docs: reconcile roadmap and CI truth

.github/CI-AUDIT.md

@@ -31,7 +31,7 @@ This document summarizes the **current inventory** and **stabilization measures*
 | pnpm | `package.json` `packageManager` | **11.5.2** |
 | Lint | Biome | `pnpm run lint` |
 | i18n | `scripts/check-i18n-keys.mjs` | `pnpm run i18n:check` |
-| Unit | Vitest + V8 | `pnpm exec vitest run --coverage` |
+| Unit | Vitest + V8 | CI: `pnpm exec vitest run --coverage`; local: targeted `pnpm exec vitest run <path>` |
 | E2E | Playwright | `CI=true pnpm run test:e2e` |
 | Bundle | `scripts/check-bundle-budget.mjs` | max **7000 KB** per chunk, max **4500 KB** entry (`index-*.js`) |
 | Lighthouse | `.lighthouserc.cjs` | Accessibility **error** ≥ 0.95; CLS **error** ≤ 0.1; Performance **warn** |
@@ -54,7 +54,7 @@ This document summarizes the **current inventory** and **stabilization measures*
 
 ```bash
 pnpm run lint && pnpm run i18n:check && pnpm run typecheck
-# optional: pnpm exec vitest run   # without --coverage
+# optional targeted file: pnpm exec vitest run <path>
 ```
 
