feat(yaml): accept the .kyaml extension in every YAML loader

KYAML is the estate's YAML dialect (standards YAML-POLICY §3.4, D280),
and estate-owned configuration uses the .kyaml extension (D307). KYAML
is a strict subset of YAML, so serde-saphyr already parses it; only the
extension dispatch was missing.

- crate::yaml gains EXTENSIONS = [yaml, yml, kyaml] plus is_extension and
  has_extension, so the list lives in one place.
- Attack profiles, ambush timelines, amuck specs, the diff report
  loader and a2ml bundles dispatch through it.
- assemblyline::is_source_file includes kyaml, so editing a .kyaml file
  changes the repo fingerprint and triggers a rescan.

Tests load real KYAML (generated with `yq -o kyaml`, mikefarah v4.54.1)
through the timeline, profile and amuck loaders, and pin the extension
set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PFaqv6iBXrt3W5Akd1Fq5k

Author: claude

CHANGELOG.adoc

@@ -2,6 +2,15 @@
 
 === [Unreleased]
 
+==== Added — `.kyaml` input (estate YAML policy D280/D307)
+
+* Attack profiles, ambush timelines, amuck specs, `+diff+` reports and
+a2ml bundles now accept the `+.kyaml+` extension alongside `+.yaml+` and
+`+.yml+`. KYAML is a strict subset of YAML, so the same parser reads it.
+The extension list lives in one place, `+crate::yaml::EXTENSIONS+`.
+* `+assemblyline+` fingerprints `+.kyaml+` files, so editing one triggers a
+rescan.
+
 ==== Fixed — YAML parser replaced with safe Rust (RUSTSEC-2024-0449)
 
 * *`+serde_yaml+` → `+serde-saphyr+` 2.0.* `+serde_yaml+` 0.9 is

src/a2ml/mod.rs

@@ -401,7 +401,7 @@ fn load_payload_for_kind(kind: ReportBundleKind, input: &Path) -> Result<ReportB
 fn load_json_or_yaml<T: DeserializeOwned>(path: &Path) -> Result<T> {
     let raw = fs::read_to_string(path).with_context(|| format!("reading {}", path.display()))?;
     match path.extension().and_then(|e| e.to_str()) {
-        Some("yaml") | Some("yml") => crate::yaml::from_report_str::<T>(&raw)
+        Some(ext) if crate::yaml::is_extension(ext) => crate::yaml::from_report_str::<T>(&raw)
             .with_context(|| format!("parsing {}", path.display())),
         _ => serde_json::from_str::<T>(&raw).with_context(|| format!("parsing {}", path.display())),
     }

src/ambush/timeline.rs

@@ -69,9 +69,7 @@ pub fn load_timeline_with_default(
             .with_context(|| format!("reading timeline {}", path.display()))?;
         buf
     };
-    let spec: TimelineSpec = if path.extension().and_then(|s| s.to_str()) == Some("yaml")
-        || path.extension().and_then(|s| s.to_str()) == Some("yml")
-    {
+    let spec: TimelineSpec = if crate::yaml::has_extension(path) {
         crate::yaml::from_str(&content)
             .with_context(|| format!("parsing yaml timeline {}", path.display()))?
     } else {
@@ -308,6 +306,24 @@ mod tests {
         assert_eq!(plan.events[0].intensity, IntensityLevel::Heavy);
     }
 
+    #[test]
+    fn test_load_timeline_kyaml() {
+        // Output of `yq -o kyaml` for the YAML timeline above.
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("timeline.kyaml");
+        std::fs::write(
+            &path,
+            "{\n  duration: \"15s\",\n  tracks: [\n    {\n      axis: \"memory\",\n      events: [\n        {\n          at: \"2s\",\n          for: \"8s\",\n          intensity: \"heavy\",\n        },\n      ],\n    },\n  ],\n}\n",
+        )
+        .unwrap();
+
+        let plan = load_timeline_with_default(&path, None).unwrap();
+        assert_eq!(plan.duration, Duration::from_secs(15));
+        assert_eq!(plan.events.len(), 1);
+        assert_eq!(plan.events[0].axis, AttackAxis::Memory);
+        assert_eq!(plan.events[0].intensity, IntensityLevel::Heavy);
+    }
+
     #[test]
     fn test_timeline_infers_duration_from_events() {
         let dir = TempDir::new().unwrap();

src/amuck/mod.rs

@@ -324,11 +324,11 @@ fn load_spec(path: &Path) -> Result<MutationSpecFile> {
         Some("json") => {
             serde_json::from_str(&content).with_context(|| format!("parsing {}", path.display()))?
         }
-        Some("yaml") | Some("yml") => crate::yaml::from_str(&content)
+        Some(ext) if crate::yaml::is_extension(ext) => crate::yaml::from_str(&content)
             .with_context(|| format!("parsing {}", path.display()))?,
         _ => {
             return Err(anyhow!(
-                "spec {} must be json/yaml/yml",
+                "spec {} must be json/yaml/yml/kyaml",
                 path.to_string_lossy()
             ));
         }
@@ -625,6 +625,26 @@ mod tests {
     use super::*;
     use tempfile::TempDir;
 
