qnbs · Aug 20, 2026 · Aug 20, 2026 · Aug 20, 2026 · Aug 20, 2026 · Aug 20, 2026
@@ -12,6 +12,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Renderer-neutral Rust Core seed:** `crates/worldscript-project` now provides headless project
   schema, validation, migration, plain JSON I/O, and a test/CLI harness, with one narrow Tauri
   validation command wired through the cross-workspace path dependency.
+- **Qt Early Killer-Gate qualification:** the native roadmap now requires cheap, evidence-backed
+  lifecycle, accessibility/input, packaging/update-trust, crash/recovery, and security checks
+  before substantial Qt UI work can create sunk cost.
 
 ### Changed
 

@@ -778,6 +778,7 @@ See **[`CONTRIBUTING.md`](CONTRIBUTING.md)** for the full dev setup, Biome / Vit
 | [`docs/DEEPSOURCE-REMEDIATION-PLAN.md`](docs/DEEPSOURCE-REMEDIATION-PLAN.md) | Prioritised DeepSource backlog tracker (P0-security→P5-docs) with triage decisions |
 | [`docs/adr/`](docs/adr/README.md) | Architecture Decision Records — state-management boundaries, local-AI stack layering, WorkerBus v2 hybrid routing |
 | [`docs/native/ROADMAP-QT-GPUI-DESKTOP.md`](docs/native/ROADMAP-QT-GPUI-DESKTOP.md) | Qt 6 + GPUI native desktop roadmap (ADR-0021) — 24-wave plan: renderer-neutral Rust Core → Qt Hardened Edition → GPUI Vision Edition, succeeding Tauri; CEF retired, historical record in `docs/historical/cef/` |
+| [`docs/native/QT-EARLY-KILLER-GATES.md`](docs/native/QT-EARLY-KILLER-GATES.md) | Evidence-first Qt feasibility qualification — lifecycle, accessibility/input, packaging/update trust, crash/recovery, and security checks before substantial native UI investment |
 | [`docs/native/CORE-MIGRATION-LEDGER.md`](docs/native/CORE-MIGRATION-LEDGER.md) | Rust Core extraction priority order — what's moved out of TypeScript vs. deferred, and why |
 | [`docs/architecture/native-readiness.md`](docs/architecture/native-readiness.md) | Native-Readiness scorecard (see ADR-0021) — cross-cutting architecture-quality checklist, re-scored at every architecture-changing PR |
 | [`docs/ACCESSIBILITY.md`](docs/ACCESSIBILITY.md) | A11y architecture (live regions, focus, WCAG 2.2, Lighthouse 0.95 gate) |