 **Heavy (CI parity):**

.github/copilot-instructions.md

@@ -170,6 +170,7 @@ On any non-trivial code change add a single-line comment explaining **why**, not
 - Pre-commit: after explicit `pnpm run hooks:install`, `simple-git-hooks` runs Biome on staged files; CI is mandatory regardless
 - **⚠️ Constrained local hardware — do NOT run heavy suites locally.** This machine has ~3–4 GB RAM. **Never** run the full Vitest **coverage** suite, **Playwright E2E**, **Stryker mutation**, **Lighthouse CI**, or the **Storybook test-runner** locally — they are **CI-only by design**. Run **one heavy command at a time** (no parallel `vitest`/`biome`/`tsc`/`vite`).
 - Local preflight (sequential, minimal): `pnpm run lint` → `pnpm run typecheck` → `pnpm run i18n:check` (only when locale JSON changed) → **targeted** `pnpm exec vitest run <path>` (no `--coverage`). Run `pnpm run build && pnpm run smoke:prod` only when you touched `vite.config.ts`, `packages/ai-core`, or `workers/`. Coverage, E2E, Lighthouse, Stryker, and Storybook are **CI gate jobs** — let GitHub Actions run them.
+- **Vitest watch-mode hard rule:** Never run `pnpm test`, `npm run test`, a bare Vitest command, or an untargeted wrapper. Always use `pnpm exec vitest run <path>`; CI is the only place that runs the full coverage suite.
 - CI pipeline (see [`docs/CI.md`](../docs/CI.md)): **`security` → `quality`** (Biome + `tsc` + Vitest matrix) **→ `build` / `e2e` / `storybook` in parallel** → **`lighthouse`** after build → **`deploy`** on `main` after build+e2e
 - Branch protection should require the **`quality`** job (and other checks your team enables); job ids match `.github/workflows/ci.yml`
 - CI runs **`pnpm audit`** every workflow; **dependency-review** on pull requests
@@ -201,8 +202,8 @@ pnpm run lint:fix     # Biome auto-fix (lint + format)
 pnpm run format       # Biome format
 pnpm run typecheck    # TypeScript type checking (tsc --noEmit)
 pnpm run test         # Vitest watch mode
-pnpm run test:run     # Vitest single run
-pnpm run test:coverage # Vitest with V8 coverage
+pnpm exec vitest run <path>             # Targeted Vitest single run
+pnpm exec vitest run <path> --coverage  # Targeted coverage debugging
 pnpm run test:e2e     # Playwright E2E (requires CI=true per package.json scripts)
 pnpm run storybook    # Storybook on port 6006
 ```

CHANGELOG.md

@@ -7,9 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- **Renderer-neutral Rust Core seed:** `crates/worldscript-project` now provides headless project
+  schema, validation, migration, plain JSON I/O, and a test/CLI harness, with one narrow Tauri
+  validation command wired through the cross-workspace path dependency.
+
+### Changed
+
+- **Native desktop strategy:** ADR-0021 adopts Qt 6/Qt Quick as the future primary native product,
+  keeps React/PWA first-class, makes Tauri transitional, admits GPUI later behind a gate, and
+  retires CEF from the target architecture.
+- **DesktopPlatform boundary:** direct Tauri imports are mechanically constrained by the zero-
+  tolerance guardrail while the renderer-neutral contract becomes the native transition surface.
+
 ### Fixed
 
 - **CI authority closure:** Core path changes now select the Tauri consumer gate, workflow-policy tests protect local path-dependency coverage and aggregate deployment gating, and Pages deployment waits for `ci-success`.
+- **Accessibility contrast:** command-palette heading contrast was corrected to meet the intended
+  WCAG threshold.
+
+### Security
+
+- **CI supply-chain policy:** CodeQL action references and token permissions were hardened and
+  Dependabot grouping was corrected so related action paths move together.
 
 ## [1.27.1] — 2026-08-14
 
@@ -329,7 +350,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   DuckDB excerpt-encryption wiring above, and the Claude serverless proxy section gains an explicit
   monitoring recommendation (platform-native Vercel/Cloudflare request analytics — no in-app
   logging, which would violate the proxy's zero-console-call stateless guarantee).
-- **`GROK-PROVIDER-INTEGRATION-PLAN.md`** status header updated from "Plan only — do not implement
+- **`docs/history/GROK-PROVIDER-INTEGRATION-PLAN.md`** status header updated from "Plan only — do not implement
   yet" to reflect that all phases shipped; retained as the historical design record.
 - **`TODO.md`** reworded the open tag/publish bullet so it no longer embeds the literal `v1.25.0`
   version string on the `- ⬜` bullet line itself, removing the risk that

CONTRIBUTING.md

@@ -200,17 +200,17 @@ Coverage, E2E, Lighthouse, Stryker, and Storybook test-runner are **CI gate jobs
 
 ### Local vs CI (low-end friendly)
 
-- **Before every push (recommended):** `pnpm run lint`, `pnpm run typecheck`, `pnpm run i18n:check`. Optional: `pnpm exec vitest run` **without** `--coverage` for a quick smoke.
+- **Before every push (recommended):** `pnpm run lint`, `pnpm run typecheck`, `pnpm run i18n:check`. Optional: targeted `pnpm exec vitest run <path>` for a quick smoke.
+- **Vitest hard rule:** Never invoke `pnpm test`, `npm run test`, or a bare Vitest wrapper; watch mode hangs constrained hardware. Use an explicit targeted `pnpm exec vitest run <path>` command.
 - **Full gate:** GitHub Actions runs Vitest **with** coverage thresholds, Playwright (desktop + mobile emulation in CI), Lighthouse, etc. A **green CI run** is the merge bar — you are **not** required to pass full E2E or LHCI on a weak laptop.
 - **Optional local E2E:** `CI=true pnpm run test:e2e` when debugging; optional mobile project: `RUN_MOBILE_E2E=1` (see [`docs/CI.md`](docs/CI.md)).
 - **CI artifacts:** When Playwright, coverage, or Lighthouse fails remotely, open **GitHub Actions → the workflow run → Artifacts** and inspect the uploaded reports locally — faster than reproducing the full heavy stack on low-end hardware.
 
 ### Unit Tests (Vitest)
 
