[spec-review] Update Safe Outputs conformance checker for recent spec changes

[github-actions]

Summary

Adds a new MCE-006 conformance check to scripts/check-safe-outputs-conformance.sh that verifies the MCP server core (actions/setup/js/mcp_server_core.cjs) correctly implements JSON-RPC 2.0 error response rules as required by Safe Outputs Specification §8.2. Also splits the single combined version comment into separate spec version (1.23.0) and script version (1.25.0) lines for clarity.

Changes

scripts/check-safe-outputs-conformance.sh — modified

What changed	Detail
New check MCE-006 added	Calls check_mce_core_error_handling() which inspects actions/setup/js/mcp_server_core.cjs for two required behaviors (see below).
Guard against non-negative error codes	Checks that mcp_server_core.cjs contains a e.code < 0 (or equivalent) guard to prevent subprocess exit codes (positive integers like 1, 2) from being forwarded as JSON-RPC error codes; failure logged at CRITICAL severity.
String() serialization of error messages	Checks that the file uses String(e.message) or String(err.message) to serialize error messages, preventing [object Object] appearing in error responses when a handler throws a plain object rather than an Error instance; failure logged at HIGH severity.
Missing-file guard	If mcp_server_core.cjs is absent entirely, the check emits a HIGH log and returns early rather than false-passing.
Version comment split	# Version: 1.24.0 (2026-06-13) → two lines: # Spec Version: 1.23.0 (2026-06-10) and # Script Version: 1.25.0 (2026-06-22).

Motivation

mcp_server_core.cjs was recently updated to fix two latent JSON-RPC non-conformances:

1. Positive error codes — subprocesses return exit codes like 1 or 2; forwarding these directly as the code field of a JSON-RPC error object violates the JSON-RPC 2.0 spec, which requires error codes to be negative integers.
2. [object Object] messages — when handler code throws a plain object (not an Error), accessing .message returns undefined and serialisation yields the unhelpful string [object Object]. Wrapping with String() normalises this.

MCE-006 locks in these fixes by making the conformance checker fail if either guard disappears from the file in future.

Risk

Low. This is a pure addition to a shell-based conformance checker script — no production code paths are modified. The new check only reads mcp_server_core.cjs via grep; it cannot alter behaviour at runtime. The worst-case outcome of a regression is a false-positive or false-negative conformance result, not a runtime failure.

Checklist

• New check is scoped to a single well-known file path (actions/setup/js/mcp_server_core.cjs)
• Missing-file case is handled gracefully (early return with log, no set -e abort)
• Severity levels are appropriate: missing error-code guard → CRITICAL; missing String() → HIGH
• Script version bumped (1.24.0 → 1.25.0); spec version explicitly documented (1.23.0)
• Commit message references the spec section (Section 8.2) and describes both sub-checks

Generated by PR Description Updater for issue #40737 · 57.4 AIC · ⌖ 7.19 AIC · ⊞ 4.5K · ◷