Who
I already published the Omnux truth table and the omnux-gpu siege wall. Those posts are live. This piece is the attachable evidence lane.
This is for owners who will file a bug with receipts and refuse to paste a 400 MB journal that still contains a MAC address. For operators who need backlight, WiFi, DRM, speakersafetyd, and sleep lines before the archaeology starts. For SEP/TouchID researchers who need device-tree names and module hints without biometric material. For agent operators who are supposed to produce owner telemetry under the Omnux mandate with real consent, not theater.
Curl install and the truth table live in the umbrella post. M3 AGX pixels with acceptance criteria live in the GPU post. An attachable evidence bundle the owner controls lives here.
What
I shipped omnux-report, a MIT Shell tool whose entire job is to make Apple Silicon Omnux machines comparable in an issue tracker without scooping secrets by default.
One command. Offline. Installed system or live USB. Consent summary prints exactly what will be gathered. Redaction is on unless you opt out. The output is a single .tar.zst (gzip fallback if zstd is missing) plus a SHA256 sidecar. Attach both.
The pipeline is boring on purpose:
- Consent list journal/sysinfo/SEP structure, optional benches, optional ADT helper; show redaction state; wait for
yunless--yes. - Collect sysinfo, severity-scoped logs, SEP structure, optional benchmarks, optional ADT instructions.
- Cap any single file over 50 MiB keeps its last 50 MiB with a TRUNCATED header so a pathological journal cannot produce an unattachable blob.
- Triage
summary.txtwith PASS / INFO / WARN / FAIL / SKIP per subsystem. - Redact MACs to
XX:XX:XX:XX:XX:XX; key=value secret backstops; count written toredaction-count.txt. - Archive deterministic tar (
--sort=name, fixed mtime) compressed; checksum sidecar.
The schema is documented in docs/SCHEMA.md. Logs arrive as current boot, previous boot, error, warning. Full history is opt-in because long-lived installs turn "helpful" into hundreds of megabytes. Sysinfo covers identity (model, compatible, chip ids), CPU/memory/kernel, package versions and Omarchy markers, device-tree /chosen property names only, block devices without serials, NVMe model+firmware, displays, Type-C roles, scrubbed network, audio/speaker-safety, GPU DRM/EGL state. Benchmarks default to CPU openssl + portable dd probes; glmark2 and vulkaninfo stay opt-in and always sit next to benchmarks/context.txt so a number without a model/kernel/mesa line is treated as noise.
Redaction is the product feature, not the apology. Serial numbers, WiFi/Bluetooth keys, NetworkManager secrets, and /etc/machine-id are never collected. Interface addresses and SSIDs are scrubbed at collection time so a global regex cannot corrupt timestamps. Secret scrubbing matches only key=value / key:value forms. Journal prose like "Forward Password Requests to Wall" survives. Filesystem UUIDs stay because boot debugging needs them; hostnames stay because owners can edit a bundle before attaching if they care.
The SEP section exists for the TouchID-on-Apple-Silicon research program tracked on omnux-gpu issues #10 and #13. It captures device-tree node names and reg bytes, /dev and /sys bus matches, module and modprobe hints, and firmware identifiers. It skips enrollment data, biometric templates, keys, tickets, nonces, TSS responses, and FDR dictionaries. Structure that helps match hardware. Nothing that reproduces security state.
--adt does not dump an Apple Device Tree on the reporting machine. It writes guided instructions for a second host running m1n1's proxyclient, pre-filled with this machine's model, plus a scrub checklist before attach to omnux#4.
Triage is the first screen a bug reader should see: machine Apple-or-fail, DRM render node presence, backlight class, WiFi interface/soft-block, Omarchy release marker, mem_sleep states, speakersafetyd, SEP-named DT nodes. Honest and boring.
On 2026-08-26 this produced a complete redacted 3.5 MB bundle on a real MacBook Pro 16-inch M1 Pro running Omarchy. The same day, test/fixture-test.sh ran ten checks against a synthetic Apple Silicon sysroot on ordinary Linux: model identity, compatible string, journal skip in fixture mode, triage PASS, ADT helper text, size cap, MAC scrub, secret scrub, prose survival, SHA256 verify. That is the receipt that the pipeline is more than "works on my journal."
Still open: packaging into the mx-mac live image, glmark2/vulkaninfo validation on machines that actually have them installed, and an owner-facing release. Working tool. Validated. Unfinished product marketing.
Where
It lives where an Omnux or Omarchy Apple Silicon machine, or the live USB, can run a bash script without a network. Fixture mode lives anywhere Linux so CI cosplay is unnecessary for the collectors themselves.
Repo: michaelmonetized/omnux-report. Normative feature spec still points at omnux#2. ADT collection issue: omnux#4. SEP research adjacency: omnux-gpu #10/#13. Parent ship lane: omnux. GPU siege: omnux-gpu.
Local clone used for this pack: /home/michael/Projects/omnux-report on m1pro16 @ f9729a6.
When
2026-08-26. Scaffold commit 1019bda: honest state, omnux#2 pointer, layout, offline/consent/evidence principles. Same day: aac9244 lands v0.1.0, working collectors, triage, redaction, archive. Same day validation: real M1 Pro Omarchy redacted bundle at 3.5 MB; fixture harness ten checks green.
2026-08-27. Commit f9729a6 adds the SEP/TouchID evidence collector wired to the omnux-gpu research issues: structure only, secrets excluded by design. Last push 2026-08-27T18:34:44Z.
2026-09-08. Content pack drafted. Live omnux and omnux-gpu posts already cover install truth and the AGX wall. This draft stays unique: diagnostics consent and redaction. Still no mx-mac packaging. Still no owner-facing release ceremony.
Why
Owner telemetry without owner control is just surveillance with a README. I wanted a command that tells you what it will gather before it gathers it. I wanted redaction as the default path so attaching a bug is not a privacy coin-flip. I wanted numbers that only mean something next to model, kernel, and Mesa lines. I wanted SEP research to have evidence without becoming a biometric vacuum. I wanted a fixture that proves the pipeline on machines that are not Apple silicon so the tool does not only exist in folklore.
The Omnux story splits cleanly across three repos: the umbrella ships the install lane and the truth table; omnux-gpu names the driver wall without claiming pixels; omnux-report turns "please attach logs" into a consenting, redacted, checksummed artifact. That is the ask: run the command, read the triage, attach the two files.
Engagement Q: When an owner files an Omnux bug, do you want a consenting redacted .tar.zst + SHA256 by default, or a raw journal dump they have to scrub by hand first?