[sergo] Sergo Report: Registry Δ38→39 sprintfint Audit + WASM Build-Tag Blind Spot - 2026-07-01

[github-actions[bot]]

Executive summary

Run R53 detected a registry delta (custom analyzers 38 → 39; grep -c Analyzer cmd/linters/main.go = 39) and deep-audited the new 39th analyzer sprintfint. It is precision-clean. The audit then surfaced a novel, systemic finding: build-constrained (*_wasm.go) files escape all 39 custom analyzers, and this has already let a real sprintfint violation drift into console_wasm.go. Two distinct, evidence-backed issues were filed.

Tool / registry updates

• Serena LSP: 23 tools, stable (no change).
• Custom analyzer registry: 38 → 39. New 39th = sprintfint (pkg/linters/sprintfint/), flags fmt.Sprintf("%d", x) for exact-int x → suggests strconv.Itoa(x) with autofix.
• Reconcile: R52's enforce-batch errortypeassertion (new 38th linter) + execcommandwithoutcontext enforce-readiness: zero production violations, add both to the [Content truncated due to length] #42416 (errortypeassertion + execcommandwithoutcontext) landed and closed; cgo.yml:1208 LINTER_FLAGS now carries 16 analyzers. R51 hardcodedfilepath: hasFormatVerb verb-set too narrow — format-template paths using %x/%t/%c/%g escape exclusion (latent FP) #42174 and httpstatuscode: context detection gates on hardcoded identifier spellings (status/statusCode/.StatusCode), not on type — false n [Content truncated due to length] #42004 remain open. doc.go still says "30 active" (tracked by open doc-sync: pkg/linters/doc.go says "29 active analyzers" but 30 are registered — list omits hardcodedfilepath and sprintferrdot #40436).

Strategy — strict 50/50 split

Cached component (proven: registry-delta detection + phantom-reconcile)

Reused the highest-success recurring play (avg score 8.78 over 52 runs): detect a new linter via grep -c Analyzer vs the cached count, fresh-audit it for the recurring precision families (syntactic_stdlib_match, pattern_set_too_narrow, suppression/test-skip parity), and reconcile prior issues against live gh api state + code grep. Outcome as expected: delta found (39), new linter audited CLEAN, #42416 confirmed landed.

New-exploration component (novel: build-constraint coverage)

Rather than stop at the single-file audit, probed how the driver loads packages. multichecker.Main over ./cmd/... ./pkg/... under default GOOS with no -tags never loads //go:build js || wasm files — an angle no prior run explored. This produced the systemic blind-spot finding, corroborated by a concrete drift between console.go and console_wasm.go.

Run targets: ≥1 clean new-linter audit · ≥1 novel systemic finding · 1–2 precise issues, zero duplicates. All met.

Findings

1. sprintfint precision — CLEAN. Type-resolved package identity (astutil.IsPkgSelector(pass, sel, "fmt"), :58), exact types.Typ[types.Int] gate (:77, excludes int64/uint/named-int for autofix compile-safety), full suppression parity (nolint :33/:49 + filecheck.IsTestFile :46). Untyped literal 42 correctly resolves to int (fixture badLiteral). No FP/FN in the recurring families.

2. sprintfint is enforce-ready (default build). The only default-build Sprintf("%d", ...) site is stringutil.go:59, whose arg is a multi-type type-switch variable (case int, int64, uint64:) with static type any — correctly not flagged. Zero default-build diagnostics. → filed as an enforce-readiness issue (welcomed precedent: #39324/#39016/#38282/#42416).

3. NOVEL — WASM build-tag blind spot. ~20 *_wasm.go production files (in console, workflow, parser, styles, tty) are invisible to all 39 analyzers. Proof: console.go:110 uses strconv.Itoa(maxLineNum) (already converted) while its //go:build js || wasm sibling console_wasm.go:41 still uses fmt.Sprintf("%d", maxLineNum) — maxLineNum is int, so an exact sprintfint true-positive that the linter never sees.

Generated tasks / issues

#	temp id	Type	Scope	Effort
1	#42644	Enforce-readiness	Add -sprintfint to cgo.yml:1208 (0 default-build violations)	XS
2	#42645	CI coverage / precision	Fix console_wasm.go:41 drift + add a WASM-targeted lint pass	S–M

Metrics

• Registry delta correctly detected (38→39); new linter audited; 0 false findings.
• Findings: 6 · Issues created: 2 (0 duplicates) · Self-scored success: 9/10.
• Aggregate: 53 runs, avg success 8.79.

Historical context

Continues the per-run registry-delta cadence (R50 httpstatuscode, R51 osgetenvlibrary, R52 errortypeassertion, R53 sprintfint). The build_tag_blind_spot pattern is new to the playbook and now recorded for R54+ (probe build-tagged siblings for drift vs their default-build counterparts).

Next-run focus (R54)

Watch for a 40th analyzer; reconcile #42644/#42645; apply the new build_tag_blind_spot probe to _windows.go/_darwin.go siblings; revisit never-deep-audited seenmapbool/errstringmatch/sprintferrdot.

References:

• §28495006831

Generated by 🤖 Sergo - Serena Go Expert · 252.6 AIC · ⌖ 13.6 AIC · ⊞ 5.9K · ◷

• expires on Jul 1, 2026, 9:22 PM UTC-08:00