volume curve: 'wm1a' needs Sony's ov_127x.tbl, which this player's firmware does not include and
+  no install has supplied — stock curve stays` instead of a bare FAILED in logcat.
 
 - **Withdrawn: "there is no EU volume cap".** `analysis/RE_volume_tables.md` (2026-09-04) compared
   the two region tables by sweeping the codec's analogue attenuator and found identical curves.
@@ -154,6 +153,29 @@ level the commit history supports; from `v0.1.6` onward, entries are written as
   and SensMe. The README and the installer no longer call the `signature` component the whole of
   Walkman One's sound signature: it reproduces the plus modes, and the external tunings are another
   model's firmware.
+- **The `wm1a` and `w1` volume curves work from a table you bring.** *Launcher sandbox and host
+  checks; device-unverified.* Put Sony's `ov_127x.tbl` (or `ov_1280.tbl`) at the top of the drive,
+  or have Wampy installed, which already keeps the same files on the player. The installer takes a
+  copy only if its SHA-256 is exactly Sony's, re-checks it after copying it into `/system`, and
+  says in the install log which file it used or why it refused one. The setuid helper now looks in
+  Sony's directory and then Cinder's, and reads nothing else. Uninstall removes Cinder's copy.
+  `install.md` ▸ *The volume curve tables* says where to get them and why Cinder cannot include
+  them: they are Sony's files, and Cinder's MIT licence cannot cover them.
+- **Release downloads carry a GitHub build attestation.** *Workflow change; runs for the first time
+  on the next tag.* `gh attestation verify <file> -R superwilso/Cinder` shows each installer and
+  `.UPG` was built by this repository's release workflow from the tagged commit. The release notes
+  and `SECURITY.md` explain how to check (`docs/SHORTCOMINGS.md` D7).
+
+### Security and privacy
+
+- **`SECURITY.md` said Cinder ships twelve setuid-root helpers. It ships eight**, and the list left
+  out `cinder-battery`. It also still described the installer as driving Sony's updater, which it no
+  longer does. `docs/SHORTCOMINGS.md` repeated the same wrong count.
+- **Two real Bluetooth addresses were still in the tree** after the 2026-08-24 redaction: 84 times
+  inside the committed HCI capture, and in the retry-mode measurement quoted in `main.cpp`, the
+  host harness and the 2026-08-26 Bluetooth audit. Both now use the documentation range, and the
+  capture is `hci_reconnect_20260819_redacted.btsnoop`. The original capture is added to
+  `tools/rewrite_history.sh`; the addresses stay in older commits until that rewrite is pushed.
 
 ## [0.3.3] — 2026-09-12
 

README.md

@@ -380,10 +380,11 @@ repository:
   Three settings changed the signal: regions CEW2 and KR3, which load Sony's quieter volume table,
   and gain mode 1. The plus modes, the sound signatures and DAC mode measured the same as stock.
 - **Can Cinder do the same without flashing?** The plus modes, yes — the
-  [`signature` component](install.md#the-sound-signature). The other models' volume tables, not
-  on a stock player: they are not part of the NW-A50's firmware and Cinder does not ship Sony's
-  files, so the installer's `wm1a` and `w1` volume curves only take effect on a player that
-  already holds those tables. The external tunings, no.
+  [`signature` component](install.md#the-sound-signature). The NW-WM1A's volume curve, yes, once you
+  bring the table: it is not part of the NW-A50's firmware and Cinder cannot include Sony's files,
+  so the installer uses a copy you put on the player's drive, or the one Wampy already installed,
+  and only if it is byte-for-byte Sony's — see
+  [The volume curve tables](install.md#the-volume-curve-tables). The external tunings, no.
 - **Can I put Cinder on top of Walkman One?** Untested — see [Known limitations](#known-limitations).
 - **What about my region's volume limit?** If your player was sold where Sony restricts volume,
   Cinder leaves the restriction in place unless you choose a different volume curve, which replaces

SECURITY.md

@@ -1,8 +1,8 @@
 # Security policy
 
-Cinder replaces the Home application on a Sony NW-A50-series Walkman. It ships twelve setuid-root
-helpers, an installer that drives Sony's own firmware updater, and a launcher that runs on the boot
-path. **This device has no public DFU or EDL recovery path**: a bad boot is recovered by the
+Cinder replaces the Home application on a Sony NW-A50-series Walkman. It ships eight setuid-root
+helpers, an installer that triggers the player's own firmware updater, and a launcher that runs on
+the boot path. **This device has no public DFU or EDL recovery path**: a bad boot is recovered by the
 escape ladder described below, or by an eMMC restore, or not at all.
 
