[fix] Voxtype installation on ARM64 guests

THIRD_PARTY_NOTICES.md

@@ -26,6 +26,10 @@ code.
 - **yay** — GPL-3.0-or-later; the official ARM64 release and its versioned
   license are pinned in `guest/spec.json` and packaged into the guest's local
   repository.
+- **Voxtype** — MIT; the signed v1.0.1 ARM64 CPU, ONNX, and OSD release assets,
+  release key, source archive, and checksums are pinned in `guest/spec.json`.
+  They are packaged in the guest's local repository but remain uninstalled
+  until the user invokes Omarchy's optional dictation installer.
 - **1Password** — proprietary software not redistributed by Try Omarchy. When a
   user explicitly invokes its optional ARM64 installer, the guest resolves the
   current vendor release and AUR CLI recipe after the factory build. These

guest/build.sh

@@ -253,6 +253,11 @@ python3 "$guest_dir/scripts/apply-omarchy-backports.py" --root "$root" --spec "$
   --work "$work" \
   --spec "$spec" \
   --pacman-config "$pacman_config"
+"$guest_dir/scripts/register-pinned-voxtype.sh" \
+  --root "$root" \
+  --work "$work" \
+  --spec "$spec" \
+  --pacman-config "$pacman_config"
 "$guest_dir/scripts/register-local-repository.sh" --root "$root" --spec "$spec"
 arch-chroot "$root" /usr/local/lib/try-omarchy/finalize-rootfs
 arch-chroot "$root" pacman -Q | LC_ALL=C sort >"$root/usr/share/try-omarchy/packages.lock.txt"

guest/keys/voxtype-release.asc

@@ -0,0 +1,12 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Comment: 9CCF 7915 B750 CAE8 B095  ED1A A3FC 9F33 FD20 9279
+Comment: Voxtype Release Signing <pete+voxtype-ci@peteonrails.co
+
+xjMEahctTBYJKwYBBAHaRw8BAQdA9GkHf8Xtp1nbufneTLN+MGTUk0sUYx9qmqUA
+wb4Ndo3NOVZveHR5cGUgUmVsZWFzZSBTaWduaW5nIDxwZXRlK3ZveHR5cGUtY2lA
+cGV0ZW9ucmFpbHMuY29tPsKWBBMWCgA+FiEEnM95FbdQyuiwle0ao/yfM/0gknkF
+AmoXLUwCGwMFCQeEzgAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQo/yfM/0g
+knmFWQEA3B3tKp/iU5JPuNbZTYGGMjlXKkG9XpDzwi3nDtGPhZ0A/i3l1i7uG5TG
++yjd00LVbB1ifpMfjXgkCUupZBf475AB
+=78oD
+-----END PGP PUBLIC KEY BLOCK-----

guest/scripts/finalize-rootfs.sh

@@ -48,6 +48,22 @@ printf '%s  %s\n' "$expected_hyprland_sha256" /usr/bin/Hyprland | sha256sum -c -
   echo "Rounded-border Hyprland binary digest mismatch" >&2
   exit 1
 }
+expected_voxtype="$(read_spec '["supplyChain"]["voxtype"]["version"]')-$(read_spec '["supplyChain"]["voxtype"]["pkgrel"]')"
+[[ ! $(pacman -Qq voxtype-bin 2>/dev/null || true) ]] || {
+  echo "Opt-in Voxtype must not be installed in the factory image" >&2
+  exit 1
+}
+voxtype_resolution=$(pacman -Sp --print-format '%n %v %a' voxtype-bin)
+grep -Fxq "voxtype-bin $expected_voxtype aarch64" <<<"$voxtype_resolution" || {
+  echo "Pinned ARM64 Voxtype package does not resolve: $voxtype_resolution" >&2
+  exit 1
+}
+for dependency in gtk4-layer-shell which; do
+  grep -Eq "^${dependency} [^ ]+ aarch64$" <<<"$voxtype_resolution" || {
+    echo "Voxtype runtime dependency does not resolve for ARM64: $dependency" >&2
+    exit 1
+  }
+done
 [[ $(pacman -Qoq /usr/local/bin/omarchy-native-cursor-restore) == try-omarchy-runtime ]] || {
   echo "Screensaver cursor helper is not owned by the Omarchy runtime package" >&2
   exit 1

guest/scripts/register-local-repository.sh

@@ -61,24 +61,29 @@ print(spec["image"]["sourceDateEpoch"])
 print(spec.get("guest", {}).get("profile"))
 hyprland = spec["supplyChain"]["hyprland"]
 print(f'{hyprland["version"]}-{hyprland["pkgrel"]}')
+voxtype = spec["supplyChain"]["voxtype"]
+print(f'{voxtype["version"]}-{voxtype["pkgrel"]}')
 PY
 )
-(( ${#metadata[@]} == 3 )) || fail "could not read local repository contract"
+(( ${#metadata[@]} == 4 )) || fail "could not read local repository contract"
 source_date_epoch=${metadata[0]}
 profile=${metadata[1]}
 expected_hyprland_version=${metadata[2]}
+expected_voxtype_version=${metadata[3]}
 [[ $source_date_epoch =~ ^[0-9]+$ ]] || fail "invalid source date epoch"
 [[ $profile == factory ]] || fail "native guest profile must be factory"
 [[ $expected_hyprland_version =~ ^[0-9]+\.[0-9]+\.[0-9]+-[0-9.]+$ ]] ||
   fail "invalid patched Hyprland package version"
+[[ $expected_voxtype_version =~ ^[0-9]+\.[0-9]+\.[0-9]+-[1-9][0-9]*$ ]] ||
+  fail "invalid Voxtype package version"
 
 repo_name=try-omarchy
 repo_dir="$root/usr/share/try-omarchy/repo"
 [[ -d $repo_dir && ! -L $repo_dir ]] || fail "local package staging directory is missing"
 shopt -s nullglob
 archives=("$repo_dir"/*.pkg.tar.zst)
 shopt -u nullglob
-expected_archive_count=5
+expected_archive_count=6
 (( ${#archives[@]} == expected_archive_count )) ||
   fail "local repository expected $expected_archive_count package archive(s), found ${#archives[@]}"
 [[ ${archives[*]} == *'/try-omarchy-runtime-'* ]] || fail "local repository is missing the Omarchy runtime"
@@ -87,6 +92,8 @@ expected_archive_count=5
 [[ ${archives[*]} == *'/try-omarchy-yay-'* ]] || fail "factory repository is missing pinned yay"
 [[ ${archives[*]} == *"/hyprland-$expected_hyprland_version-aarch64.pkg.tar.zst"* ]] ||
   fail "factory repository is missing patched Hyprland"
+[[ ${archives[*]} == *"/voxtype-bin-$expected_voxtype_version-aarch64.pkg.tar.zst"* ]] ||
+  fail "factory repository is missing pinned Voxtype"
 
 temporary=$(mktemp -d "$root/usr/share/try-omarchy/.repo-db.XXXXXX")
 cleanup() {
@@ -143,8 +150,8 @@ if text.count(marker) != 1 or "\n[try-omarchy]\n" in text:
     raise SystemExit(1)
 block = """
 # Immutable packages assembled from the checksummed Try Omarchy build spec.
-# Keep this before remote repositories so Omarchy's explicit package reinstall
-# resolves the patched Hyprland package locally.
+# Keep this before remote repositories so Omarchy's explicit package installs
+# resolve patched and ARM64-only packages locally.
 [try-omarchy]
 SigLevel = Optional TrustAll
 Server = file:///usr/share/try-omarchy/repo