[tee8z]

Problem

The agent image ships the rust-crap-score engineering skill (#140), but its collector stops before it starts:

knots 1.16.0 is required; set KNOTS_BIN to its path
required cargo-llvm-cov 0.8.5; found none

It accepts only those exact versions, and cargo llvm-cov also needs the toolchain's LLVM tools. The backend skill requires CRAP checks in some repositories, so remote agents cannot follow it today.

Change

Tool	Version	How the image gets it
llvm-tools-preview	Rust 1.97.1 component	rustup component add in development-rust, copied to /opt/rustup with the toolchain
cargo-llvm-cov	0.8.5	Release musl binary per architecture, pinned by SHA-256 like via and sccache (x86_64 e9fc23db…, aarch64 bc14a455…)
knots	1.16.0	cargo install --locked from crates.io in a new crap-tools stage; only the stripped binary reaches the image

The README lists the tools.

Design notes

• knots builds from source. Its 1.16.0 release has a linux x86_64 binary but none for arm64, and staging agent nodes are Graviton. The crate ships its own Cargo.lock, so --locked is reproducible. Cargo checks the crate against the registry checksum (ca72f815…). Its rust-toolchain.toml (stable) does not apply, because cargo install builds from the registry, outside the crate directory.
• The heavy-job gate already covers cargo llvm-cov. heavy-bin/cargo lists llvm-cov, so coverage runs hold a build slot like cargo test.

Validation

• test-image.sh now checks cargo llvm-cov --version = cargo-llvm-cov 0.8.5, knots --version = knots 1.16.0, and the installed llvm-tools component. It then collects real LCOV and knots JSON for a one-function crate, offline, as the skill does. CI runs this on both architectures.
• hadolint passes, and so does docker buildx build --check with the empty skills context.
• The checksums come from downloading the 0.8.5 release assets. I did not run the downloaded binaries locally; the image test runs them.
• This PR's CI passed on both architectures: Build buzz-agent (amd64) and (arm64), including Image contract tests and Packaged tool tests. Both logs show the coverage run of the sample crate's test (test negative ... ok) going through the heavy-job wrapper without a gate, then PASS: agent adapter packaging. That bash -e block stops at its first failure, so the version, llvm-tools, LCOV, and knots JSON checks all passed.

Limits

• Only the image's default toolchain (1.97.1) has llvm-tools. A repository that pins another toolchain in rust-toolchain.toml also needs that toolchain's llvm-tools-preview.
• The knots build adds a few minutes to each agent image build, per architecture.

Rollout

After merge, promote the new agent digest as with cd#675 and voltage-terraform#1026.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts