Proof Portal
Project overview
Omarchy
ProbeLabs73 findings · 87 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Component
lock
21 requirements allocated to this component across category functional.
16 open findings affect this component (worst: High). Coverage: 20/21 implemented, 21/21 tested.
Contracts
Interface contracts this component is a producer or consumer of.
No interface contracts
This component neither produces nor consumes a declared interface contract.
Responsibilities
the requirements this component owns, by intent — filter for coverage gapsFindings 16 open · 0 resolved
Open (16)
known issues, coverage gaps and checks that still need attention- HighExported bash functions execute as root inside apply-lock despite the trusted-PATH replacementOpenKI-APPLY-LOCK-EXPORTED-FUNCTIONS-ROOT
- HighLock engages when password PAM disappears during the stabilize window; the stranded watchdog stands downOpenKI-LOCK-PAM-FLIP-ENGAGES-LOCK
- MediumFingerprint gate fail-open: substring grep treats not-enrolled or failed fprintd-list probes as enrolledOpenKI-APPLY-LOCK-FPRINT-GATE-FAIL-OPEN
- Mediumomarchy-apply-lock rewrites the lock PAM stacks in place; an interrupted run leaves a torn stack on the live pathReviewedKI-APPLY-LOCK-PAM-NONATOMIC-WRITE
- MediumFailed PKEXEC_UID/user mapping silently degrades target_user to root, configuring PAM for the wrong accountOpenKI-APPLY-LOCK-TARGET-USER-DEGRADES-ROOT
- MediumLock-service fingerprint probe fail-open: substring grep treats zero-enrollment fprintd-list output as configuredOpenKI-LOCK-FPRINT-PROBE-FAIL-OPEN
- MediumCompositor-side lock loss with a request outstanding is treated as a finished unlock; no re-lockReviewedKI-LOCK-SPONTANEOUS-UNLOCK-FAIL-OPEN
- MediumNon-positive sleep-lock budget for logind windows <= 1s: suspend proceeds with no lock attemptOpenKI-SLEEP-LOCK-BUDGET-NONPOSITIVE
- LowFailed/empty readlink result stored as backgroundPath, wiping a good lock-screen wallpaperReviewedKI-LOCK-EMPTY-READLINK-WIPES-WALLPAPER
- LowfingerprintPam.start() returning false disables fingerprint auth for the rest of the lock with no retryReviewedKI-LOCK-FPRINT-START-FAIL-NO-RETRY
- LowAbnormal PAM error increments failedAttempts twice (onError and onCompleted both run handlePasswordFailure)OpenKI-LOCK-PAM-ERROR-DOUBLE-COUNT
- Lowomarchy-hyprland-session-locked has no deadline on hyprctl -j monitors; a stalled compositor IPC hangs the probeReviewedKI-LOCK-PROBE-HYPRCTL-NO-TIMEOUT
- LowScreen add/remove while locked clears the blank intent and never re-arms the idle blank timerReviewedKI-LOCK-SCREENS-CHANGE-BLANK-LOST
- LowIn-place video wallpaper overwrite during a running poster job keeps the stale poster frameReviewedKI-LOCK-STALE-POSTER-INPLACE-OVERWRITE
- Lowargv budget with a leading zero (08/09) bypasses the validation guard via an octal arithmetic errorOpenKI-SLEEP-LOCK-BUDGET-ARG-OCTAL
- LowHeader invariant 'every call bounded by the budget remainder' unenforced on three external callsOpenKI-SLEEP-LOCK-DEADLINE-INVARIANT-GAPS
Attached code & tests
traced files across this component’s requirements, deduplicated by pathCode(7 files)
- LockView.qmlshell/plugins/lock/LockView.qml
- omarchy-apply-lockbin/omarchy-apply-lock
- omarchy-hyprland-session-lockedbin/omarchy-hyprland-session-locked
- omarchy-system-lockbin/omarchy-system-lock
- omarchy-system-sleep-lockbin/omarchy-system-sleep-lock
- omarchy-update-lockbin/omarchy-update-lock
- Service.qmlshell/plugins/lock/Service.qml
Tests(11 files)
- apply-lock-test.shtest/shell.d/apply-lock-test.sh
- hyprland-session-locked-test.shtest/shell.d/hyprland-session-locked-test.sh
- lock-acceptance-test.shtest/shell.d/lock-acceptance-test.sh
- lock-blank-fingerprint-test.shtest/shell.d/lock-blank-fingerprint-test.sh
- lock-fingerprint-indicator-test.shtest/shell.d/lock-fingerprint-indicator-test.sh
- lock-missing-pam-test.shtest/shell.d/lock-missing-pam-test.sh
- lock-password-overflow-test.shtest/shell.d/lock-password-overflow-test.sh
- lock-stranded-recovery-test.shtest/shell.d/lock-stranded-recovery-test.sh
- sleep-lock-test.shtest/shell.d/sleep-lock-test.sh
- system-lock-test.shtest/shell.d/system-lock-test.sh
- update-lock-test.shtest/shell.d/update-lock-test.sh
How this component connects
Open in graphMapping this component’s neighbourhood…
Discussions
Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.
Sign in to discuss this with the proof team.Sign in