- Add gopkg.in/yaml.v3 dependency (approved in CONVENTIONS.md)
- Update parsePersona to detect format by file extension
- Support both .yaml and .yml extensions (case-insensitive)
- Convert built-in personas to YAML format
- Add comprehensive tests for YAML parsing
- Update README with YAML examples and documentation

YAML provides cleaner multi-line strings via literal block scalars
and supports comments, making persona definitions more readable.
JSON remains supported for backwards compatibility.

Closes #57

@@ -0,0 +7,4 @@
+## Constraints
+
+- Backwards compatibility: existing JSON personas must continue to work
+- Security: protect against DoS via deeply nested YAML (AIKIDO-2024-10486)

@@ -2,2 +2,4 @@
 
 go 1.26.2
+
+require github.com/goccy/go-yaml v1.19.2 // indirect

@@ -49,0 +52,4 @@
+	yamlFile := name + ".yaml"
+	data, err := embeddedPersonas.ReadFile("personas/" + yamlFile)
+	if err == nil {
+		return parsePersona(data, "builtin:"+yamlFile)

@@ -61,3 +73,3 @@
 		return []string{}
 	}
-	var names []string
+	seen := make(map[string]bool)

@@ -71,1 +89,4 @@
+			personaName = strings.TrimSuffix(name, ".json")
+		default:
+			continue
 		}

@@ -203,6 +309,38 @@ func TestLoadPersonaInvalidJSON(t *testing.T) {
 	}

@@ -2,2 +2,4 @@
 
 go 1.26.2
+
+require github.com/goccy/go-yaml v1.19.2 // indirect

@@ -36,2 +37,4 @@
+// LoadPersona loads a persona from a JSON or YAML file path.
+// Format is detected by file extension: .yaml/.yml for YAML, .json or other for JSON.
 func LoadPersona(path string) (*Persona, error) {
 	data, err := os.ReadFile(path)

@@ -79,0 +111,4 @@
+	var err error
+	if isYAML {
+		// go-yaml v1.16.0+ has built-in protection against deeply nested structures
+		err = yaml.Unmarshal(data, &p)

@@ -1,3 +1,5 @@
 module gitea.weiker.me/rodin/review-bot
 
 go 1.26.2
+

@@ -8,2 +8,4 @@
 	"strings"
 	"unicode/utf8"
+
+	"github.com/goccy/go-yaml"

@@ -49,0 +54,4 @@
+	if err == nil {
+		return parsePersona(data, "builtin:"+yamlFile)
+	}
+

@@ -77,2 +110,3 @@
 	var p Persona
-	if err := json.Unmarshal(data, &p); err != nil {
+	var err error
+	if isYAML {

@@ -0,0 +11,4 @@
+- Consistency: use `.yaml` extension (not `.yml`)
+- Library: use `github.com/goccy/go-yaml` v1.16.0+ (actively maintained, security fix applied)
+
+## Proposed Approach

@@ -9,2 +9,4 @@
 	"unicode/utf8"
+
+	"gopkg.in/yaml.v3"
 )

@@ -72,0 +94,4 @@
+			seen[personaName] = true
+		}
+	}
+	var names []string

@@ -79,1 +116,4 @@
+		err = json.Unmarshal(data, &p)
+	}
+	if err != nil {
 		return nil, fmt.Errorf("parse persona %s: %w", source, err)

@@ -184,12 +277,25 @@ func TestLoadPersonaValidation(t *testing.T) {
 }

@@ -0,0 +1,93 @@
+# Design: YAML Support for Persona Files (#57)

@@ -0,0 +8,4 @@
+
+- Backwards compatibility: existing JSON personas must continue to work
+- Security: protect against DoS via deeply nested YAML (AIKIDO-2024-10486)
+- Consistency: use `.yaml` extension (not `.yml`)

@@ -52,3 +64,3 @@
 	}
-	return parsePersona(data, "builtin:"+name)
+	return parsePersona(data, "builtin:"+jsonFile)
 }

@@ -71,0 +85,4 @@
+			personaName = strings.TrimSuffix(name, ".yaml")
+		case strings.HasSuffix(name, ".yml"):
+			personaName = strings.TrimSuffix(name, ".yml")
+		case strings.HasSuffix(name, ".json"):

@@ -0,0 +20,4 @@
+5. **Update embed directive** to include both formats
+
+### File Extension Detection
+

@@ -36,2 +37,4 @@
+// LoadPersona loads a persona from a JSON or YAML file path.
+// Format is detected by file extension: .yaml/.yml for YAML, .json or other for JSON.
 func LoadPersona(path string) (*Persona, error) {
 	data, err := os.ReadFile(path)

