The stable Miri app ships an engine that was built and checked in release mode#395

Outcome

When Sam moves a version from Miri Developer to the stable Miri app, the release builds the bundled engine in release mode and checks that build before the app ships. People who install Miri get an engine that was built and checked exactly as it ships.

Context

On 9 November 2026, Sam decided that engine CI does not run a release build while Miri Developer is the product. paneru#154 removes the Release build job from miri.yml in samanyudas/paneru. That job ran cargo build --release --locked --verbose, which uses the engine's release profile (lto = true, codegen-units = 1) and its default features. It took 600 s cold and over 4.5 minutes with a warm cache, while every other engine job took about 2 minutes.

Today nothing in Miri builds the engine in release mode. scripts/build-app.sh builds Miri Developer with the debug profile: cargo build ... --no-default-features --features miri-developer. So the release build is a gap in the release path, not a lost check.

Part of #82, which tracks signing, notarization, Homebrew delivery, and updates.

Acceptance criteria

• The stable Miri app's build runs cargo build --release --locked for the engine, without the miri-developer feature, and stops the release if that build fails. Check: read the release workflow log for a release candidate.
• The stable Miri app bundle contains that release engine binary, and Miri Developer keeps the debug engine. Check: compare the engine binary in each bundle with the build log that produced it.
• The selftests (make e2e or the release equivalent) pass against the stable Miri app with the release engine. Check: the release workflow log.
• Engine pull requests into miri/** still run no release build. Check: the job list of a pull request run in samanyudas/paneru.

Verification level

make check, plus one release candidate built through the release workflow. No hardware or permission grant beyond what #82 already needs for signing and notarization.

Out of scope

Adding the release build back to engine pull request CI. Signing, notarization, Homebrew, and Sparkle updates, which #82 tracks.