refactor(egress): write routes.yaml as actual YAML, not JSON-in-yml

`egress_render_routes` now emits hand-rolled YAML in the same style
as `pipelock_render_yaml`. The egress addon parses it via
`yaml_subset.parse_yaml_subset` — the same parser the manifest
loader + pipelock_apply use.

Why bother: routes.yaml is bind-mounted into the egress sidecar
AND surfaced to operators through `routes edit` (PRD 0019). JSON-
in-yml renders ugly in $EDITOR and signals "this is data" rather
than "this is config you can read at a glance". Real YAML reads
cleanly.

Mechanics:

  - `yaml_subset.py` drops its `claude_bottle.log` dependency.
    Errors now raise `YamlSubsetError` (a `ValueError`); the
    manifest loader + pipelock_apply catch it at the boundary
    and forward to `die` / `PipelockApplyError` so callers see
    the same behavior they did before.
  - `Dockerfile.egress` adds one COPY line for `yaml_subset.py`
    so it sits flat in `/app/` next to the addon. The addon
    uses an absolute-import-with-fallback shim so the same file
    works inside the container AND from the host's unit tests.
  - `egress_apply._merge_single_route` round-trips current
    routes.yaml through `parse_yaml_subset` + a new
    `_render_routes_payload` helper instead of `json.loads` +
    `json.dumps`.

End-to-end: rebuilt the egress image, ran `./cli.py start` to a
full bring-up, confirmed the addon's boot log shows `egress:
loaded 9 route(s)` — i.e., the YAML parses inside the container.
453 unit + 3 integration tests pass.

claude_bottle/backend/docker/egress_apply.py

@@ -31,6 +31,7 @@ from pathlib import Path
 
 from ...egress import EGRESS_ROUTES_IN_CONTAINER
 from ...egress_addon_core import load_routes
+from ...yaml_subset import YamlSubsetError, parse_yaml_subset
 from .bottle_state import egress_state_dir
 from .egress import egress_container_name
 from .pipelock_apply import (
@@ -42,6 +43,30 @@ from .pipelock_apply import (
 )
 
 
+def _render_routes_payload(routes_list: list[dict[str, object]]) -> str:
+    """Render a list-of-dicts routes payload as YAML matching the
+    shape `egress_render_routes` produces. The apply path
+    round-trips current routes.yaml through this so the file the
+    sidecar sees stays in the YAML format the addon expects."""
+    if not routes_list:
+        return "routes: []\n"
+    lines: list[str] = ["routes:"]
+    for entry in routes_list:
+        host = str(entry.get("host", ""))
+        lines.append(f'  - host: "{host}"')
+        auth_scheme = entry.get("auth_scheme")
+        token_env = entry.get("token_env")
+        if auth_scheme and token_env:
+            lines.append(f'    auth_scheme: "{auth_scheme}"')
+            lines.append(f'    token_env: "{token_env}"')
+        paths = entry.get("path_allowlist") or []
+        if paths:
+            lines.append("    path_allowlist:")
+            for p in paths:
+                lines.append(f'      - "{p}"')
+    return "\n".join(lines) + "\n"
+
+
 def _egress_routes_host_path(slug: str) -> Path:
     """The bind-mount source for the egress sidecar's routes.yaml.
     Must match what egress.prepare wrote at chunk-2 paths."""
@@ -219,7 +244,7 @@ def _merge_single_route(
     current_yaml: str, new_route: dict[str, object],
 ) -> str:
     """Merge a single proposed route into the current routes.yaml
-    content, returning the merged JSON-as-yaml string.
+    content, returning the merged YAML string.
 
     Behavior:
       - If `new_route['host']` is NOT in the current routes →
@@ -230,15 +255,15 @@ def _merge_single_route(
         on an existing host are ignored, matching the tool's
         documented semantics.
 
-    The supervisor renders the merged routes.yaml with the same
-    JSON layout the addon expects (host + path_allowlist +
-    auth_scheme + token_env). Token VALUES never appear here; the
-    routes file carries only env-var slot NAMES."""
+    Round-trips the file through `yaml_subset` (the same parser
+    the addon uses), so the merged output is in the YAML format
+    the sidecar reads. Token VALUES never appear here; the routes
+    file carries only env-var slot NAMES."""
     try:
-        cfg = json.loads(current_yaml)
-    except json.JSONDecodeError as e:
+        cfg = parse_yaml_subset(current_yaml)
+    except YamlSubsetError as e:
         raise EgressApplyError(
-            f"current routes.yaml is not valid JSON: {e}"
+            f"current routes.yaml is not valid YAML: {e}"
         ) from e
     routes = cfg.get("routes")
     if not isinstance(routes, list):
@@ -299,8 +324,7 @@ def _merge_single_route(
             # the slot name they'll need to provision.
         routes.append(entry)
 