+    #[test]
+    fn load_spec_reads_kyaml() {
+        // Output of `yq -o kyaml` for a one-combo YAML spec.
+        let dir = TempDir::new().expect("tempdir should create");
+        let path = dir.path().join("spec.kyaml");
+        std::fs::write(
+            &path,
+            "{\n  combos: [\n    {\n      name: \"c1\",\n      operations: [\n        {\n          op: \"replace_first\",\n          from: \"a\",\n          to: \"b\",\n        },\n      ],\n    },\n  ],\n}\n",
+        )
+        .expect("spec should write");
+
+        let spec = load_spec(&path).expect("kyaml spec should load");
+        assert_eq!(spec.combos.len(), 1);
+        assert_eq!(spec.combos[0].name.as_deref(), Some("c1"));
+        assert!(matches!(
+            spec.combos[0].operations.as_slice(),
+            [MutationOperation::ReplaceFirst { from, to }] if from == "a" && to == "b"
+        ));
+    }
+
     #[test]
     fn replace_first_changes_only_one_match() {
         let mut content = "true true true\n".to_string();

src/assemblyline.rs

@@ -291,6 +291,7 @@ fn is_source_file(path: &Path) -> bool {
             | "toml"
             | "yaml"
             | "yml"
+            | "kyaml"
             | "json"
             | "aff"
             | "affine"

src/attack/profile.rs

@@ -42,7 +42,7 @@ impl AttackProfile {
         match path.extension().and_then(|ext| ext.to_str()) {
             Some("json") => serde_json::from_str(&content)
                 .with_context(|| format!("parsing json attack profile {}", path.display())),
-            Some("yaml") | Some("yml") => crate::yaml::from_str(&content)
+            Some(ext) if crate::yaml::is_extension(ext) => crate::yaml::from_str(&content)
                 .with_context(|| format!("parsing yaml attack profile {}", path.display())),
             _ => Err(anyhow!(
                 "unsupported attack profile extension for {}",
@@ -51,3 +51,29 @@ impl AttackProfile {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::TempDir;
+
+    #[test]
+    fn loads_kyaml_profile() {
+        // Output of `yq -o kyaml` for a YAML attack profile.
+        let dir = TempDir::new().expect("tempdir should create");
+        let path = dir.path().join("profile.kyaml");
+        std::fs::write(
+            &path,
+            "{\n  common_args: [\n    \"--config\",\n    \"cfg.toml\",\n  ],\n  axes: {\n    cpu: [\n      \"--iterations\",\n      \"5000\",\n    ],\n  },\n  probe_mode: \"always\",\n}\n",
+        )
+        .expect("profile should write");
+
+        let profile = AttackProfile::load(&path).expect("kyaml profile should load");
+        assert_eq!(profile.common_args, ["--config", "cfg.toml"]);
+        assert_eq!(
+            profile.axes.get(&AttackAxis::Cpu).map(Vec::as_slice),
+            Some(["--iterations".to_string(), "5000".to_string()].as_slice())
+        );
+        assert_eq!(profile.probe_mode, Some(ProbeMode::Always));
+    }
+}

src/report/diff.rs

@@ -29,7 +29,7 @@ pub fn load_report(path: &Path) -> Result<AssaultReport> {
     };
     // Diff loader accepts JSON/YAML to match report export formats.
     match path.extension().and_then(|ext| ext.to_str()) {
-        Some("yaml") | Some("yml") => crate::yaml::from_report_str(&content)
+        Some(ext) if crate::yaml::is_extension(ext) => crate::yaml::from_report_str(&content)
             .with_context(|| format!("parsing yaml report {}", path.display())),
         _ => serde_json::from_str(&content)
             .with_context(|| format!("parsing json report {}", path.display())),

src/yaml.rs

@@ -10,11 +10,31 @@
 //! scalar-byte budgets proportional to the input length instead: an alias-free document
 //! cannot have more nodes than bytes, so the cap still bounds alias
 //! expansion while accepting any report the caller's read limit allows.
+//!
+//! KYAML (the estate's YAML dialect, D280/D307) is a strict subset of
+//! YAML, so `.kyaml` files go through the same parser.
 
 use serde::de::DeserializeOwned;
 use serde::Serialize;
 use serde_saphyr::budget::Budget;
 use serde_saphyr::options::Options;
+use std::path::Path;
+
+/// File extensions read as YAML. `kyaml` is the estate extension for
+/// KYAML-dialect configuration.
+pub const EXTENSIONS: [&str; 3] = ["yaml", "yml", "kyaml"];
+
+/// Whether `ext` (without the dot) names a YAML or KYAML file.
+pub fn is_extension(ext: &str) -> bool {
+    EXTENSIONS.contains(&ext)
+}
+
+/// Whether `path` has a YAML or KYAML extension.
+pub fn has_extension(path: &Path) -> bool {
+    path.extension()
+        .and_then(|ext| ext.to_str())
+        .is_some_and(is_extension)
+}
 
 /// Parse a hand-written YAML config with the default resource budget.
 pub fn from_str<T: DeserializeOwned>(input: &str) -> Result<T, serde_saphyr::Error> {
@@ -42,6 +62,21 @@ pub fn to_string<T: Serialize>(value: &T) -> Result<String, serde_saphyr::ser::E
 mod tests {
     use super::*;
 
+    #[test]
+    fn yaml_extensions_include_kyaml() {
+        for ext in ["yaml", "yml", "kyaml"] {
+            assert!(is_extension(ext), "{ext}");
+            assert!(
+                has_extension(Path::new(&format!("dir/file.{ext}"))),
+                "{ext}"
+            );
+        }
+        for ext in ["json", "YAML", "kyml", "ncl"] {
+            assert!(!is_extension(ext), "{ext}");
+        }
+        assert!(!has_extension(Path::new("kyaml")));
+    }
+
     #[test]
     fn report_budget_accepts_documents_past_the_default_node_cap() {
         let items: Vec<u8> = vec![0; 300_000];