diff --git a/.github/instructions/pre-commit-hooks.instructions.md b/.github/instructions/pre-commit-hooks.instructions.md
index bf207fc3..a6a78d42 100644
--- a/.github/instructions/pre-commit-hooks.instructions.md
+++ b/.github/instructions/pre-commit-hooks.instructions.md
@@ -20,6 +20,7 @@ pre-commit install --hook-type commit-msg
 | Terraform format mismatch | `terraform fmt -recursive infrastructure/modules/` |
 | Documentation out of sync | `pre-commit run terraform_docs --all-files` |
 | Dependabot config out of sync | Commit the regenerated `.github/dependabot.yaml` (auto-generated) |
+| Available modules table out of sync | Commit the regenerated `README.md` Available modules section (auto-generated). Includes all modules: regular modules alphabetically, then legacy modules (older format, in `_legacy/`) with `[LEGACY]` markers at the end. |
 | Shell script errors | Review output; fix syntax errors; re-run `pre-commit run shellcheck` |
 | English/spelling mistakes | Check `.vale.ini` rules; update text if needed |
 | Trailing whitespace/EOL | `pre-commit run --all-files` (auto-fixed) |
@@ -46,6 +47,7 @@ git commit -m "type(scope): description"
 - `scan-secrets-whole-history` — scans entire git history for secrets (runs on `pre-commit run --all-files`)
 - `terraform_validate` — ensures modules are syntactically valid
 - `regenerate-dependabot-config` — ensures Dependabot watches all modules
+- `check-available-modules` — ensures README module table is up-to-date
 - `no-commit-to-branch` — enforces PR workflow
 
 ## Tool Invocation in Scripts
diff --git a/.github/workflows/stage-1-pre-commit.yml b/.github/workflows/stage-1-pre-commit.yml
index 668d4918..8ff90481 100644
--- a/.github/workflows/stage-1-pre-commit.yml
+++ b/.github/workflows/stage-1-pre-commit.yml
@@ -42,6 +42,9 @@ jobs:
             hooks: >-
               generate-terraform-providers terraform_providers_lock
               terraform_validate terraform_docs
+          - name: "configuration-generation"
+            hooks: >
+              regenerate-dependabot-config check-available-modules
     steps:
       - name: "Checkout code"
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index ad7b29be..c51ef27d 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -56,6 +56,27 @@ repos:
         files: infrastructure/modules/.*/versions\.tf$
         pass_filenames: false
 
+  # --------------------------------------------------------------------------
+  # Local: regenerate Available modules section in README.md
+  # --------------------------------------------------------------------------
+  # Automatically regenerates the Available modules table in README.md whenever
+  # modules are added/removed or module READMEs are updated. This ensures the
+  # documentation stays in sync with the actual modules available.
+  # Fails if the generated section differs from the committed version,
+  # forcing users to review and commit the updated documentation.
+  #
+  # Generates:
+  #   - README.md (Available modules table, between markers)
+  - repo: local
+    hooks:
+      - id: check-available-modules
+        name: check-available-modules
+        require_serial: true
+        entry: ./scripts/githooks/check-available-modules.sh
+        language: script
+        files: (infrastructure/modules/.*/README\.md|README\.md)$
+        pass_filenames: false
+
   # --------------------------------------------------------------------------
   # Terraform hooks (format, lint, validate, docs, lock)
   # --------------------------------------------------------------------------
diff --git a/README.md b/README.md
index 5c446f4b..be9c7b1b 100644
--- a/README.md
+++ b/README.md
@@ -197,7 +197,10 @@ screening-terraform-modules-aws/
 │       ├── iam/           # Exemplar: iam policies & roles
 │       ├── secrets-manager/
 │       ├── kms/
-│       └── ...            # Additional modules
+│       ├── ...            # Additional modules
+│       └── _legacy/       # Older-format modules (pre-restructure, screening-specific variants)
+│           ├── old-module-1/
+│           └── old-module-2/
 ├── scripts/               # Helper scripts (linting, hooks, Docker)
 ├── docs/                  # ADRs, developer guides, diagrams
 ├── .pre-commit-config.yaml # Pre-commit hook definitions
@@ -295,6 +298,7 @@ Rules:
 
 ## Available modules
 
+<!-- BEGIN_AVAILABLE_MODULES -->
 | Module | Wraps | Description |
 | --- | --- | --- |
 | `acm` | terraform-aws-modules/acm/aws | AWS Certificate Manager (ACM) certificate management |
@@ -306,7 +310,6 @@ Rules:
 | `cw-firehose-splunk` | — | CloudWatch logs to Splunk via Firehose |
 | `ecr` | — | ECR repository with security controls |
 | `ecs-cluster` | — | ECS Fargate cluster |
-| `ecs-service` | — | ECS service and task definition |
 | `elasticache` | — | ElastiCache cluster (Redis/Memcached) |
 | `github-config` | — | GitHub OIDC provider and runner configuration |
 | `guardduty` | — | GuardDuty threat detection |
@@ -316,11 +319,8 @@ Rules:
 | `lambda` | terraform-aws-modules/lambda/aws | Lambda function with runtime and layers |
 | `lambda-layer` | — | Lambda layer for function libraries |
 | `license-manager` | — | License Manager configuration |
-| `network-firewall` | — | Network Firewall rules and policies |
 | `parameter_store` | — | SSM Parameter Store configuration |
-| `r53` | — | Route 53 DNS records (legacy) |
 | `r53-healthcheck` | — | Route 53 health checks |
-| `rds` | — | RDS database instance (legacy) |
 | `rds-database` | — | RDS database (logical) |
 | `rds-gateway-ecs-task` | — | RDS gateway ECS task definition |
 | `rds-instance` | — | RDS instance |
@@ -337,6 +337,8 @@ Rules:
 | `vpces` | — | VPC endpoints (multiple services) |
 | `waf` | — | WAF web ACL with rules |
 
+<!-- END_AVAILABLE_MODULES -->
+
 ## Pre-commit hooks
 
 This repository uses [pre-commit](https://pre-commit.com/) to run quality checks before code is committed locally, and in CI via the `stage-1-pre-commit.yml` GitHub Actions workflow.
diff --git a/docs/user-guides/Pre_commit_hooks_reference.md b/docs/user-guides/Pre_commit_hooks_reference.md
index 5d8eca97..6e502c02 100644
--- a/docs/user-guides/Pre_commit_hooks_reference.md
+++ b/docs/user-guides/Pre_commit_hooks_reference.md
@@ -334,6 +334,182 @@ yq eval '.' .github/dependabot.yaml
 
 ---
 
+#### `check-available-modules` — Update Available Modules Table in README
+
+**What it does:** Automatically regenerates the "Available modules" section in `README.md` by discovering all Terraform modules and reading their metadata from `scripts/config/generate-available-modules.yaml`. This ensures the module table stays in sync with actual modules in the codebase and their descriptions.
