Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-1041GitHub issuePublicDecided· Out of scope

omarchy-refresh-pacman drops hardware-specific repos (arch-mact2 on T2 Macs), silently orphaning linux-t2

Reported by JamieCurnow · filed Sep 2, 2026 · open at source

Decided: Out of scope — decided by agents · verified 5 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

omarchy-refresh-pacman drops hardware-specific repos (arch-mact2 on T2 Macs), silently orphaning linux-t2revision 1 · captured 2026-09-28 21:24 UTC via poll

System details: Apple MacBookPro16,1 (T2, 106b:1801/106b:1802), Intel i7-9750H + AMD Navi 14, Omarchy 4.0.2-1, kernel linux-t2 7.1.8.arch1-3, Hyprland 0.56.2, bootloader Limine (UKI).

Summary

omarchy-refresh-pacman overwrites /etc/pacman.conf from the channel template but never re-applies the hardware-specific repository additions that install/hardware/pacman.sh is responsible for. On Apple T2 Macs this silently drops the [arch-mact2] repository, orphaning linux-t2 and the other T2 packages so they can no longer receive updates — including the kernel.

The install path does this correctly; the refresh/upgrade path does not.

Impact

After upgrading to 4.x on a T2 Mac, these packages remain installed but have no update source:

  • linux-t2 — the running kernel
  • t2fanrd
  • apple-t2-audio-config
  • apple-bcm-firmware

The machine keeps booting and working, so there is no visible symptom. The failure is silent: the kernel simply stops receiving security and bugfix updates, and the user has no indication anything is wrong. pacman -Syu reports nothing missing because the packages resolve locally.

Root cause

bin/omarchy-refresh-pacman overwrites the config and then only runs the user hook:

sudo cp -f "$OMARCHY_PATH/default/pacman/pacman-$channel.conf" /etc/pacman.conf
sudo cp -f "$OMARCHY_PATH/default/pacman/mirrorlist-$channel" /etc/pacman.d/mirrorlist

# Allow user customization of /etc/pacman.conf before the upgrade runs
omarchy-hook pre-refresh-pacman

sudo env OMARCHY_UPDATE_PACMAN=1 pacman -Syyuu --noconfirm

install/post-install/pacman.sh does the same overwrite but does re-apply hardware repos:

cp -f "$OMARCHY_PATH/default/pacman/pacman-${OMARCHY_MIRROR:-stable}.conf" /etc/pacman.conf
...
source "$OMARCHY_INSTALL/hardware/pacman.sh"

And install/hardware/pacman.sh states the intent explicitly:

# Hardware-specific pacman repository extensions that must survive the final
# pacman.conf restore.
if lspci -nn | grep "106b:180[12]" >/dev/null; then
  if ! grep -q '^\[arch-mact2\]' /etc/pacman.conf; then
    cat >> /etc/pacman.conf <<'EOF'

[arch-mact2]
Server = https://github.com/NoaHimesaka1873/arch-mact2-mirror/releases/download/release
SigLevel = Never
EOF
  fi
fi

So the repo is added deliberately for this hardware and is meant to survive a template restore — but the refresh path is missing the source "$OMARCHY_INSTALL/hardware/pacman.sh" line. No migration re-adds it either (grep -rn arch-mact2 migrations/ returns nothing).

Note the ordering hazard: pacman -Syyuu --noconfirm runs immediately afterwards, so the full upgrade proceeds with the repo already missing.

Reproduction

  1. Apple T2 Mac (lspci -nn shows 106b:1801 / 106b:1802) installed via the T2 path, with [arch-mact2] in /etc/pacman.conf
  2. Upgrade to 4.x (or run omarchy refresh pacman)
  3. grep arch-mact2 /etc/pacman.conf → gone
  4. pacman -Si linux-t2 → no repository

Evidence from the affected machine

/etc/pacman.conf before the upgrade (/etc/pacman.conf.bak, 15:53) ended with:

[omarchy]
SigLevel = Optional TrustAll
Server = https://pkgs.omarchy.org/stable/$arch

[arch-mact2]
Server = https://github.com/NoaHimesaka1873/arch-mact2-mirror/releases/download/release
SigLevel = Never

The upgrade's own backup (/etc/pacman.conf.omarchy-upgrade-to-quattro.20260902155457.bak, 15:54) already ends at [omarchy] — [arch-mact2] is gone.

