Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Behavioral change review

Make the keybindings menu's Lua bind scan safe against load-time config reads

by tobi3 changed files2 requirements by whole-file tracemerge:54bed976 (merge of head 7b49d0bb)
Policy approver needed

Should the 1 protection reduction this change makes be accepted under the prior approved policy?

Requiredness unknown for 219 checks: the change edits the policy itself, so the approved policy can't be applied as-is.

Review decision
Review by exceptionSupported detail stays available, not in your way.
Legacy full view
Quick reviewFull detail

What am I accepting?

Declared by the change request: Make the keybindings menu's Lua bind scan safe against load-time config reads

This change changes a protection (policy changed unclassified)

The change modifies policy in a way the engine cannot prove is not a weakening (8 changes); a policy approver must judge it under the prior policy.

The change tightens policy (3 settings); readiness is still evaluated against the approved (base) policy.

  • proof.yaml:project.checks.code_mcdc.targets ∅ → {"enabled":true,"id":"lock-js-fingerprintmodel","js_glob":"FingerprintModel.js","language":"js","min_condition_percent":100,"min_decision_percent":100,"runner":"node","scope":"shell/plugins/lock","test_command":"lock-node"}, {"enabled":true,"id":"menu-js-emojisearch","js_glob":"EmojiSearch.js","lang… · tightened, rule required_item_added
  • proof.yaml:project.checks.proof_complexity_clean.max_variables 130 → 140 · changed, rule unclassified
  • proof.yaml:project.checks.test_results.commands ∅ → lock-node, menu-live, plugins-shell · changed, rule list_item_added
  • proof.yaml:project.commands.tests.lock-node ∅ → {"command":"set -e; . test/junit/junit.sh; junit_begin lock-node; node --test --test-reporter=spec --test-reporter-destination=stdout --test-reporter=junit --test-reporter-destination=\"$JUNIT_PART\" test/node/fingerprintmodel-replay.test.mjs || junit_fail $?; junit_end","language":"js"} · changed, rule setting_added_or_removed
  • proof.yaml:project.commands.tests.lock-shell.command set -e; B=/usr/bin/bash; . test/junit/junit.sh; junit_begin lock-shell; for t in apply-lock system-lock sleep-lock hyprland-session-locked lock-blank-fingerprint lock-fingerprint-indicator lock-password-overflow lock-stranded-recovery lock-missing-pam; do junit_run "$B" "test/shell.d/$t-test.sh"; do… → set -e; B=/usr/bin/bash; . test/junit/junit.sh; junit_begin lock-shell; for t in apply-lock system-lock sleep-lock hyprland-session-locked lock-blank-fingerprint lock-fingerprint-indicator lock-fingerprint-retry lock-fingerprint-service lock-autorepeat lock-password-overflow lock-stranded-recovery l… · changed, rule unclassified
  • proof.yaml:project.commands.tests.menu-live ∅ → {"command":"/usr/bin/env bash test/junit/live-session.sh menu-live test/shell.d/menu-compositor-test.sh test/shell.d/menu-acceptance-test.sh","language":"bash"} · changed, rule setting_added_or_removed
  • proof.yaml:project.commands.tests.menu-node.command set -e; . test/junit/junit.sh; junit_begin menu-node; node --test --test-reporter=spec --test-reporter-destination=stdout --test-reporter=junit --test-reporter-destination="$JUNIT_PART" test/node/menumodel-replay.test.mjs || junit_fail $?; junit_end → set -e; . test/junit/junit.sh; junit_begin menu-node; node --test --test-reporter=spec --test-reporter-destination=stdout --test-reporter=junit --test-reporter-destination="$JUNIT_PART" test/node/menumodel-replay.test.mjs test/node/emojisearch-replay.test.mjs || junit_fail $?; junit_end · changed, rule unclassified
  • proof.yaml:project.commands.tests.menu-shell.command set -e; B=/usr/bin/bash; . test/junit/junit.sh; junit_begin menu-shell; for t in menu menu-pointer-lifecycle tray-menu menu-plugin menu-dispatcher menu-dmenu menu-timezone menu-share menu-guards; do junit_run "$B" "test/shell.d/$t-test.sh"; done; if command -v flock >/dev/null 2>&1 && [ -d /proc ];… → set -e; B=/usr/bin/bash; . test/junit/junit.sh; junit_begin menu-shell; for t in menu menu-pointer-lifecycle tray-menu menu-plugin menu-dispatcher menu-dmenu menu-timezone menu-share menu-guards; do junit_run "$B" "test/shell.d/$t-test.sh"; done; if command -v flock >/dev/null 2>&1 && [ -d /proc ];… · changed, rule unclassified
  • proof.yaml:project.commands.tests.plugins-shell ∅ → {"command":"set -e; B=/usr/bin/bash; . test/junit/junit.sh; junit_begin plugins-shell; junit_run \"$B\" test/shell.d/emojis-test.sh; junit_end","language":"bash"} · changed, rule setting_added_or_removed
  • proof.yaml:project.verification_scope.completeness.production_include ∅ → bin/omarchy-theme-remov*, shell/plugins/emojis/EmojiSearch.js, shell/services/AppSearch.js · tightened, rule required_item_added
  • proof.yaml:project.verification_scope.include ∅ → bin/omarchy-theme-remov*, default/systemd/system-sleep/fprintd-resume, default/systemd/system/fprintd.service.d/10-stop-timeout.conf, shell/plugins/emojis/EmojiSearch.js, shell/services/AppSearch.js, test/bdiff/*, test/bdiff/**, test/junit/*, test/junit/live-session.sh, test/qml/lock/** (+10 more) · tightened, rule required_item_added
Prior-policy decision
ChangeMake the keybindings menu's Lua bind scan safe against load-time config reads#12052, #12124, #7025
No requirement text edited2 affected requirements are not intended to change — each must keep holding
2 requirements reached only through a trace to a whole changed file · all re-confirmed (trace review re-stamped, no text change)
  • Binds Hyprland reports as dispatcher __lua are shown with resolved keys from the source-derived cache and remain dispatchable.re-confirmedSW-REQ-260922-0W96
  • A code:N binding shows the keysym resolved from the compiled keymap, or the built-in fallback table when xkbcli cannot resolve it; GRAVE displays as ~.re-confirmedSW-REQ-260922-9DMS
Pull request description · as submitted at evaluation (Oct 5, 2026, 18:54 UTC)

