Add optional ABI-pinned Cua Hyprland plugin package

[f-trycua]

Scope

Update the optional Hyprland plugin package for the agreed stable x86_64
target. This PR remains held for Omarchy's own replay and release decision;
skip_build: true stays in place.

The recipe downloads immutable build kit 1.1.0,
profile omarchy-stable-20260910, instead of the historical 0.24.0 recipe.
Cua #3698 is merged. The plugin source is
Driver 0.26.1,
including the separately reviewed desktop-fault cleanup repair.
The original 0.24.0 release assets remain untouched. Please review this explicit
source change as part of the package update.

The intended Omarchy publication pairing is cua-driver-bin 0.27.0-1 plus
native Wayland Inkscape 1.4.4-6, with two independent Driver processes and
distinct native clients. Plugin package version 0.26.1-2 identifies its
pinned compositor-module source, not the separately installed Driver client.
The production plugin source and protocol are unchanged in Driver 0.27.0; that
release adds the bounded client-side stale-geometry retry described below.
Input protocol v3 and discovery protocol v2 are separate. Omarchy's own build,
replay, signing, and publication of this exact pairing remain pending.

Package contract

• Exact measured Hyprland 0.56.2-2, header, GCC 16.2.1 20260810, and
  shared-runtime identities; no compositor replacement or relaxed ABI guards.
• Checksum-pinned wrapper, complete downloaded inventory verification before
  executing tooling, and mandatory CTests even with --nocheck, --repackage,
  or --skipinteg.
• Production input built in; tracing and experimental signed input off.
• No hooks, autoloading, configuration edits, or hot replacement. Activation
  remains explicit after a fresh session and consumer compatibility check.
• Stable-only channel metadata, source: local, release_ring: fast, and
  scheduled-build exclusion. The Driver package and its update protection are
  unchanged by this PR.

The README documents activation, disabling input, incompatible desktop updates,
removal, matching rollback sets, and the best-effort ownership split.

Cua qualification

The qualification record
and #3698 separate production-package observations from trace-enabled
diagnostics and identify exact evidence digests.

Gate	Cua result
Final package paths	Fresh, separate-source-cache reuse, repackage, and skip-integrity paths each passed all 16 CTests; tampered archive refused
Real apps	Saved SVG and snapshot oracles verified keyboard and pointer effects through actual packaged Driver
Concurrency	Two independent native lanes with measured overlap; exact third-owner refusal
Primary input	Bounded independent observer checks passed; warp-and-return negative control failed as intended
Faults and lifecycle	Seven-case Fleet replay passed and retired move, resize, initial-primary, active-primary, peer-conflict, target-lifetime, and real 60-second idle/reconnect; sanitized archive SHA-256 43da0b7318b0b78613b87ce6a7b9afba228dafcc80724cab4013d5088c797555
Historical retained canonical run	Invocation 433ce968ee164d5e8e3226e800db93a6 recorded 128 required cells: 87 deliveries, 41 expected refusals, no failures/skips, using source-built Driver 0.24.0. A separate Omabot replay reported 124 passes and four failures.
Driver 0.27.0 repair qualification	Exact Cua #3732 candidate ea6ad2d40d4b018a216642177f907289c33a2c38 passed Electron drag, Electron editor save, Tauri drag, and GTK3 desktop scroll. Driver binary SHA-256 d6cb8756eb1520d1e3c6302527a270f6c6c847281e0ef8988b9c12e714671aa7; evidence SHA-256 9adbba75b52481e93b5352052b88d572ee1686b85676d3054a51a5f7e49ba1e9; cleanup verified. The exact release head then passed the canonical Linux desktop E2E. The repair is shipped in Driver 0.27.0, whose Linux x86_64 binary archive has SHA-256 87e547867ddb2a3ab7bb09ba79f7833f44a34ac11b21e7d150b867910d5999f2.
Exact published 0.27.0 replay	The published Linux x86_64 binary archive above, embedded Driver SHA-256 bb1b65394e912246220f9f758c9efbbf6260cec16e3562e62a361fa95329377f, and exact Driver/harness source 082de4344b731ae4738ddc6a6f13f21bb3c49a85 passed all four production cells, including GTK3 desktop scroll in 3,952 ms. Sanitized evidence SHA-256 b6c47278a3db398ecbb4d7aed2bce44a467e2af37e6d4ccfc236d1e07aa70af7; videos inspected; cleanup and independent namespace absence verified.
Final released-source package	Exact qualified module bytes, cold upgrade, fresh mapped-module proof, saved-output smoke, and client retirement passed

Duplicate motion notifications remain counted. They are acceptable only when
pointer identity/coordinates, focus, held input, and foreground interaction
remain unchanged. Real motion, including an excursion and return, fails. An
inert agent pointer may remain parked after input is released and authority is
revoked.

Current Calc, Chromium/Electron raw background input, XWayland, Unicode/IME,
non-US keymaps, and modified pointer gestures remain outside this profile.
These are bounded action/interval claims, not arbitrary-app or multi-user
isolation. Screenshots and build success do not replace native qualification.