 ```bash
-pnpm run test         # Run in watch mode
-pnpm run test:run     # Run once (CI mode)
-pnpm run test:coverage  # With coverage report (same as CI quality job — heavier)
+pnpm exec vitest run <path>             # Targeted single-file run
+pnpm exec vitest run <path> --coverage  # Targeted coverage debugging
 ```
 
 ### Bundle size (matches CI `build` job)
@@ -228,7 +228,7 @@ On **2–4 GB RAM** (e.g. Ubuntu 20.04), use the bundled **act + Eco-Forgejo** s
 
 - **Install:** [`infra/low-end-ci/INSTALL.md`](infra/low-end-ci/INSTALL.md)
 - **Daily workflow:** [`infra/low-end-ci/DAILY-DRIVER.md`](infra/low-end-ci/DAILY-DRIVER.md)
-- **Quick gate (no Docker):** `pnpm run ci:quick` or `pnpm run ci:quick:unit`
+- **Quick gate (no Docker):** `pnpm run ci:quick`; for one targeted unit file use `VITEST_PATH=tests/unit/example.test.ts pnpm run ci:quick:unit`
 - **Full `ci.yml` locally:** `pnpm run ci:act` (sequential act jobs)
 
 Manual [Act](https://github.com/nektos/act) example:
@@ -385,7 +385,7 @@ Open a **focused PR per theme** (storage vs. i18n vs. collaboration) to keep rev
 
 1. Fork the repository and create a feature branch
 2. Write or update tests for your changes
-3. Run the full test suite: `pnpm run test:run`
+3. Let CI run the full test suite; locally use only targeted `pnpm exec vitest run <path>`.
 4. Ensure Biome passes: `pnpm run lint`
 5. Ensure i18n parity: `pnpm run i18n:check`
 6. Ensure types compile: `pnpm run typecheck`

TODO.md

@@ -8,7 +8,26 @@ Status: 🔄 in progress | ⬜ open | ✅ done
 
 ---
 
-## Release — v1.25.0 published (2026-08-01)
+## Current Sprint — Native desktop consolidation and Wave 2 G1 (2026-08-20)
+
+> **Status: 🔄 in progress.** The authoritative native sequence is maintained in
+> [`docs/native/ROADMAP-QT-GPUI-DESKTOP.md`](docs/native/ROADMAP-QT-GPUI-DESKTOP.md), with the
+> next Rust-Core capability choice recorded in [`docs/native/CORE-MIGRATION-LEDGER.md`](docs/native/CORE-MIGRATION-LEDGER.md).
+
+- ✅ P0 CI/deployment authority stabilization merged in PR #427 at `0309a255`.
+- ✅ Cross-workspace Tauri path-dependency coverage and aggregate deployment gating are now
+  regression-tested in the quality job.
+- 🔄 G1 remains partial: task supervision, diagnostics, contract versioning, and future R-15
+  architecture remain open; no Qt or GPUI implementation is admitted yet.
+- ⏭️ Next capability slice, after this consolidation pass: choose the smallest evidence-producing
+  logger/diagnostics or task-orchestration increment from the migration ledger.
+
+## Archived sprint history
+
+The completed release and infrastructure sections below are retained for provenance. They are not
+the current sprint plan; long-term native sequencing belongs in the linked roadmap and ledger.
+
+## Archived — Release v1.25.0 published (2026-08-01)
 
 > **Status: ✅ Done.** Tagged, released, and live — see the GitHub Release link below.
 

biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.5.4/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.8/schema.json",
   "vcs": {
     "enabled": true,
     "clientKind": "git",

docs/CI.md

@@ -14,12 +14,25 @@ For historical optimization notes (targets may predate the live workflow), see [
 
 | Tier | Where | Commands / scope |
 |------|--------|------------------|
-| **Quick (local)** | Developer laptop | `pnpm run lint`, `pnpm run typecheck`, `pnpm run i18n:check`; optional `pnpm exec vitest run` **without** `--coverage` for a fast smoke |
+| **Quick (local)** | Developer laptop | `pnpm run lint`, `pnpm run typecheck`, `pnpm run i18n:check`; optional targeted `pnpm exec vitest run <path>` for a fast smoke |
 | **Heavy (CI)** | `ci.yml` | Vitest **with** `--coverage` and thresholds, Playwright E2E (`CI=true`) including **mobile emulation** (Pixel 5 / Chromium), Lighthouse CI, Storybook static build, bundle budget + analyze. Mutation testing (Stryker) is **not** part of this pipeline — see [Mutation testing status](#mutation-testing-status). |
 
 **Merge readiness:** A green workflow run on the PR/branch matters more than reproducing every E2E or LHCI step locally. Use CI **artifacts** (Playwright HTML report, coverage, Lighthouse output) to debug failures.
 
-**Optional local deep dive:** `CI=true pnpm run test:e2e`, `pnpm exec vitest run --coverage`, `pnpm exec lhci autorun` — only when the machine has enough CPU/RAM and time. Mobile Playwright project locally: set `RUN_MOBILE_E2E=1` (see [`playwright.config.ts`](../playwright.config.ts)).
+**Local deep dive:** E2E, full-suite coverage, Lighthouse, and Storybook are CI-only on constrained hardware. For a focused local investigation, use `pnpm exec vitest run <path>` or `pnpm exec vitest run <path> --coverage`; never invoke `pnpm test`, `npm run test`, or a bare Vitest wrapper.
+
+### Gate authority
+
+`✅ CI Success` is the required branch-protection status and aggregates `security`, `quality`,
+`changes`, `rust-tauri`, `core-rust`, `build`, `e2e`, and `vrt`. The `deploy` job depends only on
+that aggregate and remains main-push-only.
+
+`storybook` and `lighthouse` are currently visible, separately executed advisory jobs rather than
+members of the aggregate. Their failures must still be investigated before merge under the
+repository's full-suite policy; this explicit distinction prevents a red visible job from having
+an undefined authority model. Storybook's test-runner and Lighthouse's desktop performance step
+remain non-blocking under the exit criteria documented below. `e2e-deep` and the coverage ratchet
+are also intentionally advisory.
 
 **Post-merge doc update workflow:**
 1. Push the commit → CI starts automatically.
@@ -225,21 +238,24 @@ longer runs a root `prepare` command. `pnpm-workspace.yaml` sets `verifyDepsBefo
 
 ## Local checks (without Act)
 
-On **low-resource** machines, stop at the **Quick** tier (see [Cloud CI-first vs local development](#cloud-ci-first-vs-local-development)): **`pnpm run lint`**, **`pnpm run typecheck`**, **`pnpm run i18n:check`**, and optionally **`pnpm exec vitest run`** without `--coverage`. Treat **`CI=true pnpm run test:e2e`** (desktop + mobile projects in CI), **Lighthouse**, and **coverage threshold enforcement** as **CI-owned** unless you have a powerful workstation.
+On **low-resource** machines, stop at the **Quick** tier (see [Cloud CI-first vs local development](#cloud-ci-first-vs-local-development)): **`pnpm run lint`**, **`pnpm run typecheck`**, **`pnpm run i18n:check`**, and optionally targeted **`pnpm exec vitest run <path>`**. Treat **`CI=true pnpm run test:e2e`** (desktop + mobile projects in CI), **Lighthouse**, and **coverage threshold enforcement** as **CI-owned**.
 
