diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9145e25..4d3fd70 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,4 +1,4 @@
-# Generated from operatorstack/intelligence-flow.
+# Boatstack-owned control plane.
 name: Verify Boatstack distribution
 
 on:
@@ -11,11 +11,59 @@ permissions:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
+      - name: Detect projected runtime
+        id: runtime
+        shell: bash
+        run: |
+          if [[ -f boatstack/go.mod ]]; then
+            echo "go=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "go=false" >> "$GITHUB_OUTPUT"
+          fi
+      - uses: actions/setup-go@v5
+        if: steps.runtime.outputs.go == 'true'
+        with:
+          go-version-file: boatstack/go.mod
+          cache-dependency-path: boatstack/go.mod
+      - run: go test ./...
+        if: steps.runtime.outputs.go == 'true'
+        working-directory: boatstack
+      - run: go build ./cmd/boatstack-helper
+        if: steps.runtime.outputs.go == 'true'
+        working-directory: boatstack
       - uses: actions/setup-python@v5
+        if: steps.runtime.outputs.go != 'true'
         with:
           python-version: "3.11"
-      - run: python3 -m unittest discover -s tests -v
-      - run: python3 -m compileall -q boatstack
+      - name: Verify legacy projection during migration
+        if: steps.runtime.outputs.go != 'true'
+        env:
+          PYTHONUTF8: "1"
+        run: python3 -m unittest discover -s tests -v
+      - name: Compile legacy projection during migration
+        if: steps.runtime.outputs.go != 'true'
+        env:
+          PYTHONUTF8: "1"
+        run: python3 -m compileall -q boatstack
+      - name: Validate Bash installer
+        if: steps.runtime.outputs.go == 'true' && runner.os != 'Windows'
+        shell: bash
+        run: bash -n install.sh
+      - name: Validate PowerShell installer
+        if: steps.runtime.outputs.go == 'true' && runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $tokens = $null
+          $errors = $null
+          [System.Management.Automation.Language.Parser]::ParseFile((Resolve-Path install.ps1), [ref]$tokens, [ref]$errors) > $null
+          if ($errors.Count -gt 0) {
+            $errors | ForEach-Object { Write-Error $_ }
+            exit 1
+          }
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..5897388
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,77 @@
+# Boatstack-owned control plane.
+name: Release Boatstack helper
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - goos: linux
+            goarch: amd64
+            asset: boatstack-helper_linux_amd64
+          - goos: linux
+            goarch: arm64
+            asset: boatstack-helper_linux_arm64
+          - goos: darwin
+            goarch: amd64
+            asset: boatstack-helper_darwin_amd64
+          - goos: darwin
+            goarch: arm64
+            asset: boatstack-helper_darwin_arm64
+          - goos: windows
+            goarch: amd64
+            asset: boatstack-helper_windows_amd64.exe
+          - goos: windows
+            goarch: arm64
+            asset: boatstack-helper_windows_arm64.exe
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: boatstack/go.mod
+          cache-dependency-path: boatstack/go.mod
+      - name: Build native helper
+        shell: bash
+        env:
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+          CGO_ENABLED: "0"
+          ASSET: ${{ matrix.asset }}
+          VERSION: ${{ github.ref_name }}
+        run: |
+          source_commit="$(jq -r '.source.commit' UPSTREAM.json)"
+          mkdir -p dist
+          cd boatstack
+          go build -trimpath \
+            -ldflags "-s -w -X github.com/operatorstack/boatstack/boatstack.Version=$VERSION -X github.com/operatorstack/boatstack/boatstack.SourceCommit=$source_commit -X github.com/operatorstack/boatstack/boatstack.ChecksumsSHA256=per-asset-sidecar" \
+            -o "../dist/$ASSET" ./cmd/boatstack-helper
+          cd ../dist
+          sha256sum "$ASSET" > "$ASSET.sha256"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.asset }}
+          path: dist/${{ matrix.asset }}*
+
+  release:
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: dist
+          merge-multiple: true
+      - name: Publish release assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release create "${GITHUB_REF_NAME}" dist/* --repo "${GITHUB_REPOSITORY}" --generate-notes --verify-tag