Fix flaky SIGPIPE/pipefail false positives in safe-outputs conformance checker

[Copilot]

scripts/check-safe-outputs-conformance.sh produced non-deterministic MEDIUM failures (e.g. REQ-001) against an unmodified spec file due to a SIGPIPE race under set -o pipefail.

Root cause

Several checks piped a bounded grep -A N into a grep -q/grep -qE. When the downstream grep matches and exits early, it can send SIGPIPE to the still-writing upstream grep, which then exits 141 — surfacing as pipeline failure under pipefail even though the keyword was found.

Fix

• Replaced each grep -A N ... | grep -q ... pipeline with a two-step pattern: capture the first grep's output via command substitution ($(... || true)), then match against it with grep <<< "$var". This runs the first grep to completion before matching, eliminating the race.
• Applied consistently across all affected call sites: SEC-001 (privilege separation), REQ-001 (RFC 2119 keywords), REQ-002 (type completeness), REQ-003 (verification methods), MCE-001 (tool-description constraints), plus two additional occurrences of the same anti-pattern found during audit (TYPE-008, TYPE-010) not explicitly listed in the issue.

# before (racy)
if ! grep -A 200 "## .*$section" "$spec_file" | grep -q "MUST\|SHALL\|SHOULD\|MAY"; then

# after (deterministic)
section_text=$(grep -A 200 "## .*$section" "$spec_file" 2>/dev/null || true)
if ! grep -q "MUST\|SHALL\|SHOULD\|MAY" <<< "$section_text"; then

Verified by running the script 10 consecutive times against the unmodified repo — identical PASS results every run.

• Fixes [Safe Outputs Conformance] REQ-001: Conformance checker produces non-deterministic false positives (pipefail/SIGPIPE race) #58743

[Copilot]

🟢 Approval recommended

The changes consistently remove the identified race without altering the checks’ intended semantics.

Pull request overview

Eliminates SIGPIPE/pipefail races in the safe-outputs conformance checker.

Changes:

• Captures bounded grep output before matching.
• Applies the deterministic pattern across seven affected checks.

File summaries

File	Description
scripts/check-safe-outputs-conformance.sh	Removes racy grep pipelines from conformance checks.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.