Proof Portal
Omarchy
ProbeLabsviewing a historical runA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Once the done file exists, the script prints a non-empty selection file to stdout.
Specification
The requirement exactly as authored — its complete prose text and, where present, the formal FRETish sentence it compiles to.
Once the done file exists, the script prints a non-empty selection file to stdout.
when answer_file_written the dmenu_protocol shall eventually satisfy selection_printed
Rationale & tags
Why this requirement exists, and how it is categorised.
Rationale & tags
Why this requirement exists, and how it is categorised.
bin/omarchy-menu-select lines 91-97; same protocol in omarchy-menu-input lines 50-56.
Verification & provenance
How this requirement was checked: the review trail, edit history, and the machine-analysis status terms (each ⓘ explains what it means).
Review
- Status
- in_review
- Reviewer
- Kimi Zero Warnings · AI agent
- Reviewed
- Sep 27, 2026, 21:25 UTC
History
- Created
- Sep 22, 2026, 13:34 UTC · Kimi Dogfood · AI agent
- Modified
- Sep 30, 2026, 07:33 UTC · Leonid Bugaev
Hazard review
- scenarioreviewedboundaryedge_caseerror_handling
Worst case: the shell menu writes done_file before the selection bytes are flushed, so a user pick resolves through the -s test to the silent exit-1 cancel arm - the pick is dropped. The failure direction is fail-safe (nothing is acted on), and the write ordering lives on the QML writer side of the protocol, owned by the summon sibling; this arm pins the reader half. boundary: selection-file empty versus non-empty is the exact partition, with mktemp-guaranteed fresh files closing stale-pick replay (no previous run pick can masquerade). edge_case: the selection file vanishing between -s and cat fails under set -e to the same silent nonzero as a cancel; whitespace-only answers count as non-empty and pass through verbatim, with caller-side trimming out of this contract. error_handling: missing or empty files resolve defined, never crash; both implementations (menu-select, menu-input) share the identical arm shape. Catalog 1.11.0 re-review: input_domain not applicable, it prints the selection file verbatim and parses nothing. concurrency_scale not applicable, the client side of one request; request supersession is stated on SYS-REQ-260922-X6Z5.
- propertyreviewedtotality
Every (done-file, selection-file) state the protocol can produce after the trigger resolves to exactly one defined ending - content printed with exit 0, or silence with exit 1 - with no state printing a partial answer or exiting zero on a lost pick, in both traced implementations.
- structuralnot applicable
A -s file test, cat, and mktemp-fixed paths with an EXIT trap; selection bytes pass through verbatim with no parsing, arithmetic, or encoding transform.
- domainnot applicable
Same-user local mktemp files plus the omarchy-shell IPC summon owned by the protocol siblings (Q6ZS/9ABD/C8HX); no network egress, crypto, or privilege surface in the answer arm this requirement governs.
Change history
Every recorded revision of this requirement's source file — newest first, each with its commit message and the diff for that change.
Review history
Human and AI-agent approvals of this requirement — the 'why was this approved' lineage, each with the reviewer's justification and the code it cites.
- Kimi Zero Warnings · AI agentApprovedSpec conformanceSep 27, 2026 · 5 days agoREVIEW-55
Read omarchy-menu-select and omarchy-menu-input. Once the done file exists, the only read of the selection file is '[[ -s $selection_file ]] && cat' — a non-empty answer prints to stdout unconditionally. answer_file_written models the done-file gate; the empty case is 9ABD's condition. Formula conforms to the code.
Cited code (1)
Open known issues
Findings currently open against this requirement — issues its verification surfaced that are not resolved yet. Each links to the full finding.
Obligations
What this requirement must witness to be considered satisfied — the required evidence, and the tests that discharge each one.
2 obligations · 1 deferred
Browse the catalogueDischarging tests pending a synced audit.
Both traced implementations enter the answer arm through the unbounded done_file poll (while [[ ! -e $done_file ]]; sleep) with no deadline and no peer-liveness probe, so the answer contract only ever runs if the selector survives to write done - menu-select is the KI namesake site and menu-input its deferred second site. The bound belongs to the KI fix; this arm is tracked with it rather than suppressed.
Discharging tests pending a synced audit.
Formula evidence
The formal formula behind this requirement, the variables it is written over, and the tests that exercise it (each term is explained inline).
Formula evidence
The formal formula behind this requirement, the variables it is written over, and the tests that exercise it (each term is explained inline).
FRETish formula
when answer_file_written the dmenu_protocol shall eventually satisfy selection_printed
Witnesses· 2 scenarios total
- menu-dmenu-test.sh:1exercises 2 condition scenarios
MC/DC truth table· 3 rows
Each row assigns the formula's conditions (T/F) and shows the Result— the formula's value for that input row, not a test pass/fail. A row proves a condition when flipping only that condition flips the outcome. The test that covers each row is linked.
mcdc:ignoreNo-actionfalse-result row satisfied by designUncoveredneeds a covering test| # | answer_file_written | selection_printed | Result | Proves | Covering test |
|---|---|---|---|---|---|
| 1 | F | F | T | answer_file_written | |
| 2 | T | F | F | answer_file_written | — |
| 3 | T | T | T | selection_printed |
Its place
How this requirement connects — what proves it, what it affects, and what it rests on. Authored links only here; automatically derived links come from the audit index.
Loading graph…
Trace evidence
The concrete artifacts linked to this requirement — implementing code, verifying tests, documents, and the findings raised against it.
Impact
Blast radius — authored trace links only (automatically derived links come from the audit index and aren't shown here).
Impact
Blast radius — authored trace links only (automatically derived links come from the audit index and aren't shown here).
If you change this
Nothing downstream depends on this yet
No downstream impact — "Once the done file exists, the script prints a non-empty…" has no downstream edges.
What this rests on
Discussions
Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.