@@ -0,0 +1,109 @@
+# Qt Early Killer-Gate Qualification
+
+**Status: PLANNED — sequencing approved in the Qt/GPUI roadmap; no Qt production UI is admitted.**
+
+This document defines the cheap, evidence-producing feasibility checks that must happen before
+substantial Qt feature porting. It applies the lesson from the retired CEF path: a native direction
+must be able to falsify its most dangerous assumptions before the project has accumulated UI
+sunk cost.
+
+The qualification is an additive prerequisite between Wave 4 (R-15 implementation) and Wave 5
+(the Qt executable learning harness). It does not replace the later G2, G3, or G4 production gates.
+Those gates remain necessary because a small feasibility spike cannot prove production completeness.
+
+## Decision rule
+
+The Qt direction advances only when each gate has a reproducible evidence record, a named owner,
+and a result at the appropriate maturity level:
+
+```text
+planned → locally proven → CI-proven → packaged-proven → admitted
+```
+
+Documentation alone is not a pass. A gate that is not applicable must include a written rationale
+and an architecture decision; it must not be silently skipped. A failed kill gate stops Qt work at
+the smallest possible investment and returns the program to architecture review.
+
+## Qualification order
+
+The order is deliberately front-loaded by cost and irreversibility:
+
+1. **Contract and threat-boundary review** — static and design evidence before a toolkit spike.
+2. **Executable lifecycle/bridge spike** — prove that a minimal Qt process can safely host the
+   renderer-neutral Core boundary.
+3. **Accessibility and input feasibility** — falsify the most important writing-workflow risks
+   before custom controls are built.
+4. **Packaging, updater, and rollback trust** — test the distribution trust model with throwaway
+   artifacts before product packaging work grows around it.
+5. **Crash diagnostics and recovery feasibility** — prove useful failure evidence without weakening
+   the sandbox or recovery invariants.
+6. **Security and permission posture** — validate IPC/FFI, filesystem, network, and updater
+   boundaries under the intended runtime conditions.
+7. **Admission review** — accept the evidence, record residual risks, and only then begin larger
+   Qt shell or feature work.
+
+The checks may run in parallel after the lifecycle spike has established a runnable harness, but
+the admission decision remains conjunctive: one unresolved kill gate blocks Qt implementation.
+
+## Gate matrix
+
+| Gate | Minimum proof | Kill condition |
+|---|---|---|
+| Contract/threat boundary | Qt-facing contract inventory identifies every IPC/FFI crossing, data owner, permission, cancellation path, and failure mode; no domain truth moves into QML/C++. | The bridge requires renderer-specific domain rules, arbitrary command execution, or a new broad unsafe/FFI architecture. |
+| Lifecycle and Core bridge | Minimal Qt 6/QML executable proves window creation, QML load, typed Rust call, Rust event to QML, async operation, cancellation, clean shutdown, and repeated launch/close cycles. | Lifetime/threading behavior is nondeterministic, cancellation cannot be bounded, or the Core cannot remain GUI-independent. |
+| Accessibility and input | A real Qt Quick control sample exposes a stable accessibility tree and proves keyboard/focus, accessible errors, high contrast, scalable text, RTL/BiDi, and IME smoke behavior on a supported Linux environment. | Required semantics are not observable, custom controls require inaccessible workarounds, or IME/BiDi breaks core writing input. |
+| Packaging and updater trust | A packaged hello-world/Core roundtrip starts from a clean environment; signed update metadata, artifact identity, downgrade policy, rollback, and tamper rejection are exercised with test credentials. | Artifact identity or rollback cannot be trusted, updates accept tampered input, or the packaging model requires bypassing repository signing policy. |
+| Crash and recovery | An intentional harness crash produces actionable diagnostics and symbols for project-owned code; restart/recovery behavior is deterministic and does not corrupt test data. | Diagnostics require weakening sandbox/process isolation, recovery loses acknowledged data, or failures cannot be reproduced from packaged evidence. |
+| Security and permissions | Runtime review covers process boundaries, filesystem/network allowlists, secret handling, updater privileges, temporary files, and least-privilege IPC; negative tests prove denied operations stay denied. | A capability needs arbitrary native execution, broad filesystem/network access, plaintext secret exposure, or weakened encryption/identity binding. |
+| Admission decision | A signed/ reviewed scorecard records evidence links, residual risks, owners, expiry/retest conditions, and explicit GO/NO-GO for Wave 5. | Any Critical/High security issue, unowned residual risk, or missing evidence remains at the decision meeting. |
+
+## Minimum evidence package
+
+The qualification work should produce a small, reviewable package rather than a premature product
+framework:
+
+- `qt-early-killer-gates.md` scorecard with commit/run links and maturity labels;
+- one isolated Qt learning harness, with no WorldScript feature UI and no Qt WebEngine;
+- deterministic lifecycle tests covering repeated start/close, cancellation, and clean shutdown;
+- an accessibility/input fixture with machine-observable tree and keyboard/IME assertions;
+- a clean-environment packaged artifact and a test-key update/rollback fixture;
+- a crash fixture with a project-owned symbolized frame and recovery-state assertion;
+- a permission-negative-test record covering denied filesystem, network, and native-command paths;
+- an architecture decision record for residual risks before Wave 5 admission.
+
+The harness may use a narrow C++/Rust bridge where Qt requires it, but authoritative product
+semantics remain in the renderer-neutral Rust Core. It must not become a second product shell,
+generic command bridge, or hidden Qt-specific domain layer.
+
+## Required execution environments
+
+The early qualification should use the cheapest environment that can falsify each risk and then
+repeat the meaningful checks in CI:
+
+1. **Developer smoke:** fast lifecycle, keyboard, IME, and accessibility-tree checks on the
+   supported Linux desktop used for development.
+2. **Linux CI:** clean build, repeated lifecycle, headless display/compositor smoke, security
+   negative tests, crash artifact collection, and deterministic result assertions.
+3. **Clean packaged runtime:** install/launch/update/rollback/tamper tests against the actual
+   artifact layout rather than the build tree.
+4. **Later platform evidence:** Windows UI Automation, macOS VoiceOver/accessibility APIs, and
+   supported compositor/GPU matrices remain part of G2/G3/G4; the early Linux spike does not claim
+   cross-platform parity.
+
+## Explicit non-goals
+
+- no editor, plot board, AI panel, or broad design-system port;
+- no Qt WebEngine or embedded Chromium shortcut;
+- no GPUI implementation or Qt/GPUI parity race;
+- no Tauri retirement before Qt Stable plus the documented field window;
+- no R-15 shortcut, renderer-local encryption, or altered identity binding;
+- no broad FFI, unsafe runtime, or generic native command executor;
+- no production packaging promise based only on an unpackaged developer binary.
+
+## Relationship to later gates
+
+Wave 4.5 answers **“is Qt still technically and operationally plausible?”** cheaply. G2 answers
+**“is Qt admitted for implementation?”** with the approved license/version/bridge strategy and
+the learning harness. G3 and G4 still require project compatibility, accessibility, security,
+packaging, updater, recovery, performance, signing, support, and field evidence at production
+quality. Passing this qualification must never be used to check those later boxes early.
@@ -83,6 +83,9 @@ Rust-authoritative Core
 Storage / Crypto / Migration / Tasks / AI / Diagnostics
         │
         ▼
+Qt early killer-gate qualification
+        │
+        ▼
 Qt architecture + executable learning harness
         │
         ▼
@@ -970,6 +973,7 @@ Required:
 [ ] Qt license strategy approved
 [ ] Qt version/LTS strategy approved
 [ ] bridge technology selected by scorecard
+[ ] Wave 4.5 Qt Early Killer-Gate qualification accepted — see `docs/native/QT-EARLY-KILLER-GATES.md`
 [ ] Qt learning harness passes
 [ ] IME feasibility passes
 [ ] accessibility feasibility passes
@@ -1179,9 +1183,37 @@ Required tests:
 Exit: desktop project data uses the approved encrypted path where required; #357/#359/#360/#361 all
 closed with evidence.
 
