Proof Portal
Omarchy
ProbeLabsviewing a historical runA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Header invariant 'every call bounded by the budget remainder' unenforced on three external calls
Low-severity issue, currently open.
Description
The issue as recorded.
The script header promises the deadline enforces itself on every call, but three sites break it. (1) sync_clamshell uses a fixed timeout 0.4s+0.1s and never consults remaining_ms - with a 100ms budget it runs the script 4x past the deadline. (2) derive's busctl read gets a full 1s timeout but the deadline clock starts only at line 52. A slow reply therefore consumes exactly the 1000ms reserve held back for logind (lifetime measured at 5102ms against a 5000ms window). (3) report_unsecured's omarchy-notification-send has no timeout wrapper and '|| true' does not bound the sd-bus default (~25s). The unlocked-suspend warning can therefore stall for the whole remaining window and never land.
Affected requirements
The requirement(s) this issue violates — click through to the spec.
Severity, explained
Why this is rated the way it is — and the scoring signals behind the rating (each ⓘ explains the term).
- why this rating
- Risk-rated
- risk area
- Correctness
- CVE surface
- None
How it's proven
The reproducer — an actual test that drives the real code and shows the issue happening. Run it yourself, or peek the test and the source it covers.
known_issue_reproducer./pocs/crs-260930-gzq0-c04.sh
Reproduction steps
Technical steps for your engineers to confirm the issue by hand.
./pocs/crs-260930-gzq0-c04.sh
What protects you, and the fix
What limits your exposure today, and the planned remediation.
What protects you now
the fixed clamshell bound still stops a multi-second Hyprland stall; logind force-suspends at window end regardless
The fix
Clamp the clamshell timeout to remaining_ms. Start the deadline clock before the derive read (or charge the read to the budget). Wrap the notification send in a short timeout
Blast radius
If you touch this issue, what else may need re-checking — the requirements it affects and the code and tests that hang off them. Historical view: authored trace links only — automatically derived links aren't reconstructible for past runs.
Touch this finding and you re-check 2 requirements · 1 code files · 1 tests.
- omarchy-system-sleep-lock
- sleep-lock-test.sh
Per-requirement evidence
For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.
Per-requirement evidence
For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.
Evidence trail
The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.
Evidence trail
The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.
- proof/evidence/ki-sleep-lock-deadline-invariant-gaps.yaml
Change history
Every recorded revision of this finding's source file — when it was added, edited, or re-classified, with the diff for each change.
Discussions
Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.