Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-708GitHub issuePublicDecided· Out of scope

Network panel ping/status is IPv4-only; IPv6-only and 464XLAT Wi-Fi look down

Reported by anomalousmouse · filed Sep 10, 2026 · open at source

Decided: Out of scope — decided by agents · verified 3 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

Network panel ping/status is IPv4-only; IPv6-only and 464XLAT Wi-Fi look downrevision 1 · captured 2026-09-28 21:23 UTC via poll

System details

Intel Core i7-1060NG7, Intel Iris Plus G7 (Ice Lake), Omarchy 4.0.3-1
Kernel 7.2.4 (T2 / brcmfmac BCM4377b), NetworkManager 1.58.1, systemd-resolved

What's wrong?

On IPv6-only Wi-Fi (SLAAC + PREF64 in RAs, no DHCPv4 lease), association succeeds and IPv6 internet works, but the network panel shows Ping timeout and Packet loss 100%. The bar icon can still flip to connected once CLAT installs a dummy IPv4 default route (192.0.0.0/29).

This is related to #9261 / #9068 / #10950 (hardcoded ICMP to 1.1.1.1) but it is a different failure mode: here IPv4 itself does not work. A TCP connect to 1.1.1.1:443 also times out. Native IPv6 (ping 2606:4700:4700::1111, curl -6) is fine. The panel needs an IPv6 probe, not only a different IPv4 target.

What the packaged tools do

omarchy-network-status and omarchy-network-speedtest both key off IPv4 1.1.1.1:

internet_probe=1.1.1.1
device=$(ip route get "$internet_probe" ...)

--verbose then:

  • uses ip -j route get 1.1.1.1 and jq '.[0].gateway'
  • prints only inet addresses (select(.family == "inet"))
  • pings that gateway and 1.1.1.1 with IPv4 ping

On a CLAT/IPv6-only link the IPv4 default is via inet6 fe80::…, so .gateway is empty (the next hop is .via.host). Router ping is skipped. Internet ping to 1.1.1.1 fails. The IP row shows the CLAT dummy 192.0.0.5 instead of the working global IPv6 address.

Without CLAT, ip route get 1.1.1.1 fails outright and status is disconnected even though Wi-Fi is associated and IPv6 is routed.

Packaged --verbose on this link

iface    wlan0
ip       192.0.0.5
prefix   32
gateway
type     wifi
internet_ping_ms

Empty internet_ping_ms → panel Timeout / 100% loss (Model.js counts null samples as loss).

IPv6 ping of Cloudflare (2606:4700:4700::1111) is ~7 ms, 0% loss. The IPv6 default gateway answers on the link-local (ping fe80::…%wlan0).

Steps to reproduce

  1. Join a WPA2 AP that offers IPv6 SLAAC and PREF64, and does not hand out DHCPv4 (or only 464XLAT).
  2. Wait until NetworkManager reports connected (can take ~45s while DHCPv6 times out after SLAAC is already up).
  3. Confirm IPv6 works: ping -c1 2606:4700:4700::1111
  4. Confirm IPv4 literals fail: ping -c1 1.1.1.1 / curl -4 --connect-timeout 5 https://1.1.1.1
  5. Open the network panel.

Expected

  • Treat a default IPv6 route as online, not only ip route get 1.1.1.1.
  • Probe an IPv6 target when IPv4 is missing or is CLAT (192.0.0.0/29 and/or via.family == inet6).
  • Show the global IPv6 address and ping fe80::…%iface when that is the gateway.
  • Do not paint Ping/Loss red solely because IPv4 ICMP to 1.1.1.1 failed.

Actual

Panel looks like a dead link. Speed test (omarchy-network-speedtest) uses the same 1.1.1.1 route lookup.

Addresses/prefixes in this report are documentation (2001:db8::/32) or well-known anycast; the real SLAAC/PREF64 prefixes are omitted.

View raw text
### System details

Intel Core i7-1060NG7, Intel Iris Plus G7 (Ice Lake), Omarchy 4.0.3-1
Kernel 7.2.4 (T2 / brcmfmac BCM4377b), NetworkManager 1.58.1, systemd-resolved

### What's wrong?

On IPv6-only Wi-Fi (SLAAC + PREF64 in RAs, no DHCPv4 lease), association succeeds and IPv6 internet works, but the network panel shows **Ping timeout** and **Packet loss 100%**. The bar icon can still flip to connected once CLAT installs a dummy IPv4 default route (`192.0.0.0/29`).

This is related to #9261 / #9068 / #10950 (hardcoded ICMP to `1.1.1.1`) but it is a different failure mode: here **IPv4 itself does not work**. A TCP connect to `1.1.1.1:443` also times out. Native IPv6 (`ping 2606:4700:4700::1111`, `curl -6`) is fine. The panel needs an IPv6 probe, not only a different IPv4 target.

## What the packaged tools do

`omarchy-network-status` and `omarchy-network-speedtest` both key off IPv4 `1.1.1.1`:

```bash
internet_probe=1.1.1.1
device=$(ip route get "$internet_probe" ...)
```

`--verbose` then:

- uses `ip -j route get 1.1.1.1` and `jq '.[0].gateway'`
- prints only `inet` addresses (`select(.family == "inet")`)
- pings that gateway and `1.1.1.1` with IPv4 `ping`

On a CLAT/IPv6-only link the IPv4 default is `via inet6 fe80::…`, so `.gateway` is empty (the next hop is `.via.host`). Router ping is skipped. Internet ping to `1.1.1.1` fails. The IP row shows the CLAT dummy `192.0.0.5` instead of the working global IPv6 address.

Without CLAT, `ip route get 1.1.1.1` fails outright and status is `disconnected` even though Wi-Fi is associated and IPv6 is routed.

## Packaged `--verbose` on this link

```
iface    wlan0
ip       192.0.0.5
prefix   32
gateway
type     wifi
internet_ping_ms
```

Empty `internet_ping_ms` → panel Timeout / 100% loss (`Model.js` counts null samples as loss).

IPv6 ping of Cloudflare (`2606:4700:4700::1111`) is ~7 ms, 0% loss. The IPv6 default gateway answers on the link-local (`ping fe80::…%wlan0`).

## Steps to reproduce

1. Join a WPA2 AP that offers IPv6 SLAAC and PREF64, and does not hand out DHCPv4 (or only 464XLAT).
2. Wait until NetworkManager reports `connected` (can take ~45s while DHCPv6 times out after SLAAC is already up).
3. Confirm IPv6 works: `ping -c1 2606:4700:4700::1111`
4. Confirm IPv4 literals fail: `ping -c1 1.1.1.1` / `curl -4 --connect-timeout 5 https://1.1.1.1`
5. Open the network panel.

## Expected

- Treat a default IPv6 route as online, not only `ip route get 1.1.1.1`.
- Probe an IPv6 target when IPv4 is missing or is CLAT (`192.0.0.0/29` and/or `via.family == inet6`).
- Show the global IPv6 address and ping `fe80::…%iface` when that is the gateway.
- Do not paint Ping/Loss red solely because IPv4 ICMP to `1.1.1.1` failed.

## Actual

Panel looks like a dead link. Speed test (`omarchy-network-speedtest`) uses the same `1.1.1.1` route lookup.

Addresses/prefixes in this report are documentation (`2001:db8::/32`) or well-known anycast; the real SLAAC/PREF64 prefixes are omitted.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 11:33 UTC