@@ -79,0 +111,4 @@
+	var err error
+	if isYAML {
+		// go-yaml v1.16.0+ has built-in protection against deeply nested structures
+		err = yaml.Unmarshal(data, &p)

@@ -0,0 +43,4 @@
+    }
+    if err := validatePersona(&p, source); err != nil {
+        return nil, err
+    }

@@ -43,39 +64,76 @@ func LoadPersona(path string) (*Persona, error) {
 

@@ -71,0 +106,4 @@
+		case strings.HasSuffix(name, ".json"):
+			personaName = strings.TrimSuffix(name, ".json")
+		default:
+			continue

@@ -87,0 +150,4 @@
+	if err := dec.Decode(&node); err != nil {
+		return err
+	}
+

@@ -87,0 +158,4 @@
+	return node.Decode(out)
+}
+
+// checkYAMLDepth recursively checks that YAML nodes don't exceed the depth limit.

@@ -43,39 +64,76 @@ func LoadPersona(path string) (*Persona, error) {
 
 // LoadBuiltinPersona loads a built-in persona by name.

@@ -48,1 +69,3 @@
-	data, err := embeddedPersonas.ReadFile("personas/" + filename) // embed.FS paths use forward slashes per io/fs spec
+	// Try YAML first (preferred format)
+	yamlFile := name + ".yaml"
+	data, err := embeddedPersonas.ReadFile("personas/" + yamlFile)

@@ -0,0 +9,4 @@
+- Backwards compatibility: existing JSON personas must continue to work
+- Security: protect against DoS via deeply nested YAML (AIKIDO-2024-10486)
+- Consistency: use `.yaml` extension (not `.yml`)
+- Library: use `gopkg.in/yaml.v3` (approved in CONVENTIONS.md) with explicit depth limiting

@@ -33,1 +42,4 @@
+	Major string `json:"major" yaml:"major"`
+	Minor string `json:"minor" yaml:"minor"`
+	Nit   string `json:"nit" yaml:"nit"`
 }

@@ -87,0 +148,4 @@
+	var node yaml.Node
+	dec := yaml.NewDecoder(bytes.NewReader(data))
+	if err := dec.Decode(&node); err != nil {
+		return err

@@ -0,0 +52,4 @@
+    }
+    // Handle alias nodes by following the Alias pointer
+    if node.Kind == yaml.AliasNode && node.Alias != nil {
+        return checkYAMLDepth(node.Alias, depth, maxDepth)

@@ -69,2 +107,2 @@
-		if strings.HasSuffix(name, ".json") {
-			names = append(names, strings.TrimSuffix(name, ".json"))
+		// Strip extension to get persona name
+		var personaName string

@@ -87,0 +158,4 @@
+func unmarshalYAMLWithDepthLimit(data []byte, out any, maxDepth int) error {
+	var node yaml.Node
+	dec := yaml.NewDecoder(bytes.NewReader(data))
+	if err := dec.Decode(&node); err != nil {

@@ -87,0 +173,4 @@
+// Handles alias nodes by following the Alias pointer to check the target's depth.
+func checkYAMLDepth(node *yaml.Node, depth, maxDepth int) error {
+	if depth > maxDepth {
+		return fmt.Errorf("YAML nesting depth exceeds maximum (%d)", maxDepth)

@@ -10,3 +14,3 @@
 )
 
-//go:embed personas/*.json
+//go:embed personas/*.yaml

@@ -44,3 +73,4 @@
 // LoadBuiltinPersona loads a built-in persona by name.
 // Returns an error if the persona doesn't exist.
+// Built-in personas are stored in YAML format.
 func LoadBuiltinPersona(name string) (*Persona, error) {

@@ -79,2 +143,4 @@
+	}
+	if err != nil {
 		return nil, fmt.Errorf("parse persona %s: %w", source, err)
 	}

@@ -87,0 +162,4 @@
+		return err
+	}
+
+	if err := checkYAMLDepth(&node, 0, maxDepth); err != nil {

@@ -87,0 +156,4 @@
+// parsed; additional documents are silently ignored. This is acceptable for
+// persona files where multi-document support is not a use case.
+func unmarshalYAMLWithDepthLimit(data []byte, out any, maxDepth int) error {
+	var node yaml.Node

@@ -87,0 +161,4 @@
+	if err := dec.Decode(&node); err != nil {
+		return err
+	}
+

@@ -0,0 +44,4 @@
+        return err
+    }
+    return node.Decode(out)
+}

@@ -37,0 +57,4 @@
+	}
+	if info.Size() > MaxPersonaFileSize {
+		return nil, fmt.Errorf("persona file %s exceeds maximum size (%d bytes)", path, MaxPersonaFileSize)
+	}

@@ -55,3 +93,3 @@
 
-// ListBuiltinPersonas returns the names of all built-in personas.
+// ListBuiltinPersonas returns the names of all built-in personas in sorted order.
 // Returns an empty slice if the embedded directory cannot be read.

