Proof Portal
Omarchy
ProbeLabs73 findings · 87 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
A user entry overrides the default per key while keeping the row's original order slot.
Specification
The requirement exactly as authored — its complete prose text and, where present, the formal FRETish sentence it compiles to.
A user entry overrides the default per key while keeping the row's original order slot. The model injects a root item with label Go when no source declares one.
when user_entry_overrides the menu_model shall eventually satisfy per_key_override_applied & root_injected
Rationale & tags
Why this requirement exists, and how it is categorised.
Rationale & tags
Why this requirement exists, and how it is categorised.
MenuModel.js mergeMenuSources lines 66-96; menu-test.sh pins override order.
Verification & provenance
How this requirement was checked: the review trail, edit history, and the machine-analysis status terms (each ⓘ explains what it means).
Review
- Status
- in_review
- Reviewer
- Kimi Zero Warnings · AI agent
- Reviewed
- Sep 27, 2026, 21:25 UTC
History
- Created
- Sep 22, 2026, 13:34 UTC · Kimi Dogfood · AI agent
- Modified
- Sep 27, 2026, 21:25 UTC · Kimi Zero Warnings · AI agent
Hazard review
- scenarioreviewedmalformed_inputboundaryedge_case
Worst case: a user extension entry with a JavaScript object-protocol key (__proto__, constructor) is written into the plain nextItems map, where the __proto__ assignment mutates the map's prototype instead of adding a row - corrupting later lookups menu-wide - and an entry without an id is silently dropped by the !entry.id guard. malformed_input: both shapes are reachable from the user-editable extension JSONC, and silent-drop versus prototype-corruption is the declared handling of each. boundary: the root injection fires exactly when no source declares root - a user-declared root suppressing the Go label is the identity edge, and the merge is last-source-wins per key. edge_case: override preserving the first source's order slot while later sources append, duplicate ids within one source (first sets order, later merges), and shallow per-key replacement of nested values like aliases are the witnessed corners. Blast radius is same-user config rendering the menu wrong - graded low; no privilege or write surface composes onto it. Catalog 1.11.0 re-review: input_domain not applicable, entries reach it already parsed by SW-REQ-260922-E4J2. concurrency_scale not applicable, a pure function of its arguments, recomputed on each load or keystroke: no state across calls, no process, timer or lock.
- propertyreviewedtotality
Any pair of source arrays (null, empty, overlapping, malformed entries) yields a defined merged map and order with sequential order indexes assigned to every surviving row; the root item is guaranteed present afterwards either from a source or injected, so downstream tree building never runs against a rootless model.
- structuralnot applicable
Shallow for-in copies over plain objects; no memory, pointer, encoding, or numeric surface. The plain-object-as-map weakness against protocol keys is a semantic hazard and is dispositioned under scenario/malformed_input rather than as a language-safety class.
- domainnot applicable
In-process config merge over two already-parsed arrays; the file watching and JSONC parsing are owned by the source-loading siblings, and nothing here touches network, IPC transport, crypto, or privilege.
Change history
Every recorded revision of this requirement's source file — newest first, each with its commit message and the diff for that change.
Review history
Human and AI-agent approvals of this requirement — the 'why was this approved' lineage, each with the reviewer's justification and the code it cites.
- Kimi Zero Warnings · AI agentApprovedSpec conformanceSep 27, 2026 · 5 days agoREVIEW-40
Read mergeMenuSources. User entries merge per key over the default entry (later source keys win) while nextOrder keeps the first-seen slot, so an override does not reorder the row; when no source declares root the function injects one with label Go. Both response conjuncts (per_key_override_applied, root_injected) map to these two code blocks. Formula conforms to the code.
Cited code (1)
Open known issues
Findings currently open against this requirement — issues its verification surfaced that are not resolved yet. Each links to the full finding.
Obligations
What this requirement must witness to be considered satisfied — the required evidence, and the tests that discharge each one.
The tests that discharge each obligation need a synced audit
The evidence matrix behind each obligation comes from the audit index, which is produced by running an audit — not read from git. Nothing here means unknown — not that the requirement has no obligations.
Formula evidence
The formal formula behind this requirement, the variables it is written over, and the tests that exercise it (each term is explained inline).
Formula evidence
The formal formula behind this requirement, the variables it is written over, and the tests that exercise it (each term is explained inline).
FRETish formula
when user_entry_overrides the menu_model shall eventually satisfy per_key_override_applied & root_injected
Witnesses· 2 scenarios total
- menu-test.sh:1exercises 2 condition scenarios
MC/DC truth table· 5 rows
Each row assigns the formula's conditions (T/F) and shows the Result— the formula's value for that input row, not a test pass/fail. A row proves a condition when flipping only that condition flips the outcome. The test that covers each row is linked.
mcdc:ignoreNo-actionfalse-result row satisfied by designUncoveredneeds a covering test| # | per_key_override_applied | root_injected | user_entry_overrides | Result | Proves | Covering test |
|---|---|---|---|---|---|---|
| 1 | F | F | F | T | user_entry_overrides | |
| 2 | F | F | T | F | user_entry_overrides | Exempted · defensive — the merge copies every key of every user entry and injects root when missing, both unconditionally; an override that applies nothing needs the copy loop removed (reviewed: REVIEW-M8) |
| 3 | F | T | T | F | per_key_override_applied | Exempted · defensive — same unconditional per-key copy; root injection without the override needs the copy loop removed (reviewed: REVIEW-M8) |
| 4 | T | F | T | F | root_injected | Exempted · defensive — root injection runs whenever the merged map lacks root; an applied override without it needs the injection removed (reviewed: REVIEW-M8) |
| 5 | T | T | T | T | per_key_override_applied |
Its place
How this requirement connects — what proves it, what it affects, and what it rests on. Authored links only here; automatically derived links come from the audit index.
Loading graph…
Trace evidence
The concrete artifacts linked to this requirement — implementing code, verifying tests, documents, and the findings raised against it.
Impact
Blast radius — authored trace links only (automatically derived links come from the audit index and aren't shown here).
Impact
Blast radius — authored trace links only (automatically derived links come from the audit index and aren't shown here).
If you change this
Files to re-check (2)
- Menu.qmlshell/plugins/menu/Menu.qml
- MenuModel.jsshell/plugins/menu/MenuModel.js
Tests to re-run (2)
- menumodel-replay.test.mjstest/node/menumodel-replay.test.mjs
- menu-test.shtest/shell.d/menu-test.sh
What this rests on
Discussions
Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.