Remaining Omarchy gates

The confirmed ownership split
keeps Cua responsible for profiles, kits, fixes, and native input evidence.
Francesco (@f-trycua) is the Cua contact. Omarchy owns integration, dependency
change detection, Omabot replay, and signing/publication. Spencer (@spencerbull)
and Emir (@emirb) are the named Omarchy package and release owners for the
replay, merge, signing, and publication path.

1. Re-run the focused Omabot cells/cases against the exact package and reconcile
   them with the immutable Cua evidence above. A Fleet result is supporting
   evidence, not an Omabot result; matching source alone does not certify
   different binaries.
2. Reconcile the exact Driver, module, package, profile, harness, and environment
   identities, including the Driver version that Omarchy intends to publish
   alongside the plugin.
3. After explicit merge approval, deliberately sign and publish the validated
   bytes. Keep skip_build: true until the declared gates pass; it is not an
   artifact-to-evidence publication gate by itself.
4. Verify the signed download on a fresh consumer and run a short activation,
   background-action, and cleanup smoke.

Omabot's downstream replay/reconciliation, signing, and Omarchy publication are
not claimed by this update. Broader channels and unattended publication remain
separate work.

[spencerbull]

Reviewed 0b8aa36730fea3980f52e7795cbe4ef16a638e69: no blocking code findings for merging this optional recipe with skip_build: true. It is not yet qualified for publication or live activation.

Codex GPT-6 in T3 Code reviewed the package and its integration; a second Codex GPT-6 review at xhigh found no defects in that scope. Both read the source; shared filesystem access means strict reviewer independence is not guaranteed. The second review identified the Driver protocol mismatch below, which I verified against both releases.

• The recipe matches the published 0.24.0 build kit byte for byte. Both archive digests, the kit's checksums, the pinned manifest digest, and all 42 source-file hashes verify.
• All four repository self-test suites passed on a fresh disposable Omabot x86_64 worker. Explicit build selection includes the plugin for edge, rc, and stable; unscoped selection excludes it in all three. These selection checks are not native qualification of those channels.
• An actual clean edge build failed dependency resolution: the mirror currently supplies Hyprland 0.56.2-2, while the recipe requires 0.56.2-1. Zero packages were built. Separately, the worker's installed Hyprland was 0.56.2-1, but its GCC was 16.2.1 20260810; the native verifier correctly refused it with GCC version/date mismatch. The required compiler is 16.1.1 20260728.
• Driver Add cua-driver-bin, the Cua computer-use driver, to the fast ring #306 currently packages 0.23.2, which lacks this plugin's v3 input client. Its injection path uses UnixStream and cua-inject v1; the plugin uses SOCK_SEQPACKET and protocol 3, with the corresponding client present in Driver 0.24.0. A matching Driver is therefore part of activation qualification; merging both package recipes does not establish working plugin input. See the 0.23.2 transport and 0.24.0 client.

No code or guards were changed. Keep scheduled builds disabled until a matching environment produces a package and passes native tests, package lifecycle, representative input, and fresh-session upgrade/rollback/removal. Those runtime gates were not reached here. Maintainer merge of the disabled recipe is a separate decision from enabling distribution. The CI self-test is now green; the body's pending-approval note is stale.

🤖 Generated by Codex GPT-6 in T3 Code. Reviewed by Codex GPT-6 XHigh.

[spencerbull]

Publication architecture follow-up, targeting Cua Driver 0.24.0. The Driver package update is prepared in #375 at 09b5f48136890498fe593b758c189e0a8c6e39f9. Its x86_64 artifact built, installed through omarchy pkg add, and ran as 0.24.0 on a fresh disposable Omabot worker; package updater containment and removal also passed. See the consolidated validation. The update remains unmerged and unpublished; it supplies the intended client version but does not qualify this plugin.

I recommend keeping this as an optional signed binary package, initially restricted to one qualified x86_64 channel. Updating the current hardcoded pins alone would not provide a sustainable publication path. Codex GPT-6 in T3 Code reassessed the source and current package machinery, with a Codex GPT-6 xhigh architecture review and a separate pipeline review. The reviewers support this direction; shared filesystem access does not enforce strict independence.