+## Wave 4.5 — Qt Early Killer-Gate Qualification
+
+**Status: PLANNED — required before substantial Qt implementation.**
+
+This additive qualification wave front-loads the highest-cost-to-discover Qt risks before Wave 5's
+learning harness grows into a product shell. It is intentionally smaller than a Qt port and does
+not claim production readiness. The complete test matrix, kill criteria, evidence package, and
+maturity vocabulary live in [`docs/native/QT-EARLY-KILLER-GATES.md`](QT-EARLY-KILLER-GATES.md).
+
+Required order:
+
+1. inventory the Qt/Core contract, process, permission, and threat boundaries;
+2. run a minimal executable lifecycle/bridge spike with cancellation and repeated shutdown;
+3. prove accessibility-tree observability plus keyboard, IME, RTL/BiDi, focus, and error behavior;
+4. test clean packaged launch, signing identity, updater trust, tamper rejection, and rollback;
+5. prove crash diagnostics, project-owned symbolization, and deterministic recovery;
+6. prove least-privilege filesystem/network/IPC behavior with negative tests;
+7. record residual risk, owners, retest conditions, and an explicit GO/NO-GO decision.
+
+**Exit:** each kill gate is locally and CI-proven at the required level, packaged trust and
+recovery evidence exists, no Critical/High security blocker remains, and the admission scorecard
+authorizes Wave 5. A failed gate stops Qt work and triggers architecture review; it does not get
+papered over by checking a later G2/G4 box.
+
+This wave does not renumber the established program. It is a deliberate qualification checkpoint
+between Core/R-15 work and Qt enablement, so storage and security semantics are settled before the
+native bridge is exercised and the bridge is falsified before feature UI creates sunk cost.
+
 ## Wave 5 — Qt enablement / executable learning harness
 
-**Status: PLANNED — not started. Gated behind G2.**
+**Status: PLANNED — not started. Gated behind Wave 4.5 and G2.**
 
 Create a minimal isolated Qt 6 application proving: