Proof Portal
Omarchy
ProbeLabsviewing a historical runA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Binds Hyprland reports as dispatcher __lua are shown with resolved keys from the source-derived cache and remain dispatchable.
Specification
The requirement exactly as authored — its complete prose text and, where present, the formal FRETish sentence it compiles to.
Binds Hyprland reports as dispatcher __lua are shown with resolved keys from the source-derived cache and remain dispatchable.
when lua_binds_present the keybindings_menu shall eventually satisfy lua_binds_dispatchable
Rationale & tags
Why this requirement exists, and how it is categorised.
Rationale & tags
Why this requirement exists, and how it is categorised.
bin/omarchy-menu-keybindings lines 4-9 and the LUA_BIND_*_MAP population.
Verification & provenance
How this requirement was checked: the review trail, edit history, and the machine-analysis status terms (each ⓘ explains what it means).
Review
- Status
- in_review
- Reviewer
- Kimi Zero Warnings · AI agent
- Reviewed
- Sep 27, 2026, 21:25 UTC
History
- Created
- Sep 22, 2026, 13:34 UTC · Kimi Dogfood · AI agent
- Modified
- Sep 27, 2026, 21:25 UTC · Kimi Zero Warnings · AI agent
Hazard review
- scenarioreviewedmalformed_inputboundary
malformed_input (post-de63134b): dispatcher values that are nil, unmarked tables, or unregistered functions fall through the resolution chain with kind="" exactly as pre-delta - the new elseif only fires when o.bind_commands holds an entry for the exact dispatcher key. boundary: a registered function bind resolves to its single mapped command; Lua table keys are function-identity unique, so cross-bind command confusion is structurally impossible. Stale-cache boundary closed by the v13->v14 key bump (verified in keybindings_cache_key).
- propertyrevieweddeterminism
The bind_commands lookup is a pure map read keyed by function identity: same config run yields the same records. helpers.lua registers the mapping at bind-creation time, before the sandbox prints rows, so ordering is fixed.
- domainnot applicable
No new trust boundary: the Lua config already executes with full user privileges inside Hyprland; the keybindings script only re-reads it to render the menu, and the menu ran the resulting rows with user privileges before this delta. bind_commands values are written only by o.launch_terminal (fixed string omarchy-launch-terminal); a user-written mapping is config behavior, not an attack surface.
- structuralnot applicable
Bash + GC'd Lua; table.concat over strings only. Lua nil-key read returns nil (no error), keeping the fall-through safe; no manual memory, pointers, or format strings.
Change history
Every recorded revision of this requirement's source file — newest first, each with its commit message and the diff for that change.
Review history
Human and AI-agent approvals of this requirement — the 'why was this approved' lineage, each with the reviewer's justification and the code it cites.
- Kimi Upstream Watch · AI agentApprovedSpec conformanceSep 28, 2026 · 5 days agoREVIEW-75
Spec conformance after upstream de63134b merge (f8146395). The bind_commands dispatch branch (merged bin/omarchy-menu-keybindings:213-215) is the mechanism now making Lua function binds dispatchable as exec rows; helpers.lua:163-179 registers the mapping at bind-creation time. Verified: (1) FRETish unchanged - when lua_binds_present the menu eventually satisfies lua_binds_dispatchable; the delta moves the code CLOSER to the guarantee (pre-delta function binds fell through with empty kind). (2) Variables lua_binds_present/lua_binds_dispatchable still map to the same observable behavior; truth-table rows remain witnessed by existing keybindings-menu-test.sh MCDC lines, plus upstream's new terminal-bind test exercises the T,T scenario end-to-end through the new branch. (3) STE100 prose intact; rationale reference to LUA_BIND_*_MAP population remains accurate - bind_commands is a second population path for the same contract, noted in traces re-review. Approved.
Cited code (3) - Kimi Zero Warnings · AI agentApprovedSpec conformanceSep 27, 2026 · 5 days agoREVIEW-30
Read the implementation and keybindings-menu-test.sh. The script keeps source-derived LUA_BIND_KEY_MAP/DISPATCHER/ARG maps so binds Hyprland reports as dispatcher __lua resolve to real keys and stay dispatchable; the only gating branch is the __lua dispatch-class lookup, which the FRETish condition lua_binds_present models. Silent precondition honored: binds whose dispatch class is unknown are NOT merged into a shared row (test at keybindings-menu-test.sh:218 proves they stay apart), matching the eventual dispatchability guarantee. Formula conforms to the code.
Cited code (1)
Open known issues
Findings currently open against this requirement — issues its verification surfaced that are not resolved yet. Each links to the full finding.
