omarchy-plugin-check
Commit-bound safety and quality reviews for Omarchy plugins — the open tool.
Omarchy plugins (Quickshell/QML) run unsandboxed inside omarchy-shell, and
omarchy plugin add clones mutable upstream HEAD — so a review only means something
when it is pinned to a commit and the client can tell when the installed HEAD has drifted.
Review providers publish signed, commit-bound verdicts (safe | caution | risky | blocked);
this repository verifies and merges them, ranks plugins, and ships the website, the store app
and the checker plugin that gates installs.
Our own provider's scanner is closed on purpose: publishing detection rules and weights would let
attackers test evasions offline (ADR-0007, ADR-0011). Everything a user relies on to check a
verdict — the protocol, the signatures, the merge — is open here.
Components
| Path | What |
|---|
spec/ | Provider protocol v1 (PROTOCOL): in-toto statement, feed, registry, api/v1 + store schemas; opc_spec |
schemas/ | The optional report extension (predicate.report): report, findings, AI passes (JSON Schema 2020-12) |
aggregator/ | opc-aggregate: verify feeds (Sigstore), merge verdicts, publish api/v1/ + signed store.json |
collector/ | opc-collect: marketplace sync, GitHub activity, engagement, ranking |
site/ | Website (Astro, static): index, per-plugin reports, providers, static API under api/v1/ (README) |
store/ | omarchy-store app: standalone Quickshell app over one signed snapshot (README) |
plugin/ | the checker: CLI, menu, QML panel and bar widget, install gate; with store/ it is the installable omarchy-store (README) |
standards/ | Shared lint/type/hook configs and tool pins |
docs/ | ARCHITECTURE · VERDICT-LOGIC · THREAT-MODEL · REPORT-DIMENSIONS · RANKING · ENGINEERING · decisions |
Install omarchy-store
omarchy plugin add https://github.com/PrometheusRoot/omarchy-store --enable
One command: the store, the bar shield and the checker. Click the shield; the first run fetches
and verifies the signed snapshot. Menu entry, keybind and terminal commands are optional, from the
store's status tab (plugin/README, ADR-0042). Independent community project,
not affiliated with Omarchy.
Develop
just setup once, then just check before every commit. Everything else: docs/ENGINEERING.md.
AI agents: CLAUDE.md.
Phase status
| Phase | Scope | Status |
|---|
| P3 | Provider protocol, aggregator, collector, signed snapshot | done locally; data repo + Pages next |
| P4 | Astro static site | built; Pages deploy pending a published snapshot |
| P5 | omarchy-plugin-check plugin (CLI, menu, QML panel, install gate), store app; one-command omarchy-store | done |
| P6 | Scheduling | planned |
| P7 | Scale to all plugins, search, activity tracking, dynamic detonation | future |
Security
Report vulnerabilities privately through
GitHub private vulnerability reporting
only; scope and expectations are in SECURITY.md.
License
The code is MIT (every package's metadata says MIT). The data the aggregator and the
data repository publish (api/v1/, the signed snapshot and store bundle, providers.json, our
provider feed) is CC BY 4.0: reuse it freely with attribution. Marketplace metadata
quoted in it and other providers' attestations stay under their owners' terms.
