diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 51c8a19..eb31016 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,7 +2,12 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches:
+      - "**"
+    paths-ignore:
+      - "README.md"
+      - "docs/**"
+      - "install.sh"
   pull_request:
 
 concurrency:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 20c7dd7..f989f21 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,7 +5,8 @@ permissions:
 
 on:
   push:
-    branches: [main]
+    tags:
+      - "v*.*.*-*"
 
 concurrency:
   group: release-${{ github.ref }}
@@ -17,6 +18,16 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Validate release tag format
+        run: |
+          TAG="${GITHUB_REF_NAME}"
+          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-[A-Za-z]+$ ]]; then
+            echo "Tag '$TAG' does not match required format vX.X.X-word"
+            exit 1
+          fi
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -24,25 +35,39 @@ jobs:
       - name: Cache Rust
         uses: Swatinem/rust-cache@v2
 
+      - name: Resolve target commit
+        run: |
+          TARGET_SHA="$(git rev-list -n 1 "${GITHUB_REF_NAME}")"
+          echo "TARGET_SHA=$TARGET_SHA" >> "$GITHUB_ENV"
+
+      - name: Verify CI passed
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          COUNT="$(gh run list --workflow ci.yml --commit "$TARGET_SHA" --json conclusion,createdAt --jq 'length')"
+          if [ "$COUNT" -eq 0 ]; then
+            echo "No CI runs found for commit $TARGET_SHA"
+            exit 1
+          fi
+          CONCLUSION="$(gh run list --workflow ci.yml --commit "$TARGET_SHA" --json conclusion,createdAt --jq '.[0].conclusion')"
+          if [ "$CONCLUSION" != "success" ]; then
+            echo "Latest CI run for commit $TARGET_SHA is $CONCLUSION"
+            exit 1
+          fi
+
       - name: Build release binary
         run: cargo build --release --locked
 
-      - name: Set short git commit SHA
-        id: vars
-        run: |
-          echo "SHA_SHORT=$(git rev-parse --short ${{ github.sha }})" >> $GITHUB_ENV
-          echo "BUILD_DATE=$(date +'%Y-%m-%d')"                       >> $GITHUB_ENV
-
       - name: Package binary
         run: |
           cd target/release
           zip vibebox-macos-arm64.zip vibebox
 
-      - name: Create sha release
+      - name: Create tag release
         run: |
-          gh release create "${{ env.BUILD_DATE }}-${{ env.SHA_SHORT }}" \
-            --title "${{ env.BUILD_DATE }}-${{ env.SHA_SHORT }}" \
-            --notes "Built from commit ${{ github.sha }}" \
+          gh release create "${{ github.ref_name }}" \
+            --title "${{ github.ref_name }}" \
+            --notes "Built from commit $TARGET_SHA" \
             target/release/vibebox-macos-arm64.zip
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -56,7 +81,7 @@ jobs:
         run: |
           gh release create latest \
             --title "Latest" \
-            --notes "Built from commit ${{ github.sha }}" \
+            --notes "Built from commit $TARGET_SHA" \
             --prerelease \
             target/release/vibebox-macos-arm64.zip
         env:
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..e69de29