Problem

omarchy-menu-keybindings learns about Lua-only binds by dofile-ing the user's hyprland.lua under a stub hl whose every lookup returns a truthy noop table. Real configs read compositor state at load time, and the stub cannot survive that:

  1. Runaway `lua` at 100 % CPU. for _, m in ipairs(hl.get_monitors()) never terminates, because noop[1], noop[2], … are all non-nil. The menu exits, but the lua child keeps spinning under systemd --user until reboot. Found one on my laptop that had run for 27 hours after a single SUPER+K (PIDs omarchy-menu-keybindings → lua, 60 % of a core, dofile(hyprland.lua) never returned).
   local noop = setmetatable({}, { __index = function() return noop end, __call = function() return noop end })
   for _, m in ipairs(noop) do end   -- never returns
  1. Silently dropped binds. On current quattro, default/hypr/qconsole.lua:64 does monitor.scale <= 0, which under the stub raises attempt to compare table with number. The scan is pcall'd, so it just stops there — every Lua bind declared after that require is missing from the menu (DEBUG=1 shows lua bind scan failed: …qconsole.lua:64).

Fix

  • noop.__index answers nil for numeric keys (so ipairs/numeric loops end), __len is 0, and __lt/__le, arithmetic, __concat, __tostring degrade to harmless values instead of raising. String-key lookups behave as before.
  • The scan is wrapped in timeout 10 so a config the stub still cannot satisfy can never outlive the menu.

Test

test/shell.d/menu-keybindings-lua-scan-test.sh extracts the embedded scan and runs it against a fixture hyprland.lua that iterates monitors, compares monitor.scale, does arithmetic/concatenation on stub fields, and then declares two binds. Without the fix it hangs for the full 10 s timeout and fails; with it the scan returns in milliseconds and both binds are reported. Also verified on my own config: the scan now completes with no scan failed and lists the Lua binds that were previously lost after qconsole.lua.

Fixes #7025

Fixes #12052

Fixes #12124

Behaviour changes13 unapproved compatibility changes

13 changes between base and head need a reviewer's approval (or a fix) · not checked: observed behaviour differs (not checked, required) — a behaviour change there can go unnoticed.

