[sergo] Report: reverify-plus-fileclose-and-cancel-defer-audit — 2026-05-28 (Run 21)

[github-actions[bot]]

Executive Summary

Sergo Run 21 confirmed that both R20 trackers (sg19a1 manualmutexunlock and sg20a1 osexitinlibrary+rawloginlib) have been fully resolved — .github/workflows/cgo.yml:1040 LINTER_FLAGS now includes -manualmutexunlock -osexitinlibrary -rawloginlib, all 16 prior manual-Unlock sites have been refactored to defer, and the related issues #35130 and #35131 were both closed state_reason: completed on 2026-05-27. The sg14a1 silent-syscall tracker #33459 was instead auto-closed not_planned by the 7-day expiry workflow on the same day without a fix — all 10 sites are still present in pkg/cli/ — so it has been re-filed as #35389.

The new audit dimension targeted two additional unenforced LSP-style analyzers registered in cmd/linters/main.go: fileclosenotdeferred (file FD leak prevention) and contextcancelnotdeferred (context cancel leak prevention). fileclosenotdeferred has zero prod violations across 26 audited os.Open/Create/OpenFile sites and qualifies for free enforcement under the R20 zero-violation pattern (#35390). contextcancelnotdeferred has 6 prod violations that split cleanly into 4 sequential-call refactor targets (pkg/cli/mcp_inspect_mcp.go) and 2 defensible loop-body sites (pkg/workflow/); a refactor-plus-//nolint plan is filed as #35391.

Overall the unenforced-linter pipeline is paying off: 5 of the 16 registered analyzers are now ENFORCED (up from 2 in R19), with fileclosenotdeferred ready for free-pickup as the 6th.

Serena Tools Update

Tools Snapshot

• Total Tools Available: 23
• New Tools Since Last Run: None
• Removed Tools: None
• Modified Tools: None

Tools list has been stable since R4 (now 18 consecutive runs). No schema or parameter changes detected this run.

Tool Capabilities Used Today

• Grep (preferred over find_symbol for broad scans per cached gotcha) — used for all linter site enumeration
• Read — file inspection at line precision for syscall and lock sites
• Glob — directory and file existence checks
• gh api search/issues — verifying open tracker state and close metadata
• gh api repos/.../issues/<n>/events — confirming whether close was auto-expiry vs manual-completed
• safeoutputs create_issue / safeoutputs push_repo_memory — output channel

Strategy Selection

Cached Reuse Component (50%)

Previous Strategy Adapted: reverify-plus-unenforced-linter-zero-violation-audit (R20, success 9/10)

• Original Success Score: 9/10
• Last Used: 2026-05-27 (yesterday — 1 day gap)
• Why Reused: R20 introduced the zero-violation-free-enforcement pattern with sg20a1. Re-verifying the R20 trackers in R21 is the cheapest way to confirm the pattern landed cleanly in CI, and the re-verify pass also exposes which trackers have rolled past the 7-day expiry without fixes (so they can be re-filed).
• Modifications: Instead of just re-verifying, I extended into the next unenforced linter on the cached unenforced_linters_R20.deep_audit_pending list (fileclosenotdeferred) — and discovered another unenforced one not previously noted (contextcancelnotdeferred, registered in cmd/linters/main.go:19).

New Exploration Component (50%)

Novel Approach: Defer-correctness audit across two analyzer families simultaneously — fileclosenotdeferred (file FD) and contextcancelnotdeferred (context cancel) — to spot whether the broader "defer your cleanup" invariant holds beyond mutexes (sg19a1).

• Tools Employed: Same Grep+Read toolset, but applied across pkg/ for os.Open/os.Create/os.OpenFile and context.WithCancel/WithTimeout/WithDeadline patterns.
• Hypothesis: After sg19a1 enforcement landed, defer-discipline may be improving across the board. Expected at least one zero-violation linter and at most one non-zero one.
• Target Areas: pkg/cli/, pkg/workflow/, pkg/fileutil/, pkg/parser/, pkg/logger/, pkg/agentdrain/, pkg/syncutil/, pkg/console/.

