[sergo] Sergo Report: Cached-Reuse Enforce-Readiness + Registry Architecture Audit - 2026-08-02

[github-actions[bot]]

Executive Summary

This run (R61) surfaced a significant ~3-4 week gap in Sergo's own memory (last snapshot 2026-07-08, this run 2026-08-02) coinciding with a real architecture change in the linter registry. The core deliverable is a bundled enforce-readiness issue for two already-clean, currently-unenforced custom linters (contextcancelnotdeferred, wgdonenotdeferred), backed by an exhaustive audit confirming several previously-recurring bug classes remain fully fixed across the (now much larger) analyzer set.

Strategy split (50/50)

• Cached/proven half: reused the historically effective "re-audit known recurring bug classes across all linters" strategy (syntactic_stdlib_match, scope_boundary_funclit, suppression_enforce_gap, doc_sync gaps) — all previously tracked in sergo-stats.json patterns.
• New-exploration half: the tool/registry delta discovery itself was novel this run — the old detection heuristic (grep -c Analyzer cmd/linters/main.go) silently broke due to a refactor, so diagnosing that and re-deriving ground truth was unplanned exploration.

Tool & Registry Updates

• Architecture change: cmd/linters/main.go no longer lists analyzers directly. It's now just:

  func main() { multichecker.Main(linters.All()...) }

  The canonical list moved to pkg/linters/registry.go (var allAnalyzers = []*analysis.Analyzer{...} + func All()).
• Registry delta: 43 → 60 analyzers (+17) since the last recorded snapshot (R60, 2026-07-08). New: appendoneelement, bytesbufferstring, bytescomparestring, goroutinemissingrecover, hardcodedfilepath, ioutildeprecated, logfatallibrary, mapclearloop, mapdeletecheck, nilctxpassed, sprintfbool, stringbytesroundtrip, stringscountcontains, stringsindexhasprefix, stringsjoinone, timenowsub, trimleftright.
• CI enforcement: 33 of 60 analyzers are enforced in .github/workflows/cgo.yml (LINTER_FLAGS at line 1362, plus a second wasm-scoped gate at line 1365 covering ./pkg/console ./pkg/parser ./pkg/styles ./pkg/tty ./pkg/workflow).
• New detector going forward: since the main.go grep is dead, use pkg/linters/doc.go's "All NN active analyzers" header or the length of registry.go's allAnalyzers slice.

Why this matters (memory-gap note)

The cached memory (sergo-tools-list.json, sergo-stats.json) was last updated 2026-07-08 but this run is dated 2026-08-02 — a gap of roughly 3-4 weeks during which at least one architecture change and 17 new linters landed without a corresponding Sergo memory update. This suggests either skipped/failed runs or a memory-persistence issue in that window. Recommend checking whether scheduled Sergo runs executed normally during that period.

Findings

1. Two ready-to-enforce, zero-violation linters (primary finding, issue filed)

contextcancelnotdeferred (pkg/linters/contextcancelnotdeferred/contextcancelnotdeferred.go):

• Type-resolved via astutil.IsPkgSelector(pass, sel, "context") (line 152) — immune to the syntactic stdlib-match regression class fixed by Linter precision (regression): the syntactic stdlib-package-match migration never landed — 5 holdouts remain, 3 CI-enforced (#40 [Content truncated due to length] #43934.
• Correctly stops at *ast.FuncLit boundaries (line 90-92) — immune to the ancestor-walk-crosses-closures class fixed by timesleepnocontext: enclosing-scope walk crosses arbitrary FuncLit boundaries — false positives + misleading fix for request/cal [Content truncated due to length] #42901/execcommandwithoutcontext: enclosing-scope walk crosses non-go/defer FuncLit boundaries — false positives + misleading fix (same [Content truncated due to length] #43683.
• Uses filecheck.ShouldSkipFilename (line 64), which skips both test and generated files — the common ctx, cancel := context.WithCancel(...); cancel() test idiom is filtered at the file level.
• Reviewed ~20 production context.With{Cancel,Timeout,Deadline} call sites across pkg/cli, pkg/workflow, pkg/modelsdev: all either defer immediately or intentionally return the CancelFunc to the caller (verified this pattern is correctly not flagged).

wgdonenotdeferred (pkg/linters/wgdonenotdeferred/wgdonenotdeferred.go):

• FuncLit-boundary bug (prior wgdonenotdeferred precision: non-deferred wg.Done() inside a goroutine launched in a loop escapes detection (FuncLit scope bound [Content truncated due to length] #40947) confirmed fixed.
• Only 2 production sync.WaitGroup.Done() sites in the whole tree (pkg/console/spinner.go:193, pkg/cli/forecast_compute.go:233), both already deferred.