13 behaviour changes — none classified yet

Every finding, with base → head and the evidence · 13 findings from 4 sources

Existing test changed

checked0 findings

An existing test's expectation changed, or an existing test was removed, skipped or weakened. Run: the change modifies or deletes no existing test file.

MC/DC evidence changed

checked0 findings

The base run's and the head run's MC/DC evidence differ for a decision present in both. Run: 92 decision(s) at the base, 92 at the head.

Removed behaviour

checked13 findings

A removed or replaced expression had behaviour no test preserves.

  • unapprovedbin/omarchy-agent-usage-codex:fetch_codex_rpc
    cf-01e0e8ffcb6df230

    Removed behaviour: a child process inherits the environment and cwd; shell-based exec applies quoting / globbing; output is buffered (size limits); concurrent spawns contend and can fail under a burst

    Base
    stderr=subprocess.DEVNULL,
    Head
    no test preserves it
    Evidence
    proof change behavior-diff --base 9f3abc104cc367a0a98151e8ea4698a7381e9b8b --head 54bed97693f5ce09b9e4639b7649af281dbdaad5
  • unapprovedbin/omarchy-agent-usage-codex:scan_pi_sessions
    cf-08ed84e4dc5f0058

    Removed behaviour: regex \s: which whitespace it matches (ASCII-only or Unicode incl. BOM / NBSP / U+2028) depends on the engine and flags

    Base
    [rg, "--json", "-e", r'"provider"\s*:\s*"openai-codex"', "-e", r'"api"\s*:\s*"openai-codex', str(root)],
    Head
    no test preserves it
    Evidence
    proof change behavior-diff --base 9f3abc104cc367a0a98151e8ea4698a7381e9b8b --head 54bed97693f5ce09b9e4639b7649af281dbdaad5
  • unapprovedtest/shell.d/image-picker-test.sh
    cf-259caa478e99554f

    Removed behaviour: regex \s: which whitespace it matches (ASCII-only or Unicode incl. BOM / NBSP / U+2028) depends on the engine and flags

    Base
    /source: item\.sourceActivated && item\.thumbnailPath \? Util\.fileUrl\(item\.thumbnailPath\) : ""[\s\S]*asynchronous: false/.test(imagePickerQml),
    Head
    no test preserves it
    Evidence
    proof change behavior-diff --base 9f3abc104cc367a0a98151e8ea4698a7381e9b8b --head 54bed97693f5ce09b9e4639b7649af281dbdaad5
  • unapprovedbin/omarchy-agent-usage-claude:usable_cached_limits
    cf-2a96da5d4878d9e3

    Removed behaviour: reading a file returns its bytes as stored: a BOM, CRLF line endings and invalid UTF-8 are preserved

    Base
    return [entry for entry in entries if isinstance(entry, dict) and limit_window_open(entry, now)]
    Head
    no test preserves it
    Evidence
    proof change behavior-diff --base 9f3abc104cc367a0a98151e8ea4698a7381e9b8b --head 54bed97693f5ce09b9e4639b7649af281dbdaad5
  • unapprovedpocs/crs-260930-g166-c07-c09.sh
    cf-352c959f73e10258

    Removed behaviour: regex anchors ^ / $: input boundaries vs line boundaries depends on the multiline flag

    Base
    COND="$(sed -n '48p' "$REPO/bin/omarchy-apply-lock" | sed "s#/usr/bin/fprintd-list#$TMP/fprintd-list#; s/; *then\$//")"
    Head
    no test preserves it
    Evidence
    proof change behavior-diff --base 9f3abc104cc367a0a98151e8ea4698a7381e9b8b --head 54bed97693f5ce09b9e4639b7649af281dbdaad5
  • unapprovedtest/shell.d/update-mise-grok-test.sh
    cf-3793d6d7ef12af8a

    Removed behaviour: regex anchors ^ / $: input boundaries vs line boundaries depends on the multiline flag

    Base
    sed -i 's/^  x) .*/  x) exit 1 ;;/' "$test_tmp/bin/mise"
    Head
    no test preserves it
    Evidence
    proof change behavior-diff --base 9f3abc104cc367a0a98151e8ea4698a7381e9b8b --head 54bed97693f5ce09b9e4639b7649af281dbdaad5
  • unapprovedtest/qml/lock/shell.qml
    cf-53dcbde4a5395f69

