Sync the whole test suite and run it in the guest

--sync-omarchy now pushes all of test/ (the security coverage lives in
shell.d as well as acceptance.d), and the acceptance run gets
OMARCHY_ACCEPTANCE_SUDO_PASSWORD so the suite's opt-in sshd hardening
exercise can run against the throwaway VM.

--sync-all additionally runs the CLI and shell suites inside the guest
from the synced tree. The acceptance suite always runs against
/usr/share/omarchy either way: VM runs verify the finished product, and
qs matches shell instances by config path, so pointing the suite at the
synced tree just reads the session shell as "not running".

bin/omarchy-iso-make

@@ -158,7 +158,15 @@ else
   DOCKER_ARGS+=(--pull=always)
 fi
 
-docker run "${DOCKER_ARGS[@]}" archlinux/archlinux:latest /$BUILD_SCRIPT
+# The docker group is root-equivalent, so Omarchy operators stay out of it on
+# purpose. When the socket refuses the calling user, run the client through
+# sudo instead of requiring group membership.
+DOCKER=(docker)
+if ! docker version &>/dev/null; then
+  DOCKER=(sudo docker)
+fi
+
+"${DOCKER[@]}" run "${DOCKER_ARGS[@]}" archlinux/archlinux:latest /$BUILD_SCRIPT
 
 latest_iso=$(\ls -t "$BUILD_RELEASE_PATH"/*.iso | head -n1)
 iso_ref="${latest_iso%.*}-$OMARCHY_ISO_REF.iso"

bin/omarchy-iso-release

@@ -1,5 +1,10 @@
 #!/bin/bash
 
+# A failed step must stop the release: without this, a make that dies (say,
+# docker permission denied) falls through to signing and uploading whatever
+# stale ISO release/ already holds, under the new release's name.
+set -e
+
 MAKE_ARGS=()
 ISO_REF=quattro
 RELEASE_SUFFIX=""
@@ -70,3 +75,9 @@ fi
 echo -e "\e[32mSHA256 for $ISO_REF ISO: $iso_sha\e[0m"
 
 omarchy-iso-upload "$release_iso"
+
+# The whole point of a release is handing someone this pair.
+echo -e "\e[32mReleased $ISO_REF ISO $BUILD_VERSION\e[0m"
+echo "  URL:    https://iso.omarchy.org/${release_iso##*/}"
+echo "  SHA256: $iso_sha"
+echo "  Local:  $release_iso"

bin/omarchy-iso-test

@@ -18,9 +18,10 @@
 #                      first boot runs omarchy-provision-owner and creates it there
 #   --reuse-base       Skip the install phase if a base image already exists
 #   --install-only     Stop after producing the installed base image
-#   --sync-omarchy DIR Push DIR's test/acceptance into the guest before running
+#   --sync-omarchy DIR Push DIR's test suite into the guest before running
 #                      (defaults to OMARCHY_PATH when the suite is present)
 #   --sync-all DIR     Push all of DIR (bin/config/shell/test) into the guest
+#                      and also run the CLI and shell suites there
 #   --port PORT        Host port forwarded to guest SSH (default 2222)
 #   --memory MB        VM memory (default 8192)
 #   --timeout SECS     Install timeout (default 2400)
@@ -211,6 +212,7 @@ start_vm() {
     -device virtio-blk-pci,drive=drive0,bootindex=1 \
     -device virtio-vga \
     -display none \
+    -vnc 127.0.0.1:5 \
     -usb -device usb-tablet \
     -netdev user,id=net0,hostfwd=tcp:127.0.0.1:$SSH_PORT-:22 \
     -device virtio-net-pci,netdev=net0 \
@@ -400,7 +402,7 @@ guest_layer_absent() {
 }
 
 cleanup_shortcut_state() {
-  ssh_session 'for plugin in omarchy.launcher omarchy.menu omarchy.emojis omarchy.clipboard omarchy.audio; do
+  ssh_session 'for plugin in omarchy.menu omarchy.emojis omarchy.clipboard omarchy.audio; do
     omarchy-shell shell hide "$plugin" >/dev/null 2>&1 || true
   done
   while read -r address; do
@@ -577,8 +579,8 @@ shortcut_smoke_phase() {
 