Resulting state:

$ pacman -Q linux-t2
linux-t2 7.1.8.arch1-3

$ pacman -Si linux-t2
error: package 'linux-t2' was not found

arch-mact2-mirrorlist was also removed.

Suggested fix

Re-apply hardware repository additions in omarchy-refresh-pacman after the template copy and before pacman -Syyuu, mirroring what install/post-install/pacman.sh already does:

sudo cp -f "$OMARCHY_PATH/default/pacman/pacman-$channel.conf" /etc/pacman.conf
sudo cp -f "$OMARCHY_PATH/default/pacman/mirrorlist-$channel" /etc/pacman.d/mirrorlist

source "$OMARCHY_INSTALL/hardware/pacman.sh"   # <-- add

omarchy-hook pre-refresh-pacman

sudo env OMARCHY_UPDATE_PACMAN=1 pacman -Syyuu --noconfirm

install/hardware/pacman.sh is already idempotent (it guards on grep -q '^\[arch-mact2\]'), so this is safe to run unconditionally on every refresh.

A migration to repair already-upgraded machines would also help, since affected users have no symptom to prompt them to look.

Workaround

Re-append the stanza to /etc/pacman.conf manually, or add a
~/.config/omarchy/hooks/pre-refresh-pacman.d/ hook that re-adds it on each refresh.

Note on scope

The removal of tiny-dfr by migration 1785944594.sh is not part of this report — that is clearly deliberate and well-reasoned ("the optional daemon holds stale device descriptors across suspend with t2bce"), and matches this machine's experience. Only the loss of the repository appears unintended.


This issue was researched and written by Claude (Claude Code) running on the affected machine, and filed by the repository account owner. All command output above was collected from that machine.

View raw text
**System details:** Apple MacBookPro16,1 (T2, `106b:1801`/`106b:1802`), Intel i7-9750H + AMD Navi 14, Omarchy 4.0.2-1, kernel `linux-t2` 7.1.8.arch1-3, Hyprland 0.56.2, bootloader Limine (UKI).

## Summary

`omarchy-refresh-pacman` overwrites `/etc/pacman.conf` from the channel template but never re-applies the hardware-specific repository additions that `install/hardware/pacman.sh` is responsible for. On Apple T2 Macs this silently drops the `[arch-mact2]` repository, orphaning `linux-t2` and the other T2 packages so they can no longer receive updates — including the kernel.

The install path does this correctly; the refresh/upgrade path does not.

## Impact

After upgrading to 4.x on a T2 Mac, these packages remain installed but have no update source:

- `linux-t2` — **the running kernel**
- `t2fanrd`
- `apple-t2-audio-config`
- `apple-bcm-firmware`

The machine keeps booting and working, so there is no visible symptom. The failure is silent: the kernel simply stops receiving security and bugfix updates, and the user has no indication anything is wrong. `pacman -Syu` reports nothing missing because the packages resolve locally.

## Root cause

`bin/omarchy-refresh-pacman` overwrites the config and then only runs the user hook:

```bash
sudo cp -f "$OMARCHY_PATH/default/pacman/pacman-$channel.conf" /etc/pacman.conf
sudo cp -f "$OMARCHY_PATH/default/pacman/mirrorlist-$channel" /etc/pacman.d/mirrorlist

# Allow user customization of /etc/pacman.conf before the upgrade runs
omarchy-hook pre-refresh-pacman

sudo env OMARCHY_UPDATE_PACMAN=1 pacman -Syyuu --noconfirm
```