    Removed behaviour: a child process inherits the environment and cwd; shell-based exec applies quoting / globbing; output is buffered (size limits); concurrent spawns contend and can fail under a burst

    Base
    function exec(argv) {
    Head
    no test preserves it
    Evidence
    proof change behavior-diff --base 9f3abc104cc367a0a98151e8ea4698a7381e9b8b --head 54bed97693f5ce09b9e4639b7649af281dbdaad5
  • unapprovedbin/omarchy-agent-usage-codex:scan_native_codex_sessions
    cf-6c10978933fc8a74

    Removed behaviour: reading a file returns its bytes as stored: a BOM, CRLF line endings and invalid UTF-8 are preserved

    Base
    with path.open(errors="replace") as handle:
    Head
    no test preserves it
    Evidence
    proof change behavior-diff --base 9f3abc104cc367a0a98151e8ea4698a7381e9b8b --head 54bed97693f5ce09b9e4639b7649af281dbdaad5
  • unapprovedpocs/crs-260930-g166-c07-c09.sh
    cf-9802630089492c78

    Removed behaviour: regex anchors ^ / $: input boundaries vs line boundaries depends on the multiline flag

    Base
    LINE62="$(sed -n '62p' "$REPO/bin/omarchy-apply-lock" | sed 's/^if //; s/; *then$//')"
    Head
    no test preserves it
    Evidence
    proof change behavior-diff --base 9f3abc104cc367a0a98151e8ea4698a7381e9b8b --head 54bed97693f5ce09b9e4639b7649af281dbdaad5
  • unapprovedbin/omarchy-agent-usage-claude:scan_projects
    cf-a1ad6798a3fab1e9

    Removed behaviour: reading a file returns its bytes as stored: a BOM, CRLF line endings and invalid UTF-8 are preserved

    Base
    with path.open("r", encoding="utf-8", errors="replace") as handle:
    Head
    no test preserves it
    Evidence
    proof change behavior-diff --base 9f3abc104cc367a0a98151e8ea4698a7381e9b8b --head 54bed97693f5ce09b9e4639b7649af281dbdaad5
  • unapprovedtest/qml/lock/shell.qml
    cf-cf43f59ecd3406ba

    Removed behaviour: a child process inherits the environment and cwd; shell-based exec applies quoting / globbing; output is buffered (size limits); concurrent spawns contend and can fail under a burst

    Base
    exec([Quickshell.env("MCDC_WTYPE")].concat(args))
    Head
    no test preserves it
    Evidence
    proof change behavior-diff --base 9f3abc104cc367a0a98151e8ea4698a7381e9b8b --head 54bed97693f5ce09b9e4639b7649af281dbdaad5
  • unapprovedbin/omarchy-agent-usage-claude:registered_accounts
    cf-d43ad3b553110b94

    Removed behaviour: reading a file returns its bytes as stored: a BOM, CRLF line endings and invalid UTF-8 are preserved

    Base
    if isinstance(entry, dict) and not limit_window_open(entry, now)
    Head
    no test preserves it
    Evidence
    proof change behavior-diff --base 9f3abc104cc367a0a98151e8ea4698a7381e9b8b --head 54bed97693f5ce09b9e4639b7649af281dbdaad5
  • unapprovedpocs/crs-260930-ttvk-qml-static.sh
    cf-e591be08f233cdb2

    Removed behaviour: regex anchors ^ / $: input boundaries vs line boundaries depends on the multiline flag

    Base
    sed -n '/function startFingerprint/,/^  }/p' "$F" > "$T"
    Head
    no test preserves it
    Evidence
    proof change behavior-diff --base 9f3abc104cc367a0a98151e8ea4698a7381e9b8b --head 54bed97693f5ce09b9e4639b7649af281dbdaad5

Observed behaviour differs

not checked · required0 findings

Base and head produced different output on the same recorded input. Why: no behaviour-diff result recorded for 9f3abc104cc3..54bed97693f5; run `proof change behavior-diff --base 9f3abc104cc3 --head 54bed97693f5`.

2 requirements are in reach (2 whose traced file changed); none is intended to change — each must keep holding.

What could it affect?

2 unique requirements in 1 area. 1 changed file is unmapped; the boundary is open. 1 changed file is outside the verification scope (e.g. reproducers) — listed for transparency.