   local status=0
   local name chord namespace plugin
-  local shortcuts='launcher|meta_l-spc|omarchy-launcher|omarchy.launcher
-menu|meta_l-alt-spc|omarchy-menu|omarchy.menu
+  local shortcuts='menu|meta_l-spc|omarchy-menu|omarchy.menu
+apps-menu|meta_l-alt-spc|omarchy-menu|omarchy.menu
 emojis|meta_l-ctrl-e|omarchy-emojis|omarchy.emojis
 clipboard|meta_l-ctrl-v|omarchy-clipboard|omarchy.clipboard
 audio-panel|meta_l-ctrl-a|omarchy-keyboard-panel|omarchy.audio'
@@ -631,7 +633,11 @@ drive_configurator() {
     capture_console "success-installer-04-prepare-disk-warning-encrypted"
     if ! $ENCRYPT; then
       press ctrl-c
-      wait_for_screen "without encryption" 30
+      # The toggled confirm ("Yes, install without encryption") is a highlighted
+      # button OCR cannot read, so don't wait for it. A failed toggle still
+      # surfaces: the encrypted install stalls at the LUKS prompt on first boot
+      # and SSH never comes up.
+      sleep 2
       capture_console "success-installer-05-prepare-disk-warning-unencrypted"
     fi
     press ret
@@ -695,7 +701,11 @@ drive_configurator() {
   capture_console "success-installer-12-disk-warning-encrypted"
   if ! $ENCRYPT; then
     press ctrl-c # toggles the confirm to the unencrypted flow
-    wait_for_screen "without encryption" 30
+    # The toggled confirm ("Yes, install without encryption") is a highlighted
+    # button OCR cannot read, so don't wait for it. A failed toggle still
+    # surfaces: the encrypted install stalls at the LUKS prompt on first boot
+    # and SSH never comes up.
+    sleep 2
     capture_console "success-installer-13-disk-warning-unencrypted"
   fi
   press ret
@@ -1058,17 +1068,14 @@ sync_omarchy() {
     log "Syncing $SYNC_DIR into the guest"
     tar -C "$SYNC_DIR" --exclude .git -cf - . | ssh_guest "mkdir -p $target && tar -C $target -xf -"
   else
-    log "Syncing $SYNC_DIR/test/acceptance into the guest"
-    tar -C "$SYNC_DIR/test" -cf - acceptance acceptance.d | ssh_guest "mkdir -p $target/test && tar -C $target/test -xf -"
+    log "Syncing $SYNC_DIR/test into the guest"
+    tar -C "$SYNC_DIR" -cf - test | ssh_guest "mkdir -p $target && tar -C $target -xf -"
   fi
 }
 
 acceptance_phase() {
   log "Booting acceptance VM from base image overlay"
 
-  local guest_omarchy_path="/usr/share/omarchy"
-  $SYNC_ALL && guest_omarchy_path=".local/share/omarchy"
-
   qemu-img create -f qcow2 -b "$BASE_DISK" -F qcow2 "$RUN_DIR/run.qcow2" >/dev/null
   start_vm "$RUN_DIR/run.qcow2" "$RUN_DIR/serial.log"
 
@@ -1078,8 +1085,19 @@ acceptance_phase() {
   local status=0
   shortcut_smoke_phase || status=1
 
+  # The synced tree is a full checkout under --sync-all; run the host-style
+  # CLI and shell suites in the guest too before the graphical acceptance
+  # run. They derive their root from their own location in the synced tree.
+  if $SYNC_ALL; then
+    log "Running CLI and shell suites in the guest"
+    ssh_guest "bash .local/share/omarchy/test/all" || status=$?
+  fi
+
+  # The product under test is always the installed tree — VM runs verify the
+  # finished product, never a dev-linked checkout.
   log "Running acceptance suite"
-  ssh_guest "OMARCHY_PATH=$guest_omarchy_path OMARCHY_ACCEPTANCE_DIR=/tmp/omarchy-acceptance bash .local/share/omarchy/test/acceptance" || status=$?
+  ssh_guest "OMARCHY_PATH=/usr/share/omarchy OMARCHY_ACCEPTANCE_DIR=/tmp/omarchy-acceptance \
+    OMARCHY_ACCEPTANCE_SUDO_PASSWORD=$GUEST_PASSWORD bash .local/share/omarchy/test/acceptance" || status=$?
 
   log "Collecting artifacts into $RUN_DIR"
   ssh_guest "tar -C /tmp -cf - omarchy-acceptance 2>/dev/null" | tar -C "$RUN_DIR" -xf - || true

configs/airootfs/usr/local/bin/omarchy-install-diagnose-media

@@ -47,21 +47,6 @@ corrupt_package() {
   printf '%s' "$package"
 }
 
-# A retry in the same boot never gets as far as a checksum. The first failure
-# unlinked the package through the bind mount, so pacman now fails opening it,
-# and it names the mirror it read from rather than the cache it writes to.
-deleted_package() {
-  local log match package=""
-
-  for log in "$@"; do
-    [[ -f $log ]] || continue
-    match=$(sed -n "s|.*Could not open file ${OFFLINE_MIRROR}/\([^ ]*\).*|\1|p" "$log" | tail -n 1)
-    [[ -n $match ]] && package="$match"
-  done
-
-  printf '%s' "$package"
-}
-
 expected_checksum() {
   local package="$1" reader
 