-    cfg["routes"] = routes
-    return json.dumps(cfg, indent=2) + "\n"
+    return _render_routes_payload(routes)
 
 
 def add_route(slug: str, proposed_route_json: str) -> tuple[str, str]:

claude_bottle/backend/docker/pipelock_apply.py

@@ -23,7 +23,7 @@ import tempfile
 from pathlib import Path
 
 from ...pipelock import pipelock_render_yaml
-from ...yaml_subset import parse_yaml_subset
+from ...yaml_subset import YamlSubsetError, parse_yaml_subset
 from .bottle_state import pipelock_state_dir
 from .pipelock import pipelock_container_name
 
@@ -110,7 +110,10 @@ def fetch_current_allowlist(slug: str) -> str:
     line — the operator-facing format for the TUI / agent's
     current-config mount."""
     yaml = fetch_current_yaml(slug)
-    cfg = parse_yaml_subset(yaml)
+    try:
+        cfg = parse_yaml_subset(yaml)
+    except YamlSubsetError as e:
+        raise PipelockApplyError(f"running pipelock yaml: {e}") from e
     hosts = cfg.get("api_allowlist", [])
     if not isinstance(hosts, list):
         raise PipelockApplyError(
@@ -136,7 +139,10 @@ def apply_allowlist_change(
     new_hosts = parse_allowlist_content(new_allowlist_content)
     container = pipelock_container_name(slug)
     current_yaml = fetch_current_yaml(slug)
-    cfg = parse_yaml_subset(current_yaml)
+    try:
+        cfg = parse_yaml_subset(current_yaml)
+    except YamlSubsetError as e:
+        raise PipelockApplyError(f"running pipelock yaml: {e}") from e
     current_hosts = cfg.get("api_allowlist", [])
     if not isinstance(current_hosts, list):
         raise PipelockApplyError(

claude_bottle/egress.py

@@ -24,7 +24,6 @@ flow (PRD 0014) at egress and renames the MCP tool.
 
 from __future__ import annotations
 
-import json
 from abc import ABC, abstractmethod
 from dataclasses import dataclass
 from pathlib import Path
@@ -41,9 +40,10 @@ from .manifest import Bottle
 EGRESS_HOSTNAME = "egress"
 
 # In-container path the addon reads. Pre-created in
-# `Dockerfile.egress` so `docker cp` can drop the file directly.
-# `.yaml` extension per PRD 0017 — content is JSON (valid YAML) so
-# both sides can use stdlib `json`.
+# `Dockerfile.egress` so the host bind-mount can drop the file
+# directly. Content is YAML (hand-rolled by `egress_render_routes`
+# in the style of `pipelock_render_yaml`, parsed by `yaml_subset`
+# inside the addon).
 EGRESS_ROUTES_IN_CONTAINER = "/etc/egress/routes.yaml"
 
 
@@ -241,25 +241,32 @@ def egress_render_routes(
 ) -> str:
     """Serialize the route table for the addon to read.
 
-    JSON content (valid YAML), no token values, no host env-var
-    names — the only thing the addon needs at runtime is the host →
-    path_allowlist + auth_scheme + in-container env-var mapping. The
-    actual token values arrive via the container's environ.
+    YAML content — no token values, no host env-var names. The only
+    thing the addon needs at runtime is the host → path_allowlist
+    + auth_scheme + in-container env-var mapping. The actual token
+    values arrive via the container's environ.
 
     Authenticated routes carry `auth_scheme` + `token_env`;
     unauthenticated routes omit both keys (the addon's parser
-    enforces both-or-neither)."""
-    payload_routes: list[dict[str, object]] = []
+    enforces both-or-neither). Hand-rolled YAML in the style of
+    `pipelock_render_yaml` so the addon's parser
+    (`yaml_subset.parse_yaml_subset`) round-trips it cleanly."""
+    lines: list[str] = ["routes:"]
+    if not routes:
+        # `routes:` with an empty list on the same line — the parser
+        # needs SOMETHING here. Empty inline list is the cleanest.
+        lines[0] = "routes: []"
+        return "\n".join(lines) + "\n"
     for r in routes:
-        entry: dict[str, object] = {"host": r.host}
-        if r.path_allowlist:
-            entry["path_allowlist"] = list(r.path_allowlist)
+        lines.append(f'  - host: "{r.host}"')
         if r.auth_scheme and r.token_env:
-            entry["auth_scheme"] = r.auth_scheme
-            entry["token_env"] = r.token_env
-        payload_routes.append(entry)
-    payload = {"routes": payload_routes}
-    return json.dumps(payload, indent=2, sort_keys=False) + "\n"
+            lines.append(f'    auth_scheme: "{r.auth_scheme}"')
+            lines.append(f'    token_env: "{r.token_env}"')
+        if r.path_allowlist:
+            lines.append("    path_allowlist:")
+            for p in r.path_allowlist:
+                lines.append(f'      - "{p}"')
+    return "\n".join(lines) + "\n"
 
 
 def egress_resolve_token_values(

claude_bottle/egress_addon_core.py

@@ -6,16 +6,28 @@ exercise the parse + decision functions without depending on the
 `mitmproxy.http.HTTPFlow` API and is loaded inside the sidecar
 container.
 
