Proof Portal
Omarchy
ProbeLabsviewing a historical runA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
finishRequest with no active request or no done file just closes the menu.
Specification
The requirement exactly as authored — its complete prose text and, where present, the formal FRETish sentence it compiles to.
finishRequest with no active request or no done file just closes the menu. It creates or truncates no files.
when no_active_request the dmenu_protocol shall eventually satisfy menu_closes_silently
Rationale & tags
Why this requirement exists, and how it is categorised.
Rationale & tags
Why this requirement exists, and how it is categorised.
Menu.qml finishRequest lines 118-121.
Verification & provenance
How this requirement was checked: the review trail, edit history, and the machine-analysis status terms (each ⓘ explains what it means).
Review
- Status
- in_review
- Reviewer
- Kimi Zero Warnings · AI agent
- Reviewed
- Sep 27, 2026, 21:25 UTC
History
- Created
- Sep 22, 2026, 13:34 UTC · Kimi Dogfood · AI agent
- Modified
- Sep 27, 2026, 21:25 UTC · Kimi Zero Warnings · AI agent
Hazard review
- scenarioreviewedboundaryedge_caseconcurrency_scale
Worst case: a finish arrives with no active request and the code, unguarded, creates or truncates the done file of a future summons - a forged empty answer delivered to an invocation that has not happened yet; the !requestActive || !doneFile guard is the entire protection, so both disjuncts are the boundary pair (active request but empty doneFile path, and stale request flag with a leftover doneFile). edge_case: double dismissal - scrim click after Esc, or cancel() racing an already-finished request - reaches finishRequest a second time and must be a silent no-op; the compositor test witnesses done-only silence end to end. malformed_input is owned upstream: doneFile provenance and payload parsing live in the summon requirements (C8HX/FGZQ hold the write arm); this requirement only decides the empty-arm behavior. Catalog 1.11.0 re-review: input_domain not applicable, it reads no external text input. concurrency_scale applied, it is part of the menu request lifecycle: a finish can arrive when no request is active (a superseded or repeated finish), and it must close without touching files.
- propertyreviewedidempotency
finishRequest twice is the same observable state as once - opened=false, no file touched - because the first call clears requestActive/doneFile before returning and every entry re-checks them; the QML event loop is single-threaded so no intra-function interleaving can bypass the guard (the interleaving that matters is dismiss-vs-summon, resolved by the same re-check on each entry).
- structuralnot applicable
Boolean and path-string guard before any write; no parsing, casting, memory, or encoding surface in the silent-close arm - the write arm is string-typed elsewhere.
- domainnot applicable
This contract is the absence of filesystem effects: no file is created, truncated, or read on the no-request arm. The done/answer file write path, its permissions, and payload-derived path provenance are owned by FGZQ/C8HX and the summon-payload requirements; Menu.qml carries no network egress sink, so no domain class applies_when fires here.
Change history
Every recorded revision of this requirement's source file — newest first, each with its commit message and the diff for that change.
Review history
Human and AI-agent approvals of this requirement — the 'why was this approved' lineage, each with the reviewer's justification and the code it cites.
- Kimi Zero Warnings · AI agentApprovedSpec conformanceSep 27, 2026 · 5 days agoREVIEW-33
Read finishRequest and cancel in Menu.qml plus menu-dmenu-test.sh. finishRequest's first branch returns early with only opened=false when no request is active or no done file exists — it creates or truncates nothing, and the dismissal path (menu-dmenu-test.sh:91) observes empty stdout/stderr and exit 1. The no_active_request condition models the !requestActive || !doneFile guard exactly; cancel() routes dmenu dismissal through the same finishRequest(null). Formula conforms to the code.
Cited code (1) - Kimi Upstream Refresh · AI agentApprovedSpec conformanceSep 25, 2026 · last weekREVIEW-77
Read finishRequest guard (Menu.qml:132-135): 'if (!root.requestActive || !root.doneFile) { root.opened = false; return }' - the no_active_request antecedent (no active request OR no done file) maps one-to-one onto the disjunction, and the body only closes the menu (opened=false) with no file creation or truncation, exactly menu_closes_silently. No other exit path from this branch; cancel() on a non-dmenu mode takes the same close-only outcome. Formula faithful; no unmodeled precondition.
Cited code (2)
Open known issues
Findings currently open against this requirement — issues its verification surfaced that are not resolved yet. Each links to the full finding.
Obligations
What this requirement must witness to be considered satisfied — the required evidence, and the tests that discharge each one.
The tests that discharge each obligation aren't available for a historical run
The evidence matrix behind each obligation comes from the live audit index, which can't be rebuilt for a past commit. Nothing here means unknown — not that the requirement has no obligations.
Formula evidence
The formal formula behind this requirement, the variables it is written over, and the tests that exercise it (each term is explained inline).
Formula evidence
The formal formula behind this requirement, the variables it is written over, and the tests that exercise it (each term is explained inline).
FRETish formula
when no_active_request the dmenu_protocol shall eventually satisfy menu_closes_silently
Witnesses· 2 scenarios total
- menu-dmenu-test.sh:1exercises 2 condition scenarios
MC/DC truth table· 3 rows
Each row assigns the formula's conditions (T/F) and shows the Result— the formula's value for that input row, not a test pass/fail. A row proves a condition when flipping only that condition flips the outcome. The test that covers each row is linked.
mcdc:ignoreNo-actionfalse-result row satisfied by designUncoveredneeds a covering test| # | menu_closes_silently | no_active_request | Result | Proves | Covering test |
|---|---|---|---|---|---|
| 1 | F | F | T | no_active_request | |
| 2 | F | T | F | menu_closes_silently | Exempted · defensive — the done-only path writes nothing to stdout or stderr on any branch; noise needs code that does not exist (reviewed: REVIEW-M2) |
| 3 | T | T | T | menu_closes_silently |
Its place
How this requirement connects — what proves it, what it affects, and what it rests on. Authored links only here; automatically derived links come from the audit index.
Loading graph…
Trace evidence
The concrete artifacts linked to this requirement — implementing code, verifying tests, documents, and the findings raised against it.
Impact
Blast radius — authored trace links only (automatically derived links come from the audit index and aren't shown here).
Impact
Blast radius — authored trace links only (automatically derived links come from the audit index and aren't shown here).
If you change this
Files to re-check (1)
- Menu.qmlshell/plugins/menu/Menu.qml
Tests to re-run (1)
- menu-dmenu-test.shtest/shell.d/menu-dmenu-test.sh
What this rests on
Discussions
Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.