diff --git a/templates/investigate-security.md b/templates/investigate-security.md
index cf57c3c..b36e079 100644
--- a/templates/investigate-security.md
+++ b/templates/investigate-security.md
@@ -14,7 +14,7 @@ protocols:
   - guardrails/operational-constraints
   - guardrails/adversarial-falsification
   - analysis/security-vulnerability
-  - reasoning/exhaustive-path-tracing  # optional — apply selectively to parser/decoder functions
+  - reasoning/exhaustive-path-tracing
 taxonomies:
   - stack-lifetime-hazards
 format: investigation-report
diff --git a/tests/validate-graph-integrity.py b/tests/validate-graph-integrity.py
index 2c27577..e67da06 100644
--- a/tests/validate-graph-integrity.py
+++ b/tests/validate-graph-integrity.py
@@ -78,9 +78,10 @@ def _parse_template_frontmatter(text: str) -> dict[str, object] | None:
         if indent > 0:
             # Still collect multi-line list items at indent 2
             if current_list_field and stripped.startswith("- "):
-                result[current_list_field].append(
-                    stripped[2:].strip().strip("'\"")
-                )
+                val = stripped[2:].strip().strip("'\"")
+                # Strip inline YAML comments only when `#` follows whitespace
+                val = re.split(r"\s+#", val, maxsplit=1)[0].strip().strip("'\"")
+                result[current_list_field].append(val)
             elif stripped and current_list_field and not stripped.startswith("#"):
                 current_list_field = None
             continue
diff --git a/tests/validate-manifest.py b/tests/validate-manifest.py
index e3da1ff..e0a5916 100644
--- a/tests/validate-manifest.py
+++ b/tests/validate-manifest.py
@@ -47,7 +47,10 @@ def parse_yaml_frontmatter(text: str) -> dict[str, object] | None:
             continue
         if in_protocols:
             if stripped.startswith("- "):
-                protocols.append(stripped[2:].strip().strip("'\""))
+                val = stripped[2:].strip().strip("'\"")
+                # Strip inline YAML comments only when '#' is preceded by whitespace.
+                val = re.split(r"\s+#", val, maxsplit=1)[0].strip().strip("'\"")
+                protocols.append(val)
             else:
                 in_protocols = False
     return {"protocols": protocols}