 ```bash
 pnpm install --frozen-lockfile
 pnpm run lint
 pnpm run i18n:check
 pnpm run typecheck
-pnpm exec vitest run --coverage
+pnpm exec vitest run <path> --coverage \
+  --coverage.thresholds.lines=0 --coverage.thresholds.functions=0 \
+  --coverage.thresholds.branches=0 --coverage.thresholds.statements=0  # targeted only
 pnpm run build
 pnpm run bundle:budget
 pnpm run analyze   # optional locally; CI uploads HTML report
-CI=true pnpm run test:e2e
-pnpm exec lhci autorun   # after build + serve/preview as configured in .lighthouserc.cjs
 ```
 
+Playwright E2E, Lighthouse, Storybook, and full-suite coverage are intentionally omitted from
+the local block above; GitHub Actions owns those heavy checks on this hardware.
+
 ### Node 24+ Compatibility Troubleshooting
 
 **Problem:** Tests fail with `localStorage.clear is not a function` or similar Web Storage errors on Node 24+.
@@ -252,10 +268,10 @@ pnpm exec lhci autorun   # after build + serve/preview as configured in .lightho
 
 ```bash
 # Simuliere CI-Bedingungen exakt
-NODE_OPTIONS="--no-experimental-webstorage" pnpm exec vitest run --coverage --reporter=json --outputFile=test-results.json
+NODE_OPTIONS="--no-experimental-webstorage" pnpm exec vitest run <path> --coverage
 