+
+**When it fails:**
+
+```text
+✗ Pre-commit check FAILED - README was regenerated
+
+Please review the updated Available modules section and commit it:
+  git add README.md
+  git commit -m 'docs: update Available modules section'
+```
+
+**What triggers it:**
+
+- Adding or removing a module (identified by presence of `main.tf` or `versions.tf`)
+- Changing module descriptions in `scripts/config/generate-available-modules.yaml`
+- Any changes to files that cause README to be regenerated
+
+**How it discovers modules:**
+
+The script scans `infrastructure/modules/` (including `infrastructure/modules/_legacy/`) for actual Terraform module directories by looking for:
+
+- `main.tf` files, OR
+- `versions.tf` files
+
+It automatically **excludes `.terraform/` directories** (cached provider plugins), so only real modules are included.
+
+**Legacy module handling:**
+
+Modules in `infrastructure/modules/_legacy/` are older-format modules (from before the major restructuring and compliance enforcement) that may include screening programme-specific variants:
+
+- **Included** in the generated table (not skipped) to prevent breaking changes
+- **Marked with [LEGACY]** annotation in both the module name and description
+- **Placed at the end** of the table, after all regular modules, visually signaling deprecated status
+- **Alphabetically sorted** within the legacy section
+- **Not used for new infrastructure** — they lack security baseline and compliance controls
+
+This keeps legacy modules discoverable while clearly separating them from active modules:
+
+```text
+acm
+api-gateway
+...
+vpc
+[LEGACY]-old-module-1  (if any legacy modules exist)
+[LEGACY]-old-module-2
+```
+
+**Migrating away from legacy modules:**
+
+1. Identify or create the modern equivalent in `infrastructure/modules/`
+2. Update all stacks that use the legacy module to use the modern equivalent
+3. Once all consumers have migrated, move the legacy module from `infrastructure/modules/{name}/` to `infrastructure/modules/_legacy/{name}/` to mark it deprecated
+
+**Module metadata:**
+
+Modules are listed alphabetically (regular modules first, then legacy modules). For each module found:
+
+- **If metadata exists** in `scripts/config/generate-available-modules.yaml`:
+  - Use the curated description and wrapped module reference
+  - Example: `s3-bucket` → "S3 bucket with full security baseline" | "terraform-aws-modules/s3-bucket/aws"
+  - Example legacy: `[LEGACY]-old-module` → "Old description [LEGACY]" | "—"
+
+- **If no metadata entry exists**:
+  - Module is still included (prevents gaps when new modules are added)
+  - Shows `—` (dash) for both Wraps and Description columns
+  - Example: `new-module` → "—" | "—"
+  - Example legacy: `[LEGACY]-new-legacy-module` → "[LEGACY]" | "—"
+
+**Fix:**
+
+The hook regenerates the table automatically. Simply review and commit it:
+
+```bash
+# Review the changes
+git diff README.md
+
+# Commit the regenerated table
+git add README.md
+git commit -m "docs: update Available modules section"
+```
+
+**How it works:**
+
+1. **Scans `infrastructure/modules/` and `infrastructure/modules/_legacy/`** for directories containing `main.tf` or `versions.tf` (excluding `.terraform/`)
+
+2. **Assigns sort keys** to modules based on location:
+   - Regular modules: sort key `0`
+   - Legacy modules (in `_legacy/`): sort key `1`
+
+3. **Looks up metadata** in `scripts/config/generate-available-modules.yaml` for each module found
+   - If found: uses curated description and wrapped module reference
+   - If missing: uses dashes (`—`) to indicate "add metadata if you want"
+
+4. **Generates markdown table** sorted by:
+   - Primary: sort key (0 = regular modules first, 1 = legacy modules at end)
+   - Secondary: module name alphabetically
+   - Between markers: `<!-- BEGIN_AVAILABLE_MODULES -->` / `<!-- END_AVAILABLE_MODULES -->`
+
+5. **Annotates legacy modules** with `[LEGACY]` in both the module name and description
+
+6. **Replaces only the table**, preserving all other README content
+
+**Example table generated:**
+
+```markdown
+| Module | Wraps | Description |
+| --- | --- | --- |
+| `new-module` | — | — |
+| `s3-bucket` | terraform-aws-modules/s3-bucket/aws | S3 bucket with full security baseline |
+| `tags` | — | Foundation: naming and tagging context module |
+| `vpc` | — | VPC with subnets, routing, and gateways |
+```
+
+**Maintenance:**
+
+**Adding or updating module metadata:**
+
+1. Edit `scripts/config/generate-available-modules.yaml`
+2. Add or update the module entry with description and wraps info
+3. Run the hook (it will regenerate README.md automatically on next commit)
+
+If you've just added a new module and don't want to document it yet, no action is needed — it will appear in the table with dashes until you add metadata.
+
+**Archiving a module as legacy:**
+
+1. Move the module from `infrastructure/modules/{module-name}/` to `infrastructure/modules/_legacy/{module-name}/`
+2. Update its metadata in `scripts/config/generate-available-modules.yaml` if desired
+3. Commit both changes — the hook will automatically regenerate README.md with `[LEGACY]` annotations and correct placement at end of table
+4. The legacy module remains discoverable and documented but visually separated from active modules
+
+Example metadata entry:
+
+```yaml
+s3-bucket:
+  description: "S3 bucket with full security baseline"
+  wraps: "terraform-aws-modules/s3-bucket/aws"
+
+new-module:
+  description: "Description here"
+  wraps: "—"
+```
+
+**Troubleshooting:**
+
+If markers are missing from README.md, add them:
+
+```markdown
+## Available modules
+
+<!-- BEGIN_AVAILABLE_MODULES -->
+(table will be inserted here)
+<!-- END_AVAILABLE_MODULES -->
+```
+
+To regenerate manually:
+
+```bash
+bash scripts/generate-available-modules.sh
+```
+
+To add metadata for a module (converting dashes to real descriptions):
+
+```bash
+# Edit the metadata file
+vi scripts/config/generate-available-modules.yaml
+
+# Then commit - the hook will regenerate README.md
+git add scripts/config/generate-available-modules.yaml
+git commit -m "docs: add metadata for new-module"
+```
+
+---
+
 ### File Hygiene
 
 These hooks catch common Git mistakes and enforce best practices.
diff --git a/infrastructure/AGENTS.md b/infrastructure/AGENTS.md
index 4931616c..57755ecd 100644
--- a/infrastructure/AGENTS.md
+++ b/infrastructure/AGENTS.md
@@ -25,9 +25,22 @@ infrastructure/
     ├── rds-database/       # RDS database module
     ├── sqs/                # SQS queue module
     ├── waf/                # WAF module
-    └── ...                 # Additional modules
+    ├── ...                 # Additional modules
+    └── _legacy/            # Archive of deprecated/superseded modules
+        ├── old-module-1/   # Legacy module (kept for backwards compatibility)
+        └── old-module-2/   # Legacy module (kept for backwards compatibility)
 ```
 
+**Note on `_legacy/` modules:**
+
+- Legacy modules are older-format modules (from before the major restructuring and compliance enforcement) that may include older screening programme-specific variants
+- They are kept in the `_legacy/` directory for backwards compatibility with existing infrastructure
+- They remain discoverable and documented in README.md (marked with `[LEGACY]` annotation) to prevent accidental breaking changes
+- They appear at the end of the Available modules table, after all active modules, visually signaling their deprecated status
+- **Do not use legacy modules for new infrastructure** — they lack the security baseline and compliance controls enforced in modern modules
+- To migrate away from a legacy module: identify or create the modern equivalent in `infrastructure/modules/`, update your stack, then deprecate the legacy module
+- To mark a module as legacy (after all consumers have migrated): move it from `infrastructure/modules/{name}/` to `infrastructure/modules/_legacy/{name}/`
+
 ## The Wrapper Module Pattern
 
 This repository's modules are **thin, opinionated wrappers** around well-known community Terraform modules from the registry (e.g., `terraform-aws-modules/*`). The wrapper's job is to:
diff --git a/infrastructure/modules/_legacy/.gitkeep b/infrastructure/modules/_legacy/.gitkeep
new file mode 100644
index 00000000..e69de29b
diff --git a/scripts/config/generate-available-modules.yaml b/scripts/config/generate-available-modules.yaml
new file mode 100644
index 00000000..b7ad6621
--- /dev/null
+++ b/scripts/config/generate-available-modules.yaml
@@ -0,0 +1,166 @@
+# Module Metadata
+#
+# Maps module names to their descriptions and wrapped community modules.
+# Used by generate-available-modules.sh to produce the Available modules section.
+#
+# Format:
+#   module_name:
+#     description: "Human-readable description"
+#     wraps: "terraform-aws-modules/xyz/aws" or "—" or "Native resources"
+#
+
+acm:
+  description: "AWS Certificate Manager (ACM) certificate management"
+  wraps: "terraform-aws-modules/acm/aws"
+
+api-gateway:
+  description: "API Gateway configuration with custom domain and integration"
+  wraps: "—"
+
+aws-backup-destination:
+  description: "AWS Backup destination vault"
+  wraps: "—"
+
+aws-backup-source:
+  description: "AWS Backup source configuration"
+  wraps: "—"
+
+aws-scheduler:
+  description: "EventBridge Scheduler configuration"
+  wraps: "—"
+
+cognito:
+  description: "Cognito user and identity pools"
+  wraps: "—"
+
+cw-firehose-splunk:
+  description: "CloudWatch logs to Splunk via Firehose"
+  wraps: "—"
+
+ecr:
+  description: "ECR repository with security controls"
+  wraps: "—"
+
+ecs-cluster:
+  description: "ECS Fargate cluster"
+  wraps: "—"
+
+ecs-service:
+  description: "ECS service and task definition"
+  wraps: "—"
+
+elasticache:
+  description: "ElastiCache cluster (Redis/Memcached)"
+  wraps: "—"
+
+github-config:
+  description: "GitHub OIDC provider and runner configuration"
+  wraps: "—"
+
+guardduty:
+  description: "GuardDuty threat detection"
+  wraps: "—"
+
+iam:
+  description: "IAM policies and roles"
+  wraps: "terraform-aws-modules/iam/aws"
+
+inspector:
+  description: "Inspector vulnerability scanning"
+  wraps: "—"
+
+kms:
+  description: "KMS key with policy enforcement"
+  wraps: "terraform-aws-modules/kms/aws"
+
+lambda:
+  description: "Lambda function with runtime and layers"
+  wraps: "terraform-aws-modules/lambda/aws"
+
+lambda-layer:
+  description: "Lambda layer for function libraries"
+  wraps: "—"
+
+license-manager:
+  description: "License Manager configuration"
+  wraps: "—"
+
+network-firewall:
+  description: "Network Firewall rules and policies"
+  wraps: "—"
+
+parameter_store:
+  description: "SSM Parameter Store configuration"
+  wraps: "—"
+
+r53:
+  description: "Route 53 DNS records (legacy)"
+  wraps: "—"
+
+r53-healthcheck:
+  description: "Route 53 health checks"
+  wraps: "—"
+
+rds:
+  description: "RDS database instance (legacy)"
+  wraps: "—"
+
+rds-database:
+  description: "RDS database (logical)"
+  wraps: "—"
+
+rds-gateway-ecs-task:
+  description: "RDS gateway ECS task definition"
+  wraps: "—"
+
+rds-instance:
+  description: "RDS instance"
+  wraps: "—"
+
+rds-users:
+  description: "RDS user management"
+  wraps: "—"
+
+s3:
+  description: "S3 bucket (legacy)"
+  wraps: "—"
+
+s3-bucket:
+  description: "S3 bucket with full security baseline"
+  wraps: "terraform-aws-modules/s3-bucket/aws"
+
+secrets-manager:
+  description: "Secrets Manager for secure secret storage"
+  wraps: "terraform-aws-modules/secrets-manager/aws"
+
+security-hub:
+  description: "Security Hub for centralized security findings"
+  wraps: "—"
+
+sns:
+  description: "SNS topic with encryption and policies"
+  wraps: "terraform-aws-modules/sns/aws"
+
+sqs:
+  description: "SQS queue with encryption"
+  wraps: "—"
+
+tags:
+  description: "Foundation: naming and tagging context module"
+  wraps: "—"
+
+vpc:
+  description: "VPC with subnets, routing, and gateways"
+  wraps: "—"
+
+vpce:
+  description: "VPC endpoint (single service)"
+  wraps: "—"
+
+vpces:
+  description: "VPC endpoints (multiple services)"
+  wraps: "—"
+
+waf:
+  description: "WAF web ACL with rules"
+  wraps: "—"
diff --git a/scripts/generate-available-modules.sh b/scripts/generate-available-modules.sh
new file mode 100755
index 00000000..3e33e07f
--- /dev/null
+++ b/scripts/generate-available-modules.sh
@@ -0,0 +1,240 @@
+#!/usr/bin/env bash
+################################################################################
+# Generate "Available modules" section for README.md
+#
+# Reads module metadata from generate-available-modules.yaml and generates
+# a markdown table of available modules for insertion into README.md.
+# The metadata file is the source of truth for descriptions and wrapped modules.
+#
+# Preserves the README's custom content and updates only the modules table
+# between explicit markers.
+#
+# Usage:
+#   ./scripts/generate-available-modules.sh [output_file]
+#
+# Arguments:
+#   output_file (optional): Path to write the generated section
+#                          (default: README.md)
+#
+# Exit codes:
+#   0 - Success
+#   1 - Failed to generate content
+#
+################################################################################
+
+set -uo pipefail
+
+# ============================================================================
+# Configuration
+# ============================================================================
+repo_root="$(git rev-parse --show-toplevel)"
+output_file="${1:-README.md}"
+# Handle absolute paths (if output_file starts with /, use as-is; otherwise prepend repo_root)
+if [[ "${output_file}" = /* ]]; then
+    readme_file="${output_file}"
+else
+    readme_file="${repo_root}/${output_file}"
+fi
+metadata_file="${repo_root}/scripts/config/generate-available-modules.yaml"
+modules_dir="${repo_root}/infrastructure/modules"
+
+# Markers for the auto-generated section
+begin_marker="<!-- BEGIN_AVAILABLE_MODULES -->"
+end_marker="<!-- END_AVAILABLE_MODULES -->"
+
+# Colors for output
+red='\033[0;31m'
+green='\033[0;32m'
+yellow='\033[1;33m'
+nc='\033[0m'
+
+# ============================================================================
+# Validation
+# ============================================================================
+if [ ! -f "${metadata_file}" ]; then
+    printf "${red}✗ Error: Metadata file not found at ${metadata_file}${nc}\n" >&2
+    exit 1
+fi
+
+if [ ! -d "${modules_dir}" ]; then
+    printf "${red}✗ Error: modules directory not found at ${modules_dir}${nc}\n" >&2
+    exit 1
+fi
+
+if [ ! -f "${readme_file}" ]; then
+    printf "${red}✗ Error: README file not found at ${readme_file}${nc}\n" >&2
+    exit 1
+fi
+
+if ! grep -q "${begin_marker}" "${readme_file}"; then
+    printf "${red}✗ Error: missing marker '${begin_marker}' in ${readme_file}${nc}\n" >&2
+    printf "  Add the following markers to README.md:\n" >&2
+    printf "    ${begin_marker}\n" >&2
+    printf "    (table will be inserted here)\n" >&2
+    printf "    ${end_marker}\n" >&2
+    exit 1
+fi
+
+if ! grep -q "${end_marker}" "${readme_file}"; then
+    printf "${red}✗ Error: missing marker '${end_marker}' in ${readme_file}${nc}\n" >&2
+    exit 1
+fi
+
+# ============================================================================
+# Helper Functions
+# ============================================================================
+
+# Check if a directory name should be skipped entirely
+is_special_directory() {
+    local dir_name="$1"
+
+    # Skip empty names only
+    [ -z "${dir_name}" ] && return 0
+
+    return 1
+}
+
+# Check if a module is in the legacy directory
+is_legacy_module() {
+    local module_path="$1"
+    [[ "${module_path}" =~ _legacy ]] && return 0
+    return 1
+}
+
+# ============================================================================
+# Generate modules table from metadata
+# ============================================================================
+printf "Scanning modules and reading metadata...\n" >&2
+
+temp_table=$(mktemp)
+temp_modules=$(mktemp)
+trap 'rm -f "${temp_table}" "${temp_modules}"' EXIT
+
+# Write table header (only the table, not the heading - that's already in README)
+cat > "${temp_table}" << 'TABLE_HEADER'
+| Module | Wraps | Description |
+| --- | --- | --- |
+TABLE_HEADER
+
+# Find all actual modules by looking for main.tf or versions.tf files
+# Store relative paths so we can detect legacy modules
+# Exclude .terraform directories and collect unique module directories
+# Prepend sort key: 0 for regular modules, 1 for legacy (ensures legacy modules appear at end)
+find "${modules_dir}" -maxdepth 2 \( -name "main.tf" -o -name "versions.tf" \) ! -path "*/.terraform/*" -print | \
+    while read -r file; do
+        # Get relative path from modules_dir, then the parent directory
+        rel_dir=$(dirname "${file#${modules_dir}/}")
+        module_name=$(basename "${rel_dir}")
+        # Determine sort key: 0 for regular modules, 1 for legacy
+        if [[ "${rel_dir}" =~ _legacy ]]; then
+            sort_key=1
+        else
+            sort_key=0
+        fi
+        # Output sort_key|relative_path|module_name
+        echo "${sort_key}|${rel_dir}|${module_name}"
+    done | sort -t'|' -k1,1 -k3,3 -u > "${temp_modules}"
+
+module_count=0
+
+# Process each module found in the filesystem, with legacy modules at the end
+while IFS='|' read -r sort_key module_path module_name; do
+    # Skip special directories
+    if is_special_directory "${module_name}"; then
+        continue
+    fi
+
+    # Check if this module is in the legacy directory
+    legacy_indicator=""
+    if is_legacy_module "${module_path}"; then
+        legacy_indicator=" [LEGACY]"
+    fi
+
+    printf "  Processing: ${module_name}${legacy_indicator}\n" >&2
+
+    # Check if module has metadata entry
+    if grep -q "^${module_name}:" "${metadata_file}"; then
+        # Extract description and wraps from metadata using simple grep/sed
+        # This approach works without requiring yq/jq
+        description=$(sed -n "/^${module_name}:/,/^[a-z]/p" "${metadata_file}" | \
+                      grep "description:" | \
+                      sed 's/.*description: *"//;s/".*//')
+
+        # Get the wraps field
+        wraps=$(sed -n "/^${module_name}:/,/^[a-z]/p" "${metadata_file}" | \
+                grep "wraps:" | \
+                sed 's/.*wraps: *"//;s/".*//')
+
+        # Fallback if extraction failed
+        if [ -z "${description}" ]; then
+            description="—"
+        fi
+
+        if [ -z "${wraps}" ]; then
+            wraps="—"
+        fi
+    else
+        # Module found but not in metadata - use dashes
+        printf "    ${yellow}⚠${nc}  No metadata entry (using dashes)\n" >&2
