diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index 7382296..79ca8d7 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -171,8 +171,9 @@ packages/protocol   wire contract: schemas, codec (total), kinds, chunking,
   wiped from component state immediately after send.
 - Do not downgrade Node / TypeScript / Rust / NDK versions to work around a build
   failure; fix the root cause.
-- The root `main.js` shim and `docker/Dockerfile` both assume the bridge builds
-  to `apps/bridge/out/main.js` — keep them consistent if that changes.
+- The `docker/main.js` shim (copied to `/app/main.js` in the image) and
+  `docker/Dockerfile` both assume the bridge builds to `apps/bridge/out/main.js`
+  — keep them consistent if that changes.
 
 ## Vendored history note
 
diff --git a/README.md b/README.md
index f4325c6..8c765db 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,7 @@
 # CodeDeck+
 
+[![CI](https://github.com/deymosh/codedeck-plus/actions/workflows/ci.yml/badge.svg)](https://github.com/deymosh/codedeck-plus/actions/workflows/ci.yml)
+
 CodeDeck+ is a community-maintained continuation of CodeDeck Next. The
 original work belongs to [JeroenOnNostr](https://github.com/JeroenOnNostr),
 whose two upstream projects are:
@@ -30,8 +32,8 @@ patch) but is built separately with its own Android/Rust toolchain.
 ```
 codedeck-plus/
 ├── vendor/              # pristine git-subtree mirrors of upstream — never hand-edited
-│   ├── bridge/           #   codedeck-next-bridge @ main
-│   └── mobile/           #   codedeck-next-mobile @ main
+│   ├── bridge/           #   codedeck-next-bridge @ main (carries its own package.json / pnpm-*,
+│   └── mobile/           #   codedeck-next-mobile @ main   inert — not in the workspace glob)
 ├── packages/             # shared workspace packages (the actual, editable code)
 │   ├── protocol/          #   wire format + NIP-42 signer, used by both apps
 │   ├── core/               #   bridge engine (Node-only: Tor/SOCKS5 transport lives here)
@@ -41,9 +43,15 @@ codedeck-plus/
 │   └── mobile/             # Tauri v2 + React Android app (not built by Docker)
 ├── docker/
 │   ├── Dockerfile
-│   └── entrypoint.sh
+│   ├── entrypoint.sh
+│   └── main.js          # container entry shim (WebSocket global → built bridge CLI)
+├── docs/
+│   └── PROTOCOL.md      # the wire contract (packages/protocol/src/ is authoritative)
 ├── scripts/
 │   └── sync-upstream.sh  # pulls upstream into vendor/*, for hand-merging
+├── .github/workflows/   # ci.yml (typecheck + test + build + cargo) · release.yml (tag → release)
+├── .claude/             # CLAUDE.md + skills for Claude Code
+├── codedeck             # ./codedeck — bridge / Tor / APK / test wrapper (Docker, no host toolchain)
 ├── docker-compose.yml
 ├── pnpm-workspace.yaml
 └── data/                 # runtime volume (bridge identity, paired phones, sessions)
@@ -124,6 +132,26 @@ docker compose --profile tor up -d --build
 docker compose logs -f codedeck-bridge
 ```
 
+## Releases
+
+Pushing a `vMAJOR.MINOR.PATCH` tag runs [`.github/workflows/release.yml`](.github/workflows/release.yml),
+which publishes one GitHub Release with every artifact of that version:
+
+| Component | Artifact |
+|---|---|
+| Android app | `codedeck-vX.Y.Z.apk` — release aarch64 build, signed |
+| Bridge CLI (`npx` / global install) | `codedeck-bridge-X.Y.Z.tgz` |
+| Bridge container image | `ghcr.io/deymosh/codedeck-plus-bridge:vX.Y.Z` (and `:latest`) |
+
+A tag with a hyphen (`v1.2.3-rc1`) is published as a prerelease and does not move
+`:latest`. The tag's version is stamped into the bridge and mobile manifests at
+build time. `workflow_dispatch` runs the same pipeline for a dry run.
+
+APK signing needs four repository secrets — `SIGNING_KEY` (base64 keystore),
+`KEY_ALIAS`, `KEY_STORE_PASSWORD`, `KEY_PASSWORD`. See
+[`.claude/skills/cut-release/SKILL.md`](.claude/skills/cut-release/SKILL.md) for
+the full runbook.
+
 ## Related repos
 
 - [codedeck-next-mobile](https://github.com/JeroenOnNostr/codedeck-next-mobile) — upstream Android app
diff --git a/apps/bridge/README.md b/apps/bridge/README.md
index 7e3bfab..030fe60 100644
--- a/apps/bridge/README.md
+++ b/apps/bridge/README.md
@@ -8,10 +8,10 @@ extension — same engine (`@codedeck/core`), no editor required.
 ## Quickstart
 
