Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-4588GitHub issuePublicReceived

Any mise-wrapped tool hits broken aqua attestations: gh wrapper fails on Quattro (affects omarchy-mise-install defaults)

Reported by alvarosaavedra · filed Aug 14, 2026Closed upstream on 2026-08-15 by dhh, as not planned.

Open at source
Received and recorded verbatim. Nothing has been checked yet.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
Not yet mapped to any requirement or component.
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.

Original report

Any mise-wrapped tool hits broken aqua attestations: gh wrapper fails on Quattro (affects omarchy-mise-install defaults)revision 1 · captured 2026-10-04 12:03 UTC via poll

Sibling to #6886 (same root cause class: bare mise tool names resolving to broken backends in omarchy-mise-install wrappers).

What happened

On Quattro, the mise-backed gh wrapper generated by Omarchy (~/.local/bin/gh) fails with an aqua attestation error:

mise [email protected]                 install
mise [email protected]                 download gh_2.97.0_linux_amd64.tar.gz
mise [email protected]                 verify GitHub attestations
mise ERROR Failed to install aqua:cli/cli@latest:
   0: GitHub attestations verification failed for aqua:cli/[email protected]: HTTP error: error decoding response body

The wrapper runs:

mise use -g "gh" || exit 1
exec mise x "gh" -- "gh" "$@"

The bare gh name resolves through mise's registry to aqua:cli/cli, whose GitHub attestation verification keeps failing with an HTTP decode error, so gh is unusable through Omarchy-managed tooling.

Fix (confirmed working)

Same pattern as #6886 — pin the GitHub backend:

omarchy-mise-install github:cli/cli gh
mise use -g github:cli/cli   # installs 2.97.0 cleanly, no aqua involved

\u2192 change omarchy-mise-install gh to omarchy-mise-install github:cli/cli gh in install/user/mise.sh.

Broader note

Both #6886 (opencode → aqua:sst/opencode) and this one (gh → aqua:cli/cli attestation failure) suggest the bare-name-to-aqua resolution path in install/user/mise.sh is fragile. It may be worth pinning every entry there to an explicit github:owner/repo or npm: backend so registry drift and aqua attestation flakiness can't break agent/dev-tool setup.

System details

  • Omarchy version: 4.0.0-1
  • Kernel: 6.17.7-arch1-Watanare-T2-1-t2 x86_64
  • CPU: Intel Core i9-9880H
  • Hyprland: 0.56.2-1
  • mise: 2025.10.19 linux-x64
View raw text
Sibling to #6886 (same root cause class: bare mise tool names resolving to broken backends in `omarchy-mise-install` wrappers).

## What happened

On Quattro, the mise-backed `gh` wrapper generated by Omarchy (`~/.local/bin/gh`) fails with an aqua attestation error:

```
mise [email protected]                 install
mise [email protected]                 download gh_2.97.0_linux_amd64.tar.gz
mise [email protected]                 verify GitHub attestations
mise ERROR Failed to install aqua:cli/cli@latest:
   0: GitHub attestations verification failed for aqua:cli/[email protected]: HTTP error: error decoding response body
```

The wrapper runs:

```bash
mise use -g "gh" || exit 1
exec mise x "gh" -- "gh" "$@"
```

The bare `gh` name resolves through mise's registry to `aqua:cli/cli`, whose GitHub attestation verification keeps failing with an HTTP decode error, so `gh` is unusable through Omarchy-managed tooling.

## Fix (confirmed working)

Same pattern as #6886 — pin the GitHub backend:

```bash
omarchy-mise-install github:cli/cli gh
mise use -g github:cli/cli   # installs 2.97.0 cleanly, no aqua involved
```

\u2192 change `omarchy-mise-install gh` to `omarchy-mise-install github:cli/cli gh` in `install/user/mise.sh`.

## Broader note

Both #6886 (opencode → `aqua:sst/opencode`) and this one (gh → `aqua:cli/cli` attestation failure) suggest the bare-name-to-aqua resolution path in `install/user/mise.sh` is fragile. It may be worth pinning every entry there to an explicit `github:owner/repo` or `npm:` backend so registry drift and aqua attestation flakiness can't break agent/dev-tool setup.

## System details

- Omarchy version: 4.0.0-1
- Kernel: 6.17.7-arch1-Watanare-T2-1-t2 x86_64
- CPU: Intel Core i9-9880H
- Hyprland: 0.56.2-1
- mise: 2025.10.19 linux-x64

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

No decision has been recorded yet.