diff --git a/CMakeLists.txt b/CMakeLists.txt
index 71bad5f..2cd189f 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -29,6 +29,10 @@ option(VELOX_BUILD_FUZZ   "Build libFuzzer targets (clang only)"  OFF)
 option(VELOX_ENABLE_MEDIA "Build the HLS/DASH media grabber (M4)" OFF)
 option(VELOX_WERROR       "Treat warnings as errors"              ON)
 
+# Central OS detection (docs/adr/0020-cross-platform-strategy.md). Included early: the
+# dependency finds below gate Linux-only libraries on VELOX_OS_LINUX.
+include(${CMAKE_CURRENT_SOURCE_DIR}/cmake/platform.cmake)
+
 # Project-wide warning flags. Set via add_compile_options (a directory property), not the
 # CMAKE_CXX_FLAGS cache variable, because the dev/tsan presets overwrite that cache var
 # wholesale for sanitizer flags — a target's warnings must not ride on it.
@@ -55,12 +59,24 @@ endif()
 if(EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/daemon/CMakeLists.txt)
     find_package(SQLite3 REQUIRED)
     find_package(nlohmann_json 3.11 REQUIRED)
-    find_package(PkgConfig REQUIRED)
-    pkg_check_modules(LIBSECRET REQUIRED IMPORTED_TARGET libsecret-1)
+    # libsecret / Secret Service is Linux-only (docs/adr/0020-cross-platform-strategy.md,
+    # docs/08-porting.md): macOS uses Keychain behind the same credential-store seam, so
+    # this stays REQUIRED on Linux and simply absent elsewhere — PORT's job is to add the
+    # macOS side of that seam, not to touch this find.
+    if(VELOX_OS_LINUX)
+        find_package(PkgConfig REQUIRED)
+        pkg_check_modules(LIBSECRET REQUIRED IMPORTED_TARGET libsecret-1)
+    endif()
 endif()
 
 if(VELOX_BUILD_GUI AND EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/gui/CMakeLists.txt)
-    find_package(Qt6 6.6 REQUIRED COMPONENTS Widgets Svg Network LinguistTools)
+    # DBus (gui/docs/pkg-qa-requests-m1.md R4) backs the org.freedesktop.portal
+    # GlobalShortcuts path — Linux/portal-only, same reasoning as libsecret above.
+    if(VELOX_OS_LINUX)
+        find_package(Qt6 6.6 REQUIRED COMPONENTS Widgets Svg Network DBus LinguistTools)
+    else()
+        find_package(Qt6 6.6 REQUIRED COMPONENTS Widgets Svg Network LinguistTools)
+    endif()
     qt_standard_project_setup()
 endif()
 
diff --git a/cmake/platform.cmake b/cmake/platform.cmake
new file mode 100644
index 0000000..e193425
--- /dev/null
+++ b/cmake/platform.cmake
@@ -0,0 +1,45 @@
+# cmake/platform.cmake — central OS detection and per-OS source selection.
+#
+# Owned by PKG/QA (docs/adr/0020-cross-platform-strategy.md §4-5, amended: PORT owns
+# **/platform/<os>/** and the macOS/Windows packaging trees, but this file is root build
+# infrastructure and lands in Phase 0 — CORE's and DAEMON's own seams need
+# velox_platform_sources() to select their platform/linux/*.cpp before PORT ever starts).
+#
+# Sets exactly one of VELOX_OS_LINUX / VELOX_OS_MACOS / VELOX_OS_WINDOWS. Selection lives
+# here and nowhere else — no lane's own CMakeLists.txt should reimplement this check.
+if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
+    set(VELOX_OS_LINUX TRUE)
+elseif(CMAKE_SYSTEM_NAME STREQUAL "Darwin")
+    set(VELOX_OS_MACOS TRUE)
+elseif(CMAKE_SYSTEM_NAME STREQUAL "Windows")
+    set(VELOX_OS_WINDOWS TRUE)
+else()
+    message(FATAL_ERROR "velox: unsupported CMAKE_SYSTEM_NAME '${CMAKE_SYSTEM_NAME}' — "
+                        "expected Linux, Darwin or Windows.")
+endif()
+
+# velox_platform_sources(<target> <dir>) adds <dir>/platform/<os>/*.cpp to <target>, where
+# <os> is linux, macos or windows to match this file's VELOX_OS_* selection. <dir> is
+# relative to the calling lane's own CMakeLists.txt (e.g. src/io, src/rpc) — the seam
+# headers themselves (<dir>/platform/*.hpp) are not globbed here, they're ordinary sources
+# the owning lane already lists.
+function(velox_platform_sources target dir)
+    if(VELOX_OS_LINUX)
+        set(os_dir "linux")
+    elseif(VELOX_OS_MACOS)
+        set(os_dir "macos")
+    elseif(VELOX_OS_WINDOWS)
+        set(os_dir "windows")
+    endif()
+
+    file(GLOB platform_sources CONFIGURE_DEPENDS
+         "${CMAKE_CURRENT_SOURCE_DIR}/${dir}/platform/${os_dir}/*.cpp")
+
+    if(NOT platform_sources)
+        message(WARNING "velox: velox_platform_sources(${target} ${dir}) found no "
+                        "sources under ${dir}/platform/${os_dir}/ — is the seam missing "
+                        "its ${os_dir} backend?")
+    endif()
+
+    target_sources(${target} PRIVATE ${platform_sources})
+endfunction()