 That is the context for everything here. Please read it before reporting, and before contributing
@@ -23,15 +23,17 @@ no SLA, and there is no bug bounty.
 
 The parts where a defect can cost someone their device or their root:
 
-* **The setuid helpers** (`cinder-power`, `cinder-msc`, `cinder-clock`, `cinder-fm`,
-  `cinder-voltable`, `cinder-gpunode`, `cinder-umount`, …). They run as root on behalf of an
+* **The setuid helpers** — all eight: `cinder-power`, `cinder-msc`, `cinder-clock`, `cinder-fm`,
+  `cinder-voltable`, `cinder-battery`, `cinder-gpunode`, `cinder-umount` (the `chmod 4755` lines
+  in `install_cinderhome.sh` are the authoritative list). They run as root on behalf of an
   unprivileged UI. Argument handling, path handling and anything reachable from `/contents`
   (which is FAT, world-writable, and shared with any PC the player is plugged into) matter most.
 * **The launcher and the escape ladder** — `install_cinderhome.sh`'s launcher, the bad-boot
   counter, the auto-revert, the crash supervisor, the kill switch. A defect that disarms an escape
   is more serious than one that crashes the app, because the app crashing is what the escapes are
   for.
-* **The installer** — it writes `NW_WM_FW.UPG` to a device root and triggers Sony's updater.
+* **The installer** — it writes `NW_WM_FW.UPG` to a device root and sends the player's vendor
+  SCSI upgrade command (pass-through on Windows, `SG_IO` on Linux), which runs as administrator/root.
 * **Anything that can make the device unbootable**, whether or not an attacker is involved.
 
