📄 .githooks/validate-k9.sh:122-131 📄 .githooks/validate-k9.sh:141-150 📄 .githooks/validate-k9.sh:169-183 📄 .githooks/validate-a2ml.sh:102-111 📄 .githooks/validate-a2ml.sh:128-142 📄 .githooks/validate-a2ml.sh:239-253 📄 .githooks/validate-a2ml.sh:270-280
All the while IFS= read -r line; do ... done < "$file" loops in both scripts skip the final line when a file lacks a trailing newline, because read returns non-zero on the last unterminated line and the loop body never runs for it. This silently omits the last line from every content check (pedigree name/version/leash, SPDX, attestation, section-heading), producing false negatives or false positives — e.g. a K9 file ending in leash = "hunt" } with no newline would evade the hunt-signature check, and a single-line file K9! with no newline reports a missing magic number. Add the standard fallback so the last line is always processed.

📄 .githooks/validate-k9.sh:95-108
In validate-k9.sh, raw="${raw## }" / raw="${raw%% }" use a literal single-space pattern (no wildcard), so only one space is removed. A leash value indented or padded with tabs or multiple spaces (e.g. security_level = "hunt") will retain whitespace after normalisation and fail the exact == comparison against kennel/yard/hunt, wrongly reporting an invalid security level. Use a bracket-with-wildcard pattern to strip all leading/trailing whitespace.