2 requirementsGrouped into 1 area
Behavioural areaWhy affected RequirementsEvidence gaps
1 changed file is outside the mapped boundary. 2 is the identified scope, not a guaranteed maximum. Inspect gaps
1 changed file is outside the verification scope (e.g. reproducers) — listed for transparency.
1 area contains 2 requirements; areas are disjoint groups, not samples.View this scope’s evidence
Scope and interface boundaries · no interface contract crossed · 1 open spec-gap candidate

Engine scope reading: One focused change All 2 touched requirement(s) are related in the intent graph (satisfies/parent, sibling or shared component).

1 spec cluster (engine grouping, not areas)

Interface contracts crossed

None recorded.

Spec-gap candidates (to judge, not verdicts)
  • New code with no requirement — 1 open of 1

Each candidate is listed under What remains unresolved.

Why should I believe it works?

3 obligation checks across 2 requirements — every one is passing or accounted for; none is open. The breakdown below says how each is settled.

  • 3 obligation checks
  • 1 covered by more specific requirements
  • 1 covered by an open known issue (accepted as debt, not fixed)
  • 1 recorded as not applying to the requirement
  • 2 requirements
  • 2 settled through more specific requirements, an open known issue accepted as debt, or a recorded not-applicable decision
Test report: 69 passed · 0 failed · 0 skipped · 0/0 tagged tests joinedmerge:54bed976
Configure/emit test results — no outcome can be joined

No test of the requirements in scope is tagged with an obligation class (<requirement>:<class>:<evidence>), so none of the 2 obligation cells in scope has an observed outcome.

Required work

No requirement needs attention on this evaluation.

✓ Supported× Mismatch≠ Conflicting◷ Stale○ Not observed / no linked test↳ Child spec◇ Accepted debt– Doesn't apply— Not specifiedObserved per obligation class
Evidence limits · 13 skipped checks · code reach is not behavioural evidence
Skipped checks — did not run, so they prove nothing either way
  • build_matrix_complete no build_targets declared
  • description_grammar_enumeration_complete Turned off in the project's check policy
  • documentation_coverage Turned off in the project's check policy
  • documented_claim_verified no documented_behaviors declared
  • dual_path_guards_equivalent no dual-path rules declared
  • known_issue_closure_platform_bound no known issue declares platforms
  • lemma_binding_freshness no separate-file lemma bindings recorded yet
  • no_authored_change_surface_reviewed Turned off in the project's check policy
  • security_surface_covered Turned off in the project's check policy
  • signal_fixtures_valid Turned off in the project's check policy
  • spec_lint_mediation_contract_contradicted Turned off in the project's check policy
  • spec_lint_na_denies_property_enforced_unevenly Turned off in the project's check policy
  • spec_lint_na_denies_property_the_code_manages Turned off in the project's check policy
Not checked
  • Coverage not measured for: bin/omarchy-menu-keybindings
  • Whether 2 relevant tests actually run the changed code
  • 1 changed file traced to no requirement
  • Side effects of the changed functions (what they now call or write) — not reported in this package
  • 13 audit checks skipped or not run
  • Who produced this evidence — the producer isn't signed, so authorship isn't attested (the content itself is checked by its digest)
Approximations and uncertainty the engine declared
  • Function level mapping comes from trace targets `path:symbol` / line ranges (authored + derived) and function local annotations; a whole file trace is file level (weak) and says nothing about which function a requirement needs.
  • Intent relations: requirement level = satisfies/parent or siblings under a parent with <= 20 children; component level = shared component (incl. traces.components); contract level = an interface requirement naming both components. A missing spec edge can make a real dependency look uncodified, and a broad contract can make an uncodified dependency look related — every candidate is a question for a reviewer, not a verdict on the code or the spec.
  • Removed code traces: targets naming a removed/renamed/moved function or a deleted file, and requirement ids cited on removed diff lines that the evaluated file no longer cites. remainingTraces counts the requirement's other code targets at the evaluated revision without re checking that each still resolves.
  • Renamed/moved detection is best effort: a removed and an added function with the same name in different files are "moved"; a different name with >= 80% identical normalized body lines (>= 3 lines) is "renamed"; anything else is removed + added.
  • Scope clusters are seeded only by directly touched requirements (spec changes and code changed); behavior affected requirements are what the change reaches and are judged by the uncodified connection rule instead.
  • Uncodified connections need call level impact (review.effects — C/C++ only today): this package has none, so NO uncodified connection could be detected. Absence of such candidates proves nothing here.
  • Units are function granular only where a parser extracts function boundaries (tree sitter languages, plus C/C++ function like macros); other changed files are one file granular unit, and hunks outside any function are attributed to the file only when no function of that file changed.
  • When a changed function is traced only at FILE level, every requirement of its file is a from side seed: a relation through any of them counts as codified, so a coarse trace can MASK an uncodified connection (and inflate scope clusters — see coarse trace).
  • baseline mismatch
  • effects unavailable
  • unmapped code