Combined Strategy Rationale

The cached re-verify component cheaply confirms the linter-enforcement pipeline is healthy and which existing trackers expired vs completed. The new audit component finds the next free-enforcement candidate (fileclosenotdeferred) and the next refactor-then-enforce candidate (contextcancelnotdeferred), which together feed two ready-to-merge PRs into the same .github/workflows/cgo.yml:1040 pattern that produced sg19a1+sg20a1. Coverage is broad (all pkg/) and depth is targeted (only 4 linter families touched). The combination keeps the unenforced-linter backlog moving forward at a steady ~2 analyzers/run.

Analysis Execution

Codebase Context

• Total Go Files (pkg/): ~700+
• Packages Analyzed: pkg/cli, pkg/workflow, pkg/fileutil, pkg/parser, pkg/logger, pkg/agentdrain, pkg/syncutil, pkg/console (8 packages)
• Registered Analyzers: 16 (cmd/linters/main.go:19-34)
• Enforced Analyzers: 5 (cgo.yml:1040 LINTER_FLAGS)
• Focus Areas: defer-correctness across mutex / file / context-cancel cleanup patterns

Findings Summary

• Total Issues Found: 6
• Critical: 0
• High: 1 (sg21a1 silent syscall — re-file, secrets-related)
• Medium: 1 (sg21a3 contextcancelnotdeferred — 6 sites, refactor)
• Low: 4 (sg21a2 zero-violation enforce; 3 sg-RESOLVED verifications: sg19a1, sg20a1, manual unlock zero-prod)

Detailed Findings

High Priority Issues

sg21a1 — Silent syscall discards in pkg/cli (re-file of expired #33459)

• 10 prod sites unchanged: 4× os.Setenv + 6× os.Chdir
• Previous tracker #33459 closed not_planned by 7-day expiry on 2026-05-27
• Three of four os.Setenv sites store secrets (Copilot token, system PAT, generic API key)
• See created issue body for full file/line table and proposed cliutil helper

Medium Priority Issues

sg21a3 — contextcancelnotdeferred has 6 prod violations

Clean refactor candidates (4):

• pkg/cli/mcp_inspect_mcp.go:196 → cancel:198 (listTools in connectStdioMCPServer)
• pkg/cli/mcp_inspect_mcp.go:208 → cancel:210 (listResources in connectStdioMCPServer)
• pkg/cli/mcp_inspect_mcp.go:285 → cancel:287 (listTools in connectHTTPMCPServer)
• pkg/cli/mcp_inspect_mcp.go:297 → cancel:299 (listResources in connectHTTPMCPServer)

Defensible loop-body sites (2, need //nolint):

• pkg/workflow/action_resolver.go:137 → peelCancel:140 (annotated-tag peel loop)
• pkg/workflow/safe_outputs_actions.go:291 → cancel:294 (filename for-range loop)

Low Priority Issues

sg21a2 — fileclosenotdeferred ready for zero-violation enforcement

• 26 prod os.Open/os.Create/os.OpenFile sites audited
• 22 use canonical defer file.Close() immediately after open
• 3 use defer func() { ... f.Close() ... }() IIFE to capture close error (workflows.go:312, workflows.go:412, logs_download.go:422)
• 1 (pkg/fileutil/CopyFile at out := os.Create(dst)) closes via defer out.Close() inside callee copyFileContents — linter-safe (no manual close in opener fn)
• Zero manual .Close() without paired defer in pkg/

Re-verification of R20 trackers

sg14a1 (#33459 — silent syscall) — closed not_planned on 2026-05-27T06:03:46Z by 7-day expiry workflow. 10 sites confirmed unchanged via Grep. Re-filed as sg21a1.

sg19a1 (#35131 — manualmutexunlock) — closed state_reason: completed by @pelikhan on 2026-05-27T11:49:59Z. Confirmed:

• cgo.yml:1040 now lists -manualmutexunlock in LINTER_FLAGS
• Grep over pkg/ (excluding _test.go and linter testdata) shows ZERO non-deferred .Unlock() / .RUnlock() calls
• 16 R20 sites (miner.go:118/137/148, spinner.go:130/143/159/175/195, compile_watch.go:189/197, docker_images.go:104/149, virtual_fs.go:102, coordinator.go:115, virtual_fs_wasm.go:37) all now use defer mu.Unlock()

sg20a1 (#35130 — osexitinlibrary + rawloginlib) — closed state_reason: completed by @pelikhan on 2026-05-27T12:31:45Z. Confirmed cgo.yml:1040 lists both -osexitinlibrary -rawloginlib in LINTER_FLAGS.

sgbo1 (filepath.Join shape variants) — still defensible, no change (intentional per cli/git.go:303 trailing-slash and cli/fix_command.go:410 Separator-suffix prefix match).