-Stdlib only: this file ships into the egress image, where the
-container's Python is whatever mitmproxy itself runs on.
+Imports: stdlib + `yaml_subset` (which is itself stdlib-only and
+ships flat into the egress image alongside this file — see
+`Dockerfile.egress`).
 """
 
 from __future__ import annotations
 
-import json
 import typing
 from dataclasses import dataclass
 
+# Absolute import — `yaml_subset.py` is copied flat into the egress
+# image's `/app/` next to this file (via `Dockerfile.egress`). The
+# host-side unit tests run with the repo on sys.path, where the
+# bare `yaml_subset` module also resolves because
+# `claude_bottle/yaml_subset.py` shadows it at import time... actually
+# no, on host the module lives under the `claude_bottle` package.
+# The try/except shim picks whichever import works.
+try:
+    from yaml_subset import YamlSubsetError, parse_yaml_subset  # type: ignore[import-not-found]
+except ImportError:  # pragma: no cover - host-side path
+    from .yaml_subset import YamlSubsetError, parse_yaml_subset
+
 
 @dataclass(frozen=True)
 class Route:
@@ -126,12 +138,14 @@ def _parse_one(idx: int, raw: object) -> Route:
 
 
 def load_routes(text: str) -> tuple[Route, ...]:
-    """Convenience: parse JSON text → routes. Raises `ValueError` for
-    both decode and shape errors so callers handle them uniformly."""
+    """Parse YAML text → routes. Raises `ValueError` for both
+    decode and shape errors so callers handle them uniformly.
+    `YamlSubsetError` from the parser is a `ValueError` subclass so
+    it already satisfies the same surface; we let it propagate."""
     try:
-        payload = json.loads(text)
-    except json.JSONDecodeError as e:
-        raise ValueError(f"routes payload: invalid JSON: {e}") from e
+        payload = parse_yaml_subset(text)
+    except YamlSubsetError as e:
+        raise ValueError(f"routes payload: invalid YAML: {e}") from e
     return parse_routes(payload)
 
 

claude_bottle/manifest.py

@@ -45,7 +45,7 @@ from pathlib import Path
 from typing import Mapping, cast
 
 from .log import die, warn
-from .yaml_subset import parse_frontmatter
+from .yaml_subset import YamlSubsetError, parse_frontmatter
 
 
 def _empty_str_dict() -> dict[str, str]:
@@ -832,6 +832,8 @@ def _load_bottles_from_dir(bottles_dir: Path) -> dict[str, Bottle]:
             fm, _body = parse_frontmatter(path.read_text())
         except OSError as e:
             die(f"could not read {path}: {e}")
+        except YamlSubsetError as e:
+            die(f"{path}: {e}")
         unknown = set(fm.keys()) - _BOTTLE_KEYS
         if unknown:
             allowed = ", ".join(sorted(_BOTTLE_KEYS))
@@ -867,6 +869,8 @@ def _load_agents_from_dir(
             fm, body = parse_frontmatter(path.read_text())
         except OSError as e:
             die(f"could not read {path}: {e}")
+        except YamlSubsetError as e:
+            die(f"{path}: {e}")
         unknown = set(fm.keys()) - _AGENT_KEYS
         if unknown:
             allowed = ", ".join(sorted(_AGENT_KEYS))

claude_bottle/yaml_subset.py

@@ -59,7 +59,20 @@ from __future__ import annotations
 import re
 from dataclasses import dataclass
 
-from .log import die
+
+class YamlSubsetError(ValueError):
+    """Raised when input violates the YAML subset's rules. Callers
+    that want fatal-exit semantics (manifest loader, pipelock-apply,
+    etc.) catch this at their own boundary and forward to `die`;
+    callers running outside the claude-bottle CLI process (the
+    egress sidecar's addon) handle it as a normal exception."""
+
+
+def die(msg: str) -> None:
+    """Module-local helper so the parser body reads cleanly. Just
+    raises YamlSubsetError — the `claude-bottle: error: ` prefix
+    is added by the boundary `die` in `claude_bottle.log`."""
+    raise YamlSubsetError(msg)
 
 
 # --- Tokenizer / line preprocessing ----------------------------------------