The proposed work has four boundaries:

1. Cua source and build tooling: preserve the published 0.24.0 assets. Introduce reviewed native environment profiles and separately versioned packaging tooling, retaining source hashes, exact compiler/runtime checks, mandatory tests and negative cases. Record source, tooling and profile identities separately so an ABI rebuild need not pretend to be a new Driver release. Source compatibility changes still require an explicit reviewed revision or patch set.
2. Omarchy packaging: use the existing channel allowlist and keep skip_build: true during qualification. Build signed artifacts against each supported environment, with unique package identities when ABI-specific bytes differ. Preserve the package's updater containment for Driver 0.24.0: upstream's pacman fix trycua/cua#3636 merged after that release tag.
3. Qualification and publication: dependency-version changes should trigger candidate builds, not certify them. Current rebuilt_against records planned versions by architecture, and skip_build only suppresses scheduling; neither enforces native acceptance before publication. Add a package-opt-in gate binding the artifact digest and destination environment to reviewed build, lifecycle and real-input evidence, including prebuilt publication paths.
4. Activation and upgrades: check the actual consumer compositor/runtime before loading, retain the plugin's ABI check, and require fresh compositor sessions for replacement. Disabling input does not remove the exact Hyprland package dependency. When no compatible replacement exists, the supported update flow must offer explicit plugin removal: confirm, exit Hyprland, remove the plugin and apply the desktop update outside the graphical session, then start and verify a fresh session. Direct pacman users retain a documented dependency refusal/removal path.

Keep discovery protocol v2, input protocol v3, native ABI qualification and application behavior separate. Driver 0.24.0's raw background input admits specific Calc/Inkscape versions; a successful ABI rebuild does not qualify arbitrary apps or layouts. Foreground and AT-SPI capabilities remain distinct. Hyprpm can remain a developer route, but local compilation does not replace these checks.

This plugin review remains a design review, with no plugin source changes or new plugin build/runtime qualification. The prior clean disabled-recipe verdict stands; broad publication should wait for these bounded gates. The immediate next work is to inventory one channel's native and application versions on a worker, prepare the profile-aware tooling, and revise this PR against that measured target and the Driver 0.24.0 package in #375. Fresh direct channel metadata reads returned HTTP403 here, so I am not asserting new channel versions from this pass.

Source anchors: release generator, load-time ABI check, application admission, current release sequence.

🤖 Generated by Codex GPT-6 in T3 Code. Reviewed by Codex GPT-6 XHigh.

[spencerbull]

Rereview of 0b8aa36730fea3980f52e7795cbe4ef16a638e69 against master be95483566c394a48b23e5f196631223cdc36882, including merged #375: the Driver version/protocol mismatch is resolved; this plugin is still not ready for functional publication or activation. The PR's three plugin files are unchanged. A clean local integration at a3cb2d4f5b353ce8b4119731920c28359598bea7 was used for the fresh Omabot run.

cua-driver-bin 0.24.0-1 is now published in edge, rc and stable, verified from freshly downloaded package databases. On a fresh disposable x86_64 worker, the stable package installed through omarchy pkg add cua-driver-bin directly from https://pkgs.omarchy.org/stable/x86_64; no local candidate repository was used. Its detached signature verified as a fully trusted Omarchy signature. Pacman reported 21 files with zero alterations; both the CLI and the running package-owned daemon reported 0.24.0, and health_report returned overall: ok. This verifies published delivery, startup and capability health, not plugin input. The worker's compositor remained the template's Hyprland 0.56.2-1; channel build dependencies were separately refreshed and measured.

The remaining native blockers are reproducible:

Requirement	Pinned contract	Current edge / rc / stable observation
Hyprland package	0.56.2-1	All supply 0.56.2-2
Compiler	GCC 16.1.1 20260728	GCC package 16.2.1+r23+gd564253eb6c8-1; worker compiler reports 16.2.1 20260810
Inkscape background eligibility	1.4.4-6	Matches the source allowlist; input remains untested
LibreOffice background eligibility	libreoffice-fresh 26.2.5-3	All supply 26.8.0-2, which the Driver's exact allowlist refuses

All four package-repository self-test suites passed. The actual bin/repo build --package cua-hyprland-plugin --arch x86_64 --mirror edge exited 1 with target not found: hyprland=0.56.2-1; zero plugin packages were built. The dependency is at PKGBUILD:10. Separately, on the template's installed 0.56.2-1, the checksum-verified upstream native verifier exited 1 with GCC version/date mismatch. An unrestricted gcc build dependency does not provision the exact compiler, and changing the Hyprland dependency alone would leave that verifier refusal. No additional omitted dependency was established before compilation could begin.

Codex GPT-6 in T3 Code reviewed the integration and worker results; a named Codex GPT-6 xhigh source reviewer found no new verified defect in the disabled recipe and confirmed the 0.24.0 client matches production protocol 3 and the plugin's SOCK_SEQPACKET transport. It also checked disabled-by-default input, same-user socket/peer checks, per-action authority, and stale-target refusal. This was a bounded source review; shared filesystem access does not enforce strict reviewer independence. The exact application allowlist applies to production background input. Foreground routing has separate guards; it was not validated here.

Keep skip_build: true. The next change belongs in the plugin's upstream packaging contract and then this PR: provide a separately versioned, checksum-pinned build kit/profile for Driver 0.24.0's source that qualifies the intended current channel, preserving compositor/compiler/runtime checks. Start application qualification with the matching Inkscape version. Supporting current LibreOffice background input also requires a separately reviewed Driver compatibility update; a plugin rebuild alone cannot change its client allowlist. Native plugin tests, lifecycle, fresh-session activation, application results, and restart-based upgrade/rollback/removal remain blocked by the failed build. The prior limited verdict for merging a disabled recipe is unchanged; it is not a working-plugin sign-off.