219 checks with unknown requiredness — the engine could not establish from an approved policy whether they are required.

Code reach

0 of 0 changed decision lines reached by tests Code reach says which changed lines ran under some test; it does not say the behaviour was checked.

Not measured: bin/omarchy-menu-keybindings

Removed behaviour · 13 behaviours of replaced expressions · 13 unverified
Replaced expressionBehaviour it hadAccounted for by
bin/omarchy-agent-usage-claude:registered_accounts
if isinstance(entry, dict) and not limit_window_open(entry, now)		reading a file returns its bytes as stored: a BOM, CRLF line endings and invalid UTF-8 are preservedunverified
bin/omarchy-agent-usage-claude:scan_projects
with path.open("r", encoding="utf-8", errors="replace") as handle:		reading a file returns its bytes as stored: a BOM, CRLF line endings and invalid UTF-8 are preservedunverified
bin/omarchy-agent-usage-claude:usable_cached_limits
return [entry for entry in entries if isinstance(entry, dict) and limit_window_open(entry, now)]		reading a file returns its bytes as stored: a BOM, CRLF line endings and invalid UTF-8 are preservedunverified
bin/omarchy-agent-usage-codex:fetch_codex_rpc
stderr=subprocess.DEVNULL,		a child process inherits the environment and cwd; shell-based exec applies quoting / globbing; output is buffered (size limits); concurrent spawns contend and can fail under a burstunverified
bin/omarchy-agent-usage-codex:scan_native_codex_sessions
with path.open(errors="replace") as handle:		reading a file returns its bytes as stored: a BOM, CRLF line endings and invalid UTF-8 are preservedunverified
bin/omarchy-agent-usage-codex:scan_pi_sessions
[rg, "--json", "-e", r'"provider"\s*:\s*"openai-codex"', "-e", r'"api"\s*:\s*"openai-codex', str(root)],		regex \s: which whitespace it matches (ASCII-only or Unicode incl. BOM / NBSP / U+2028) depends on the engine and flagsunverified
pocs/crs-260930-g166-c07-c09.sh
COND="$(sed -n '48p' "$REPO/bin/omarchy-apply-lock" | sed "s#/usr/bin/fprintd-list#$TMP/fprintd-list#; s/; *then\$//")"		regex anchors ^ / $: input boundaries vs line boundaries depends on the multiline flagunverified
pocs/crs-260930-g166-c07-c09.sh
LINE62="$(sed -n '62p' "$REPO/bin/omarchy-apply-lock" | sed 's/^if //; s/; *then$//')"		regex anchors ^ / $: input boundaries vs line boundaries depends on the multiline flagunverified
pocs/crs-260930-ttvk-qml-static.sh
sed -n '/function startFingerprint/,/^ }/p' "$F" > "$T"		regex anchors ^ / $: input boundaries vs line boundaries depends on the multiline flagunverified
test/qml/lock/shell.qml
exec([Quickshell.env("MCDC_WTYPE")].concat(args))		a child process inherits the environment and cwd; shell-based exec applies quoting / globbing; output is buffered (size limits); concurrent spawns contend and can fail under a burstunverified
test/qml/lock/shell.qml
function exec(argv) {		a child process inherits the environment and cwd; shell-based exec applies quoting / globbing; output is buffered (size limits); concurrent spawns contend and can fail under a burstunverified
test/shell.d/image-picker-test.sh
/source: item\.sourceActivated && item\.thumbnailPath \? Util\.fileUrl\(item\.thumbnailPath\) : ""[\s\S]*asynchronous: false/.test(imagePickerQml),		regex \s: which whitespace it matches (ASCII-only or Unicode incl. BOM / NBSP / U+2028) depends on the engine and flagsunverified
test/shell.d/update-mise-grok-test.sh
sed -i 's/^ x) .*/ x) exit 1 ;;/' "$test_tmp/bin/mise"		regex anchors ^ / $: input boundaries vs line boundaries depends on the multiline flagunverified

What remains unresolved?