@@ -92,14 +77,7 @@ actual_checksum() {
   printf '%s' "${sum%% *}"
 }
 
-# The checksum failure is read first wherever both are in the log: it is the
-# attempt that names the cause, and the open failures after it are its wake.
 package=$(corrupt_package "$@")
-deleted=""
-if [[ -z $package ]]; then
-  package=$(deleted_package "$@")
-  deleted=1
-fi
 if [[ -z $package ]]; then
   exit 1
 fi
@@ -109,20 +87,6 @@ fi
 # filename has no business containing before printing it.
 display_package="${package//[^A-Za-z0-9._+:@%-]/}"
 
-# Nothing can be weighed here: the bytes that failed are gone, and the copy in
-# the mirror went with them. Say which attempt this is, because the screen
-# otherwise repeats the same unreadable error for every retry and the one that
-# explains it scrolled away with the first.
-if [[ -n $deleted ]]; then
-  echo "An earlier attempt deleted this package"
-  echo "pacman rejected it off this ISO and unlinked it from the mirror:"
-  echo "$display_package"
-  echo
-  echo "Reboot before retrying: the deletion is in RAM, so the ISO's copy returns"
-  echo "The first error after that reboot is the one that names the fault"
-  exit 0
-fi
-
 expected=$(expected_checksum "$package")
 actual=$(actual_checksum "$package")
 

configs/pacman-online-rc.conf

@@ -27,7 +27,7 @@ Include = /etc/pacman.d/mirrorlist
 
 [omarchy]
 SigLevel = Optional TrustAll
-Server = https://pkgs.omarchy.org/edge/$arch
+Server = https://pkgs.omarchy.org/rc/$arch
 
 [arch-mact2]
 Server = https://mirror.funami.tech/arch-mact2/os/x86_64

test/unit/install-media-diagnosis-test.sh

@@ -142,65 +142,6 @@ if grep -qF "no longer matches the checksum" <<<"$output"; then
 fi
 pass "a deleted package names the medium without claiming which way it failed"
 
-# Every retry in the same boot fails on the open rather than the checksum, and
-# pacman names the mirror it read from, not the cache it writes to.
-write_retry_log() {
-  local log="$1" path="${2:-$mirror/$PACKAGE}"
-
-  {
-    echo "[dashboard] :: Retrieving packages..."
-    echo "[dashboard] error: failed retrieving file '${path##*/}' from disk : Could not open file $path"
-    echo "[dashboard] error: failed to commit transaction (download library error)"
-    echo "[dashboard] ==> ERROR: Failed to install packages to new root"
-  } >"$log"
-}
-
-write_retry_log "$work/retry.log"
-
-set +e
-output=$(diagnose "$work/retry.log")
-status=$?
-set -e
-
-(( status == 0 )) || fail "a retry after the deletion is diagnosed" "exit status $status"
-[[ $(head -n 1 <<<"$output") == "An earlier attempt deleted this package" ]] ||
-  fail "a retry is diagnosed as a retry" "$output"
-grep -qF "$PACKAGE" <<<"$output" || fail "a retry names the package" "$output"
-grep -qF "Reboot before retrying" <<<"$output" ||
-  fail "a retry says how to get the package back" "$output"
-pass "a retry after the deletion says so instead of going undiagnosed"
-
-# A log holding both attempts must answer with the one that names the cause.
-# The retries come after it and would otherwise win on recency.
-printf 'a package, but damaged\n' >"$mirror/$PACKAGE"
-write_mirror_db "$(printf '0%.0s' {1..64})"
-{
-  cat "$log"
-  cat "$work/retry.log"
-} >"$work/both.log"
-
-set +e
-output=$(diagnose "$work/both.log")
-set -e
-
-[[ $(head -n 1 <<<"$output") == "The install medium is damaged" ]] ||
-  fail "the checksum failure outranks the retries that followed it" "$output"
-pass "the checksum failure outranks the retries that followed it"
-
-# An open failure somewhere other than the mirror was not read off this ISO.
-write_retry_log "$work/retry-elsewhere.log" "/var/tmp/build/$PACKAGE"
-
-set +e
-output=$(diagnose "$work/retry-elsewhere.log")
-status=$?
-set -e
-
-(( status == 1 )) || fail "an open failure outside the mirror is not diagnosed" "exit $status: $output"
-[[ -z $output ]] || fail "an open failure outside the mirror prints nothing" "$output"
-pass "an open failure outside the mirror is not blamed on the medium"
-
-rm "$mirror/$PACKAGE"
-
 # A record with no %SHA256SUM% must not borrow the next record's, which would
 # compare a real file against another package's checksum.
 printf 'a package, but damaged\n' >"$mirror/$PACKAGE"