[sergo] Sergo Report: DELTA-43to48 New-Linter Audit + Cross-Linter Overlap Detection - 2026-07-14

[github-actions[bot]]

Executive summary

Run R61 detected a large registry jump — the custom analyzer count went from 43 → 48 (+5 linters) since R60. Prior finding sg60a1 (writebytestring autofix compile-correctness) landed and closed as #44187. This run audited the freshest un-analyzed additions and surfaced a cross-linter redundancy: the new logfatallibrary analyzer is a strict subset of the already-CI-enforced rawloginlib. One issue filed (#45379).

Tool / registry updates

• Serena LSP: 23 tools, stable (no delta vs cached snapshot).
• Custom analyzer registry: grep -c Analyzer cmd/linters/main.go = 48 (was 43 at R60). Net +5: bytesbufferstring, bytescomparestring, logfatallibrary, ioutildeprecated, stringscountcontains.
• doc.go drift: header says "44 active analyzers" but 48 are registered — a known low-value drift class (recently filed & closed as doc-sync: pkg/linters/doc.go says "44 active analyzers" but 45 are registered — the list omits stringscountcontains #45185); intentionally skipped as noise.

Strategy — 50/50 split

Cached component (proven vein): new-linter audit on the registry delta, applying the accumulated FP/FN pattern lenses (syntactic-pkg-match, FuncLit-boundary, SuggestedFix compile-correctness + RWSF-parity, pattern-set narrowness, enforce-readiness). This vein produced the last several accepted issues (#44187, #43934, #43683).

New exploration component: cross-linter overlap detection — a novel lens asking not "is linter X correct in isolation?" but "does X's detection set overlap another already-enforced linter?" This surfaced the flagship finding, which single-linter audits would have missed.

Run targets: ≥5 evidence-backed findings; ≥1 distinct, non-duplicate, actionable issue; reconcile all open sergo issues first.

Pre-run reconciliation

• sg60a1 → writebytestring (new 43rd linter): autofix emits non-compiling io.WriteString(w, s) for named string types + missing RunWithSugg [Content truncated due to length] #44187 CLOSED (landed).
• 2 open sergo issues (not duplicated): Enforce-readiness: strings-contains-family linters are clean — add stringsindexcontains to CI (0 violations); stringscountcontai [Content truncated due to length] #45186 (strings-contains-family enforce-readiness), Autofix import robustness: sprintfint/writebytestring/bytescomparestring key import-presence on the path but emit a hardcoded pa [Content truncated due to length] #45037 (autofix import-robustness for sprintfint/writebytestring/bytescomparestring).

Findings

Flagship — logfatallibrary ⊂ CI-enforced rawloginlib (filed #45379). rawloginlib.rawLogFuncs already includes Fatal/Fatalf/Fatalln (rawloginlib.go:26-30) and is enforced in CI (cgo.yml:1208, :1211). The new logfatallibrary targets exactly that subset with identical gating (IsPkgSelector "log", same /cmd/+/main exemption, same test-skip). Consequence: zero added coverage; double-reporting + dual //nolint if enforced. 0 production log.Fatal* sites exist in pkg/ today.

New-linter audit detail (4 linters reviewed)

Linter	Verdict	Notes
logfatallibrary	redundant	strict subset of enforced rawloginlib; see flagship finding
bytesbufferstring	clean	value-receiver-only (excludes *bytes.Buffer — nil-safe reasoning is sound); type-resolved; rewrite buf.String() adds no import; RWSF-golden-verified
ioutildeprecated	clean, enforce-ready	type-resolved qualified and dot-import handling; complete 8/8 io/ioutil identifier map; no autofix (no compile risk); 0 prod ioutil usages
bytescomparestring	prior issues	premise (#44484), import robustness (#45037) already cover it

Latent FN (both log linters): neither rawloginlib nor logfatallibrary catches *log.Logger instance calls (logger.Fatal(...) from log.New(...)), which carry the same os.Exit(1) harm. 0 prod sites → latent; noted for post-partition follow-up.

Generated task

Partition rawloginlib / logfatallibrary so each owns a disjoint, correctly-messaged slice. Preferred: remove Fatal/Fatalf/Fatalln from rawLogFuncs, then enforce logfatallibrary (which carries the accurate "return errors / avoid implicit os.Exit" remediation). Alternative: drop logfatallibrary from the registry and fold its wording into rawloginlib. Effort: small. Full problem statement, evidence table, and validation checklist are in #45379.

Metrics

Metric	Value
Run	R61
Registry delta	43 → 48 (+5)
Findings	7
Issues filed	1 (#45379)
Duplicates skipped	overlap-vein confirmed non-duplicate vs #39981/#45186/#45037
Success score (self)	9 / 10
Cumulative runs / findings / tasks	61 / 415 / 110

Historical context

The new-linter-audit vein remains highly productive (last 3 issues all landed/closed: #44187, #43934, #43683). R61 adds a reusable lens — subset-of-an-already-enforced-linter = redundancy — that complements the existing single-linter correctness lenses. IsPkgSelector type-resolution continues to prove out across every new linter (no syntactic-pkg-match regressions this run).

Recommendations & next-run focus (R62)

1. Watch for the 49th analyzer (grep -c Analyzer cmd/linters/main.go).
2. Re-verify #45379 landed; reconcile open enforce-readiness issues (Enforce-readiness: strings-contains-family linters are clean — add stringsindexcontains to CI (0 violations); stringscountcontai [Content truncated due to length] #45186, Autofix import robustness: sprintfint/writebytestring/bytescomparestring key import-presence on the path but emit a hardcoded pa [Content truncated due to length] #45037).
3. Post-partition, revisit ioutildeprecated + logfatallibrary enforce-readiness (both 0-violation clean).
4. Probe rawloginlib's Print*/Panic* remediation-message accuracy (the "use pkg/logger" advice is weak for Panic).

References:

• §29306333935
• §29224842172

Generated by 🤖 Sergo - Serena Go Expert · 312.4 AIC · ⌖ 14 AIC · ⊞ 5.8K · ◷

• expires on Jul 14, 2026, 8:49 PM UTC-08:00