- MediumOpen
parse_keycodes rewrites code:N/mouse:N tokens anywhere in a record, corrupting descriptions and commands
KI-MENU-KEYBINDINGS-CODE-REWRITE-OVERREACH
- MediumOpen
Comma in a binding description shifts every later CSV field: truncated label, wrong dispatcher, failed dispatch
KI-MENU-KEYBINDINGS-CSV-DESC-COMMA
- MediumOpen
Lua function binds (Select all, Universal copy/paste/cut, Zoom in, Reset zoom) render in the menu but dispatch nothing
KI-MENU-KEYBINDINGS-FUNC-BIND-NO-DISPATCH
- MediumOpen
Lua bind scan aborts on the first throwing require; every later Lua bind silently vanishes from the menu cache
KI-MENU-KEYBINDINGS-SCAN-DOFILE-ABORT
- MediumOpen
Warm keybindings cache serves a stale Lua command after the user edits only the command a __lua bind runs
KI-MENU-KEYBINDINGS-STALE-LUA-CACHE
- MediumOpen
Successful hyprctl dispatch with a stderr warning is treated as a refusal and the exec command runs twice
KI-MENU-KEYBINDINGS-STDERR-FAILS-DISPATCH
- LowOpen
Refused key-up after an accepted key-down leaves a synthetic key stuck down and skips the sendshortcut fallback
KI-MENU-KEYBINDINGS-SENDKEY-UP-FAIL-STUCK
Obligations
What this requirement must witness to be considered satisfied — the required evidence, and the tests that discharge each one.
The tests that discharge each obligation aren't available for a historical run
The evidence matrix behind each obligation comes from the live audit index, which can't be rebuilt for a past commit. Nothing here means unknown — not that the requirement has no obligations.
Formula evidence
The formal formula behind this requirement, the variables it is written over, and the tests that exercise it (each term is explained inline).
Formula evidence
The formal formula behind this requirement, the variables it is written over, and the tests that exercise it (each term is explained inline).
FRETish formula
when lua_binds_present the keybindings_menu shall eventually satisfy lua_binds_dispatchable
Witnesses· 3 scenarios total
- keybindings-menu-test.sh:1exercises 3 condition scenarios
MC/DC truth table· 3 rows
Each row assigns the formula's conditions (T/F) and shows the Result— the formula's value for that input row, not a test pass/fail. A row proves a condition when flipping only that condition flips the outcome. The test that covers each row is linked.
mcdc:ignoreNo-actionfalse-result row satisfied by designUncoveredneeds a covering test| # | lua_binds_dispatchable | lua_binds_present | Result | Proves | Covering test |
|---|---|---|---|---|---|
| 1 | F | F | T | lua_binds_present | |
| 2 | F | T | F | lua_binds_dispatchable | |
| 3 | T | T | T | lua_binds_dispatchable |
Its place
How this requirement connects — what proves it, what it affects, and what it rests on. Authored links only here; automatically derived links come from the audit index.
Loading graph…
Trace evidence
The concrete artifacts linked to this requirement — implementing code, verifying tests, documents, and the findings raised against it.
7 open · 0 resolved
- MediumOpen
parse_keycodes rewrites code:N/mouse:N tokens anywhere in a record, corrupting descriptions and commands
KI-MENU-KEYBINDINGS-CODE-REWRITE-OVERREACH
- MediumOpen
Comma in a binding description shifts every later CSV field: truncated label, wrong dispatcher, failed dispatch
KI-MENU-KEYBINDINGS-CSV-DESC-COMMA
- MediumOpen
Lua function binds (Select all, Universal copy/paste/cut, Zoom in, Reset zoom) render in the menu but dispatch nothing
KI-MENU-KEYBINDINGS-FUNC-BIND-NO-DISPATCH
- MediumOpen
Lua bind scan aborts on the first throwing require; every later Lua bind silently vanishes from the menu cache
KI-MENU-KEYBINDINGS-SCAN-DOFILE-ABORT
- MediumOpen
Warm keybindings cache serves a stale Lua command after the user edits only the command a __lua bind runs
KI-MENU-KEYBINDINGS-STALE-LUA-CACHE
- MediumOpen
Successful hyprctl dispatch with a stderr warning is treated as a refusal and the exec command runs twice
KI-MENU-KEYBINDINGS-STDERR-FAILS-DISPATCH
- LowOpen
Refused key-up after an accepted key-down leaves a synthetic key stuck down and skips the sendshortcut fallback
KI-MENU-KEYBINDINGS-SENDKEY-UP-FAIL-STUCK
Impact
Blast radius — authored trace links only (automatically derived links come from the audit index and aren't shown here).
Impact
Blast radius — authored trace links only (automatically derived links come from the audit index and aren't shown here).
If you change this
Files to re-check (1)
- omarchy-menu-keybindingsbin/omarchy-menu-keybindings
Tests to re-run (1)
- keybindings-menu-test.shtest/shell.d/keybindings-menu-test.sh
What this rests on
Discussions
Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.