feat(native): add Intel macOS qualification-only build lane (S5)

.github/workflows/tauri-intel-qualification.yml

@@ -0,0 +1,61 @@
+# Intel macOS (x86_64) build-qualification lane — NOT part of the production release matrix.
+# See docs/TAURI-CI.md "Follow-ups" and docs/native/INTEL-MACOS-QUALIFICATION.md for context.
+
+name: Tauri Intel macOS qualification
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: tauri-intel-qualification-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  qualify:
+    name: Build qualification (macos-15-intel)
+    runs-on: macos-15-intel
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # QNBS-v3: composite action handles pnpm/node setup + frozen install.
+      - uses: ./.github/actions/setup
+
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
+        with:
+          workspaces: src-tauri
+          cache-all-crates: true
+          prefix-key: "v1-intel"
+
+      - name: Install macOS dependencies (create-dmg)
+        run: brew install create-dmg
+
+      # QNBS-v3: qualification-only, no updater secrets — disables updater artifacts, never publishes.
+      - name: Build Tauri app (qualification, no updater artifacts)
+        shell: bash
+        run: |
+          set -euo pipefail
+          if ! command -v jq &>/dev/null; then
+            echo "::error::jq is required for Tauri build configuration but not installed"
+            exit 1
+          fi
+          jq '.bundle.createUpdaterArtifacts = false' src-tauri/tauri.conf.json > src-tauri/tauri.conf.json.tmp
+          mv src-tauri/tauri.conf.json.tmp src-tauri/tauri.conf.json
+          echo "Building Tauri app for macos-15-intel (qualification only)..."
+          pnpm exec tauri build
+          echo "Tauri build completed successfully"
+
+      - name: Upload bundle directory (qualification evidence, not a release asset)
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: tauri-bundle-macos-15-intel-qualification
+          path: src-tauri/target/release/bundle/
+          if-no-files-found: warn
+          retention-days: 14

README.md

@@ -812,6 +812,7 @@ See **[`CONTRIBUTING.md`](CONTRIBUTING.md)** for the full dev setup, Biome / Vit
 | [`docs/PWA-AUDIT.md`](docs/PWA-AUDIT.md) | PWA manifest, service worker, share-target checklist |
 | [`infra/low-end-ci/`](infra/low-end-ci/) | Local CI on low-end hardware (act + Eco-Forgejo) |
 | [`docs/TAURI-CI.md`](docs/TAURI-CI.md) | Tauri desktop workflow: manual/tag builds, 7-step first-release checklist |
+| [`docs/native/INTEL-MACOS-QUALIFICATION.md`](docs/native/INTEL-MACOS-QUALIFICATION.md) | Intel macOS (x86_64) qualification-only build lane status (`macos-15-intel`), not yet in the release matrix |
 | [`docs/TAURI-UPDATER.md`](docs/TAURI-UPDATER.md) | Tauri plugin-updater: secrets table, `latest.json` auto-generation, signing |
 | [`docs/graphify.md`](docs/graphify.md) | Graphify knowledge graph — multi-modal AST graph (`pnpm run graphify:update`) |
 | [`docs/codegraph.md`](docs/codegraph.md) | CodeGraph semantic code intelligence — MCP-powered symbol graph (`pnpm run codegraph:update`) |

docs/TAURI-CI.md

@@ -17,17 +17,27 @@ Workflow: [`.github/workflows/tauri-build.yml`](../.github/workflows/tauri-build
 | `windows-latest` | x86_64 (NSIS `-setup.exe`, MSI fallback) | `windows-x86_64` |
 | `macos-latest` | **aarch64** (Apple Silicon) | `darwin-aarch64` |
 
-**Native Intel-Mac (x86_64) builds are currently unavailable.** `macos-13` (the last GitHub-hosted
-Intel runner) was removed from the matrix on 2026-07-28: 3 consecutive tagged-release runs each had
-the `macos-13` job sit in GitHub's runner queue indefinitely (never reaching `in_progress`, so the
-job's own `timeout-minutes: 45` never applied) until GitHub's ~24h queue ceiling auto-cancelled it —
-and because the `release` job's `needs: [bundle]` only resolves once every matrix leg reaches a
-terminal state, this blocked the entire release for 24h even though Ubuntu/Windows/macOS-ARM all
-finished in ~12 minutes. This is a GitHub-hosted-runner availability issue (Intel macOS images are
-being phased out), not a bug in this repo's build logic — the `latest.json` generator already
-tolerates a missing arch (per-arch warning, hard-fail only if *no* arch signs), so once a working
-Intel runner option exists again (self-hosted, `macos-latest-large`, or a new hosted image), re-adding
-it to the matrix needs no other changes. Tracked as a re-opened follow-up in `TODO.md`.
+**Native Intel-Mac (x86_64) builds are not in the production release matrix.** `macos-13` (the last
+GitHub-hosted Intel runner using that label) was removed from the matrix on 2026-07-28: 3 consecutive
+tagged-release runs each had the `macos-13` job sit in GitHub's runner queue indefinitely (never
+reaching `in_progress`, so the job's own `timeout-minutes: 45` never applied) until GitHub's ~24h
+queue ceiling auto-cancelled it — and because the `release` job's `needs: [bundle]` only resolves
+once every matrix leg reaches a terminal state, this blocked the entire release for 24h even though
+Ubuntu/Windows/macOS-ARM all finished in ~12 minutes. This was a GitHub-hosted-runner availability
+issue (Intel macOS images were being phased out), not a bug in this repo's build logic.
+
+**Update (empirically re-verified):** GitHub's replacement label `macos-15-intel` (introduced
+2025-09-18, available through August 2027) does schedule and run successfully on this org's plan — a
+throwaway `workflow_dispatch` probe completed in full. A separate, qualification-only workflow,
+[`tauri-intel-qualification.yml`](../.github/workflows/tauri-intel-qualification.yml), builds the
+app on `macos-15-intel` to confirm the toolchain still works there; it is deliberately **not** wired
+into the production release matrix or `latest.json` — one successful build proves the runner label
+works, not that it's ready for regular release qualification (soak testing, artifact size/behavior
+parity with the ARM build, and a decision on ongoing maintenance cost are still open). Promoting it
+into the release matrix is tracked separately — see `docs/native/INTEL-MACOS-QUALIFICATION.md` and
+the Follow-ups section below. The `latest.json` generator already tolerates a missing arch (per-arch
+warning, hard-fail only if *no* arch signs), so re-adding Intel to the release matrix needs no other
+changes once that decision is made.
 
