acrogenesis's open omacom/omarchy#14937 proposes blocking unfamiliar USB and Thunderbolt devices while locked, automatically admitting locked-time arrivals after unlock, and offering optional approval for new devices attached while unlocked. Product review remains required before merge; this is a proposed default rather than shipped behavior.
greptile-apps[bot] raised a concern that the Thunderbolt service sandbox would prevent authorization writes. acrogenesis responded in omacom/omarchy#14937:discussion_r4416496723 that the write boundary had been made explicit and installed-service tests passed with real boltd and simulated hardware. The responder also said the original denial did not reproduce on that Lab/systemd version. Reported VM CI passed, but physical Thunderbolt, firmware and physical suspend behavior remain outside the stated verification.