 # Ohne Coverage für schnelles Feedback
-pnpm exec vitest run
+pnpm exec vitest run <path>
 ```
 
 **Coverage Ratchet Mechanism:**
@@ -270,7 +286,7 @@ For **Ubuntu 20.04 / 2–4 GB RAM** laptops: run the **Quick tier** natively (no
 
 | Tier | Command | When |
 |------|---------|------|
-| **Quick (daily)** | `pnpm run ci:quick` / `ci:quick:unit` | Every commit |
+| **Quick (daily)** | `pnpm run ci:quick`; optional targeted `VITEST_PATH=tests/unit/example.test.ts pnpm run ci:quick:unit` | Every commit |
 | **Full workflow (on-demand)** | `pnpm run ci:act` | Before release / weekly |
 | **Eco Git** | `infra/low-end-ci/scripts/ci-eco-start.sh` | Only when pushing to local Forgejo |
 

docs/CODEANT-REVIEW-LOOP.md

@@ -3,7 +3,7 @@
 > **Canonical, agent-agnostic workflow.** This is the single source of truth for how *every*
 > agent (Claude Code, Kimi, Cursor, Copilot, Gemini, human) handles inline PR review comments on
 > this repository — from CodeAnt AI **and any other reviewer or bot**. All instruction files
-> (`CLAUDE.md`, `AGENTS.md`, `KIMI-INSTRUCT.md`, `.cursorrules`, `.github/copilot-instructions.md`)
+> (`CLAUDE.md`, `AGENTS.md`, `docs/history/KIMI-INSTRUCT.md`, `.cursorrules`, `.github/copilot-instructions.md`)
 > point here. Keep this file current when the workflow or tooling changes.
 >
 > **See also:** [`DEEPSOURCE-REVIEW-LOOP.md`](DEEPSOURCE-REVIEW-LOOP.md) — the complementary,

docs/DEPENDABOT-TRIAGE.md

@@ -79,6 +79,19 @@ Coverage, Storybook, Lighthouse where applicable) — not just the required-chec
 [`CLAUDE.md`](../CLAUDE.md)'s branching-discipline section for the general "wait for advisory jobs
 too" rule; it applies to dependency PRs exactly as it does to feature PRs.
 
+## OSV ignore-expiry review
+
+The 2026-08-20 consolidation review found **19** entries in `src-tauri/osv-scanner.toml`, all
+currently sharing the `2026-11-30T00:00:00Z` review deadline. This is a synchronized review cliff,
+not evidence that the risks were extended or resolved. The entries remain grouped by their real
+reason: legacy GTK3/WebKit bindings, build-time `proc-macro-error`/`paste`, archived Unicode data
+crates, and the transitive `extract-zip` advisory.
+
+No ignore deadline was extended in this pass. `extract-zip` remains a transitive Playwright browser
+download dependency with no patched release and no production-runtime footprint; it must still be
+rechecked before expiry and removed as soon as an upstream fix or dependency-path change makes that
+possible. Review each cluster against current upstream status before changing any deadline.
+
 ## Special-attention dependencies
 
 These need more than a changelog skim because of documented quirks elsewhere in this repo:
@@ -90,6 +103,7 @@ These need more than a changelog skim because of documented quirks elsewhere in
 | `react` / `react-dom` | Already grouped — must stay in lockstep, split bumps cause version-mismatch errors at test time. |
 | `tauri*` / `wry` / `tao` | Already grouped (`tauri-deps`) — same lockstep concern for the desktop backend. |
 | `github/codeql-action*` | Already grouped — see incident above. |
+| `@biomejs/biome` | Check the installed package version against `biome.json`'s `$schema` URL after every bump; the schema URL is versioned independently from the npm dependency declaration. |
 | Any WASM/WebGPU-adjacent package (`@huggingface/transformers`, `@mlc-ai/web-llm`, `onnxruntime-web`) | These ship in `vendor-*` SW-excluded chunks (`vite.config.ts` `globIgnores`) — verify a version bump didn't change the package's exported chunk structure in a way that breaks the manual-chunk mapping. |
 
 ## Merge discipline — one at a time, sequenced

docs/adr/0016-native-grok-and-claude-providers.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-07-30
 - **Deciders:** Maintainer + Claude Code
 - **Context tags:** ai, grok, anthropic, claude, cors, tauri, proxy, backend
-- **Related:** [`GROK-PROVIDER-INTEGRATION-PLAN.md`](../../GROK-PROVIDER-INTEGRATION-PLAN.md) (execution plan this ADR formalizes) · extends [ADR 0012](0012-local-server-connectivity-tauri-http.md) · see also [ADR 0004](0004-csp-connect-src-byok-tradeoff.md)
+- **Related:** [`GROK-PROVIDER-INTEGRATION-PLAN.md`](../history/GROK-PROVIDER-INTEGRATION-PLAN.md) (archived execution plan this ADR formalizes) · extends [ADR 0012](0012-local-server-connectivity-tauri-http.md) · see also [ADR 0004](0004-csp-connect-src-byok-tradeoff.md)
 
 ## Context
 
@@ -127,7 +127,7 @@ for the full design.
 
 ## References
 
-- [`GROK-PROVIDER-INTEGRATION-PLAN.md`](../../GROK-PROVIDER-INTEGRATION-PLAN.md) — full phased execution plan
+- [`GROK-PROVIDER-INTEGRATION-PLAN.md`](../history/GROK-PROVIDER-INTEGRATION-PLAN.md) — archived full phased execution plan
 - [[0012-local-server-connectivity-tauri-http]] — the native-HTTP pattern Track A reuses
 - [[0004-csp-connect-src-byok-tradeoff]] — why the web CSP's `https:` scheme-source already covers Grok
 - [Issue #266](https://github.com/qnbs/WorldScript-Studio/issues/266) — origin of both the ADR-0012 pattern and the Ollama-in-PWA follow-up