15 items need work before this change can be ready.

What must change before readiness — the same gaps as the evidence table, by next action.
What needs to happenWhy it mattersWho can actInspect
Unresolved findingApprove the backward-compatibility change, or fix itRemoved behaviour at bin/omarchy-agent-usage-codex:fetch_codex_rpc: Removed behaviour: a child process inherits the environment and cwd; shell-based exec applies quoting / globbing; output is buffered (size limits); concurrent spawns contend and can fail under a burst (base "stderr=subprocess.DEVNULL," → head "no test preserves it"); not approved as a compatibility change.
Prevents a ready verdict · Medium severityIntroduced by this changeReviewerInspect
Unresolved findingApprove the backward-compatibility change, or fix itRemoved behaviour at bin/omarchy-agent-usage-codex:scan_pi_sessions: Removed behaviour: regex \s: which whitespace it matches (ASCII-only or Unicode incl. BOM / NBSP / U+2028) depends on the engine and flags (base "[rg, \"--json\", \"-e\", r'\"provider\"\\s*:\\s*\"openai-codex\"', \"-e"… → head "no test preserves it"); not approved as a compatibility change.
Prevents a ready verdict · Medium severityIntroduced by this changeReviewerInspect
Unresolved findingApprove the backward-compatibility change, or fix itRemoved behaviour at test/shell.d/image-picker-test.sh: Removed behaviour: regex \s: which whitespace it matches (ASCII-only or Unicode incl. BOM / NBSP / U+2028) depends on the engine and flags (base "/source: item\\.sourceActivated && item\\.thumbnailPath \\? Uti"… → head "no test preserves it"); not approved as a compatibility change.
Prevents a ready verdict · Medium severityIntroduced by this changeReviewerInspect
Unresolved findingApprove the backward-compatibility change, or fix itRemoved behaviour at bin/omarchy-agent-usage-claude:usable_cached_limits: Removed behaviour: reading a file returns its bytes as stored: a BOM, CRLF line endings and invalid UTF-8 are preserved (base "return [entry for entry in entries if isinstance(entry, dict"… → head "no test preserves it"); not approved as a compatibility change.
Prevents a ready verdict · Medium severityIntroduced by this changeReviewerInspect
Unresolved findingApprove the backward-compatibility change, or fix itRemoved behaviour at pocs/crs-260930-g166-c07-c09.sh: Removed behaviour: regex anchors ^ / $: input boundaries vs line boundaries depends on the multiline flag (base "COND=\"$(sed -n '48p' \"$REPO/bin/omarchy-apply-lock\" | sed \"s"… → head "no test preserves it"); not approved as a compatibility change.
Prevents a ready verdict · Medium severityIntroduced by this changeReviewerInspect
Unresolved findingApprove the backward-compatibility change, or fix itRemoved behaviour at test/shell.d/update-mise-grok-test.sh: Removed behaviour: regex anchors ^ / $: input boundaries vs line boundaries depends on the multiline flag (base "sed -i 's/^ x) .*/ x) exit 1 ;;/' \"$test_tmp/bin/mise\"" → head "no test preserves it"); not approved as a compatibility change.
Prevents a ready verdict · Medium severityIntroduced by this changeReviewerInspect
Unresolved findingApprove the backward-compatibility change, or fix itRemoved behaviour at test/qml/lock/shell.qml: Removed behaviour: a child process inherits the environment and cwd; shell-based exec applies quoting / globbing; output is buffered (size limits); concurrent spawns contend and can fail under a burst (base "function exec(argv) {" → head "no test preserves it"); not approved as a compatibility change.
Prevents a ready verdict · Medium severityIntroduced by this changeReviewerInspect
Unresolved findingApprove the backward-compatibility change, or fix itRemoved behaviour at bin/omarchy-agent-usage-codex:scan_native_codex_sessions: Removed behaviour: reading a file returns its bytes as stored: a BOM, CRLF line endings and invalid UTF-8 are preserved (base "with path.open(errors=\"replace\") as handle:" → head "no test preserves it"); not approved as a compatibility change.
Prevents a ready verdict · Medium severityIntroduced by this changeReviewerInspect