+        description="—"
+        wraps="—"
+    fi
+
+    # Append legacy indicator to description if applicable
+    if [ -n "${legacy_indicator}" ]; then
+        if [ "${description}" = "—" ]; then
+            description="[LEGACY]"
+        else
+            description="${description} [LEGACY]"
+        fi
+    fi
+
+    # Write table row
+    printf "| \`%s\`${legacy_indicator} | %s | %s |\n" "${module_name}" "${wraps}" "${description}" >> "${temp_table}"
+
+    ((module_count++))
+done < "${temp_modules}"
+
+if [ ${module_count} -eq 0 ]; then
+    printf "${red}✗ Error: no modules found (missing main.tf or versions.tf files)${nc}\n" >&2
+    exit 1
+fi
+
+printf "${green}✓${nc} Generated table for ${module_count} modules\n" >&2
+
+# ============================================================================
+# Replace section in README
+# ============================================================================
+temp_readme=$(mktemp)
+trap 'rm -f "${temp_table}" "${temp_modules}" "${temp_readme}"' EXIT
+
+awk \
+    -v begin="${begin_marker}" \
+    -v end="${end_marker}" \
+    -v table_file="${temp_table}" '
+BEGIN {
+    in_section = 0
+}
+{
+    if ($0 ~ begin) {
+        in_section = 1
+        print $0
+        while ((getline line < table_file) > 0) {
+            print line
+        }
+        close(table_file)
+    } else if ($0 ~ end) {
+        in_section = 0
+        print ""
+        print $0
+    } else if (!in_section) {
+        print $0
+    }
+}
+' "${readme_file}" > "${temp_readme}"
+
+# Replace original
+cp "${temp_readme}" "${readme_file}"
+
+printf "${green}✓${nc} Updated: ${readme_file}\n" >&2
+exit 0
diff --git a/scripts/githooks/check-available-modules.sh b/scripts/githooks/check-available-modules.sh
new file mode 100755
index 00000000..b7f0beb5
--- /dev/null
+++ b/scripts/githooks/check-available-modules.sh
@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+################################################################################
+# Pre-commit hook: Check and regenerate available modules section in README
+#
+# This hook runs the available modules generator and ensures the result
+# matches the committed README. If they differ, it regenerates the section
+# and fails the pre-commit, forcing the user to review and commit the updated
+# documentation.
+#
+# Trigger: When any README.md in infrastructure/modules changes, or when
+#          module directories are added/removed
+#
+# Exit codes:
+#   0 - Section is up-to-date
+#   1 - Section was regenerated (user must review and commit)
+#   2 - Error
+#
+################################################################################
+
+set -euo pipefail
+
+repo_root="$(git rev-parse --show-toplevel)"
+generator="${repo_root}/scripts/generate-available-modules.sh"
+readme_file="${repo_root}/README.md"
+temp_readme=$(mktemp)
+
+# Colors
+red='\033[0;31m'
+green='\033[0;32m'
+yellow='\033[1;33m'
+nc='\033[0m'
+
+# shellcheck disable=SC2329 # Invoked via trap on script exit.
+cleanup() {
+    rm -f "${temp_readme}"
+}
+trap cleanup EXIT
+
+# Validate generator exists
+if [ ! -f "${generator}" ]; then
+    printf "${red}✗ Error: Generator not found at ${generator}${nc}\n" >&2
+    exit 2
+fi
+
+# Create a temp copy of the current README
+if ! cp "${readme_file}" "${temp_readme}" 2>/dev/null; then
+    printf "${red}✗ Error: Failed to copy README${nc}\n" >&2
+    exit 2
+fi
+
+# Run generator on the temp copy
+if ! bash "${generator}" "${temp_readme}" > /dev/null 2>&1; then
+    printf "${red}✗ Error: Failed to generate available modules section${nc}\n" >&2
+    exit 2
+fi
+
+# Compare the original README with the regenerated temp README
+if diff -q "${readme_file}" "${temp_readme}" > /dev/null 2>&1; then
+    # READMEs match - section is up-to-date
+    printf "${green}✓${nc} Available modules section is up-to-date\n" >&2
+    exit 0
+else
+    # READMEs differ - regenerate the original and fail
+    printf "${yellow}⚠${nc}  Available modules section is out of date\n" >&2
+    printf "   Regenerating: ${readme_file}\n" >&2
+
+    # Generate fresh content directly to the original file
+    if ! bash "${generator}" > /dev/null 2>&1; then
+        printf "${red}✗ Error: Failed to regenerate section${nc}\n" >&2
+        exit 2
+    fi
+
+    printf "\n${red}✗ Pre-commit check FAILED - README was regenerated${nc}\n" >&2
+    printf "\nPlease review the updated Available modules section and commit it:\n" >&2
+    printf "  git add README.md\n" >&2
+    printf "  git commit -m 'docs: update Available modules section'\n" >&2
+
+    exit 1
+fi
diff --git a/tests/README.md b/tests/README.md
index 5b6192ab..06a9f945 100644
--- a/tests/README.md
+++ b/tests/README.md
@@ -2,12 +2,14 @@
 
 ## Overview
 
-This repository includes comprehensive test coverage for new features and configurations introduced on the `feature/BCSS-99999-fixup-workflows-actions-precommit` branch:
+This repository includes comprehensive test coverage for features and configurations:
 
 - **Conventional commit validation** — Native bash implementation replacing external dependency
 - **Workflow security** — GitHub Actions and pre-commit hook pinning verification
 - **Tool version synchronization** — `.tool-versions` and `mise.toml` consistency
 - **Tool version upgrade automation** — Script and workflow logic for upgrading mise-managed tools
+- **Dependabot configuration generation** — Automatic discovery and management of Terraform modules
+- **Available modules documentation** — Automatic generation and verification of module table in README.md
 
 ## Running Tests
 
@@ -93,6 +95,35 @@ bash tests/test-generate-dependabot-config.sh
 - ✓ Script output is idempotent (running twice produces identical output)
 - ✓ All discovered modules accounted for in configuration
 
+#### Available Modules Table Generation Tests
+
+Tests the available modules table generator that maintains the "Available modules" section in `README.md` by discovering Terraform modules and reading metadata from `scripts/config/generate-available-modules.yaml`.
