## What this is

Vendor-produced evidence against DISA's General Purpose Operating System Security Requirements Guide, [GPOS SRG V3R3](https://www.cyber.mil) (2025-09-22). The packet uses those V-IDs and marks each row `implemented`, `partial`, `gap`, or `not-applicable`.

It is not a DISA STIG, not an Arch Linux STIG, and not an authorization to operate. An authorizing official would receive it with an Omarchy **stable** image. Honest gap rows stay gap rows.

A draft catalog covers the 20 CAT I findings plus V-203599 (session lock, CAT II). Nothing here asks to change the default desktop.

## The public image stays the default

Default Omarchy remains the general-purpose system: 5-minute lock, passwordless sudo still available, AUR still available, advisories (when the feed exists) warn and do not block install or update.

Corporate and gov/mil requirements sit on top of that image. They are opt-in presets, not a second distribution.

| Who | What they run |
| --- | --- |
| Public | Default Omarchy. A missing advisory file is a warning. |
| Corporate | The same image, plus an opt-in profile: 15-minute lock, passwordless sudo refused, exposure report fails closed when the advisory file is missing or in error. |
| Gov/mil | A stable image, plus a restricted package tree copied from stable by allowlist, plus this overlay as the evidence packet. |

The restricted tree is not a fourth edge → rc → stable stage. Sites that want it point at that tree. Everyone else keeps the normal repositories.

## What a profile can close, and what it cannot

Settings already in the product can be tightened by the opt-in profile: lock timer (V-203599) and passwordless sudo (the default-desktop half of V-203695).

These CAT I rows stay gaps until someone asks for an install-time preset. A profile applied after install cannot honestly close them:

- V-203776 / V-203739 — FIPS-validated and NSA-approved cryptography
- V-203782 — unattended or automatic logon (the ISO creates an autologin session)
- V-203682 — cryptographic protection of audit tools (no STIG-complete auditd ruleset)
- V-252688 — wireless peripheral crypto policy

V-203720 (signed patches) is partial: Arch and OPR packages are signed, the AUR is not. The close is the restricted allowlist, not removing the AUR from the public image.

## The one row that needs the OPR advisory feed

V-259333 (install security-relevant updates within 30 days) needs the per-artifact advisory files from omacom/omarchy-pkgs#378, plus Arch's own audit data. A missing advisory file is "no evidence," not a claim that the package is clean. The other overlay rows are desktop and installer behavior, not package CVE metadata.

## Ask

Does this evidence packet belong in `docs/compliance/` on an Omarchy stable image, with the public defaults unchanged? Pull requests for the overlay, the opt-in profile, and the restricted package tree should wait on that answer.