Fix pre-existing CI: bound wire decoder recursion; unblock Smoke + parse gates

[hyperpolymath]

What

Fixes two pre-existing, unrelated CI failures on main (surfaced while CI ran on the now-merged hook PR #63). Both were investigated and reproduced locally.

This branch contains only these fixes (4 files); the SessionStart hook from #63 is already merged.

1. parse-gate — vcltotal-parse stack overflows

Two distinct causes, both fixed:

a) The wire decoder was not actually total. from_wire / from_wire_op / from_wire_schema are documented "total, never panics", but dec_expr (and dec_vqltype in the schema codec) recursed without any depth bound. A deeply-nested adversarial stream — thousands of nested Compare/Aggregate tags, or nested TList — overflows the native stack and aborts the process (SIGABRT). A crash is not a total Ok/Err, so this violated the trusted-boundary contract (and is a DoS vector). The existing *_total_on_garbage fuzz tests didn't catch it because ≤2048 random bytes rarely form a deep valid prefix.

Fix: bound decode recursion with a DepthGuard + MAX_DEPTH = 128 (the same cap serde_json uses), returning a new WireError::TooDeep. This mirrors the module's existing anti-DoS stance on untrusted counts (never pre-allocated), now extended to untrusted nesting. New regression test feeds a 200k-deep stream to both from_wire and from_wire_schema and asserts Err(TooDeep) with no overflow on the default 2 MiB stack.

b) The roundtrip property tests intermittently overflowed the 2 MiB test stack. proptest's recursive expr() / statement() strategies recurse far enough during value generation for some RNG seeds to exhaust the default test-thread stack — flaky, seed-dependent, and the cause of the intermittent red. The generated values themselves are shallow (measured max depth 6), so this is proptest harness overhead, not a deep AST, and is independent of (a).

Fix: run the parse-gate test step with RUST_MIN_STACK=32 MiB. (Verified: 8 MiB already clears it across repeated runs; 32 MiB is comfortable headroom.)

2. backend-matrix — every Smoke (<prover>) job fails at setup

All ~105 jobs failed identically before running any prover logic:

error: cannot create the lock file …/src/interface/echidna-client/Cargo.lock
because --locked was passed to prevent this

echidna-client is a standalone workspace with no committed Cargo.lock — its transitive echidna-core path-dep only exists once the sibling repo is cloned (the step just above), so a lockfile can't be committed and --locked can never be satisfied.

Fix: drop --locked from that one cargo test invocation so deps resolve fresh against the just-cloned sibling.

Validation

• ✅ Full vcltotal-parse suite (lib + gate + parse + wire + conformance, 36 tests) green at RUST_MIN_STACK=32 MiB
• ✅ cargo clippy --manifest-path src/interface/parse/Cargo.toml --all-targets --locked -- -D warnings clean (the gate's SPARK-grade lint set)
• ✅ Totality regression test passes on the default 2 MiB stack (no overflow)
• ✅ Roundtrip property tests pass repeatedly at ≥8 MiB

Note

The backend-matrix (Smoke) change can't be exercised locally — those jobs clone the echidna sibling, which isn't available here — but the edit directly removes the exact --locked condition that produced the error.

🤖 Generated with Claude Code

https://claude.ai/code/session_017nyxs8RgqZa72PzrTu3L75

---

Generated by Claude Code