Skip to content

OMUS v1.1.0 — Every mouse. One system.

Latest

Choose a tag to compare

@github-actions github-actions released this 24 Sep 17:56
a33c416

OMUS v1.1.0 — Bounded Automatic Discovery and evidence-driven Lab

Release acceptance note (2026-09-24): The initial scan of the immutable
AppImage (078efc18ccf26ad5233ea8dee2346a5af2fdc629f4ac0f8a3bf19b176c46d6bf)
reported one Microsoft malicious result,
Trojan:Script/Wacatac.B!ml; the RPM, DEB, wheel, and source archive reported
zero detections. A controlled rescan of the same artifact bytes at
2026-09-24 21:37:34 UTC reported 0/64 detections, including Microsoft as
undetected. The initial analysis
and current point-in-time results are preserved; no tag or release asset was
changed.

Automatic Discovery

OMUS now runs one canonical, explainable pipeline from exact interface
quarantine and physical identity through Protocol Genome recognition, active
fingerprint selection, Advice compilation, bounded grammar/integrity/structure
inference, and proof or Lab escalation. All 20 currently compiled repertoire
families produce 62 operation-specific Genome records. These records represent
known structure and evidence; they do not imply that every listed mouse is
physically validated or writable.

Inference is deterministic and explicitly budgeted. When safe automatic
analysis cannot continue, OMUS reports the missing evidence and one exact human
action instead of guessing. Compact runtime recipes are validated against
identity, descriptor, firmware, generation, evidence ancestry, and evidence
revision before reuse.

Discovery Lab and TUI

The existing full-screen Hardware Discovery and Lab pages now present the same
canonical outcome. Recognition, inference, proof, fast-path reuse, stopping
reason, and required Lab action remain visibly distinct. Evidence collected in
the Lab returns to the same EvidenceGraph rather than creating a parallel
authority path. Existing navigation, setup, service, update, and review/save
behavior is preserved.

Safety

  • Hardware authority remains fail-closed and bound to exact identity,
    interface, generation, evidence, adapter ownership, and protocol proof.
  • Recipe persistence is atomic and rejects symlinks, corruption, oversized
    data, schema drift, stale revisions, and invalid value domains.
  • Corpus, vendor, public, and community evidence can improve recognition but
    cannot grant write authority.
  • Generic HID inspection remains read-only; ambiguous or unknown hardware is
    never probed with speculative writes.

Native support

The Logitech G305 remains the physically validated HID++ reference device.
Native Razer remains an independently implemented, exact-model path covered by
offline regression tests. Other repertoire families range from sourced
recognition through experimental/Lab-assisted discovery and require their own
physical evidence before write support can be claimed.

Licensing

OMUS v1.1.0 is distributed under AGPL-3.0-or-later. Organizations requiring
other terms may contact the project for separate commercial licensing. The
public AGPL source is not intentionally feature-limited, and rights already
received under the AGPL are unaffected by commercial availability. Historical
releases retain the licenses applicable when they were distributed; third-party
research, data, and assets retain their recorded licenses or provenance.

Security and supply chain

Release gates retain immutable-pinned GitHub Actions, least-privilege workflow
permissions, hash-locked dependency environments, CodeQL, OpenSSF Scorecard,
CycloneDX project SBOM generation, SHA-256 manifests, SLSA provenance and SBOM
attestations, exact artifact allowlists, VirusTotal follow-up verification, and
reproducible wheel comparison. Hosted checks are required for publication and
are not represented as locally executed by these notes.

Primary candidate artifacts are omus-1.1.0-1.fc44.noarch.rpm,
omus_1.1.0_all.deb, OMUS-1.1.0-x86_64.AppImage,
omus-1.1.0-py3-none-any.whl, and omus-1.1.0.tar.gz.

VirusTotal analysis

VirusTotal scanned the five primary distributable artifacts. Results are a point-in-time signal, not a certification of safety.

Artifact SHA-256 Result at scan time Analysis
OMUS-1.1.0-x86_64.AppImage 078efc18ccf26ad5233ea8dee2346a5af2fdc629f4ac0f8a3bf19b176c46d6bf 0 detections at scan time VirusTotal analysis
omus-1.1.0-1.fc44.noarch.rpm b566f0fed3eeb57dbdc92d0df65778063e4ec178ee0e21c1dce2c50586a32944 0 detections at scan time VirusTotal analysis
omus-1.1.0-py3-none-any.whl 03c99abbc505653821c1c09ea2b915a85c1d17a04f7727c331726249ed026f67 0 detections at scan time VirusTotal analysis
omus-1.1.0.tar.gz c6281f6ded58c9d983d70d895574738ce69a2d6a6b8831aa8fa060227d12bde5 0 detections at scan time VirusTotal analysis
omus_1.1.0_all.deb d93e833c6da6d0780ba38868d90c8b5deeebbbd2fd89f80b8fdc3ccec45b381f 0 detections at scan time VirusTotal analysis