Proof Portal
Omarchy
ProbeLabsviewing a historical runA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
A summon arriving while a select/input request is still active answers that prior request as cancelled (done file only, empty selection) before opening the new menu, so the caller polling the done file is never abandoned by a later summon.
Specification
The requirement exactly as authored — its complete prose text and, where present, the formal FRETish sentence it compiles to.
A summon arriving while a select/input request is still active answers that prior request as cancelled (done file only, empty selection) before opening the new menu, so the caller polling the done file is never abandoned by a later summon.
when menu_open_called & ! no_active_request the dmenu_protocol shall eventually satisfy prior_request_cancelled
Rationale & tags
Why this requirement exists, and how it is categorised.
Rationale & tags
Why this requirement exists, and how it is categorised.
Menu.qml open lines 26-32 (summon answers an in-flight request as cancelled before dispatching) and finishRequest lines 131-149; mitigates KI-MENU-SELECT-POLL-DEADLOCK's abandoned-request trigger.
Verification & provenance
How this requirement was checked: the review trail, edit history, and the machine-analysis status terms (each ⓘ explains what it means).
Review
- Status
- in_review
- Reviewer
- Kimi Upstream Refresh · AI agent
- Reviewed
- Sep 25, 2026, 09:20 UTC
History
- Created
- Sep 25, 2026, 08:56 UTC · Leonid Bugaev
- Modified
- Sep 25, 2026, 09:21 UTC · Kimi Upstream Refresh · AI agent
Hazard review
- scenarioreviewedconcurrent
PR#9056 hunk (Menu.qml:32) is the mitigation for the concurrent-summon hazard: a summon interleaved with an in-flight select/input request now answers the prior request as cancelled before opening, closing KI-MENU-SELECT-POLL-DEADLOCK's abandoned-request trigger. Worst case pre-mitigation: caller polls doneFile forever. MC/DC witness rows for the guard run in Phase 2 (Linux).
- domainnot applicable
Domain classes fire only on matching workload tags (HTTP/crypto/IPC frameworks); these menu dmenu-protocol requirements carry no domain tags and the component is a local QML plugin + bash scripts with no network/crypto surface.
- structuralnot applicable
Structural classes target C-family memory/format-string hazards (pointer arithmetic, manual ownership, sanitizer evidence). Implementation is QML/JS (GC'd) plus bash invoking printf with constant format strings; no manual memory or binary framing exists in this component.
- propertyreviewedatomicity
The cancel-before-open is ordered strictly ahead of any state mutation by the new open (openDmenu/openExistingMenu), so the prior request is always fully answered before its file paths can be overwritten or cleared - no interleaving yields an abandoned caller. Witness runs in Phase 2.
Change history
Every recorded revision of this requirement's source file — newest first, each with its commit message and the diff for that change.
Review history
Human and AI-agent approvals of this requirement — the 'why was this approved' lineage, each with the reviewer's justification and the code it cites.
- Kimi Upstream Refresh · AI agentApprovedSpec conformanceSep 25, 2026 · last weekREVIEW-26
MC/DC row disposition for the PR#9056 cancel-prior decision (Menu.qml:32). Read open() (22-56) and finishRequest (131-149): when requestActive is set, open() calls finishRequest(null) unconditionally BEFORE dispatching to openDmenu/openRoute, so inside the QML decision model the violation row (menu_open_called=T, no_active_request=F, prior_request_cancelled=F) is structurally unreachable -- producing it needs the guard call removed. The one known way the cancel WRITE can still be lost is the resultProc busy-drop: QML Process ignores command changes while running (Menu.qml:1067-1072), so a finishRequest landing mid-write of a previous answer can be dropped. That is a runtime race below the decision's structural model, not a code path that skips the guard; it is tracked as deferred claim CRS-0017/C01 with a Phase-2 live-harness PoC and re-validated by the Phase-2 MC/DC measurement, which will re-open this disposition if the row is ever observed. The other three rows are witnessed in test/shell.d/menu-compositor-test.sh (no-action rows carry caller-level probe assertions: requestActive/doneFile exposed by the injected read-only probe).
Cited code (4) - Kimi Upstream Refresh · AI agentApprovedSpec conformanceSep 25, 2026 · last weekREVIEW-21
Read open() and finishRequest. The guard 'if (root.requestActive) root.finishRequest(null)' (Menu.qml:32) is exactly the antecedent menu_open_called & !no_active_request: openDmenu sets requestActive=!!doneFile, so requestActive true implies a done file exists, matching no_active_request's definition (no active request or no done file). finishRequest(null) takes the null branch (Menu.qml:143-147) writing only the done file, which is prior_request_cancelled; it runs before openDmenu/openExistingMenu can overwrite or clear the file paths, so the formula's 'eventually satisfy' is immediate and unconditional on this path. Branch coverage: guard-false path leaves state untouched (correct, no obligation). No silent preconditions found.
Cited code (2)
Open known issues
Findings currently open against this requirement — issues its verification surfaced that are not resolved yet. Each links to the full finding.
Obligations
What this requirement must witness to be considered satisfied — the required evidence, and the tests that discharge each one.
The tests that discharge each obligation aren't available for a historical run
The evidence matrix behind each obligation comes from the live audit index, which can't be rebuilt for a past commit. Nothing here means unknown — not that the requirement has no obligations.
Formula evidence
The formal formula behind this requirement, the variables it is written over, and the tests that exercise it (each term is explained inline).
Formula evidence
The formal formula behind this requirement, the variables it is written over, and the tests that exercise it (each term is explained inline).
FRETish formula
when menu_open_called & ! no_active_request the dmenu_protocol shall eventually satisfy prior_request_cancelled
Witnesses· 3 scenarios total
- summonCancelRaceexercises 3 condition scenarios
MC/DC truth table· 4 rows
Each row assigns the formula's conditions (T/F) and shows the Result— the formula's value for that input row, not a test pass/fail. A row proves a condition when flipping only that condition flips the outcome. The test that covers each row is linked.
mcdc:ignoreNo-actionfalse-result row satisfied by designUncoveredneeds a covering test| # | menu_open_called | no_active_request | prior_request_cancelled | Result | Proves | Covering test |
|---|---|---|---|---|---|---|
| 1 | F | F | F | T | menu_open_called | |
| 2 | T | F | F | F | menu_open_called | — |
| 3 | T | F | T | T | prior_request_cancelled | |
| 4 | T | T | F | T | no_active_request |
Its place
How this requirement connects — what proves it, what it affects, and what it rests on. Authored links only here; automatically derived links come from the audit index.
Loading graph…
Trace evidence
The concrete artifacts linked to this requirement — implementing code, verifying tests, documents, and the findings raised against it.
Impact
Blast radius — authored trace links only (automatically derived links come from the audit index and aren't shown here).
Impact
Blast radius — authored trace links only (automatically derived links come from the audit index and aren't shown here).
If you change this
Nothing downstream depends on this yet
No downstream impact — "A summon arriving while a select/input request is still…" has no downstream edges.
What this rests on
Discussions
Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.