Published Driver artifact SHA-256: 0398f856abf73e30ec37a33ca5d0b9987b2e84108842726349bb8b149bba6fbd. Package recipes matched the local integration by SHA-256. No PR source, ABI guard, scheduled-build setting, or user's host installation was changed. The review daemon was stopped and the disposable worker destroyed.

🤖 Generated by Codex GPT-6 in T3 Code. Reviewed by Codex GPT-6 XHigh.

[spencerbull]

Current stance: hold this PR until it provides an installable, validated optional plugin for a supported Omarchy environment. This replaces the earlier limited recommendation that we could merge the recipe while builds stayed disabled. That would preserve the recipe, but our acceptance goal is a working integration. Keep skip_build: true while the work below is pending. cua-driver-bin 0.24.0-1 is already published and remains usable independently.

The plugin is valuable for a specific capability: raw mouse and keyboard actions in qualified native background applications through dedicated compositor input seats. The intended use is an agent working in a supported application while the person continues using another application. The v3 candidate provides two independent agent input lanes, exact live-target checks, conflict refusal and cancellation. Driver already owns CLI/MCP access, sessions and permission policy; its existing capture and accessibility capabilities remain usable independently. Some accessibility actions can also work in the background without synthetic input. The v3 exact-target foreground route also requires this plugin and its advertised foreground capability; it may change primary focus and cursor position.

This is limited multi-agent input concurrency within one desktop account. The transport checks the compositor user's UID and trusts code running as that user. It does not provide multi-user authentication, separate desktop accounts, tenant isolation or a sandbox for mutually untrusted agents. Two lanes cannot freely control the same application client, and human focus on a background target client revokes that lane's authority. The v3 protocol defines these limits; foreground routing is separate from the isolated background route.

The completed Omabot validation covers unchanged head 0b8aa36730fea3980f52e7795cbe4ef16a638e69. The published Driver installed from stable, its trusted Omarchy signature verified, and its daemon reported 0.24.0 with health ok. Four package-repository self-test suites passed. The plugin build produced zero packages: the recipe requires hyprland=0.56.2-1, while the refreshed edge/rc/stable databases on September 10 UTC supplied 0.56.2-2. The native verifier also rejected GCC 16.2.1 20260810 against its required 16.1.1 20260728. Plugin activation and input therefore remain untested. Codex GPT-6 in T3 Code checked the integration and worker evidence; the named Codex GPT-6 xhigh source reviewer found no new defect in the disabled recipe and confirmed that Driver 0.24.0 resolves the previous v3 client mismatch. Shared filesystem access does not enforce strict reviewer independence. This comment consolidates that review and the requested merge criteria; it reports no new test run.

Requested changes and dependencies before merge:

• Cua upstream — provide a maintained native build contract. Supply a new immutable, qualified build kit for an explicitly named initial Omarchy channel, covering its exact compositor, headers, compiler and shared runtime. Regenerate the recipe, verifier, provenance and checksums together, preserving their checks. Keep published 0.24.0 artifacts immutable; identify any source changes separately from packaging/environment changes. A package-release-number edit alone does not resolve the compiler/runtime contract.
• PR author — update this package to consume that qualified kit. Name one initial x86_64 channel and scope intended publication to it, with pinned artifact identities and accurate dependency requirements. Document the supported Driver/protocol pairing and activation procedure. Keep activation opt-in, and refresh the PR description's stale CI and dependency notes. Do not relax ABI checks or require Omarchy to downgrade its desktop/toolchain to fit the old kit.
• Cua/Omarchy — declare and prove the initial application scope. Inkscape 1.4.4-6 matches Driver 0.24.0's background-input allowlist and is the first candidate to validate. Current libreoffice-fresh 26.8.0-2 does not match its allowed 26.2.5-3; either explicitly defer Calc background support or provide a separately reviewed Driver compatibility update and evidence. That Driver change is required only if current Calc support is part of the initial promise. State the canonical US keymap, native-Wayland and operation limits; successful Inkscape delivery must not imply arbitrary-app support.
• Omabot/native validation — prove the actual package and desktop behavior. Require a clean channel build and bundled tests, package provenance/integrity checks, install/remove/reinstall checks, and fresh-session activation. Verify application state after supported actions, both lanes, a third owner's refusal, simultaneous primary-user interaction, target conflicts, stale-target/geometry refusals, cancellation and cleanup. Retain inspected visual/application evidence alongside exact source, package and environment identities. Then exercise restart-based upgrade, rollback and removal. Portable tests and health reports cannot satisfy these input gates.
• Omarchy packaging — make maintenance and upgrade handling explicit. Name ownership and CI triggers for compositor/toolchain changes, and require native compatibility evidence before publishing a changed artifact. Document the path when no compatible replacement exists: exit the graphical session, remove the optional plugin, apply the desktop update, and verify a fresh session. Preserve a matching rollback set. For the initial channel, attach the passing candidate evidence and document deliberate signing/publication after maintainer merge; expanded channels or unattended publication need their own enforced qualification gates.