Unresolved findingApprove the backward-compatibility change, or fix itRemoved behaviour at pocs/crs-260930-g166-c07-c09.sh: Removed behaviour: regex anchors ^ / $: input boundaries vs line boundaries depends on the multiline flag (base "LINE62=\"$(sed -n '62p' \"$REPO/bin/omarchy-apply-lock\" | sed "… → head "no test preserves it"); not approved as a compatibility change.
Prevents a ready verdict · Medium severityIntroduced by this changeReviewerInspect
Unresolved findingApprove the backward-compatibility change, or fix itRemoved behaviour at bin/omarchy-agent-usage-claude:scan_projects: Removed behaviour: reading a file returns its bytes as stored: a BOM, CRLF line endings and invalid UTF-8 are preserved (base "with path.open(\"r\", encoding=\"utf-8\", errors=\"replace\") as h"… → head "no test preserves it"); not approved as a compatibility change.
Prevents a ready verdict · Medium severityIntroduced by this changeReviewerInspect
Unresolved findingApprove the backward-compatibility change, or fix itRemoved behaviour at test/qml/lock/shell.qml: Removed behaviour: a child process inherits the environment and cwd; shell-based exec applies quoting / globbing; output is buffered (size limits); concurrent spawns contend and can fail under a burst (base "exec([Quickshell.env(\"MCDC_WTYPE\")].concat(args))" → head "no test preserves it"); not approved as a compatibility change.
Prevents a ready verdict · Medium severityIntroduced by this changeReviewerInspect
Unresolved findingApprove the backward-compatibility change, or fix itRemoved behaviour at bin/omarchy-agent-usage-claude:registered_accounts: Removed behaviour: reading a file returns its bytes as stored: a BOM, CRLF line endings and invalid UTF-8 are preserved (base "if isinstance(entry, dict) and not limit_window_open(entry, "… → head "no test preserves it"); not approved as a compatibility change.
Prevents a ready verdict · Medium severityIntroduced by this changeReviewerInspect
Unresolved findingApprove the backward-compatibility change, or fix itRemoved behaviour at pocs/crs-260930-ttvk-qml-static.sh: Removed behaviour: regex anchors ^ / $: input boundaries vs line boundaries depends on the multiline flag (base "sed -n '/function startFingerprint/,/^ }/p' \"$F\" > \"$T\"" → head "no test preserves it"); not approved as a compatibility change.
Prevents a ready verdict · Medium severityIntroduced by this changeReviewerInspect
Missing evidenceMap the changed files to requirements, or confirm they carry no behaviour1 changed code file traces to no requirement: that behaviour has no stated intent and no claim to check — test/shell.d/menu-keybindings-lua-scan-test.sh
Prevents a ready verdict · High severityOrigin not comparedChange authorInspect
Missing evidenceConfigure/emit test results — no outcome can be joinedNo test of the requirements in scope is tagged with an obligation class (<requirement>:<class>:<evidence>), so none of the 2 obligation cells in scope has an observed outcome.
Prevents a ready verdict · Medium severityOrigin not comparedChange authorInspect

Who decides?

Should the 1 protection reduction this change makes be accepted under the prior approved policy?

Policy approver needed

proof.yaml @9f3abc10 · Policy approver · merge:54bed976

Next decision: human judgement — a protection is weakened · readiness: not ready yet

Policy & authority

Decisions are recorded by people with authority over the change; this page is read-only.

Required authority, approved policy and evaluated revision
Required authority
Policy approver · approved policy
Accepted identity
GitHub login, portal user
Prior-policy sign-off
Required — judged under the approved (base) policy, which the change cannot alter
Approved policy
proof.yaml @9f3abc104cc367a0a98151e8ea4698a7381e9b8b
Policy digest
sha256:aa07aea6a69338890e00056b4f2fdefc4c99bdc18364509d6fdf0aa458f676df
Policy in this change
Changed unclassified
Enforcement
Portal or forge
Evaluated revision
54bed97693f5ce09b9e4639b7649af281dbdaad5 (merge of head 7b49d0bb into base 9f3abc10)
Proof · review by exceptionEvery fact above comes from the evaluated evidence package.Legacy full view
Policy approver neededBound to merge:54bed976
Decision