 ## Outputs
 
@@ -183,3 +193,4 @@ See [`docs/TAURI-UPDATER.md`](TAURI-UPDATER.md) for full secrets reference and p
 
 - macOS notarization requires `APPLE_*` secrets — see [`docs/TAURI-UPDATER.md`](TAURI-UPDATER.md) § macOS code signing.
 - Windows Authenticode signing requires a CA-issued Authenticode certificate — track in [`TODO.md`](../TODO.md).
+- Promoting `tauri-intel-qualification.yml`'s `macos-15-intel` build into the production release matrix (real `latest.json` entry, `darwin-x86_64` updater key, ongoing soak testing) — see `docs/native/INTEL-MACOS-QUALIFICATION.md` for current status and the tracking issue.

docs/native/INTEL-MACOS-QUALIFICATION.md

@@ -0,0 +1,49 @@
+# Intel macOS (x86_64) Qualification — Status
+
+**Status:** Runner-availability qualified, not release-matrix qualified.
+**Owner lane:** `tauri-intel-qualification.yml` (`workflow_dispatch` only).
+
+## History
+
+- `macos-13` (the last GitHub-hosted Intel runner using that label) was removed from
+  `tauri-build.yml`'s production matrix on 2026-07-28 after 3 consecutive tagged-release runs each
+  had the job sit in GitHub's queue indefinitely, never reaching `in_progress` — see
+  [`docs/TAURI-CI.md`](../TAURI-CI.md) for the full incident detail.
+- On 2026-08-26, GitHub's replacement label `macos-15-intel` (introduced 2025-09-18, available
+  through August 2027) was empirically probed via a throwaway `workflow_dispatch` workflow: it
+  scheduled and completed successfully on this organization's plan.
+
+## Current qualification lane
+
+[`tauri-intel-qualification.yml`](../../.github/workflows/tauri-intel-qualification.yml) runs a real
+`pnpm exec tauri build` on `macos-15-intel`, manually triggered only (`workflow_dispatch`). It is
+deliberately **not**:
+
+- part of the production release matrix (`tauri-build.yml`'s `bundle` job),
+- wired into `latest.json` generation or any `darwin-x86_64` updater key,
+- able to mutate a GitHub Release (`permissions: contents: read` only, no signing secrets, no
+  release-publication steps of any kind — verified structurally sound by `scripts/workflow-policy-check.mjs`'s
+  publishing-boundary check, since this job is not on the `PUBLISHING_ALLOWLIST`).
+
+A single successful qualification build proves the *runner label* works — it does not by itself
+prove the build is ready for regular release inclusion.
+
+## What's still open before promoting Intel to the release matrix
+
+1. **Soak/repeat testing.** One successful run isn't enough evidence that `macos-15-intel`
+   provisions reliably at release time (the exact failure mode that removed `macos-13` was
+   *queue* unavailability, not build failure — that requires repeated real-world observation, not
+   a single manual dispatch, to rule out).
+2. **Artifact parity check** against the existing `macos-latest` (Apple Silicon) bundle — bundle
+   size, `.dmg`/`.app.tar.gz` structure, and updater-signature behavior should be verified
+   equivalent before shipping both architectures under one release.
+3. **Ongoing maintenance-cost decision.** Adding a second macOS architecture to the release matrix
+   roughly doubles macOS CI minutes per release; whether that's worth it for the current Intel-Mac
+   user base is a product decision, not a technical one — out of scope for this qualification lane.
+4. **Explicit promotion PR.** When (1)–(3) are resolved, promoting means: adding `macos-15-intel` to
+   `tauri-build.yml`'s `bundle` matrix, adding a `darwin-x86_64` entry to the `latest.json`
+   generator's expected-platform set, and updating `docs/TAURI-CI.md`'s Build matrix table.
+
+## Tracking
+
+Issue: [#507](https://github.com/qnbs/WorldScript-Studio/issues/507).