What we are waiting for: a qualified upstream build contract and the resulting native evidence. Merely waiting for mirrors to refresh will not make the historical dependency pins suitable. The package and documentation changes can be prepared now; the merge decision remains pending until the declared initial scope passes the checks above.

trycua/cua#3636 fixes pacman-managed self-updates and is separate from these plugin blockers. Preserve the current package updater protection while targeting Driver 0.24.0. Adopting that upstream fix through a later suitable Driver release does not establish plugin ABI compatibility.

🤖 Generated by Codex GPT-6 in T3 Code. Reviewed by Codex GPT-6 XHigh.

[f-trycua]

The upstream packaging follow-up is selected in trycua/cua#3698. It preserves the published 0.24.0 source archive and adds a separately identified environment profile, verifier and build kit. Native validation is still pending; skip_build: true stays in place.

A fresh public archive audit found matching base-package checksums across stable, RC and edge for Hyprland 0.56.2-2, Inkscape 1.4.4-6, and GCC 16.2.1+r23+gd564253eb6c8-1. The downloaded Hyprland ELF identifies GCC 16.2.1 20260810. This is archive evidence, not a claim about an installed worker or plugin compatibility. I propose stable x86_64 for the initial profile, with Inkscape-only background qualification and both independent input lanes retained. Current Calc remains deferred.

@spencerbull, can you confirm stable as the initial channel and the representative Omabot build/native environment for the final packaging-path replay? Cua will own the immutable kit/profile updates and input qualification. Who should own Omarchy's dependency-change trigger, package build, and deliberate signing/publication of the exact certified bytes?

I am preparing the matched Fleet environment and native evidence in parallel. That will not substitute for the Omarchy packaging-path replay or your merge/publication decision.

[spencerbull]

We confirm stable x86_64 as the initial supported release target, with edge and RC used for ongoing compatibility validation. We support the separately versioned build-kit/profile approach in Cua #3698, preserving the published Driver 0.24.0 source and its compatibility guards.

Application scope: Driver 0.24.0's isolated background mouse/keyboard path currently admits two applications at exact versions:

Application	Admitted package
Inkscape	inkscape 1.4.4-6
LibreOffice Calc	libreoffice-fresh 26.2.5-3

This allowlist is enforced. Current Omarchy Calc is outside it, so the proposed first Omarchy qualification covers Inkscape; current Calc and broader application support require separate compatibility work and evidence. Foreground input, capture and accessibility have separate contracts. Two input lanes mean two concurrent agent owners, not a permanent limit of two supported applications or multi-user security isolation.

Support model: Edge detects upcoming incompatibilities; RC validates the environment intended for stable; stable receives qualified optional packages. Qualification follows the actual Driver/plugin, Hyprland, runtime and application versions in each channel. On x86_64, Hyprland comes from the channel's Arch mirror, so mirror updates and channel switches must trigger compatibility checks. Matching version labels alone do not establish matching binaries.

Maintenance is best effort, with no agreed turnaround or promise of a compatible plugin for every desktop update. If a matching replacement is unavailable, offer explicit plugin removal so the desktop can update. Require consent and a fresh-session procedure; declining removal preserves the dependency refusal. Keep a matching rollback set.

Proposed ownership, for Cua to confirm: Cua maintains the profiles/build kits, fixes plugin incompatibilities and supplies native input evidence. Omarchy owns package integration, dependency-change detection, Omabot validation, and signing/publication decisions. Omarchy supplies upcoming RC environment details; Cua responds on a best-effort basis. Please confirm this split and name the Cua contact.

Next steps:

1. Cua: finish #3698's remaining native gates and publish the reviewed immutable kit/profile with accessible evidence. The reported native build/load and bounded two-client Inkscape keyboard results are progress; pointer qualification and the remaining acceptance checks still need completion.
2. Package author: update Add optional ABI-pinned Cua Hyprland plugin package #346 to consume those exact assets through Omarchy's build path, and document application limits, activation, channel changes, updates and removal.
3. Omarchy/Omabot: replay the package build and installation on a fresh worker matching the measured stable profile, using the actual published cua-driver-bin 0.24.0-1. Verify application effects, both lanes using distinct native Wayland clients and independent Driver processes, third-owner refusal, human-input isolation, stale-target/conflict refusal, cancellation, and restart-based upgrade/rollback/removal. Bind results to the actual Driver executable and shipped plugin/package bytes.
4. Omarchy release owner: keep Add optional ABI-pinned Cua Hyprland plugin package #346 unmerged and skip_build: true until the declared initial scope passes. After explicit merge approval, deliberately sign/publish the validated bytes and verify the downloaded package. Unattended publication requires an enforced artifact-to-evidence gate.
5. Cua and Omarchy: document the follow-up path for current Calc and broader application support, and assign the Omarchy package/release owner before rollout.

Codex GPT-6 in T3 Code prepared this maintainer-directed proposal; Codex GPT-6 at xhigh checked its scope and wording. This is a comment-only review, with no new code review or Omabot runtime pass.

🤖 Generated by Codex GPT-6 in T3 Code. Reviewed by Codex GPT-6 XHigh.

[f-trycua]

Confirmed on the proposed best-effort ownership split: Cua maintains the immutable profiles/build kits, plugin compatibility fixes, and native input evidence; Omarchy owns integration, dependency-change detection, Omabot validation, and signing/publication decisions. Francesco (@f-trycua) is the Cua contact through this PR. There is no turnaround commitment or guarantee of a compatible plugin for every desktop update.

Stable x86_64 and Inkscape 1.4.4-6 remain the initial scope, with both independent input lanes. The current candidate builds with the measured Hyprland/toolchain and is installed in a fresh validation session. Remaining native acceptance is tracked in Cua #3698; this is not a merge or publication request yet.

@spencerbull, who should be the named Omarchy package/release owner for the final Omabot replay and deliberate signing/publication? We will keep skip_build: true while those gates remain open.

[spencerbull]

Taking a look!

@f-trycua, @emirb and I will own the omarchy pkgs and run it through our validation flows, and work with you on any big updates.

[spencerbull]

Omabot review of ab84f6c7a1ff85a37920dc19630e2aee9e3d7ccc: not ready to merge yet. The earlier Hyprland/compiler dependency blockers are resolved, and the package builds and installs successfully. The remaining gates are an activation-documentation correction and the qualification failures below.

P2 — document the exact keymap prerequisite. The activation instructions say “canonical US” without specifying rules=evdev, model=pc105, layout=us, empty variant/options and no custom keymap file. Stock Omarchy 4.0.3 English (US) uses compose:caps,shift:both_capslock_cancel. A user can therefore pass the consumer check and reach ready input v3 while plugin-routed background input is refused as unsupported_layout. We reproduced that refusal with the packaged Driver and production module, with zero dispatch. Document the explicit Lua override, its Compose/Caps tradeoff, reload/readback and a safe verification action, and restoration of prior settings. Keep this opt-in and preserve the admission guard. Disabling NumLock was only a strict observer-fixture requirement, not a demonstrated background-input requirement.

The complete unchanged Linux runner recorded 124 passes and four failures across 128 cells. This used source-built released Driver 0.24.0, separately from the installed-package native proofs:

Failed cell	Observed result
linux-electron-drag-px-foreground	Drag started, then returned partial/unknown delivery; the fixture ended outside the drop target.
linux-tauri-drag-px-foreground	Drag started, then returned partial/unknown delivery.
linux-electron-editor-save-ax-foreground	Typing returned Hyprland input connection failed; the document remained draft.
linux-gtk3-desktop-scroll-px-foreground	Fixture activation refused stale_geometry before scroll dispatch or recording.

The final evidence validator rejected the GTK3 case’s missing video/turn evidence, and the runner exited nonzero. These observations do not establish a common cause or an Inkscape background-lane defect. Interrupted actions were not replayed. Cua should diagnose these exact cells and requalify them using fresh fixtures and the original assertions; the existing exact-cell selector can support that investigation. Compositor leave-marshalling warnings are retained in the logs, but are not causally attributed to these failures.

Seven native qualification cases remain unproven: move, resize, initial-primary conflict, active-primary takeover, peer conflict, target lifetime, and real idle expiry/reconnect. Their original helpers were invoked, but stopped before the intended action/fault. Bounded Inkscape observations omitted the required selection-status footer that fresh full snapshots and inspected images showed. Primary-conflict cleanup additionally accessed missing trace_after; idle cleanup masked its initial failure, and never reached the real 60-second expiry interval. Cua should correct observation and failed-setup cleanup, supply a pinned harness revision, and have Omabot replay these cases. No helper assertion or snapshot limit was relaxed, and these failures are not proof that the intended plugin behavior is defective.

The tested pairing is plugin 0.26.1-2 + published cua-driver-bin 0.24.0-1, stable x86_64, Omarchy 4.0.3-1, Hyprland 0.56.2-2, and profile omarchy-stable-20260910. Plugin source cc542544 contains the upstream repair; its version does not mean Driver 0.26.1 was tested. The current profile qualifies native Inkscape 1.4.4-6 with two independent input lanes in one user session. Current Calc and broader application support remain outside this qualification.

Passed validation	Evidence
Package/build integrity	Exact PR built through bin/repo build --package cua-hyprland-plugin --arch x86_64 --mirror stable; four repository self-tests, 16 CTests in both package phases, and 113 upstream packaging tests passed. Pinned kit/source/tool identities matched; corrupted kit rejection worked even with --skipinteg.
Production package and real applications	Consumer/integrity checks, explicit activation, six two-lane keyboard actions and ten pointer/save operations passed using the actual packaged Driver. Both saved SVGs and fresh image/semantic results were inspected. Independent foreground isolation reported zero violations; deliberate interference was correctly detected by its negative control.
Separate diagnostic module	Traced overlapping drags, cleanup, third-owner refusal, SIGKILL/SIGTERM cancellation with sibling completion/recovery, and configuration/keymap/display/lock fault cases passed within their stated scopes.
Package lifecycle	Cold same-version reinstall, removal and restoration passed with three fresh compositor processes, unchanged desktop configuration/binary fingerprints, and no automatic plugin loading. Packaged Driver desktop capture worked after each transaction, including removal. Explicit reactivation then passed another fresh two-lane keyboard/saved-SVG proof.

The bounded source/security review found no additional verified causal defect. Production observer checks and diagnostic traces are separate evidence; lock/unlock transition isolation and interrupted saved-document effects remain unproven. Canonical tests used the full-resolution workaround for the existing Linux harness scaling issue, so the default resized-image path is not certified. The history gate rebuilt its source Driver as prescribed; neither source-built executable is being represented as the installed package binary. These VM results do not qualify bare metal, edge/RC, broader applications, or multi-user security isolation.

Recorded SHA-256 identities:

• Unsigned Omabot package: 4bc6809222fdce66093d258ddb144184b2ea88d81147fc315960faf1e81cac9e.
• Installed production module: 65e362aba8b0b6c187b1952791e5a57705cf22262ec100b1c8c6d9ed18215324, matching the upstream qualified module.
• Installed Driver executable: de5780e43a0ef1e6a7df13884d0c56e2972b9ef26097fcba484288b9818148dd.

Next steps:

1. Cua: diagnose the four canonical failures and repair the native observation/cleanup harness. Pin the resulting qualification inputs; publish a new product/profile artifact only if diagnosis requires changing those bytes. These findings do not yet establish a required Driver upgrade.
2. Omarchy/Omabot: replay the outstanding cases against the identified candidate and reconcile the evidence before requesting the maintainer’s merge decision. Keep stable as the supported target, edge/RC qualification best effort, and skip_build until deliberate release enablement. Preserve exact dependency guards and explicit user-consented plugin removal for incompatible desktop updates.
3. Publication owners: after acceptance, sign/publish the validated artifact and verify a fresh signed-consumer install and background action. The tested removal/restoration is not a historic version downgrade or a real incompatible desktop upgrade; retain a matched rollback set before future version transitions.

Codex GPT-6 in T3 Code coordinated this Omabot run. A separate Codex GPT-6 reviewer at xhigh checked the exact source and independently reconciled raw evidence; two further Codex GPT-6 threads ran upstream/native and canonical validation. Shared filesystem access does not enforce read isolation. The reviewers’ reconciled recommendation is to retain the merge hold for the items above.

🤖 Generated by Codex GPT-6 in T3 Code. Reviewed by Codex GPT-6 XHigh.

[f-trycua]

Cua-side validation is now complete and the PR body has been refreshed with immutable evidence. The exact Driver repair candidate passed all four previously failing canonical cells on Fleet, including GTK3; the separate seven-case recovery/lifecycle replay also passed and retired every case with verified cleanup. The repair is merged in trycua/cua#3732 and shipped in Cua Driver 0.27.0. Could Omabot please replay the focused package cells/cases against this PR and reconcile the exact Driver/module/profile identities? skip_build: true remains in place pending your merge/sign/publish decision.

[f-trycua]

Driver PR #395 is merged, and the stable x86_64 repository now serves cua-driver-bin 0.27.0-1 plus its detached signature (repository SHA-256 c4981fed72efb474c87646760f8079e93d810c0f13696d2b3c1b7732a0e81e19).

This plugin branch is rebased onto the exact current master containing that Driver recipe at head 6970a5da896416d6628e1472ad9dada7c37f29a0; both self-tests and build-isolation are green. The three-file plugin diff and pinned bytes are unchanged, and skip_build: true remains in place.

@spencerbull, the exact-pair Omabot replay can proceed against the published Driver package when ready.

[spencerbull]

Omabot re-review of exact head 6970a5da896416d6628e1472ad9dada7c37f29a0: retain the merge hold. The stable x86_64 package path and the stated Inkscape support scope pass, but the PR's explicit Driver 0.27 replay gate is not reconciled because two of the four previously failing canonical cells still fail reproducibly on Omarchy.

No verified source, package-shape, or security defect was found in the three-file PR diff. Codex GPT-5.6 Sol in T3 Code reviewed the exact current head, and a separate Codex GPT-5.6 Sol reviewer at xhigh found the plugin files byte-identical to the reviewed pre-rebase version and found no new defect; shared filesystem access means strict reviewer independence is not guaranteed. Both current CI checks are green.

The replay used a fresh credential-free Omabot worker running Omarchy 4.0.3-1, Hyprland 0.56.2-2, aquamarine 0.15.0-2, Inkscape 1.4.4-6, and the published, fully trusted stable package cua-driver-bin 0.27.0-1. The repository package SHA-256 is c4981fed72efb474c87646760f8079e93d810c0f13696d2b3c1b7732a0e81e19; pacman -Qkk reported 21 Driver files with zero alterations. The installed executable SHA-256 is 72a5d34ace1eed0937bf48f1873de79f3d3f04a72828c4ce25fce2220d483551 because the Omarchy recipe replaces exactly two updater URLs in place. Reversing only those substitutions reproduced the upstream released executable SHA-256 bb1b65394e912246220f9f758c9efbbf6260cec16e3562e62a361fa95329377f, resolving the binary identity difference.

The exact PR recipe built through bin/repo build --package cua-hyprland-plugin --arch x86_64 --mirror stable. All four repository self-test suites passed, and both mandatory package phases passed all 16 CTests. The unsigned candidate is cua-hyprland-plugin 0.26.1-2, package SHA-256 fc744681609f644749ed2bf26416d8bfc83f51a20216bb45a0152576ae0cc59e; the installed module SHA-256 is 65e362aba8b0b6c187b1952791e5a57705cf22262ec100b1c8c6d9ed18215324. Build kit 7beb736adfd334eed52e84070177634269e3a09f8bb25971b38606933ff4c997, profile 5dacea79a6a5927e59fca7b51e6c04e94fa45133ac1b8fb7f4e1f442d113eb9a, plugin source cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7, and Driver/harness source 082de4344b731ae4738ddc6a6f13f21bb3c49a85 matched the declared inputs.

The supported production path passed with the actual installed packages. Explicit activation mapped the exact module with an ABI match, protocol 3 ready, and two idle lanes. Two independent Driver processes controlled two distinct native Inkscape clients concurrently; six background keyboard actions completed, both documents saved with exact SVG position oracles [2,0], inspected screenshots showed the expected X 40 to 42 changes and saved state, the independent foreground observer recorded no motion/focus violations, and both lanes retired idle. Clean removal, fresh-session absence, reinstall, manual load/unload, package integrity, and byte-exact desktop configuration restoration also passed. The plugin did not autoload, and the final fresh compositor had no mapped module or config error.

The complete unchanged 0.27 Linux canonical runner recorded 130 results: 82 deliveries, 41 expected refusals, seven failures, and no skips. Clean focused reruns cleared the Electron type-text, type-submit, press-key, and editor-save failures. The remaining reproducible failures are:

Cell	Omarchy result
linux-electron-drag-px-foreground	The compositor acknowledged drag start, then returned foreground_partial_unknown; delivery remained partial/unknown and the fixture ended outside the drop target. It failed with both the source-built and installed Driver, including a clean repeat after dismissing all desktop notifications.
linux-tauri-drag-px-foreground	The same acknowledged-start, partial/unknown result occurred with both Driver forms and on the clean notification-free repeat.
linux-gtk3-scroll-ax-foreground	The Driver refused before dispatch with input point outside attested logical target geometry. The test declares linux_at_spi_action, but the Linux foreground branch resolves the off-screen GTK scrollbar element to a window-local compositor pointer point; the fixture remained at scroll_offset=0. This is a newly observed broader-app/harness contract issue, not the previously failing GTK3 desktop-scroll cell, which now passes.

One installed-Driver focused Electron press_key repeat also returned Hyprland input connection failed; it passed in the clean source-focused rerun and the installed Inkscape keyboard proof passed, so this is retained as an unresolved intermittent result rather than treated as an Inkscape failure.

The current support promise remains intact: stable x86_64, native Wayland Inkscape 1.4.4-6, canonical US keymap, and two independent lanes inside one desktop account. The failed Electron, Tauri, and GTK3 foreground cells do not expand that support scope, but two are the exact regression cells this PR names as its pre-merge replay gate. An all-green canonical or exact four-cell reconciliation therefore cannot be claimed, and merging now would contradict the README's stated gate even though skip_build: true prevents scheduled publication.

Next steps: Cua should reproduce the two foreground drag cells on the recorded Omarchy/Hyprland environment and explain the difference from its exact-release Fleet evidence, then provide a Driver or plugin candidate if the failure is in production code. Cua should also align the GTK3 foreground-scroll test's declared route and target geometry with the path it actually exercises. Omarchy/Omabot can then replay only those affected cells plus the intermittent package-backed key action. Keep skip_build: true; after those results reconcile and the maintainer approves merge, sign the validated plugin bytes and perform the documented fresh signed-consumer smoke before publication. No plugin source change is justified until the drag failure is localized.

🤖 Generated by GPT-5.6 Sol in T3 Code. Reviewed by GPT-5.6 Sol XHigh.

[spencerbull]

I'm thinking we merge and open these as open issues for the plugin for further enablement. Thoughts @f-trycua?

[f-trycua]

yeah, I agree. I'd merge the recipe with skip_build: true, open focused upstream issues for those failures