Proof Portal
Omarchy
ProbeLabs73 findings · 87 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
The select payload carries mode=select, prompt, options, selectionFile, and doneFile, plus integer width/maxHeight only when given.
Specification
The requirement exactly as authored — its complete prose text and, where present, the formal FRETish sentence it compiles to.
The select payload carries mode=select, prompt, options, selectionFile, and doneFile, plus integer width/maxHeight only when given. Options come from arguments or, with none and non-terminal stdin, from stdin lines.
when select_invoked the dmenu_protocol shall eventually satisfy payload_shape_correct
Rationale & tags
Why this requirement exists, and how it is categorised.
Rationale & tags
Why this requirement exists, and how it is categorised.
bin/omarchy-menu-select lines 29-87.
Verification & provenance
How this requirement was checked: the review trail, edit history, and the machine-analysis status terms (each ⓘ explains what it means).
Review
- Status
- in_review
- Reviewer
- Kimi Zero Warnings · AI agent
- Reviewed
- Sep 27, 2026, 21:25 UTC
History
- Created
- Sep 22, 2026, 13:34 UTC · Kimi Dogfood · AI agent
- Modified
- Oct 1, 2026, 21:23 UTC · Claude Baseline Pass · AI agent
Hazard review
- scenarioreviewedboundaryedge_casemalformed_inputinput_domain
Worst case: caller-supplied bytes corrupting the summon payload into a shape the shell misreads as a different mode or destination - closed structurally: every string field passes an explicit UTF-8 decode and JSON encode in perl, so any argv bytes arrive as payload values, never structure. boundary: the options-source partition is the contract spine - argv options, or stdin lines when no arguments and stdin is non-terminal, or the B839 usage exit when neither source exists; width/maxHeight appear only when given and are int-coerced. edge_case: an empty pipe yields an empty options array (defined empty menu rather than an error, with B839 owning the no-source case); invalid UTF-8 argv dies loudly at the decode instead of mojibake-ing into the payload. Catalog 1.11.0 re-review: input_domain applied, input_domain is on its obligation checklist: LF and CRLF lines, a BOM, Unicode spaces, blank lines, invalid UTF-8 (decoded to U+FFFD) and 5000 lines all become option text, and an empty stdin is no options (witnesses in test/shell.d/menu-dmenu-test.sh). concurrency_scale not applicable, each run owns its own mktemp selection and done files; supersession of overlapping requests is stated on SYS-REQ-260922-X6Z5.
- propertyreviewedtotalitydeterminism
totality: every (argv, stdin-kind, width/maxheight-presence) combination resolves to exactly one payload shape or the usage exit, with no combination emitting a partial or mis-typed field set. determinism: fields serialize in fixed order from fixed sources, so the same invocation always produces the same payload.
- structuralnot applicable
Encode/decode boundaries are explicit (UTF-8 decode before JSON encode, integer coercion for dimensions); no eval, shell interpolation of payload fields, or pointer work - the payload is built in perl structures and printed once.
- domainnot applicable
Local mktemp paths and the session shell IPC summon; the far side of the protocol is the shell plugin siblings own surface, and this side carries no network, crypto, or privilege boundary.
Change history
Every recorded revision of this requirement's source file — newest first, each with its commit message and the diff for that change.
Review history
Human and AI-agent approvals of this requirement — the 'why was this approved' lineage, each with the reviewer's justification and the code it cites.
- Kimi Zero Warnings · AI agentApprovedSpec conformanceSep 27, 2026 · 5 days agoREVIEW-59
Read omarchy-menu-select. The select payload is one deterministic perl encode carrying mode=select, prompt, options, selectionFile and doneFile, with integer width/maxHeight added only when given; options come from argv or, with none and stdin non-terminal, from the stdin mapfile. select_invoked models the summon; payload_shape_correct is the fixed encode. Note KI-MENU-SELECT-POLL-DEADLOCK tracks a known poll deadlock against this req, currently evidenced. Formula conforms to the code.
Cited code (1)
Open known issues
Findings currently open against this requirement — issues its verification surfaced that are not resolved yet. Each links to the full finding.
- MediumReviewed
omarchy-menu-select hangs forever when the summoned menu dies before writing done_file
KI-MENU-SELECT-POLL-DEADLOCK
- MediumOpen
omarchy-menu-select blocks forever inside the omarchy-shell summon call when the IPC never returns
KI-MENU-SELECT-SUMMON-UNBOUNDED
- LowOpen
Geometry flags silently coerce non-numeric and flag-like values: --width abc summons width 0
KI-MENU-SELECT-GEOMETRY-INT-COERCION
- LowOpen
Failed second mktemp leaks the selection handshake temp file: cleanup trap installed only after both files exist
KI-MENU-SELECT-HANDSHAKE-TMP-LEAK
Obligations
What this requirement must witness to be considered satisfied — the required evidence, and the tests that discharge each one.
2 obligations · 1 deferred · 1 discharged
Browse the catalogueEvery cross-process call shall declare connect, read, and total deadlines; no external call is defaulted to "no timeout."
This requirement implementation carries the done_file poll itself (while [[ ! -e $done_file ]]; sleep 0.05) with no deadline and no peer-liveness probe: a selector that dies after a successful summon hangs the script and every synchronous dmenu caller - the reproduced defect the KI pins. The bound belongs to the KI fix at this site.
- nominalrequireddeferredWitnessing deferred — accepted while the tracking known issue stays open.
A parser, reader, or configuration loader states its accepted input domain at the byte level and what happens for each partition of it.
- nominalrequiredpresentCovered by 5 tests
- negativerecommendedpresentCovered by 2 tests
Formula evidence
The formal formula behind this requirement, the variables it is written over, and the tests that exercise it (each term is explained inline).
Formula evidence
The formal formula behind this requirement, the variables it is written over, and the tests that exercise it (each term is explained inline).
FRETish formula
when select_invoked the dmenu_protocol shall eventually satisfy payload_shape_correct
Witnesses· 2 scenarios total
- menu-dmenu-test.sh:1exercises 2 condition scenarios
MC/DC truth table· 3 rows
Each row assigns the formula's conditions (T/F) and shows the Result— the formula's value for that input row, not a test pass/fail. A row proves a condition when flipping only that condition flips the outcome. The test that covers each row is linked.
mcdc:ignoreNo-actionfalse-result row satisfied by designUncoveredneeds a covering test| # | payload_shape_correct | select_invoked | Result | Proves | Covering test |
|---|---|---|---|---|---|
| 1 | F | F | T | select_invoked | |
| 2 | F | T | F | payload_shape_correct | Exempted · defensive — the payload is one deterministic perl encode ahead of the single summon; a malformed payload means perl died and set -e kills the script before any summon, so invoked-with-bad-shape is structural (reviewed: REVIEW-M2) |
| 3 | T | T | T | payload_shape_correct |
Its place
How this requirement connects — what proves it, what it affects, and what it rests on. Authored links only here; automatically derived links come from the audit index.
Loading graph…
Trace evidence
The concrete artifacts linked to this requirement — implementing code, verifying tests, documents, and the findings raised against it.
Impact
Blast radius — authored trace links only (automatically derived links come from the audit index and aren't shown here).
Impact
Blast radius — authored trace links only (automatically derived links come from the audit index and aren't shown here).
If you change this
Files to re-check (1)
- omarchy-menu-selectbin/omarchy-menu-select
Tests to re-run (1)
- menu-dmenu-test.shtest/shell.d/menu-dmenu-test.sh
What this rests on
Discussions
Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.