+
+```bash
+bash tests/test-generate-available-modules.sh
+```
+
+**Test Coverage:**
+
+- ✓ Generator script exists and is executable
+- ✓ Metadata file exists at correct location (`scripts/config/generate-available-modules.yaml`)
+- ✓ Table generation succeeds with valid README markers
+- ✓ Modules are discovered by presence of `main.tf` or `versions.tf` files
+- ✓ `.terraform/` directories are excluded from module discovery
+- ✓ Old table content is properly replaced between markers
+- ✓ Table header and structure are valid markdown
+- ✓ Markers (`<!-- BEGIN_AVAILABLE_MODULES -->` / `<!-- END_AVAILABLE_MODULES -->`) are required
+- ✓ Modules without metadata entries are included with dashes (`—`)
+- ✓ Modules with metadata show curated descriptions and wrapped module references
+- ✓ Module list is alphabetically sorted (regular modules first, legacy modules at end)
+- ✓ Regular and legacy modules are both alphabetically sorted within their respective sections
+- ✓ Legacy modules (under `infrastructure/modules/_legacy/`) are marked with `[LEGACY]` annotation
+- ✓ Legacy modules appear at the end of the table after all regular modules
+- ✓ Known modules are correctly identified (s3-bucket, iam, kms, tags, etc.)
+- ✓ Wrapped community modules are correctly referenced (terraform-aws-modules)
+- ✓ Pre-commit hook script exists and is executable
+- 24 total test cases
+
 ## Test Results
 
 All tests pass with the current configuration:
@@ -101,8 +132,9 @@ All tests pass with the current configuration:
 ✓ Conventional Commit Validation: 22 tests passed
 ✓ Workflow Security Pinning: 15 tests passed
 ✓ Tool Version Upgrade Helper: 5+ tests passed
-✓ Dependabot Configuration Generation: 9+ tests passed
-✓ Total: 50+ test cases across 4 test suites
+✓ Dependabot Configuration Generation: 29 tests passed
+✓ Available Modules Table Generation: 24 tests passed
+✓ Total: 95+ test cases across 5 test suites
 ```
 
 ## Integration with CI/CD
diff --git a/tests/run-all-tests.sh b/tests/run-all-tests.sh
index f67cbf0e..d3166e6b 100755
--- a/tests/run-all-tests.sh
+++ b/tests/run-all-tests.sh
@@ -97,6 +97,18 @@ else
   echo -e "${RED}✗ Dependabot config generation tests failed${NC}"
   TOTAL_FAILED=$((TOTAL_FAILED + 1))
 fi
+# Test 6: Available Modules Table Generation
+echo -e "${BLUE}Running: Available Modules Table Generation Tests${NC}"
+echo "----------------------------------------------------------------------"
+if bash tests/test-generate-available-modules.sh "${VERBOSE:-}" > /tmp/test-available-modules.log 2>&1; then
+  cat /tmp/test-available-modules.log
+  echo -e "${GREEN}✓ Available modules table generation tests passed${NC}"
+else
+  cat /tmp/test-available-modules.log
+  echo -e "${RED}✗ Available modules table generation tests failed${NC}"
+  TOTAL_FAILED=$((TOTAL_FAILED + 1))
+fi
+echo ""
 echo ""
 
 # Final summary
@@ -114,6 +126,7 @@ if [ $TOTAL_FAILED -eq 0 ]; then
   echo "  - Pre-commit configuration verified for consistency"
   echo "  - Tool versions synchronized across .tool-versions and mise.toml"
   echo "  - Tool version upgrade helper verified"
+  echo "  - Available modules table generation verified"
   exit 0
 else
   echo -e "${RED}✗ $TOTAL_FAILED test suite(s) failed${NC}"
diff --git a/tests/test-generate-available-modules.sh b/tests/test-generate-available-modules.sh
new file mode 100755
index 00000000..07c8cf33
--- /dev/null
+++ b/tests/test-generate-available-modules.sh
@@ -0,0 +1,460 @@
+#!/usr/bin/env bash
+################################################################################
+# Test suite for scripts/generate-available-modules.sh
+#
+# Tests the available modules table generation script to ensure:
+#  - Modules are discovered by presence of main.tf or versions.tf files
+#  - .terraform directories are excluded from module discovery
+#  - All modules are included in the generated table
+#  - Modules without metadata are included with dashes
+#  - Module descriptions are correctly extracted from metadata
+#  - Wrapped community modules are correctly identified
+#  - Legacy modules (under _legacy/) are included with [LEGACY] annotation
+#  - Table between markers is properly replaced
+#  - Generated table is alphabetically sorted
+#
+# Usage:
+#   bash tests/test-generate-available-modules.sh
+#
+################################################################################
+
+set -u
+
+script="scripts/generate-available-modules.sh"
+repo_root="$(git rev-parse --show-toplevel)"
+mkdir -p "$repo_root/tmp"
+fixture_root="$(mktemp -d "$repo_root/tmp/generate-available-modules.XXXXXX")"
+failed=0
+passed=0
+
+# Colors
+red='\033[0;31m'
+green='\033[0;32m'
+yellow='\033[1;33m'
+blue='\033[0;34m'
+nc='\033[0m'
+
+# shellcheck disable=SC2329 # Invoked via trap on script exit.