 This package is **not on the npm registry** — install it from the release
-tarball:
+tarball attached to each CodeDeck+ GitHub release:
 
 ```sh
-npm i -g https://github.com/JeroenOnNostr/codedeck-next-bridge/releases/download/v0.9.3/codedeck-bridge-0.9.3.tgz
+npm i -g https://github.com/deymosh/codedeck-plus/releases/download/v0.10.0/codedeck-bridge-0.10.0.tgz
 
 codedeck-bridge run     # run the bridge, serving pairing (Ctrl-C to stop)
 codedeck-bridge pair    # pairing window only: terminal QR + pairing URL
diff --git a/apps/bridge/package.json b/apps/bridge/package.json
index a513f99..7992cf6 100644
--- a/apps/bridge/package.json
+++ b/apps/bridge/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@codedeck/bridge",
-  "version": "0.9.3",
+  "version": "0.10.0",
   "type": "module",
   "bin": {
     "codedeck-bridge": "./out/main.js"
@@ -28,8 +28,8 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/JeroenOnNostr/codedeck-next-bridge.git",
-    "directory": "apps/bridge-cli"
+    "url": "git+https://github.com/deymosh/codedeck-plus.git",
+    "directory": "apps/bridge"
   },
   "engines": {
     "node": ">=20"
diff --git a/apps/mobile/package.json b/apps/mobile/package.json
index 36ffb82..66b1fde 100644
--- a/apps/mobile/package.json
+++ b/apps/mobile/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@codedeck/mobile",
-  "version": "0.9.5",
+  "version": "0.10.0",
   "private": true,
   "type": "module",
   "license": "MIT",
diff --git a/apps/mobile/src-tauri/Cargo.lock b/apps/mobile/src-tauri/Cargo.lock
index 23e6f88..ad1eea7 100644
--- a/apps/mobile/src-tauri/Cargo.lock
+++ b/apps/mobile/src-tauri/Cargo.lock
@@ -665,7 +665,7 @@ dependencies = [
 
 [[package]]
 name = "codedeck-mobile"
-version = "0.9.5"
+version = "0.10.0"
 dependencies = [
  "hex",
  "mdk-core",
@@ -685,6 +685,7 @@ dependencies = [
  "tauri-plugin-http",
  "tauri-plugin-mesh",
  "tauri-plugin-notification",
+ "tauri-plugin-tor-proxy",
  "tempfile",
  "tokio",
 ]
@@ -5520,6 +5521,16 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "tauri-plugin-tor-proxy"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+ "tauri",
+ "tauri-plugin",
+]
+
 [[package]]
 name = "tauri-runtime"
 version = "2.11.3"
diff --git a/apps/mobile/src-tauri/Cargo.toml b/apps/mobile/src-tauri/Cargo.toml
index 41371a7..1c6590e 100644
--- a/apps/mobile/src-tauri/Cargo.toml
+++ b/apps/mobile/src-tauri/Cargo.toml
@@ -2,7 +2,7 @@
 name = "codedeck-mobile"
 # Semver per package (plan: the padded/unpadded calendar-version Cargo footgun
 # is dead). Keep in lockstep with tauri.conf.json `version`.
-version = "0.9.5"
+version = "0.10.0"
 description = "CodeDeck — remote-control Claude Code over Nostr (mobile/desktop shell)"
 edition = "2021"
 rust-version = "1.77.2"
diff --git a/apps/mobile/src-tauri/tauri.conf.json b/apps/mobile/src-tauri/tauri.conf.json
index 783b5ca..8be3427 100644
--- a/apps/mobile/src-tauri/tauri.conf.json
+++ b/apps/mobile/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "CodeDeck+",
-  "version": "0.9.5",
+  "version": "0.10.0",
   "identifier": "com.codedeck.next",
   "build": {
     "frontendDist": "../dist",
diff --git a/docker/Dockerfile b/docker/Dockerfile
index fbfd66f..8a3ff36 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -55,7 +55,7 @@ COPY --chown=root:root docker/git-credential-codedeck-secret /usr/local/bin/git-
 RUN chmod 0755 /usr/local/bin/git-credential-codedeck-secret
 COPY --chown=root:root docker/gh-codedeck-secret /usr/local/bin/gh
 RUN chmod 0755 /usr/local/bin/gh
-COPY --chown=codedeck:codedeck main.js /app/main.js
+COPY --chown=codedeck:codedeck docker/main.js /app/main.js
 
 # Switch back to the non-root user for running the application
 USER codedeck
diff --git a/main.js b/docker/main.js
similarity index 100%
rename from main.js
rename to docker/main.js
diff --git a/package.json b/package.json
index cde2e7e..9d5d732 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "codedeck-plus",
   "private": true,
-  "version": "0.1.0",
+  "version": "0.10.0",
   "description": "CodeDeck+ community continuation of CodeDeck Next — unified bridge + mobile monorepo with Tor/SOCKS5 transport and NIP-42 relay auth.",
   "scripts": {
     "typecheck": "pnpm -r --no-bail run typecheck",
diff --git a/packages/core/package.json b/packages/core/package.json
index acb036a..13fabd0 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@codedeck/core",
-  "version": "0.9.3",
+  "version": "0.10.0",
   "private": true,
   "type": "module",
   "main": "src/index.ts",
diff --git a/packages/protocol/package.json b/packages/protocol/package.json
index 750a29a..9b520bf 100644
--- a/packages/protocol/package.json
+++ b/packages/protocol/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@codedeck/protocol",
-  "version": "0.9.4",
+  "version": "0.10.0",
   "private": true,
   "type": "module",
   "main": "src/index.ts",
diff --git a/packages/testkit/package.json b/packages/testkit/package.json
index fc52c09..552699b 100644
--- a/packages/testkit/package.json
+++ b/packages/testkit/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@codedeck/testkit",
-  "version": "0.9.3",
+  "version": "0.10.0",
   "private": true,
   "type": "module",
   "main": "src/index.ts",