Proof Portal

Sign in
Project overview

Omarchy

ProbeLabsviewing a historical run

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Viewing historical run 199d112Oct 2, 2026, 02:38 AMquattro-proofBack to current
Back to findings
Known issueKI-LOCK-STALE-POSTER-INPLACE-OVERWRITE

In-place video wallpaper overwrite during a running poster job keeps the stale poster frame

OpenReviewedLow

Low-severity issue, currently open.

Description

The issue as recorded.

refreshPoster drops the new request while posterProc is running (running guard, Service.qml:138) without queueing, and posterProc.onExited (523-527) commits whenever sourcePath === backgroundPath. An in-place overwrite (same path, new bytes) therefore keeps the poster hashed from the pre-overwrite stat. BackgroundVersion changes the URL but the jpeg bytes are stale, and the code schedules no second refresh.

Affected requirements

The requirement(s) this issue violates — click through to the spec.

SYS-REQ-260912-T0XP

Severity, explained

Why this is rated the way it is — and the scoring signals behind the rating (each ⓘ explains the term).

LowRated severity — the impact if this issue is exploited or hit.
why this rating
Risk-rated
risk area
Correctness

How it's proven

The reproducer — an actual test that drives the real code and shows the issue happening. Run it yourself, or peek the test and the source it covers.

Known issue reproducedprofileknown_issue_reproducerprovesSYS-REQ-260912-T0XP
Reproducer test
Run it yourself
./pocs/crs-260930-ttvk-qml-static.sh
Covers (2)
Last run Sep 30, 2026, 11:02 PM

Reproduction steps

Technical steps for your engineers to confirm the issue by hand.

./pocs/crs-260930-ttvk-qml-static.sh

What protects you, and the fix

What limits your exposure today, and the planned remediation.

What protects you now

another wallpaper change or re-lock regenerates it

The fix

Queue (or re-arm) the poster request when the running guard fires. Then compare the stat signature - not just the path - in onExited before committing

Blast radius

If you touch this issue, what else may need re-checking — the requirements it affects and the code and tests that hang off them. Historical view: authored trace links only — automatically derived links aren't reconstructible for past runs.

Tracing blast radius…

Touch this finding and you re-check 6 requirements · 3 code files · 5 tests.

Requirements (1)
SYS-REQ-260912-T0XP
Code files (3)
  • omarchy-system-lock
  • LockView.qml
  • Service.qml
Tests (5)
  • system-lock-test.sh
  • lock-fingerprint-indicator-test.sh
  • lock-missing-pam-test.sh
  • lock-blank-fingerprint-test.sh
  • lock-password-overflow-test.sh

Per-requirement evidence

For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.

SYS-REQ-260912-T0XP
Implementing code (9)
  • bin/omarchy-system-lock
  • shell/plugins/lock/LockView.qml
  • shell/plugins/lock/LockView.qml
    submitted
  • shell/plugins/lock/Service.qml
  • shell/plugins/lock/Service.qml
    checkStrandedLock
  • shell/plugins/lock/Service.qml
    finishUnlock
  • shell/plugins/lock/Service.qml
    lines
  • shell/plugins/lock/Service.qml
    realScreenCount
  • shell/plugins/lock/Service.qml
    submitPassword
Tests & evidence (1)
  • test/shell.d/system-lock-test.sh
Proof obligations (2)
error_handling

Behavior when operations fail or dependencies are unavailable.

  • ✓negative (required) — test/shell.d/system-lock-test.sh:83
  • ✓nominal (required) — test/shell.d/system-lock-test.sh:43
nominal

Happy-path behavior with valid inputs.

  • ✓nominal (required) — test/shell.d/system-lock-test.sh:44

Evidence trail

The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.

  • proof/evidence/ki-lock-stale-poster-inplace-overwrite.yaml

Change history

Every recorded revision of this finding's source file — when it was added, edited, or re-classified, with the diff for each change.

Discussions

Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.

Sign in to discuss this with the proof team.Sign in