From 2d22829746d7a0d4e7fe9ee6e632edfc626f8371 Mon Sep 17 00:00:00 2001
From: Norrie Taylor <norrie@minimal.dev>
Date: Tue, 23 Jun 2026 20:18:32 -0700
Subject: [PATCH] fix(sdd-execute): install protobuf-compiler in host rust
 cleanup

The post-agent rust cleanup installs the Rust toolchain on the host
runner but not protoc. The refresh step's `cargo clippy` compiles the
workspace and runs build scripts; crates using prost/tonic shell out to
`protoc`, so a manifest-adding task that pulls a protobuf crate fails the
refresh with "Could not find protoc" (seen on a consumer pilot run adding
a WireGuard mesh dependency). Install protobuf-compiler best-effort,
gated on the same Rust-edit detection; non-Debian hosts degrade to a
warning so clippy fails loudly rather than this step erroring opaquely.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0143kv2BRrRqGxmVwwHskQtS
---
 shared/sdd-rust-cleanup.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/shared/sdd-rust-cleanup.md b/shared/sdd-rust-cleanup.md
index ee07906..8629778 100644
--- a/shared/sdd-rust-cleanup.md
+++ b/shared/sdd-rust-cleanup.md
@@ -94,6 +94,27 @@ post-steps:
     with:
       toolchain: stable
       components: rustfmt, clippy
+  - name: Install protobuf-compiler (host)
+    # `cargo clippy` in the refresh step below compiles the workspace, which
+    # runs build scripts; crates using prost/tonic shell out to `protoc` at
+    # build time. The host runner has the Rust toolchain (above) but not
+    # protoc, so a manifest-adding task that pulls a protobuf crate fails the
+    # refresh with `Could not find protoc` (first seen on a consumer pilot run
+    # adding a WireGuard mesh dep). Install it best-effort, gated on the same
+    # Rust-edit detection. Non-Debian hosts (no apt) degrade to a warning so
+    # clippy fails loudly on the missing tool rather than this step erroring.
+    if: steps.cargo_detect.outputs.changed == 'true'
+    shell: bash
+    run: |
+      set -euo pipefail
+      if command -v protoc >/dev/null 2>&1; then
+        echo "protoc already present: $(protoc --version)"
+      elif command -v apt-get >/dev/null 2>&1; then
+        sudo apt-get update -qq && sudo apt-get install -y -qq protobuf-compiler
+        echo "Installed $(protoc --version)"
+      else
+        echo "::warning::apt-get unavailable; cannot auto-install protobuf-compiler. Crates using prost/tonic may fail the clippy refresh."
+      fi
   - name: Refresh Cargo.lock, format, and lint-fix the agent patch
     if: steps.cargo_detect.outputs.changed == 'true'
     shell: bash