Both are correctness-clean and violation-free — safe, low-effort additions to cgo.yml's enforced set. Filed as a single bundled issue (see Tasks below).

2. Recurring bug classes re-verified as fully closed (negative/confirmatory audit)

• syntactic_stdlib_match (raw ident.Name == "pkg" instead of type-resolved matching): re-checked sortslice, ioutildeprecated, hardcodedfilepath, timenowsub, strconvparseignorederror, timeafterleak, fileclosenotdeferred — all now use types.PkgName/astutil.IsPkgSelector. No holdouts found this run.
• scope_boundary_funclit (ancestor walks crossing closure boundaries): re-checked httprespbodyclose (prior httprespbodyclose: FuncDecl-only scope + FuncLit skip misses responses closed inside closures (goroutines/handlers) — false nega [Content truncated due to length] #43465, confirmed fixed — nodeFilter now treats FuncDecl and FuncLit as independent roots and stops recursion at nested FuncLits).
• suppression_enforce_gap (missing nolint/test-skip wiring, prior gap in largefunc/excessivefuncparams): confirmed both now wire nolint.HasDirectiveForLinter and filecheck.ShouldSkipFilename correctly.
• doc-sync gap (prior doc-sync guard is incomplete: {registry, spec_test} and {doc.go, README} are two disconnected clusters — a linter present in cod [Content truncated due to length] #47190 class): pkg/linters/doc_sync_test.go now comprehensively cross-validates linters.All() registry vs. doc.go bullets vs. README.md table vs. spec_test.go — this gap is closed.

3. Previously-fixed linter re-confirmed clean: writebytestring

The R60 finding (isStringType matching named string types when io.WriteString needs an exact string, causing a non-compiling SuggestedFix) was re-read this run: the fix is in place — isExactString(t types.Type) bool correctly checks *types.Basic with Kind() == types.String, and buildStringExpr wraps named types in string(...). No further action needed. (Note: did not re-run gh api to confirm issue #aw_sg60a1 is formally closed — flagged as a to-do for next run.)

Tasks Generated

1. Add contextcancelnotdeferred and wgdonenotdeferred to CI enforcement (issue filed, label sergo)
   • Before: both linters exist, are correctness-clean, and have zero production violations, but are absent from cgo.yml's LINTER_FLAGS.
   • After: both flags added at cgo.yml:1362; wgdonenotdeferred also added at cgo.yml:1365 (covers pkg/console, its only prod hit outside pkg/cli).
   • Validation: make golint-custom with new flags against ./... returns zero findings before merging the CI change.
   • Effort: Small (CI config only).

Metrics

• Findings this run: 5 (1 primary actionable + 4 confirmatory/negative audits)
• Issues created: 1 (bundled, 2 linters)
• Success score: 8/10 (docked slightly for not completing the gh api reconcile pass and leaving seenmapbool partially audited)
• Total historical: 61 runs, 413 findings, 110 tasks, avg success score 8.74

Historical Context

• sergo-stats.json's patterns dict now records 8 recurring bug classes; this run's audit touched syntactic_stdlib_match, scope_boundary_funclit, suppression_enforce_gap, and enforce_readiness — all with clean results except the new enforce-readiness opportunity.
• The ci_enforce_14 field (stale, actually 33 enforced) has been corrected to ci_enforce_33 in memory with the current accurate list.
• Memory gap noted above should be investigated — if it recurs, historical trend data (avg success score, pattern recurrence rates) becomes unreliable.

Recommendations

1. Merge the filed CI-enforcement issue (small, safe change).
2. Investigate the ~3-4 week gap in Sergo's own run cadence/memory persistence.
3. Re-run gh api repos/OWNER/REPO/issues?labels=sergo&state=all reconciliation at the start of the next run (skipped this run due to sandbox friction) to confirm prior issues (especially #aw_sg60a1) have actually landed, not just been filed.

Next-Run Focus (R62)

• Reconcile all open sergo-labeled issues via gh api first.
• Individually audit the 17 linters new since R60 for enforce-readiness and the recurring bug classes (only ioutildeprecated, hardcodedfilepath, timenowsub were spot-checked this run).
• Finish the seenmapbool production-violation audit (left incomplete this run).
• Probe still-unenforced linters: sprintferrdot, sprintferrorsnew, lenstringzero, errorfwrapv, excessivefuncparams, largefunc, deferinloop, errormessage.

Generated by 🤖 Sergo - Serena Go Expert · agent · 244.4 AIC · ⌖ 14.4 AIC · ⊞ 6K · ◷

• expires on Aug 2, 2026, 9:05 PM UTC-08:00