Improvement Tasks Generated

Task 1 (High): Re-file silent syscall sg21a1 — eliminate 10 silent discards in pkg/cli

Issue Type: Symbol/Pattern Analysis (silent error discard)

Problem: 10 pkg/cli/ sites discard errors from os.Setenv (4) and os.Chdir (6). 3 of 4 os.Setenv sites store secrets; a silent failure presents the user with a success message while leaving the env var unset, causing opaque downstream auth failures.

Location(s): See sg21a1 issue body — table of 10 file:line entries.

Impact: Severity HIGH. Secret storage is silently broken on failure. Defer-cleanup os.Chdir failures leave the process in a removed directory.

Recommendation: Introduce cliutil.SetenvOrWarn(log, name, value) and cliutil.ChdirOrWarn(log, dir) helpers; replace each site. Optionally append -ossetenvlibrary to cgo.yml:1040 LINTER_FLAGS after the refactor lands.

Estimated Effort: Medium (~10 file:line replacements + 1 helper file + tests).

Task 2 (Low): Enforce fileclosenotdeferred analyzer (sg21a2) — zero-cost

Issue Type: CI Linter Enforcement

Problem: fileclosenotdeferred analyzer is registered (cmd/linters/main.go:24) but not in cgo.yml:1040 LINTER_FLAGS. Zero prod violations confirmed across 26 open sites.

Location(s): .github/workflows/cgo.yml:1040

Impact: Severity LOW (no current bug). Prevents future regressions to non-deferred file Close patterns.

Recommendation: Append -fileclosenotdeferred to the existing LINTER_FLAGS string.

-      run: make golint-custom LINTER_FLAGS="-errstringmatch -panicinlibrarycode -manualmutexunlock -osexitinlibrary -rawloginlib -test=false"
+      run: make golint-custom LINTER_FLAGS="-errstringmatch -panicinlibrarycode -manualmutexunlock -osexitinlibrary -rawloginlib -fileclosenotdeferred -test=false"

Estimated Effort: Small (1-line PR).

Task 3 (Medium): Refactor + enforce contextcancelnotdeferred (sg21a3)

Issue Type: Refactor + CI Linter Enforcement

Problem: 6 prod sites violate contextcancelnotdeferred. Risk of context cancel-funnel leak on early return or panic.

Location(s): See sg21a3 issue body — table of 4 mcp_inspect_mcp.go sites + 2 workflow loop-body sites.

Impact: Severity MEDIUM. Small runtime impact today, brittle to future early-returns added between WithTimeout and cancel().

Recommendation:

1. Wrap each mcp_inspect_mcp.go site in an IIFE with defer cancel() (preserves per-op timeout intent)
2. Add //nolint:contextcancelnotdeferred with comment to the 2 loop-body sites, OR extract loop bodies to helpers with defer cancel()
3. Append -contextcancelnotdeferred to cgo.yml:1040 LINTER_FLAGS

Estimated Effort: Medium (4 IIFE wraps + 2 nolint annotations + 1-line CI change).

Success Metrics

This Run

• Findings Generated: 6 (3 re-verifications + 3 new)
• Tasks Created: 3
• Issues Created: 3 (sg21a1, sg21a2, sg21a3)
• Files Analyzed: ~80 across 8 packages
• Success Score: 9/10

Reasoning for Score

• Findings Quality (4/4): 1 High-severity re-file (secret-storing setenv), 1 Medium refactor, 1 Low zero-cost enforcement — all actionable and well-scoped.
• Coverage (2/3): Touched 4 linter families (manualmutex, osexit, rawlog re-verify; fileclose, contextcancel new) across 8 packages. Did not run Serena find_symbol for deeper structural analysis this run.
• Task Generation (3/3): 3 distinct tasks, each with file:line precision, code diff or example, and validation checklist. Matched the target band.

