Proof Portal
Omarchy
ProbeLabsviewing a historical runA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Unparseable input (after stripping), non-object JSON, and non-object entries yield an empty or skipped item set; no exception escapes the parser.
Specification
The requirement exactly as authored — its complete prose text and, where present, the formal FRETish sentence it compiles to.
Unparseable input (after stripping), non-object JSON, and non-object entries yield an empty or skipped item set; no exception escapes the parser.
when json_invalid the menu_model shall eventually satisfy empty_item_set & !parse_error_raised
Rationale & tags
Why this requirement exists, and how it is categorised.
Rationale & tags
Why this requirement exists, and how it is categorised.
MenuModel.js parseMenuJsonc. A crashing parser would take the whole menu down on a user edit. Upstream e332dc97 rejects scalar and null roots only; for..in walks a top-level JSON array root and renders phantom rows (KI-MENU-JSONC-ARRAY-ROOT, omacom/omarchy#13492).
Verification & provenance
How this requirement was checked: the review trail, edit history, and the machine-analysis status terms (each ⓘ explains what it means).
Review
- Status
- in_review
- Reviewer
- Kimi Zero Warnings · AI agent
- Reviewed
- Sep 28, 2026, 00:00 UTC
History
- Created
- Sep 22, 2026, 13:34 UTC · Kimi Dogfood · AI agent
- Modified
- Oct 1, 2026, 21:23 UTC · Claude Baseline Pass · AI agent
Hazard review
- scenarioreviewedmalformed_inputerror_handlinginput_domain
Clean-baseline review against upstream e332dc97 (2026-10-01). malformed_input: unparseable-after-strip input routes to the unconditional catch that returns []; scalar and null roots return []; non-object entries are skipped. An array root is NOT rejected upstream: for..in walks its indices and renders phantom rows keyed 0,1,... - tracked as KI-MENU-JSONC-ARRAY-ROOT (#13492) with reproducer test/reports/report-cmulr8j7z0hy31gw4pne8v6u4.sh. error_handling: the failure mode is a silent empty item set by design; no exception escapes. Comma and comment stripping belong to E4J2; their upstream gaps are KI-MENU-JSONC-COMMA-IN-STRING (#13250) and KI-MENU-JSONC-INLINE-COMMENT (#13493). Catalog 1.11.0 re-review: input_domain applied, input_domain is on its obligation checklist: empty, whitespace-only and U+FFFD or NUL outside strings reject the document to an empty item set without an exception (witnesses in test/shell.d/menu-test.sh). concurrency_scale not applicable, a pure function of its arguments, recomputed on each load or keystroke: no state across calls, no process, timer or lock.
- propertyrevieweddeterminism
- domainnot applicable
No domain workload tags; local config parser.
- structuralnot applicable
GC'd JavaScript; no C-family structural hazard surface.
Change history
Every recorded revision of this requirement's source file — newest first, each with its commit message and the diff for that change.
Review history
Human and AI-agent approvals of this requirement — the 'why was this approved' lineage, each with the reviewer's justification and the code it cites.
- Kimi Fix Jsonc Refresh · AI agentApprovedSpec conformanceSep 27, 2026 · 5 days agoREVIEW-22
Delta-touch conformance for the fix branch: agent-25 extended the description and rationale to name the string-aware trailing-comma semantics (trailing_comma_dropped = !comma_in_string && next_char_closes_json) and the pre-fix silent-corruption behavior. Verified against MenuModel.js: the stripJsonc scanner drops a comma iff it is outside every string literal and the next non-whitespace byte is } or ], and parseMenuJsonc still routes any post-strip parse failure to the catch that returns [] with no exception escaping (fretish: json_invalid -> eventually empty_item_set & !parse_error_raised unchanged and still honored; unterminated-string case verified by direct execution this campaign). The added prose is descriptive, not normative; the normative equivalence lives in SW-REQ-260927-66FW. Status promoted draft -> review on 2026-09-28 by agent:kimi-zero-warnings after the defect_review stamp gained verified:2 (CRS-0017/C03 array-root claim closed by SW-REQ-260928-BMFE; CRS-0017/C01 inline-comment claim closed by SW-REQ-260928-C8W1), which put this spec into the branch changed set.
Cited code (5)
Open known issues
Findings currently open against this requirement — issues its verification surfaced that are not resolved yet. Each links to the full finding.
Obligations
What this requirement must witness to be considered satisfied — the required evidence, and the tests that discharge each one.
3 obligations · 3 discharged
Browse the catalogueBehavior at limits, thresholds, and edge-of-range values.
- nominalrequiredpresentCovered by 1 test
- negativerecommendedpresentCovered by 2 tests
Behavior when operations fail or dependencies are unavailable.
- negativerequiredpresentCovered by 2 tests
- nominalrequiredpresentCovered by 1 test
A parser, reader, or configuration loader states its accepted input domain at the byte level and what happens for each partition of it.
- nominalrequiredpresentCovered by 1 test
- negativerecommendedpresentCovered by 1 test
Formula evidence
The formal formula behind this requirement, the variables it is written over, and the tests that exercise it (each term is explained inline).
Formula evidence
The formal formula behind this requirement, the variables it is written over, and the tests that exercise it (each term is explained inline).
FRETish formula
when json_invalid the menu_model shall eventually satisfy empty_item_set & !parse_error_raised
Witnesses· 2 scenarios total
- countexercises 2 condition scenarios
MC/DC truth table· 4 rows
Each row assigns the formula's conditions (T/F) and shows the Result— the formula's value for that input row, not a test pass/fail. A row proves a condition when flipping only that condition flips the outcome. The test that covers each row is linked.
mcdc:ignoreNo-actionfalse-result row satisfied by designUncoveredneeds a covering test| # | empty_item_set | json_invalid | parse_error_raised | Result | Proves | Covering test |
|---|---|---|---|---|---|---|
| 1 | F | F | F | T | json_invalid | |
| 2 | F | T | F | F | empty_item_set | — |
| 3 | T | T | F | T | empty_item_set | |
| 4 | T | T | T | F | parse_error_raised | — |
Its place
How this requirement connects — what proves it, what it affects, and what it rests on. Authored links only here; automatically derived links come from the audit index.
Loading graph…
Trace evidence
The concrete artifacts linked to this requirement — implementing code, verifying tests, documents, and the findings raised against it.
Impact
Blast radius — authored trace links only (automatically derived links come from the audit index and aren't shown here).
Impact
Blast radius — authored trace links only (automatically derived links come from the audit index and aren't shown here).
If you change this
Files to re-check (2)
- Menu.qmlshell/plugins/menu/Menu.qml
- MenuModel.jsshell/plugins/menu/MenuModel.js
Tests to re-run (2)
- menumodel-replay.test.mjstest/node/menumodel-replay.test.mjs
- menu-test.shtest/shell.d/menu-test.sh
What this rests on
Discussions
Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.