Prior Art

Repository: github.com/Denton-L/based-connect
Language: C with BlueZ
Status: Works for QC35. NCH700 compatibility is partial — QC35-format commands work on channels 8/9 for basic queries, but the NCH700-specific features (11-level NC, EQ, etc.) use a different protocol.
Protocol details: SPP-based, message format is [fn1][fn2][sub][len][data...] with no checksum. The details.txt in the repo documents known command bytes.
Key insight from this project: The based-connect protocol format works on the NCH700 for reading device info, but the 05 magic byte documented for QC35 was NOT observed on the NCH700. Instead, channels 8/9 accept raw [fn1][fn2][sub][len] without a magic prefix.

Repository: github.com/bosefirmware/ced
NCH700 firmware path: goodyear/ directory (matching the internal codename)
Contains: Firmware changelogs and update files. Useful for understanding version history and feature additions (e.g., EQ was added in firmware v1.4.12).

URL: blog.davidv.dev/reverse-engineering-the-bose-qc35-bluetooth-protocol.html
Key insight: Documents the QC35 message format [byte1][byte2][byte3][length][...data...] and the reverse engineering methodology using btmon and packet analysis.
Relevance: The methodology applies directly to NCH700 research, even though the protocol has evolved.