diff --git a/.gitignore b/.gitignore
index 9bc24d84..7df3cc9f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,6 +10,8 @@ Thumbs.db
!.env.example
*.pem
*.key
+*.p12
+*.p8
secrets.json
credentials.json
.watermark-lint.sh
diff --git a/desktop/app/loading.html b/desktop/app/loading.html
new file mode 100644
index 00000000..1796585c
--- /dev/null
+++ b/desktop/app/loading.html
@@ -0,0 +1,154 @@
+
+
+
+
+ Orcabot
+
+
+
+
+
+
Orcabot
+
Warming up the engines…
+
+
+
+
+
+
Loading Orcabot...
-
-
-
-REDIRECT_EOF
-printf '%s\n' " Created: redirect page in dist/"
+cp "$ROOT_DIR/app/loading.html" "$DIST_DIR/index.html"
+# Brand logo for the loading screen (best-effort; the page hides it if missing).
+cp "$ROOT_DIR/../frontend/public/orca.png" "$DIST_DIR/orca.png" 2>/dev/null || true
+printf '%s\n' " Created: loading page in dist/"
printf '%s\n' "Desktop resources staged in $TAURI_RESOURCES_DIR"
+
+# --- Code-sign nested Mach-O binaries for Developer ID notarization ----------
+# Tauri signs the app shell but NOT these bundled resource executables, so we
+# sign them here — before Tauri copies them in and seals/notarizes the bundle.
+# Gated on APPLE_SIGNING_IDENTITY so plain dev builds are unaffected. workerd
+# (V8) needs JIT entitlements; vz-helper needs the virtualization entitlement.
+if [ -n "${APPLE_SIGNING_IDENTITY:-}" ]; then
+ ENT_DIR="$ROOT_DIR/app/src-tauri"
+ printf '%s\n' "Code-signing nested binaries with: $APPLE_SIGNING_IDENTITY"
+ sign_bin() {
+ [ -f "$1" ] || { printf '%s\n' " skip (missing): $1"; return 0; }
+ if [ -n "${2:-}" ]; then
+ codesign --force --options runtime --timestamp --entitlements "$2" --sign "$APPLE_SIGNING_IDENTITY" "$1"
+ else
+ codesign --force --options runtime --timestamp --sign "$APPLE_SIGNING_IDENTITY" "$1"
+ fi
+ printf '%s\n' " signed: $1"
+ }
+ sign_bin "$TAURI_RESOURCES_DIR/workerd/workerd" "$ENT_DIR/entitlements-workerd.plist"
+ sign_bin "$TAURI_RESOURCES_DIR/d1-shim/d1-shim"
+ sign_bin "$TAURI_RESOURCES_DIR/vm/vz-helper" "$ENT_DIR/entitlements-vz-helper.plist"
+else
+ printf '%s\n' "APPLE_SIGNING_IDENTITY not set — skipping nested-binary signing (dev build)"
+fi
diff --git a/desktop/scripts/publish-release.sh b/desktop/scripts/publish-release.sh
new file mode 100755
index 00000000..ada83c6c
--- /dev/null
+++ b/desktop/scripts/publish-release.sh
@@ -0,0 +1,84 @@
+#!/usr/bin/env sh
+set -eu
+# Publish a desktop release to GitHub Releases.
+#
+# Uploads, for the version in tauri.conf.json:
+# - the DMG (direct download for new installs)
+# - Orcabot.app.tar.gz (+ .sig) updater artifacts
+# - latest.json updater manifest (what the app polls)
+#
+# Prereqs:
+# - `gh` CLI authenticated (`gh auth login`)
+# - a signed+notarized build already in app/src-tauri/target/release/bundle
+# (i.e. you've run `cargo tauri build` with the signing env)
+#
+# The updater endpoint (tauri.conf.json) is:
+# https://github.com//releases/latest/download/latest.json
+# so the release must be published (not draft) to become "latest".
+
+REPO="${ORCABOT_RELEASE_REPO:-Hyper-Int/OrcaBot}"
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+SRC_TAURI="$SCRIPT_DIR/../app/src-tauri"
+BUNDLE="$SRC_TAURI/target/release/bundle"
+
+VERSION=$(grep -m1 '"version"' "$SRC_TAURI/tauri.conf.json" | sed -E 's/.*"version"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/')
+[ -n "$VERSION" ] || { echo "could not read version from tauri.conf.json"; exit 1; }
+TAG="v$VERSION"
+
+# Match THIS version's DMG explicitly. Tauri doesn't clean the bundle dir
+# between builds, so a bare *.dmg glob could pick up a stale previous-version
+# (or pre-rename "Orcabot Desktop_...") DMG while latest.json points at the
+# current tarball.
+set -- "$BUNDLE"/dmg/Orcabot_"$VERSION"_*.dmg
+if [ "$#" -ne 1 ] || [ ! -f "$1" ]; then
+ echo "expected exactly one Orcabot_${VERSION}_*.dmg in $BUNDLE/dmg — found: $*"
+ echo "(clean the bundle dir, or rebuild this version's DMG)"
+ exit 1
+fi
+DMG="$1"
+TARBALL="$BUNDLE/macos/Orcabot.app.tar.gz"
+SIG="$TARBALL.sig"
+for f in "$TARBALL" "$SIG"; do
+ [ -f "$f" ] || { echo "missing artifact: $f — run a signed \`cargo tauri build\` first"; exit 1; }
+done
+
+# The updater downloads the tarball from this versioned release URL. (arm64 only
+# here; add a darwin-x86_64 entry if you also build an Intel target.)
+URL="https://github.com/$REPO/releases/download/$TAG/Orcabot.app.tar.gz"
+SIGNATURE=$(cat "$SIG")
+PUB_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+WORK=$(mktemp -d)
+LATEST="$WORK/latest.json"
+cat > "$LATEST" < $URL"
+
+if gh release view "$TAG" --repo "$REPO" >/dev/null 2>&1; then
+ echo "Release $TAG exists — uploading/replacing assets."
+ gh release upload "$TAG" --repo "$REPO" --clobber "$DMG" "$TARBALL" "$SIG" "$LATEST"
+else
+ gh release create "$TAG" --repo "$REPO" \
+ --title "Orcabot $TAG" \
+ --notes "Orcabot desktop $TAG" \
+ "$DMG" "$TARBALL" "$SIG" "$LATEST"
+fi
+
+echo
+echo "Done."
+echo " Direct download: https://github.com/$REPO/releases/download/$TAG/$(basename "$DMG")"
+echo " Updater manifest: https://github.com/$REPO/releases/latest/download/latest.json"