 ## What is out of scope
@@ -68,5 +70,16 @@ sha256sum -c SHA256SUMS
 ```
 
 `SHA256SUMS` is attached to each release. It proves the download matches what the release workflow
-produced. It does **not** prove the workflow built this source tree — there is no build
-attestation yet (D7).
+produced. On its own it does **not** prove the workflow built this source tree.
+
+Releases tagged after 2026-09-14 also carry a GitHub build attestation for every published file:
+
+```sh
+gh attestation verify cinder-installer-windows-x64.exe -R superwilso/Cinder
+```
+
+A pass means the file was produced by `.github/workflows/release.yml` in this repository, from the
+commit the tag points at — signed through Sigstore, so it cannot be forged by whoever uploads a
+file. What it does not cover (D7): the installer is still unsigned for SmartScreen, and the ARM
+payload inside it is committed rather than built on the runner, so for those bytes the attestation
+leans on `tools/release.sh`'s rebuild-and-compare manifest (D4).

analysis/G_bt_nfc/RE_findings.md

@@ -7,6 +7,10 @@
 > Nothing here depends on their value: what the findings turn on is that an address is *present*,
 > that it is six bytes, and which device it belongs to — and the device is named alongside it.
 > The same substitution was applied across `cinder-home/src/`, `STATUS.md` and `docs/`.
+> **2026-09-14:** two more were found and replaced the same way — `:03`, the peer in the 2026-08-26
+> retry-mode measurement (`main.cpp`, `fake_pst.cpp`, `AUDIT_2026-08-26_bluetooth.md`), and the
+> CMF Buds' raw address inside the committed HCI capture, now
+> `hci_reconnect_20260819_redacted.btsnoop` (`:02`, byte-for-byte otherwise).
 
 **Status: the API surface is fully recovered. No Ghidra needed.**
 

analysis/G_bt_nfc/hci_reconnect_20260819.btsnoop

@@ -78,10 +78,12 @@ voltable | CINDER_VOLTABLE | enum:stock,wm1a,w1 | stock | Wired volume curve
     all — and its live steps coarsen toward the top, which is where the volume-change pop is
     loudest. `wm1a` is the NW-WM1A's own table: monotonic across the whole range, no dead zones,
     finer steps at the top.
-    NOT ON A STOCK PLAYER. Neither `wm1a` (ov_127x.tbl) nor `w1` (ov_1280.tbl) is part of Sony's
-    NW-A50 firmware, and Cinder does not ship Sony's files, so on a stock player both leave the
-    stock curve in place (checked against a stock player's /system/usr/share/audio_dac,
-    2026-09-13). They only take effect where those tables have already been put there.
+    BRING THE TABLE. Neither `wm1a` (ov_127x.tbl) nor `w1` (ov_1280.tbl) is part of Sony's NW-A50
+    firmware, and Cinder cannot include them: they are Sony's files. Before installing, put
+    ov_127x.tbl (and ov_dsd_127x.tbl, for DSD) at the top of the player's drive, next to MUSIC —
+    install.md "The volume curve tables" says where to get them. If Wampy is installed, its copies
+    are used and nothing needs downloading. A file is taken only if its SHA-256 is Sony's own;
+    without one the stock curve stays and the install log says which file is missing.
     On this (European) unit, with the table present, it does NOT raise the maximum — both curves reach the same ceiling —
     but it IS quieter at the same number through the mid range, so a familiar volume setting will
     sound different.

analysis/G_bt_nfc/hci_reconnect_20260819_redacted.btsnoop

@@ -315,16 +315,62 @@ if [ ! -f /contents/cinder_voltable.conf ]; then
 else
     echo "volume curve: keeping existing /contents/cinder_voltable.conf ($("$BB" cat /contents/cinder_voltable.conf 2>/dev/null))"
 fi
-# The two non-stock curves need tables a stock NW-A50 does not have (only its own 1291 set ships,
-# and Cinder does not ship Sony's files). Say so here, where the choice lands, as well as at boot.
+# 1f3b) the tables `wm1a` and `w1` need. A stock NW-A50 has only its own 1291 set, and Cinder does
+#       not ship Sony's files: they are Sony's copyright, not Cinder's to license (install.md, "The
+#       volume curve tables"). So they come from where the user already has them —
+#         /contents/<name>          copied to the top of the player's drive over USB
+#         Wampy's sound_settings    the same bytes, named for the model Wampy took them from
+#       — and are installed ONLY when they are byte-for-byte Sony's file. This is the step where a
+#       file from the user-writable drive enters root-owned /system, and cinder-voltable writes what
+#       it finds there straight into the codec, so the hash is checked again on the copy that lands.
+#       Every install looks, whatever curve is chosen, so the curve can be changed later over USB
+#       without a reinstall; a table installed earlier stays when no candidate is found.
+#       VT_DIR must match CINDER_DIR in src/cinder-voltable.c and the launcher's check below.
+VT_DIR=/system/vendor/unknown321/usr/share/cinder/audio_dac
+WAMPY_SS=/system/vendor/unknown321/usr/share/wampy/sound_settings
+vt_sha() { "$BB" sha256sum "$1" 2>/dev/null | "$BB" cut -d' ' -f1; }
+vt_take() {  # vt_take <name> <sha256> <candidate>... — install the first candidate that IS Sony's <name>
+    vt_name="$1"; vt_want="$2"; shift 2
+    for vt_cand in "$@"; do
+        [ -f "$vt_cand" ] || continue
+        vt_got="$(vt_sha "$vt_cand")"
+        if [ "$vt_got" != "$vt_want" ]; then
+            # Wampy's folders hold other tables too; only a file put on the drive is worth a word.
+            case "$vt_cand" in
+                /contents/*) echo "WARN: $vt_cand is not Sony's $vt_name (SHA-256 ${vt_got:-unreadable}) — not installed" ;;
+            esac
+            continue
+        fi
+        "$BB" mkdir -p "$VT_DIR" 2>/dev/null
+        "$BB" cat "$vt_cand" > "$VT_DIR/$vt_name.tmp" 2>/dev/null
+        if [ "$(vt_sha "$VT_DIR/$vt_name.tmp")" = "$vt_want" ]; then
+            "$BB" chmod 644 "$VT_DIR/$vt_name.tmp"
+            "$BB" mv -f "$VT_DIR/$vt_name.tmp" "$VT_DIR/$vt_name"
+            echo "volume table: installed $vt_name from $vt_cand (SHA-256 matches Sony's)"
+            return 0
+        fi
+        "$BB" rm -f "$VT_DIR/$vt_name.tmp" 2>/dev/null
+        echo "WARN: copying $vt_cand to $VT_DIR did not verify — not installed"
+    done
+    return 1
+}
+# The hashes are of Sony's own files: the NW-WM1A's ov_127x / ov_dsd_127x (Wampy's ZX-300 1288
+# pair is the same bytes) and Walkman One's ov_1280 (Wampy's ov_1280_nw-wm1a).
+vt_take ov_127x.tbl     b5dd878b0484c43312f3a93c6675d40d546f78ef7494684991eea0aef8651320 \
+    /contents/ov_127x.tbl "$WAMPY_SS"/master_volume/*.tbl
+vt_take ov_dsd_127x.tbl b777b7e2786f952797e82830d5d17565d03a4758555436a376bf6daff5e50ac7 \
+    /contents/ov_dsd_127x.tbl "$WAMPY_SS"/master_volume_dsd/*.tbl
+vt_take ov_1280.tbl     0902981b0b00b5f98eb04d00713f4ddc96f4bb91af76289d8cce15486c30a9c7 \
+    /contents/ov_1280.tbl "$WAMPY_SS"/master_volume/*.tbl
+# Say so here, where the choice lands, as well as at boot, when the chosen curve still has no table.
 vt_now="$("$BB" cat /contents/cinder_voltable.conf 2>/dev/null | "$BB" tr -d ' \t\r\n')"
 case "$vt_now" in
     wm1a) vt_tbl=ov_127x.tbl ;;
     w1)   vt_tbl=ov_1280.tbl ;;
     *)    vt_tbl="" ;;
 esac
-if [ -n "$vt_tbl" ] && [ ! -f "/system/usr/share/audio_dac/$vt_tbl" ]; then
-    echo "WARN: volume curve '$vt_now' needs /system/usr/share/audio_dac/$vt_tbl, which this player does not have (it is not part of the stock firmware) — the stock curve stays."
+if [ -n "$vt_tbl" ] && [ ! -f "/system/usr/share/audio_dac/$vt_tbl" ] && [ ! -f "$VT_DIR/$vt_tbl" ]; then
+    echo "WARN: volume curve '$vt_now' needs Sony's $vt_tbl, which this player's firmware does not include and which was not found at the top of the drive or in Wampy — the stock curve stays. Put $vt_tbl on the drive and install again (install.md: The volume curve tables)."
 fi
 
 # 1f4) battery/charger reader. The bq24262 charger's registers live under /proc/regmon/bq24262/,
@@ -702,12 +748,13 @@ if [ -x "$VOLTABLE_BIN" ] && [ -f "$VOLTABLE_CONF" ]; then
             vt_log "volume curve: stock — keeping the table the boot script loaded"
             ;;
         wm1a|w1)
-            # Both need a table a STOCK NW-A50 DOES NOT HAVE: only its own 1291 set ships, and
-            # Cinder does not ship Sony's files. Look first, so the log says why instead of a bare
-            # FAILED — the helper's rc 4 means the same thing, silently.
+            # Both need a table a STOCK NW-A50 DOES NOT HAVE: only its own 1291 set ships. An
+            # install puts the user's own copy in Cinder's directory once its SHA-256 matches Sony's
+            # (step 1f3b above), and cinder-voltable looks in both places. Look first, so the log
+            # says why instead of a bare FAILED — the helper's rc 4 means the same thing, silently.
             case "$vt" in wm1a) vt_tbl=ov_127x.tbl ;; *) vt_tbl=ov_1280.tbl ;; esac
-            if [ ! -f "/system/usr/share/audio_dac/$vt_tbl" ]; then
-                vt_log "volume curve: '$vt' needs /system/usr/share/audio_dac/$vt_tbl, which is not part of the stock firmware and is not on this player — stock curve stays"
+            if [ ! -f "/system/usr/share/audio_dac/$vt_tbl" ] && [ ! -f "/system/vendor/unknown321/usr/share/cinder/audio_dac/$vt_tbl" ]; then
+                vt_log "volume curve: '$vt' needs Sony's $vt_tbl, which this player's firmware does not include and no install has supplied — stock curve stays (put it at the top of the drive and install again)"
             elif "$VOLTABLE_BIN" "$vt" >/dev/null 2>&1; then
                 vt_log "volume curve: $vt applied"
             else