diff --git a/.github/labeler.yml b/.github/labeler.yml
index 8c39d170ffc..9663656b7ec 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -69,6 +69,12 @@
       - any-glob-to-any-file:
           - "extensions/qa-channel/**"
           - "docs/channels/qa-channel.md"
+"extensions: qa-lab":
+  - changed-files:
+      - any-glob-to-any-file:
+          - "extensions/qa-lab/**"
+          - "docs/concepts/qa-e2e-automation.md"
+          - "docs/channels/qa-channel.md"
 "channel: signal":
   - changed-files:
       - any-glob-to-any-file:
diff --git a/.gitignore b/.gitignore
index ffa92691b18..5901f051b32 100644
--- a/.gitignore
+++ b/.gitignore
@@ -149,3 +149,4 @@ changelog/fragments/
 test/fixtures/openclaw-vitest-unit-report.json
 analysis/
 .artifacts/qa-e2e/
+extensions/qa-lab/web/dist/
diff --git a/docs/channels/qa-channel.md b/docs/channels/qa-channel.md
index 3b060c40569..107baba5389 100644
--- a/docs/channels/qa-channel.md
+++ b/docs/channels/qa-channel.md
@@ -68,9 +68,19 @@ Current vertical slice:
 pnpm qa:e2e
 ```
 
-This starts the in-repo QA bus, boots the bundled `qa-channel` runtime slice,
-runs a deterministic self-check, and writes a Markdown report under
-`.artifacts/qa-e2e/`.
+This now routes through the bundled `qa-lab` extension. It starts the in-repo
+QA bus, boots the bundled `qa-channel` runtime slice, runs a deterministic
+self-check, and writes a Markdown report under `.artifacts/qa-e2e/`.
+
+Private debugger UI:
+
+```bash
+pnpm qa:lab:build
+pnpm openclaw qa ui
+```
+
+That launches the private QA debugger at a local URL, separate from the
+shipped Control UI bundle.
 
 ## Scope
 
diff --git a/docs/concepts/qa-e2e-automation.md b/docs/concepts/qa-e2e-automation.md
index ca11227db20..5de0290b996 100644
--- a/docs/concepts/qa-e2e-automation.md
+++ b/docs/concepts/qa-e2e-automation.md
@@ -100,7 +100,7 @@ Discord, Teams, and similar channels.
 
 ## System overview
 
-The system has five pieces.
+The system has six pieces.
 
 1. `qa-channel` plugin
 
@@ -144,6 +144,14 @@ The auto-fix worker should start outside the container. It needs direct repo
 and GitHub access, clean worktree control, and better isolation from the
 runtime under test.
 
+6. `qa-lab` extension
+
+- Bundled extension under `extensions/qa-lab`
+- Owns the QA harness, Markdown report flow, and private debugger UI
+- Registers hidden CLI entrypoints such as `openclaw qa run` and
+  `openclaw qa ui`
+- Stays separate from the shipped Control UI bundle
+
 ## High-level flow
 
 1. Start `qa-bus`.
@@ -222,6 +230,29 @@ That is enough to build a first QA controller for:
 This should be Phase 0 because it de-risks the scenario protocol before the
 full channel lands.
 
+## `qa-lab` extension design
+
+`qa-lab` is the private operator-facing half of this system.
+
+Suggested package:
+
+- `extensions/qa-lab/`
+
+Suggested responsibilities:
+
+- host the synthetic bus state machine
+- host the scenario runner
+- write Markdown reports
+- serve a private debugger UI on a separate local server
+- keep that UI entirely outside the shipped Control UI bundle
+
+Suggested UI shape:
+
+- left rail for conversations and threads
+- center transcript pane
+- right rail for event stream and report inspection
+- bottom inject-composer for inbound QA traffic
+
 ## `qa-channel` plugin design
 
 ## Package layout