fix(lsp): fail closed on malformed requests; extend aspect gate to panic family

[hyperpolymath]

Closes #49.

What #49 asked, and where it stands

Re-audited all three items against the current tree (the gate has evolved since the issue was filed in June — it now scopes checks 2–3 to production code and accepts // SAFETY:-justified FFI, both correct refinements):

Issue item	Disposition
5 missing SPDX headers	Done (landed earlier, e.g. #116). Verified: 0 missing.
20 unsafe in src/	10 remain, all justified: each carries a contiguous // SAFETY: comment; attest and recompute-wasm (the only crates with unsafe) both set #![deny(clippy::undocumented_unsafe_blocks)]. These are #[no_mangle] extern "C" FFI trust boundaries, which cannot be written without unsafe — elimination is impossible, documentation is the correct posture, and the gate enforces it.
61 unwrap/expect in src/	All remaining hits are test-only: every one sits inside a #[cfg(test)] module or under src/*/tests/ (plus testing.expect in Zig test files, out of the Rust gate's scope by design). Production count is 0.

The gate already passed 6/6 — but the audit found one genuine hole in the same SPARK-grade family that the gate didn't cover: a production panic!.

Changes

• src/interface/lsp/src/main.rs — the request dispatcher panic!'d (crashing the whole server) when a request's method matched but its params failed JSON deserialization. It now answers JSON-RPC Invalid params (-32602) naming the method and the error, via a new three-outcome Cast type that rescues the request id before extract() consumes it. Also adds #![deny(clippy::unwrap_used, clippy::expect_used)], mirroring vclt-gate, and dedupes error responses through a new send_error helper.
• tests/aspect_tests.sh — check 3 now also rejects panic!/unreachable!/todo!/unimplemented! in production src/, matching the documented vcltotal-parse SPARK-grade lint set (the estate pattern per parse/src/lib.rs).
• src/interface/parse/src/parser.rs — one doc comment reworded (panic! → panic, meaning unchanged) so the textual gate stays precise.
• CHANGELOG.adoc — [Unreleased] / Fixed entries.

Validation

• bash tests/aspect_tests.sh → 6 passed, 0 failed (before and after; the gate is now strictly stronger).
• Negative test: temporarily injecting panic!("boom") into production src/ makes the new check FAIL as intended; removed afterwards.
• bash -n on the script and git diff --check clean.
• Note: vcltotal-lsp is not built by standalone CI (it needs the echidna sibling path-dep; only the estate e2e layout compiles it), and this sandbox has no Rust toolchain — so the main.rs change was verified by inspection against the lsp-server 0.7 API on docs.rs (Request { pub id, pub method, pub params }, Request: Clone, extract signature, ExtractError::{MethodMismatch, JsonError { method, error }} shapes all confirmed). Only previously-unused-but-public API surface (req.id.clone()) is introduced; every other construct mirrors adjacent existing code.

Suggested follow-up (not in this PR)

Per-crate #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, …)] on the remaining lib crates (lsp, dap, fmt, lint, attest, echidna-client) with allows in their test modules, mirroring vcltotal-parse. Deliberately left out: it needs cargo clippy validation per crate, which isn't available in this sandbox — and #49 itself warns against blind passes.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 25bee442-ee39-44ef-a337-6f4540d4f413

📥 Commits

Reviewing files that changed from the base of the PR and between 9546eda and e317ece.

📒 Files selected for processing (4)

• CHANGELOG.adoc
• src/interface/lsp/src/main.rs
• src/interface/parse/src/parser.rs
• tests/aspect_tests.sh

 _______________________________________________
< Finding your faults 10 times faster than Mom. >
 -----------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• 🔴 Error committing to branch - (🔄 Check to retry)
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hyperpolymath]

CI verification (for the merger)

All checks covering this change pass: Aspect tests, vcltotal-parse (clippy/tests), license-policy, Licence consistency, Root workspace tests, attest / recompute-wasm clippy+tests, CodeQL, secret scanners, Semgrep, OpenSSF.

The 5 remaining red checks were each verified pre-existing on main at the base commit 9546eda (identical job, identical conclusion) — zero regressions from this PR:

Check	PR #117	main @ 9546eda
rust-ci / Cargo check + clippy + fmt	failure	failure (run 37154179619)
governance / Workflow security linter	failure	failure (run 37154179580)
Hypatia neurosymbolic scan (Static Analysis Gate)	failure	failure (run 37154179050)
Validate K9 contracts (Dogfood Gate)	failure	failure (run 37154179093)
Dependency audit (cargo-audit)	failure	failure (run 37154179103)

(These match the pre-existing reds already documented in #116. Backend-matrix Smoke jobs still pending at time of writing are unrelated to this change.)

On merge, Closes #49 takes effect; the Aspect gate re-runs on main via e2e.yml.

[coderabbitai]

❌ Failed to create Coding Agent finishing-touch task. Please try again.

[coderabbitai]

Autopilot could not be updated. Open Coding to check access and billing.