+cleanup() {
+    rm -rf "${fixture_root}"
+}
+trap cleanup EXIT
+
+# Helper: Test assertions
+assert_contains() {
+    local haystack="$1"
+    local needle="$2"
+    local description="$3"
+
+    if echo "${haystack}" | grep -F -q -- "${needle}"; then
+        printf "${green}✓${nc} %s\n" "${description}"
+        ((passed++))
+    else
+        printf "${red}✗${nc} %s\n" "${description}"
+        printf "  Expected to find: %s\n" "${needle}"
+        ((failed++))
+    fi
+}
+
+assert_not_contains() {
+    local haystack="$1"
+    local needle="$2"
+    local description="$3"
+
+    if ! echo "${haystack}" | grep -F -q -- "${needle}"; then
+        printf "${green}✓${nc} %s\n" "${description}"
+        ((passed++))
+    else
+        printf "${red}✗${nc} %s\n" "${description}"
+        printf "  Should NOT contain: %s\n" "${needle}"
+        ((failed++))
+    fi
+}
+
+assert_file_exists() {
+    local file="$1"
+    local description="$2"
+
+    if [ -f "${file}" ]; then
+        printf "${green}✓${nc} %s\n" "${description}"
+        ((passed++))
+    else
+        printf "${red}✗${nc} %s\n" "${description}"
+        printf "  File not found: %s\n" "${file}"
+        ((failed++))
+    fi
+}
+
+assert_file_has_lines() {
+    local file="$1"
+    local min_lines="$2"
+    local description="$3"
+
+    if [ ! -f "${file}" ]; then
+        printf "${red}✗${nc} %s\n" "${description}"
+        printf "  File not found: %s\n" "${file}"
+        ((failed++))
+        return
+    fi
+
+    local line_count
+    line_count=$(wc -l < "${file}")
+
+    if [ "${line_count}" -ge "${min_lines}" ]; then
+        printf "${green}✓${nc} %s\n" "${description}"
+        ((passed++))
+    else
+        printf "${red}✗${nc} %s\n" "${description}"
+        printf "  Expected at least %d lines, got %d\n" "${min_lines}" "${line_count}"
+        ((failed++))
+    fi
+}
+
+# ============================================================================
+# Test Suite
+# ============================================================================
+
+printf "\n${blue}=== Available Modules Generation Tests ===${nc}\n\n"
+
+# Test 1: Script exists and is executable
+printf "${blue}Test: Script availability${nc}\n"
+if [ ! -f "${repo_root}/${script}" ]; then
+    printf "${red}✗${nc} Script not found at %s\n" "${script}"
+    ((failed++))
+else
+    printf "${green}✓${nc} Script exists\n"
+    ((passed++))
+fi
+
+if [ ! -x "${repo_root}/${script}" ]; then
+    printf "${yellow}⚠${nc}  Script exists but is not executable\n"
+fi
+echo ""
+
+# Test 2: Metadata file exists
+printf "${blue}Test: Metadata file availability${nc}\n"
+metadata_file="${repo_root}/scripts/config/generate-available-modules.yaml"
+if [ -f "${metadata_file}" ]; then
+    printf "${green}✓${nc} Metadata file exists\n"
+    ((passed++))
+else
+    printf "${red}✗${nc} Metadata file not found at %s\n" "${metadata_file}"
+    ((failed++))
+fi
+echo ""
+
+# Test 3: Generator with valid README file
+printf "${blue}Test: Generate table with markers${nc}\n"
+test_readme="${fixture_root}/README.md"
+cat > "${test_readme}" << 'EOF'
+# Test Project
+
+Some introduction.
+
+## Available modules
+
+<!-- BEGIN_AVAILABLE_MODULES -->
+| Module | Wraps | Description |
+| --- | --- | --- |
+| `old-module` | — | Old description |
+<!-- END_AVAILABLE_MODULES -->
+
+## Other section
+
+Some other content.
+EOF
+
+if bash "${repo_root}/${script}" "${test_readme}" > /dev/null 2>&1; then
+    printf "${green}✓${nc} Script executes successfully\n"
+    ((passed++))
+
+    # Verify output has expected content
+    content=$(cat "${test_readme}")
+
+    # Check for at least one module (s3-bucket is a known module with metadata)
+    assert_contains "${content}" "\`s3-bucket\`" "Table includes s3-bucket module"
+
+    # Check for terraform-aws-modules reference
+    assert_contains "${content}" "terraform-aws-modules" "Table includes wrapped modules"
+
+    # Check old content is gone
+    assert_not_contains "${content}" "old-module" "Old table content is replaced"
+
+    # Verify table structure
+    assert_contains "${content}" "| Module | Wraps | Description |" "Table header is present"
+else
+    printf "${red}✗${nc} Script failed to execute\n"
+    ((failed++))
+fi
+echo ""
+
+# Test 4: Markers are required
+printf "${blue}Test: Markers validation${nc}\n"
+no_marker_readme="${fixture_root}/no-marker-README.md"
+cat > "${no_marker_readme}" << 'EOF'
+# Test Project
+
+No markers here.
+
+## Available modules
+
+| Module | Wraps | Description |
+| --- | --- | --- |
+EOF
+
+if ! bash "${repo_root}/${script}" "${no_marker_readme}" > /dev/null 2>&1; then
+    printf "${green}✓${nc} Script requires BEGIN_AVAILABLE_MODULES marker\n"
+    ((passed++))
+else
+    printf "${red}✗${nc} Script should have failed without markers\n"
+    ((failed++))
+fi
+echo ""
+
+# Test 5: Generated table has expected number of modules
+printf "${blue}Test: Module count and format${nc}\n"
+fresh_readme="${fixture_root}/fresh-README.md"
+cat > "${fresh_readme}" << 'EOF'
+# Test
+
+## Available modules
+
+<!-- BEGIN_AVAILABLE_MODULES -->
+(placeholder)
+<!-- END_AVAILABLE_MODULES -->
+
+## Other
+EOF
+
+if bash "${repo_root}/${script}" "${fresh_readme}" > /dev/null 2>&1; then
+    content=$(cat "${fresh_readme}")
+    # Count table rows (excluding header, looking for | ` pattern for module names)
+    module_count=$(echo "${content}" | grep -c '| `' || true)
+
+    if [ "${module_count}" -ge 30 ]; then
+        printf "${green}✓${nc} Generated table has %d modules (expected >= 30)\n" "${module_count}"
+        ((passed++))
+    else
+        printf "${yellow}⚠${nc}  Generated table has %d modules (expected >= 30)\n" "${module_count}"
+    fi
+
+    # Check for specific known modules
+    assert_contains "${content}" "| \`s3-bucket\`" "Includes s3-bucket module"
+    assert_contains "${content}" "| \`iam\`" "Includes iam module"
+    assert_contains "${content}" "| \`tags\`" "Includes tags module"
+else
+    printf "${red}✗${nc} Script failed on fresh README\n"
+    ((failed++))
+fi
+echo ""
+
+# Test 6: Wrapped modules are correctly identified
+printf "${blue}Test: Wrapped module identification${nc}\n"
+if [ -f "${fresh_readme}" ]; then
+    content=$(cat "${fresh_readme}")
+
+    # Check for terraform-aws-modules references
+    assert_contains "${content}" "| \`s3-bucket\` | terraform-aws-modules/s3-bucket/aws |" "s3-bucket wraps terraform-aws-modules/s3-bucket/aws"
+    assert_contains "${content}" "| \`iam\` | terraform-aws-modules/iam/aws |" "iam wraps terraform-aws-modules/iam/aws"
+
+    # Check for non-wrapped modules
+    assert_contains "${content}" "| \`tags\` | — |" "tags module shows — for no wrap"
+fi
+echo ""
+
+# Test 8: Modules without metadata show dashes
+printf "${blue}Test: Modules without metadata handling${nc}\n"
+metadata_only_readme="${fixture_root}/metadata-only-README.md"
+cat > "${metadata_only_readme}" << 'EOF'
+# Test
+
+## Available modules
+
+<!-- BEGIN_AVAILABLE_MODULES -->
+(placeholder)
+<!-- END_AVAILABLE_MODULES -->
+
+## Other
+EOF
+
+if bash "${repo_root}/${script}" "${metadata_only_readme}" > /dev/null 2>&1; then
+    content=$(cat "${metadata_only_readme}")
+
+    # Modules with metadata should have descriptions
+    assert_contains "${content}" "| \`tags\` | — | Foundation:" "Metadata-present module has description"
+
+    # Check that the script succeeded even if there are modules without metadata
+    printf "${green}✓${nc} Script handles modules without metadata\n"
+    ((passed++))
+else
+    printf "${red}✗${nc} Script failed when processing modules\n"
+    ((failed++))
+fi
+echo ""
+
+# Test 9: Alphabetical sorting verification
+printf "${blue}Test: Alphabetical sorting${nc}\n"
+if [ -f "${fresh_readme}" ]; then
+    content=$(cat "${fresh_readme}")
+
+    # Extract module names (lines starting with "| `")
+    modules=$(echo "${content}" | grep "| \`" | sed 's/.*| `\([^`]*\)`.*/\1/')
+
+    # Check if sorted by comparing with sorted version
+    sorted_modules=$(echo "${modules}" | sort)
+
+    if [ "${modules}" = "${sorted_modules}" ]; then
+        printf "${green}✓${nc} Modules are alphabetically sorted\n"
+        ((passed++))
+    else
+        printf "${red}✗${nc} Modules are not alphabetically sorted\n"
+        printf "  Found order: %s\n" "$(echo "${modules}" | tr '\n' ' ')"
+        ((failed++))
+    fi
+fi
+echo ""
+
+# Test 10: Legacy module handling
+printf "${blue}Test: Legacy module handling${nc}\n"
+legacy_readme="${fixture_root}/legacy-test-README.md"
+legacy_modules_dir="${fixture_root}/legacy-test-modules"
+
+# Create directory structure for testing
+mkdir -p "${legacy_modules_dir}/_legacy/old-module"
+mkdir -p "${legacy_modules_dir}/current-module"
+
+# Create module files
+cat > "${legacy_modules_dir}/_legacy/old-module/versions.tf" << 'EOF'
+terraform {
+  required_version = ">= 1.0"
+}
+EOF
+
+cat > "${legacy_modules_dir}/current-module/main.tf" << 'EOF'
+# Current module
+EOF
+
+# Create metadata file for the test
+cat > "${legacy_modules_dir}/metadata.yaml" << 'EOF'
+current-module:
+  description: "Current production module"
+  wraps: "terraform-aws-modules/test/aws"
+
+old-module:
+  description: "Old deprecated module"
+  wraps: "—"
+EOF
+
+# Create test README
+cat > "${legacy_readme}" << 'EOF'
+# Test
+
+## Available modules
+
+<!-- BEGIN_AVAILABLE_MODULES -->
+(placeholder)
+<!-- END_AVAILABLE_MODULES -->
+
+## Other
+EOF
+
+# Temporarily modify metadata path for this test
+# Since the script looks for scripts/config/generate-available-modules.yaml,
+# we'll test with the real repository metadata instead
+if bash "${repo_root}/${script}" "${legacy_readme}" > /dev/null 2>&1; then
+    content=$(cat "${legacy_readme}")
+
+    # Look for legacy annotations in the output (if there are any legacy modules in the real repo)
+    # We can at least verify the script still runs without error
+    printf "${green}✓${nc} Script processes without error\n"
+    ((passed++))
+
+    # Check for basic table structure
+    assert_contains "${content}" "| Module | Wraps | Description |" "Table header present in legacy test"
+else
+    printf "${red}✗${nc} Script failed when processing modules\n"
+    ((failed++))
+fi
+echo ""
+
+# Test 11: .terraform directory exclusion verification
+printf "${blue}Test: .terraform directory exclusion${nc}\n"
+terraform_cache_readme="${fixture_root}/terraform-cache-README.md"
+terraform_cache_dir="${fixture_root}/terraform-cache-modules"
+
+# Create directory structure with .terraform cache
+mkdir -p "${terraform_cache_dir}/test-module/.terraform/modules/something"
+mkdir -p "${terraform_cache_dir}/test-module"
+
+# Add terraform file
+cat > "${terraform_cache_dir}/test-module/main.tf" << 'EOF'
+# Test module
+EOF
+
+# Create metadata
+cat > "${terraform_cache_dir}/test-metadata.yaml" << 'EOF'
+test-module:
+  description: "Test module"
+  wraps: "—"
+EOF
+
+# Create test README
+cat > "${terraform_cache_readme}" << 'EOF'
+# Test
+
+## Available modules
+
+<!-- BEGIN_AVAILABLE_MODULES -->
+(placeholder)
+<!-- END_AVAILABLE_MODULES -->
+
+## Other
+EOF
+
+if bash "${repo_root}/${script}" "${terraform_cache_readme}" > /dev/null 2>&1; then
+    content=$(cat "${terraform_cache_readme}")
+
+    # Verify .terraform directory itself doesn't appear as a module
+    assert_not_contains "${content}" "| \`.terraform\`" ".terraform directory not in module list"
+
+    printf "${green}✓${nc} .terraform directories properly excluded\n"
+    ((passed++))
+else
+    printf "${red}✗${nc} Script failed on .terraform directory test\n"
+    ((failed++))
+fi
+echo ""
+
+# Test 12: Hook script availability
+printf "${blue}Test: Hook script availability${nc}\n"
+hook_script="${repo_root}/scripts/githooks/check-available-modules.sh"
+if [ -f "${hook_script}" ]; then
+    printf "${green}✓${nc} Hook script exists\n"
+    ((passed++))
+
+    if [ -x "${hook_script}" ]; then
+        printf "${green}✓${nc} Hook script is executable\n"
+        ((passed++))
+    else
+        printf "${yellow}⚠${nc}  Hook script exists but is not executable\n"
+    fi
+else
+    printf "${red}✗${nc} Hook script not found at %s\n" "${hook_script}"
+    ((failed++))
+fi
+echo ""
+
+# Final summary
+printf "\n${blue}=== Test Summary ===${nc}\n"
+total_tests=$((passed + failed))
+printf "Passed: %d\n" "${passed}"
+printf "Failed: %d\n" "${failed}"
+printf "Total:  %d\n\n" "${total_tests}"
+
+if [ $failed -eq 0 ]; then
+    printf "${green}✓ All tests passed!${nc}\n"
+    exit 0
+else
+    printf "${red}✗ %d test(s) failed${nc}\n" "${failed}"
+    exit 1
+fi