fix(content-lane): parse zero-indent YAML block sequences in frontmatter

[RealDiligent]

Summary

parseSimpleFrontmatter (src/review/content-lane/duplicates.ts) states it captures each top-level field's value regardless of scalar style — a parser that silently drops a value "would let a contributor hide a protected-field edit and bypass the protected-edit + duplicate gates". Its sequence branch broke that contract: it only consumed lines beginning with whitespace, so a zero-indent block sequence — valid YAML that js-yaml/gray-matter (the site build's own parser) accept —

author:
- Alice
downloadUrl:
- https://good.example/x.zip

was dropped, leaving author/downloadUrl empty strings. A protected-field edit written this way parses identically before and after (both ""), so protectedFrontmatterChanges sees no change, and the duplicate/source-evidence gates never see the value.

Fix

Extend the sequence-consume loop to also accept a zero-indent line starting with -, stopping at a blank line or the next top-level key: (a line matching /^([A-Za-z][A-Za-z0-9_]*):/ terminates the sequence even at zero indent, so it is never swallowed). Applied identically to:

• the byte-equivalent parser copy in src/review/content-lane/source-evidence.ts, and
• findDuplicateFrontmatterKeys's mirroring skip loop, so a zero-indent - item is never mistaken for a duplicate top-level key.

Indented sequences, block scalars (|/>), flow sequences, and inline scalars are unchanged; already-lowercase/indented inputs are byte-identical. No YAML library added (the module exists to avoid one).

Tests

• parseSimpleFrontmatter returns {author: "Alice", downloadUrl: "https://good.example/x.zip"} for the zero-indent example (content-lane-duplicates.test.ts), and the same value is captured via extractSubmittedSourceUrls for the source-evidence.ts copy (content-lane-source-evidence.test.ts).
• protectedFrontmatterChanges returns ["author"] when before/after differ only in a zero-indent author: sequence value.
• findDuplicateFrontmatterKeys returns [] for two different keys each carrying a zero-indent sequence.
• A zero-indent sequence terminates at the next top-level key (and at a blank line), with the following key parsed correctly.

Both suites pass (183 total); the parser/protected/source-evidence cases fail against the current indent-only loop.

Closes #9664

[loopover-orb]

Tip

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-29 19:21:12 UTC}

4 files · 1 AI reviewer · no blockers · readiness 98/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This fixes a real correctness gap: parseSimpleFrontmatter's sequence-consuming loop only matched `/^\s/`-prefixed lines, so a zero-indent YAML block sequence (`author:\n- Alice`), which js-yaml/gray-matter accept, was silently dropped to an empty string on both sides of a diff, letting a protected-field edit slip past protectedFrontmatterChanges undetected. The fix widens the loop's continuation condition to also accept a zero-indent `-`-prefixed line while still terminating on a blank line or the next top-level `key:` line, and is applied identically to duplicates.ts's sequence-consume loop, its mirroring dupe-key skip loop, and the byte-equivalent copy in source-evidence.ts. Tests cover the zero-indent capture, termination at the next key and at a blank line, non-duplicate-key misclassification, and the protected-edit-gate regression scenario, closing the security-relevant gap the PR describes.

Nits — 2 non-blocking

• duplicates.ts:108 and source-evidence.ts:190 — the loop condition `/^-/.test(...)` matches any line starting with `-`, not just a YAML sequence marker (`- `); this is only reachable when `inline === ""` (i.e. right after a bare `key:`), so in practice it's always a sequence item, but consider anchoring to `/^-\s|^-$/` for extra precision if a future caller ever changes that invariant.
• Consider adding one more regression test for a zero-indent sequence immediately followed by EOF (no trailing `---`) to confirm the loop guard `i < lines.length` terminates cleanly, though this is likely already implicitly covered by existing bounds-guard tests.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#9664
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 251 registered-repo PR(s), 99 merged, 38 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	RealDiligent; Gittensor profile; 251 PR(s), 38 issue(s).
Improvement	✅ Minor	risk: clean · value: minor · LLM: moderate

Linked issue satisfaction

Addressed
The diff widens the sequence-consume loop in both duplicates.ts and source-evidence.ts to accept zero-indent '-' items while still terminating at a blank line or the next top-level key (guarded by the same regex logic), applies the identical change to findDuplicateFrontmatterKeys's mirroring skip loop, and adds all five required regression tests covering the zero-indent parse, protected-field dete

Review context

• Author: RealDiligent
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 251 PR(s), 38 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.42%. Comparing base (e3247ed) to head (86ff85e).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9891      +/-   ##
==========================================
+ Coverage   79.28%   79.42%   +0.14%     
==========================================
  Files         281      283       +2     
  Lines       58516    58922     +406     
  Branches     6777     6933     +156     
==========================================
+ Hits        46393    46799     +406     
  Misses      11840    11840              
  Partials      283      283              

Flag	Coverage Δ
backend	100.00% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/review/content-lane/duplicates.ts	100.00% <ø> (ø)
src/review/content-lane/source-evidence.ts	100.00% <ø> (ø)

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.