From e214b5276ab624b1f550f79ec2914fe39aceb57e Mon Sep 17 00:00:00 2001
From: "Len P. van der Hof" <Lenvanderhof@ReasonKit.sh>
Date: Sun, 23 Aug 2026 19:42:57 +0200
Subject: [PATCH] fix(dist): verify release artifact builds

---
 .github/workflows/ci.yml        |  2 ++
 CHANGELOG.md                    |  2 ++
 Cargo.toml                      |  4 ++++
 justfile                        |  5 ++++-
 tests/test_distribution_docs.py | 16 ++++++++++++++++
 5 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1dd3e18..a1e9d0e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -39,6 +39,8 @@ jobs:
         run: cargo install cargo-dist --version 0.32.0 --locked
       - name: Validate configuration-only cargo-dist manifest
         run: dist manifest --artifacts=local --output-format=json --no-local-paths
+      - name: Build cargo-dist host artifacts
+        run: dist build --artifacts=host
       - name: Build release
         run: cargo build --release
       - name: Full-pack smoke test (stdio MCP)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 66d2bb8..d70bcc7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -49,3 +49,5 @@ All notable changes to ReasonKit Think are documented here.
 - Added deterministic protocol, pack, eight-check adversarial governance,
   packaging, Registry, cargo-dist, and dependency-audit gates for CI and local
   release checks.
+- Added the cargo-dist release profile and a real host-artifact build gate so
+  distribution validation cannot pass while archive production is broken.
diff --git a/Cargo.toml b/Cargo.toml
index 5472d3a..9cf6fb1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -46,3 +46,7 @@ reqwest = { version = "0.12", default-features = false, features = ["blocking",
 
 [dev-dependencies]
 uuid = { version = "1", features = ["v4"] }
+
+[profile.dist]
+inherits = "release"
+lto = "thin"
diff --git a/justfile b/justfile
index d7d95a1..3aac336 100644
--- a/justfile
+++ b/justfile
@@ -31,7 +31,10 @@ dist-check:
     @test "$(dist --version)" = "cargo-dist 0.32.0"
     @dist manifest --artifacts=local --output-format=json --no-local-paths > /dev/null
 
-ci: check eval audit package-check registry-check dist-check
+dist-host-check: dist-check
+    dist build --artifacts=host
+
+ci: check eval audit package-check registry-check dist-check dist-host-check
 
 fmt:
     CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-{{ justfile_directory() }}/target}" cargo fmt
diff --git a/tests/test_distribution_docs.py b/tests/test_distribution_docs.py
index b564418..0f079eb 100644
--- a/tests/test_distribution_docs.py
+++ b/tests/test_distribution_docs.py
@@ -142,6 +142,22 @@ def test_cargo_dist_bootstrap_is_config_only(self) -> None:
         self.assertEqual(config["dist"]["hosting"], ["github"])
         self.assertFalse((ROOT / ".github" / "workflows" / "release.yml").exists())
 
+    def test_cargo_dist_has_a_buildable_release_profile_and_host_gate(self) -> None:
+        cargo = tomllib.loads((ROOT / "Cargo.toml").read_text(encoding="utf-8"))
+        self.assertEqual(
+            cargo["profile"]["dist"],
+            {"inherits": "release", "lto": "thin"},
+        )
+
+        justfile = (ROOT / "justfile").read_text(encoding="utf-8")
+        self.assertIn("dist-host-check:", justfile)
+        self.assertIn("dist build --artifacts=host", justfile)
+
+        workflow = (ROOT / ".github" / "workflows" / "ci.yml").read_text(
+            encoding="utf-8"
+        )
+        self.assertIn("dist build --artifacts=host", workflow)
+
     @unittest.skipUnless(shutil.which("dist"), "cargo-dist is not installed")
     def test_cargo_dist_manifest_needs_no_generated_workflow(self) -> None:
         result = subprocess.run(