Proof Portal
Omarchy
ProbeLabs74 findings · 94 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
A failed probe is an answer from /usr/bin/fprintd-list that neither lists an enrolled fingerprint nor reports that the target user has none.
Specification
The requirement exactly as authored — its complete prose text and, where present, the formal FRETish sentence it compiles to.
A failed probe is an answer from /usr/bin/fprintd-list that neither lists an enrolled fingerprint nor reports that the target user has none. After a failed probe, omarchy-apply-lock shall keep the existing fingerprint configuration. It shall not write or remove the PAM fingerprint stack, the fprintd resume hook or the stop-timeout drop-in. It shall print that it could not check the enrollment.
when fingerprint_probe_failed the apply_lock shall always satisfy fingerprint_config_kept
Rationale & tags
Why this requirement exists, and how it is categorised.
Rationale & tags
Why this requirement exists, and how it is categorised.
Upstream #7158 (879d6583) stopped treating a failed enrollment probe as an empty enrollment. Before, a transient fprintd failure during setup or an upgrade removed working fingerprint authentication and its recovery. Examples are an fprintd that the system cannot activate and a D-Bus timeout. Now only a definite answer changes the configuration, and the helper says that it could not check.
Verification & provenance
How this requirement was checked: the review trail, edit history, and the machine-analysis status terms (each ⓘ explains what it means).
Review
- Status
- in_review
- Reviewer
- Claude Code · AI agent
- Reviewed
- Oct 4, 2026, 19:06 UTC
History
- Created
- Oct 4, 2026, 18:59 UTC · Claude Code · AI agent
- Modified
- Oct 4, 2026, 19:16 UTC · Claude Code · AI agent
Hazard review
- scenarioreviewederror_handlingboundary
Worst case: a transient fprintd failure during setup or an upgrade removes working fingerprint authentication, or a failure is read as an enrollment and installs a stack for a user with no print. error_handling: any answer that is neither a listed print row nor fprintd's "has no fingers enrolled" keeps the PAM stack, the resume hook and the drop-in byte for byte and prints the could-not-check line (witnessed: "an unknown enrollment probe preserves existing recovery files"). boundary: the classifier is the anchored row match ( - #N:) and the fixed phrase; a header that mentions "- #0:" mid-line, a non-numeric index or a reader named Fingerprint do not count as enrolled. input_domain not applicable: the answer comes from the packaged /usr/bin/fprintd-list run as root, and only an anchored pattern and a fixed phrase are matched. concurrency_scale not applicable: one probe per helper run. edge_case not applicable beyond the boundary rows above.
- propertyreviewedidempotency
idempotency: rerunning the helper while fprintd keeps failing leaves the same files in place every time.
- structuralnot applicable
A grep over the probe answer and a branch; no memory, encoding or format-string surface.
- domainnot applicable
Local root helper; the answer is read from a packaged binary, not from a user-writable source.
Change history
Every recorded revision of this requirement's source file — newest first, each with its commit message and the diff for that change.
Review history
Human and AI-agent approvals of this requirement — the 'why was this approved' lineage, each with the reviewer's justification and the code it cites.
- Claude Code · AI agentApprovedSpec conformanceOct 4, 2026 · 15 hours agoREVIEW-261004-SP6R
Read the fingerprint step of bin/omarchy-apply-lock at upstream quattro 035ce29f. The probe runs /usr/bin/fprintd-list with stderr folded in and ignores its exit status. The if arm needs a line that starts with a dash and a numeric index (a listed print); the elif arm needs the literal answer no (no fprintd-list) or the phrase has no fingers enrolled. Every other answer reaches the else arm, which only prints that it could not check the enrollment and keeps the PAM stack, the resume hook and the drop-in. So fingerprint_config_kept holds whenever fingerprint_probe_failed holds; the violation row needs the else arm to write or remove a file and is dispositioned defensive. Witnesses in test/shell.d/apply-lock-test.sh: an unreachable daemon (status 1, activation error) keeps all three files byte for byte; a listed print writes the stack (not kept). Requirement authored by agent:claude-code under the owner's delegation.
Cited code (3)
Obligations
What this requirement must witness to be considered satisfied — the required evidence, and the tests that discharge each one.
The tests that discharge each obligation need a synced audit
The evidence matrix behind each obligation comes from the audit index, which is produced by running an audit — not read from git. Nothing here means unknown — not that the requirement has no obligations.
Formula evidence
The formal formula behind this requirement, the variables it is written over, and the tests that exercise it (each term is explained inline).
Formula evidence
The formal formula behind this requirement, the variables it is written over, and the tests that exercise it (each term is explained inline).
FRETish formula
when fingerprint_probe_failed the apply_lock shall always satisfy fingerprint_config_kept
Witnesses· 2 scenarios total
- apply-lock-test.sh:1exercises 2 condition scenarios
MC/DC truth table· 3 rows
Each row assigns the formula's conditions (T/F) and shows the Result— the formula's value for that input row, not a test pass/fail. A row proves a condition when flipping only that condition flips the outcome. The test that covers each row is linked.
mcdc:ignoreNo-actionfalse-result row satisfied by designUncoveredneeds a covering test| # | fingerprint_config_kept | fingerprint_probe_failed | Result | Proves | Covering test |
|---|---|---|---|---|---|
| 1 | F | F | T | fingerprint_probe_failed | |
| 2 | F | T | F | fingerprint_config_kept | Exempted · defensive — the else arm for a failed probe only prints the could-not-check line; it writes and removes nothing (reviewed: REVIEW-261004-SP6R) |
| 3 | T | T | T | fingerprint_config_kept |
Its place
How this requirement connects — what proves it, what it affects, and what it rests on. Authored links only here; automatically derived links come from the audit index.
Loading graph…
Trace evidence
The concrete artifacts linked to this requirement — implementing code, verifying tests, documents, and the findings raised against it.
Impact
Blast radius — authored trace links only (automatically derived links come from the audit index and aren't shown here).
Impact
Blast radius — authored trace links only (automatically derived links come from the audit index and aren't shown here).
If you change this
Files to re-check (1)
- omarchy-apply-lockbin/omarchy-apply-lock
Tests to re-run (1)
- apply-lock-test.shtest/shell.d/apply-lock-test.sh
What this rests on
Discussions
Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.