Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Package mirror not edge-cached (cf-cache-status: DYNAMIC) — slow updates in Asia despite Cloudflare edge nearby
Reported by moskovich · filed Jul 21, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
Summary
stable-mirror.omarchy.org sits behind Cloudflare, but every response comes back cf-cache-status: DYNAMIC — the edge never caches, so each package proxies back to origin. From Taipei this means low latency (<300ms TTFB, I'm hitting the local TPE edge) but poor sustained throughput (~140 KB/s), because the bottleneck is the origin link rather than the nearby edge. A full update pulling a few hundred MB takes 30–40+ minutes.
Measurements (from Taipei, Taiwan)
| File | Size | Total time | Throughput | TTFB | cf-cache-status |
|---|---|---|---|---|---|
extra/os/x86_64/extra.db | 8.7 MB | 61 s | ~142 KB/s | 0.30 s | DYNAMIC |
core/os/x86_64/core.db | ~127 KB | 0.6–2.7 s | 48–200 KB/s (erratic) | 0.02–0.27 s | DYNAMIC |
Edge: cf-ray: ...-TPE, edge IP 104.18.2.204. TTFB is consistently good, so distance/edge isn't the issue — throughput to origin is.
Root cause
Responses carry no `Cache-Control` header (only Last-Modified):
content-length: 8724890
last-modified: Mon, 20 Jul 2026 23:23:00 GMT
cf-cache-status: DYNAMICWith no Cache-Control, Cloudflare doesn't cache these by default → DYNAMIC on every request.
Suggested fix
Package repo files are effectively immutable (versioned filenames), so they're ideal to cache at the edge:
- Set a Cloudflare Cache Rule (or origin
Cache-Control: public, max-age=...) to cache*.pkg.tar.zst(and the*.dbwith a shorter TTL / revalidation). - Optionally set
Edge Cache TTLand enable "cache everything" for the repo path.
Once files serve from the edge, Asia (and any region far from origin) would get near-line-rate downloads instead of origin-throttled ~140 KB/s.
Happy to re-run measurements after a change to confirm.
View raw text
## Summary `stable-mirror.omarchy.org` sits behind Cloudflare, but every response comes back `cf-cache-status: DYNAMIC` — the edge never caches, so each package proxies back to origin. From Taipei this means low latency (<300ms TTFB, I'm hitting the local TPE edge) but poor sustained throughput (~140 KB/s), because the bottleneck is the origin link rather than the nearby edge. A full update pulling a few hundred MB takes 30–40+ minutes. ## Measurements (from Taipei, Taiwan) | File | Size | Total time | Throughput | TTFB | cf-cache-status | |------|------|-----------|-----------|------|-----------------| | `extra/os/x86_64/extra.db` | 8.7 MB | **61 s** | ~142 KB/s | 0.30 s | DYNAMIC | | `core/os/x86_64/core.db` | ~127 KB | 0.6–2.7 s | 48–200 KB/s (erratic) | 0.02–0.27 s | DYNAMIC | Edge: `cf-ray: ...-TPE`, edge IP `104.18.2.204`. TTFB is consistently good, so distance/edge isn't the issue — throughput to origin is. ## Root cause Responses carry **no `Cache-Control` header** (only `Last-Modified`): ``` content-length: 8724890 last-modified: Mon, 20 Jul 2026 23:23:00 GMT cf-cache-status: DYNAMIC ``` With no `Cache-Control`, Cloudflare doesn't cache these by default → `DYNAMIC` on every request. ## Suggested fix Package repo files are effectively immutable (versioned filenames), so they're ideal to cache at the edge: - Set a Cloudflare Cache Rule (or origin `Cache-Control: public, max-age=...`) to cache `*.pkg.tar.zst` (and the `*.db` with a shorter TTL / revalidation). - Optionally set `Edge Cache TTL` and enable "cache everything" for the repo path. Once files serve from the edge, Asia (and any region far from origin) would get near-line-rate downloads instead of origin-throttled ~140 KB/s. Happy to re-run measurements after a change to confirm.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 03:57 UTC