@@ -84,6 +150,53 @@ func parsePersona(data []byte, source string) (*Persona, error) {
 	return &p, nil
 }
 
+// unmarshalYAMLWithDepthLimit unmarshals YAML data with explicit depth limiting

@@ -87,0 +174,4 @@
+	// We must re-decode from the original data because yaml.Node.Decode() doesn't
+	// support the KnownFields option.
+	strictDec := yaml.NewDecoder(bytes.NewReader(data))
+	strictDec.KnownFields(true)

@@ -0,0 +1,108 @@
+# Design: YAML Support for Persona Files (#57)

@@ -1,81 +1,147 @@
 package review

@@ -87,0 +161,4 @@
+	// This prevents stack exhaustion before we attempt to decode into structs.
+	var node yaml.Node
+	dec := yaml.NewDecoder(bytes.NewReader(data))
+	if err := dec.Decode(&node); err != nil {

@@ -87,0 +186,4 @@
+	}
+	// Handle alias nodes: follow the alias to its anchor target.
+	// The alias itself doesn't add depth, but we must check the target.
+	if node.Kind == yaml.AliasNode && node.Alias != nil {

@@ -0,0 +73,4 @@
+
+| Error | Handling |
+|-------|----------|
+| Invalid YAML syntax | Return parse error with source file |

@@ -64,4 +106,4 @@
 	for _, e := range entries {
 		if e.IsDir() {
 			continue
 		}

@@ -87,0 +168,4 @@
+	}
+
+	// Reject multi-document YAML files - silently ignoring additional documents
+	// could lead to confusing behavior where users think their changes take effect.

@@ -87,0 +180,4 @@
+	}
+
+	// Second pass: decode with strict field checking enabled.
+	// KnownFields(true) rejects unknown keys, catching typos like "focuss" or "identiy".

@@ -96,6 +176,7 @@ func TestLoadPersonaFromJSONFile(t *testing.T) {
 		"display_name": "Test Persona",

@@ -87,0 +157,4 @@
+// unmarshalYAMLWithDepthLimit unmarshals YAML data with explicit depth limiting
+// and strict field checking. This protects against stack exhaustion from deeply
+// nested structures and catches typos in field names.
+// Multi-document YAML files are rejected to prevent silent data loss.

@@ -0,0 +32,4 @@
+```
+
+### YAML Parsing with Depth Protection
+

@@ -37,0 +56,4 @@
+	if err != nil {
+		return nil, fmt.Errorf("read persona file %s: %w", path, err)
+	}
+	if !info.Mode().IsRegular() {

@@ -79,0 +143,4 @@
+	if isYAML {
+		err = unmarshalYAMLWithDepthLimit(data, &p, MaxYAMLDepth)
+	} else {
+		err = json.Unmarshal(data, &p)

@@ -0,0 +52,4 @@
+    }
+    // Handle alias nodes by following the Alias pointer
+    if node.Kind == yaml.AliasNode && node.Alias != nil {
+        return checkYAMLDepth(node.Alias, depth, maxDepth)

@@ -76,1 +134,4 @@
+// Format is detected by the source file extension.
 func parsePersona(data []byte, source string) (*Persona, error) {
+	lowerSource := strings.ToLower(source)
+	isYAML := strings.HasSuffix(lowerSource, ".yaml") || strings.HasSuffix(lowerSource, ".yml")

@@ -87,0 +185,4 @@
+	// KnownFields(true) rejects unknown keys, catching typos like "focuss" or "identiy".
+	// We must re-decode from the original data because yaml.Node.Decode() doesn't
+	// support the KnownFields option.
+	strictDec := yaml.NewDecoder(bytes.NewReader(data))

@@ -87,0 +216,4 @@
+		return checkYAMLDepth(node.Alias, depth+1, maxDepth, maxNodes, seen, nodeCount)
+	}
+
+	for _, child := range node.Content {

@@ -240,0 +446,4 @@
+	}
+
+	// Comments should be ignored
+	if p.Name != "commented" {

@@ -71,0 +109,4 @@
+		// Strip extension to get persona name
+		var personaName string
+		switch {
+		case strings.HasSuffix(name, ".yaml"):

@@ -79,0 +145,4 @@
+		// YAML's KnownFields(true) - both reject unknown fields to catch typos.
+		dec := json.NewDecoder(bytes.NewReader(data))
+		dec.DisallowUnknownFields()
+		err = dec.Decode(&p)