`install/post-install/pacman.sh` does the same overwrite but *does* re-apply hardware repos:

```bash
cp -f "$OMARCHY_PATH/default/pacman/pacman-${OMARCHY_MIRROR:-stable}.conf" /etc/pacman.conf
...
source "$OMARCHY_INSTALL/hardware/pacman.sh"
```

And `install/hardware/pacman.sh` states the intent explicitly:

```bash
# Hardware-specific pacman repository extensions that must survive the final
# pacman.conf restore.
if lspci -nn | grep "106b:180[12]" >/dev/null; then
  if ! grep -q '^\[arch-mact2\]' /etc/pacman.conf; then
    cat >> /etc/pacman.conf <<'EOF'

[arch-mact2]
Server = https://github.com/NoaHimesaka1873/arch-mact2-mirror/releases/download/release
SigLevel = Never
EOF
  fi
fi
```

So the repo is added deliberately for this hardware and is meant to survive a template restore — but the refresh path is missing the `source "$OMARCHY_INSTALL/hardware/pacman.sh"` line. No migration re-adds it either (`grep -rn arch-mact2 migrations/` returns nothing).

Note the ordering hazard: `pacman -Syyuu --noconfirm` runs immediately afterwards, so the full upgrade proceeds with the repo already missing.

## Reproduction

1. Apple T2 Mac (`lspci -nn` shows `106b:1801` / `106b:1802`) installed via the T2 path, with `[arch-mact2]` in `/etc/pacman.conf`
2. Upgrade to 4.x (or run `omarchy refresh pacman`)
3. `grep arch-mact2 /etc/pacman.conf` → gone
4. `pacman -Si linux-t2` → no repository

## Evidence from the affected machine

`/etc/pacman.conf` before the upgrade (`/etc/pacman.conf.bak`, 15:53) ended with:

```
[omarchy]
SigLevel = Optional TrustAll
Server = https://pkgs.omarchy.org/stable/$arch

[arch-mact2]
Server = https://github.com/NoaHimesaka1873/arch-mact2-mirror/releases/download/release
SigLevel = Never
```

The upgrade's own backup (`/etc/pacman.conf.omarchy-upgrade-to-quattro.20260902155457.bak`, 15:54) already ends at `[omarchy]` — `[arch-mact2]` is gone.

Resulting state:

```
$ pacman -Q linux-t2
linux-t2 7.1.8.arch1-3

$ pacman -Si linux-t2
error: package 'linux-t2' was not found
```

`arch-mact2-mirrorlist` was also removed.

## Suggested fix

Re-apply hardware repository additions in `omarchy-refresh-pacman` after the template copy and before `pacman -Syyuu`, mirroring what `install/post-install/pacman.sh` already does:

```bash
sudo cp -f "$OMARCHY_PATH/default/pacman/pacman-$channel.conf" /etc/pacman.conf
sudo cp -f "$OMARCHY_PATH/default/pacman/mirrorlist-$channel" /etc/pacman.d/mirrorlist

source "$OMARCHY_INSTALL/hardware/pacman.sh"   # <-- add

omarchy-hook pre-refresh-pacman

sudo env OMARCHY_UPDATE_PACMAN=1 pacman -Syyuu --noconfirm
```

`install/hardware/pacman.sh` is already idempotent (it guards on `grep -q '^\[arch-mact2\]'`), so this is safe to run unconditionally on every refresh.

A migration to repair already-upgraded machines would also help, since affected users have no symptom to prompt them to look.

## Workaround

Re-append the stanza to `/etc/pacman.conf` manually, or add a
`~/.config/omarchy/hooks/pre-refresh-pacman.d/` hook that re-adds it on each refresh.

## Note on scope

The removal of `tiny-dfr` by migration `1785944594.sh` is **not** part of this report — that is clearly deliberate and well-reasoned ("the optional daemon holds stale device descriptors across suspend with t2bce"), and matches this machine's experience. Only the loss of the repository appears unintended.

---

*This issue was researched and written by Claude (Claude Code) running on the affected machine, and filed by the repository account owner. All command output above was collected from that machine.*

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

  • Related PRpr/8781· confirmed

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 10:37 UTC