Reproduction and root cause

Confirmed against main at 0904973b18ec40768760c44eb9423317803c608e.

Public minimal repro: urandon/gitcode-mcp-testing-polygon, branch
codex/repro-repo-config-yaml-sequence, commit
399d8548ef690b8a897ee0e0d494cf2beeba8298.

Minimal repository config:

repository_docs:
  include:
    - README.md

A standards YAML parser accepts this document. From the repository root,
gitcode-mcp config show --redacted exits 1 with config: malformed config file ....

The failure is formatting-dependent: the equivalent flow sequence
include: [README.md] is accepted.

Root cause: internal/config.parseYAMLConfig is a line-oriented parser. It
requires every non-section line to contain :, so a normal sequence item such
as - README.md fails before the dedicated repository_docs policy parser
(yaml.v3) can consume the valid configuration. The same tracked file is
therefore interpreted by incompatible YAML implementations.

Proposed scope

• Decode effective YAML with yaml.v3 instead of treating YAML as independent
  key/value lines.
• Preserve current merge precedence, repo-local machine-path restrictions,
  field-source attribution, and compatibility with existing flow-style files.
• Keep repository_docs owned by the dedicated policy parser while allowing
  the effective-config loader to safely ignore that section.
• Add deterministic tests for block and flow sequences, comments, quoted
  scalars containing :, nested maps/lists, and malformed YAML.

No new UX cohort is introduced: this repairs an existing documented config
shape across CLI, MCP startup, daemon enrollment, and Admin-driven maintenance.

Verification plan

1. Unit regression in internal/config using the three-line fixture above.
2. Policy regression proving the same bytes resolve through
   repositorydocs.ParsePolicy.
3. CLI integration proving config show --redacted succeeds from a temporary
   Git repository with the formatted file.
4. go test ./... and git diff --check.

Current-base reproduction and implementation plan

Base 646f7e5f1da549d2439cd7b3a5d4fb830502e809 is clean merged main with successful required CI. The minimal three-line repository_docs/include block sequence is now encoded as an offline effective-config regression, alongside its flow form. The existing line-oriented loader rejects the block form before the dedicated documentation-policy parser runs.

Scope: replace line-oriented YAML parsing with the already-used yaml.v3 standard decoder over typed configuration fields. Preserve merge order, field-source attribution, cache placement, repo-local machine-path restrictions, credential policy, RAG/service/feedback semantics and legacy JSON. Support real YAML lists for list fields while retaining legacy pipe/semicolon scalar lists. Keep repository_docs interpretation in its owning policy parser; unrelated sections are decoded safely but ignored by effective configuration. Reject malformed YAML, wrong known-field shapes, duplicate keys and extra YAML documents with content-free diagnostics rather than raw decoder snippets.

Acceptance/tests: equivalent block/flow forms and comments/quoted colon scalars; nested RAG maps/lists and aliases; explicit/global/repo-local precedence and path restrictions; malformed/duplicate/multi-document inputs; same-byte documentation policy parsing; CLI config-show and MCP startup regression in isolated temporary repositories. Existing shared loader serves CLI/MCP/daemon/Admin, so no new UI resource/action or separate UI implementation is needed; required CI still runs Admin semantic gates.

Non-goals: no cache migration, config rewriting, sync/network action, provider installation, or new feature. Main risk is legacy parser compatibility; preserve documented scalar/list inputs and independently review exact SHA before merge. Full uncached Go, config race, docs and whitespace gates plus public polygon repro and exact branch/main CI are the verification plan.

Implementation and local verification — exact candidate f97378943e9f98ded5441b603e51c93780896c63, base 646f7e5f1da549d2439cd7b3a5d4fb830502e809.

Replaced the line/colon lexer with the existing pinned yaml.v3 decoder over the shared typed merge schema. Standard block/flow lists, mappings, comments, quoted colons and aliases now parse consistently; the repository-document policy remains separately owned. Historical pipe/semicolon lists and quoted/strconv numeric/boolean spellings remain compatible. Typed scalar normalization is bounded and copy-on-write so a shared string anchor cannot be changed by another typed field. Invalid types, duplicate known keys, extra documents and cyclic aliases yield sanitized diagnostics.

Baseline: the minimal block-sequence regression failed on the exact base with a malformed-config error. Candidate verification passed: go test -count=1 ./...; go test -race -count=1 ./internal/config ./cmd/gitcode-mcp; ./scripts/check-product-docs.sh; git diff --check.

Public polygon evidence: unmodified urandon/gitcode-mcp-testing-polygon branch codex/repro-repo-config-yaml-sequence, exact commit 399d8548ef690b8a897ee0e0d494cf2beeba8298. In an isolated checkout/config/cache, candidate CLI config show --redacted --format json discovers the repository config and candidate offline MCP tools/list exposes search_sources (not recovery-only). No global cache was changed and no live GitCode access was needed by these reads.

UX: shared loader repair for CLI/MCP/daemon/Admin; no new UI action or resource. JSON schema, existing merge precedence/field provenance and repository-local machine-path restrictions remain covered. Independent exact-SHA review and remote CI are still pending; this is not merge/closure evidence.

Independent exact-SHA review completed for !146.

Reviewer inspected candidate f97378943e9f98ded5441b603e51c93780896c63 against base 646f7e5f1da549d2439cd7b3a5d4fb830502e809, including typed YAML decoding, bounded copy-on-write scalar compatibility, aliases/merges, sanitized failures, JSON compatibility, repository-local restrictions and CLI/MCP regressions. Verdict: no P0–P2 findings.

Independent focused config, entrypoint and documentation-policy tests passed, as did documentation and exact-range whitespace gates. Canonical PR head/base match; current public comments and fresh unresolved-discussion readback are empty. Worktree is clean.

Required head CI: run 37964218237, workflow CI, event push, exact reviewed SHA. Still pending at this comment; merge remains gated on terminal success, then resulting main CI.

Completed: !146 merged into main at 57b2359175b18c0ca08527046c05adf072b06682.

Acceptance evidence: minimal block-sequence repro failed on base 646f7e5f1da549d2439cd7b3a5d4fb830502e809; fixed block/flow forms share effective settings and documentation policy identity. CLI config-show and offline MCP normal tools/list passed on public testing polygon 399d8548ef690b8a897ee0e0d494cf2beeba8298. Known type errors, cyclic aliases, extra documents, legacy spellings/lists, JSON compatibility, field provenance and repo-local path restrictions are covered without publishing raw scalar content.

Passed local commands: go test -count=1 ./...; go test -race -count=1 ./internal/config ./cmd/gitcode-mcp; ./scripts/check-product-docs.sh; git diff --check.

Independent reviewer: no P0–P2 on exact reviewed head f97378943e9f98ded5441b603e51c93780896c63. Required head CI 37964218237 passed; main CI 37964857732 passed on exact merge commit. Canonical head/base matched and fresh unresolved discussions were empty before merge. Epic #165 has been updated; no child task or unresolved rollout dependency remains for this repair. Closing #149; continuing with #150, no release yet.