Historical Context

Strategy Performance

• 7 of last 10 strategies have been reverify-plus-X variants (R13–R21). All scored 8 or 9.
• R21 marks the third consecutive successful application of the zero-violation-free-enforcement pattern (R19 panicinlibrarycode, R20 osexit+rawlog, R21 fileclosenotdeferred).
• The cgo.yml:1040 LINTER_FLAGS count has grown from 0 (pre-R14) → 1 (R14 errstringmatch) → 2 (R19 panicinlibrarycode) → 5 (R21 manualmutex+osexit+rawlog). On track for 6 with sg21a2.

Cumulative Statistics

• Total Runs: 21
• Total Findings: 181
• Total Tasks Generated: 46
• Average Success Score: 8.62/10
• Most Successful Strategy: reverify-plus-X family (mean 8.86 over 7 runs)

Recommendations

Immediate Actions

1. Land sg21a2 first (1-line CI change, zero prod risk) to bring enforced analyzers to 6.
2. Tackle sg21a3 mcp_inspect_mcp.go IIFE refactor next (small, isolated, follows sg19a1 precedent).
3. sg21a1 silent syscall refactor — biggest impact (secrets!) but largest scope; can be parallelized with above.

Long-term Improvements

• The 7-day create-issue.expires window is too short for High-severity tracking issues. sg14a1/#33459 expired without action; re-filing as sg21a1 is technically a regression in tracking visibility. Consider per-label expiry overrides (e.g., code-quality → 30d).
• 10 of 16 registered analyzers are still unenforced (ssljson, ctxbackground, errormessage, excessivefuncparams, largefunc, regexpcompileinfunction, ossetenvlibrary, uncheckedtypeassertion, contextcancelnotdeferred, fileclosenotdeferred). At ~1.5 analyzers/run, full enforcement is ~6 more runs out.
• The pattern of pelikhan manually closing sergo trackers as completed (within hours of the fix landing, well before the 7-day expiry) is a strong signal. Worth capturing as a positive validation channel.

Next Run Preview

Suggested Focus Areas

• Deep audit of regexpcompileinfunction (83 files match regexp.MustCompile/Compile, but most are package-level vars — need to discriminate var-vs-in-fn).
• Re-verify sg21a1/a2/a3 status (will likely all still be open after only 1 day of latency).
• Audit uncheckedtypeassertion (sg18a1 was previously fixed, but the linter is still unenforced — may be ready for zero-violation enforcement).

Strategy Evolution

• The reverify-plus-X pattern continues to be the highest-yield strategy. Next variant: reverify-plus-regexp-compile-in-function-audit.
• Consider adding a tracker-aging micro-step at the start of each run: list all open sergo-labeled issues and prioritize re-verifying those nearest the 7-day expiry mark to prevent silent disappearance.

References

• §26555755561
• Previous tracker #33459 (sg14a1, expired)
• Resolved #35130 (sg20a1, completed)
• Resolved #35131 (sg19a1, completed)

Generated by 🤖 Sergo - Serena Go Expert · opus47 24.3M · ◷

• expires on May 29, 2026, 5:16 AM UTC

[github-actions[bot]]

💥 KA-POW! 🦸♂️ The Smoke Test Agent has BLAZED through this dimension! WHOOSH! All systems nominal — Claude engine humming like a perfectly-tuned hyperdrive! ⚡🚀 Cue dramatic cape flutter 🦸♀️ THWIP! 💨 Until next sprint, true believers!

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• android.clients.google.com
• clients2.google.com
• contentautofill.googleapis.com
• safebrowsingohttpgateway.googleapis.com
• www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

💥 [THE END] — Illustrated by Smoke Claude · opus47 4.4M · ◷

[github-actions[bot]]

Ook! Smoke test agent was here. Tiny bot footprints. Big green vibes. 🐾

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• android.clients.google.com
• clients2.google.com
• contentautofill.googleapis.com
• safebrowsingohttpgateway.googleapis.com
• www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · gpt55 3.8M · ◷

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-05-29T05:16:38.169Z.

Closed by Workflow