Fix investigate-security protocol mismatch breaking CI (#246)

* Fix investigate-security protocol mismatch breaking CI

Remove inline YAML comment from investigate-security.md frontmatter
that the lightweight YAML parsers were not stripping, causing
'exhaustive-path-tracing' to be parsed as
'exhaustive-path-tracing  # optional — apply selectively to
parser/decoder functions'.

Also harden both validate-manifest.py and validate-graph-integrity.py
to strip inline YAML comments from list items, preventing similar
issues in the future.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Use re.split for YAML comment stripping to preserve # in values

Address PR review feedback: replace regex that treats any # as a
comment delimiter with re.split(r'\s+#', ...) which only strips #
when preceded by whitespace, matching YAML comment semantics.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: 3 people

templates/investigate-security.md

@@ -14,7 +14,7 @@ protocols:
   - guardrails/operational-constraints
   - guardrails/adversarial-falsification
   - analysis/security-vulnerability
-  - reasoning/exhaustive-path-tracing  # optional — apply selectively to parser/decoder functions
+  - reasoning/exhaustive-path-tracing
 taxonomies:
   - stack-lifetime-hazards
 format: investigation-report

tests/validate-graph-integrity.py

@@ -78,9 +78,10 @@ def _parse_template_frontmatter(text: str) -> dict[str, object] | None:
         if indent > 0:
             # Still collect multi-line list items at indent 2
             if current_list_field and stripped.startswith("- "):
-                result[current_list_field].append(
-                    stripped[2:].strip().strip("'\"")
-                )
+                val = stripped[2:].strip().strip("'\"")
+                # Strip inline YAML comments only when `#` follows whitespace
+                val = re.split(r"\s+#", val, maxsplit=1)[0].strip().strip("'\"")
+                result[current_list_field].append(val)
             elif stripped and current_list_field and not stripped.startswith("#"):
                 current_list_field = None
             continue

tests/validate-manifest.py

@@ -47,7 +47,10 @@ def parse_yaml_frontmatter(text: str) -> dict[str, object] | None:
             continue
         if in_protocols:
             if stripped.startswith("- "):
-                protocols.append(stripped[2:].strip().strip("'\""))
+                val = stripped[2:].strip().strip("'\"")
+                # Strip inline YAML comments only when '#' is preceded by whitespace.
+                val = re.split(r"\s+#", val, maxsplit=1)[0].strip().strip("'\"")
+                protocols.append(val)
             else:
                 in_protocols = False
     return {"protocols": protocols}