[sergo] Sergo Report: Registry-Jump-Reconcile-EnforceReadiness - 2026-08-04

[github-actions[bot]]

Run: §30878629010

Executive summary

The custom-linter registry jumped from 43 → 62 analyzers since the last recorded baseline (R60, 2026-07-08) — a bigger gap than any single prior run, and the registry mechanism itself was refactored along the way. All previously-filed sergo issues are closed, including for the two newest linters. This run reconciled that history, confirmed several prior fixes actually landed in code (not just closed-without-action), and found that 23 of the 62 registered linters are still absent from CI enforcement. One high-confidence batched issue was filed covering 4 of those 23 that are demonstrably clean and ready to enforce today.

Tool & infrastructure changes

• cmd/linters/main.go no longer enumerates analyzers individually — it now calls linters.All() from the new pkg/linters/registry.go. The old detection method (grep -c Analyzer main.go) is dead; the new source of truth is the doc.go bullet count cross-checked against the registry.go array (both agree at 62, no doc-drift this run).
• Serena MCP toolset unchanged: 23 tools stable.
• No missing tools or blocked dependencies this run.

Strategy: 50/50 split

• Cached (50%): Reused the repo's established "batched enforce-readiness" issue template (previously used in Enforce-readiness: three clean, type-resolved linters (bytesbufferstring, mapdeletecheck, ioutildeprecated) have zero production [Content truncated due to length] #45629, Enforce-readiness: three clean autofix linters (appendoneelement, timenowsub, stringsjoinone) have zero production violations — [Content truncated due to length] #47916, Enforce-readiness: contextcancelnotdeferred + wgdonenotdeferred are clean, type/AST-resolved, zero production violations #49710) — group multiple clean-but-unenforced linters into a single issue rather than filing near-duplicate reports.
• New exploration (50%): Applied the full known-bug-pattern checklist (syntactic pkg-match, FuncLit scope-boundary walks, SuggestedFix exact-type assignability, nolint/test-skip parity, node-filter narrowness) against the ~19 linters added since R60, and reconciled the entire sergo-labeled issue history via gh api rather than trusting local memory files alone.

Findings

Reconciliation: zero open sergo issues, prior fixes verified landed

gh api repos/github/gh-aw/issues?labels=sergo&state=open returned zero results — every issue up to and including #49902 (uncheckedflushreturn node-filter gap) and #49901 (walkfuncerrshadow migration debt) is closed. Spot-checked that closure reflects real fixes, not just closure:

• writebytestring: isExactString check present, wraps non-exact-string args with string(s) — sg60a1 fix landed.
• bytescomparestring: message no longer claims allocation; now "written the long way" — bytescomparestring (new 44th linter): the "allocates" premise is inaccurate under gc — string(a) == string(b) does NOT allocate [Content truncated due to length] #44484 landed.
• nilctxpassed: call.Ellipsis.IsValid() guard present — nilctxpassed: spread call f(nil...) to a variadic context.Context param is a false positive — nil variadic slice misreported as [Content truncated due to length] #45903 variadic-spread false positive fixed.
• stringbytesroundtrip: []byte(string(b)) arm now correctly labeled a "wasteful two-copy clone", not a false "redundant round-trip" — stringbytesroundtrip: the []byte(string(b)) arm mislabels the defensive-copy idiom as a "redundant round-trip" — a false-positiv [Content truncated due to length] #47704 fixed.
• hardcodedfilepath: format-verb regex now includes %x %t %c %g — hardcodedfilepath: hasFormatVerb verb-set too narrow — format-template paths using %x/%t/%c/%g escape exclusion (latent FP) #42174 fixed.
• logfatallibrary / rawloginlib: function sets (Fatal* vs Print*/Panic*) confirmed non-overlapping — logfatallibrary duplicates the already-CI-enforced rawloginlib — its entire detection surface (log.Fatal/Fatalf/Fatalln in libra [Content truncated due to length] #45379 resolved by design, not just closed.
• walkfuncerrshadow is already in the CI LINTER_FLAGS list, which corroborates that its migration debt (walkfuncerrshadow (61st linter): 10 production sites still shadow err/err — migration from ADR-49633 not done #49901: "10 sites still shadow err") must be resolved — otherwise CI would be failing on every build.

Non-obvious note for future runs: the local strategy history (sergo-strategies.jsonl) only had 3 entries (R58–R60) despite issue numbers jumping from #44187 to #49902 — clear evidence 15+ runs happened between recorded entries. The aggregate sergo-stats.json "last_run" date was similarly stale. Future runs should trust gh api issue history over local run counters when they disagree.

Enforce-readiness gap: 39/62 linters enforced in CI

.github/workflows/cgo.yml's lint-go job enforces 39 linters via LINTER_FLAGS (both the default and GOOS=js GOARCH=wasm steps). 23 registered linters are absent from that list. Of those 23, four were verified this run to be fully wired (type-resolved detection, internal/nolint + internal/filecheck support) with their previously-known bugs fixed and zero current production violations:

Linter	Prior bug (now fixed)	Production violations
uncheckedflushreturn (62nd, newest)	Missing DeferStmt in node filter	0 (2 .Flush() sites, both check the error)
bytescomparestring	Inaccurate "allocates" message	0
nilctxpassed	Variadic-spread false positive	0
stringbytesroundtrip	Defensive-copy mislabeled as redundant	0

Filed as a single batched issue (matching this repo's established pattern for grouping enforce-readiness findings).

Audited clean, no issue filed

• goroutinemissingrecover: correctly refuses to descend into nested FuncLits when searching for a top-level defer/recover() guard, and verifies recover via types.Builtin (not just identifier name) to avoid a user-shadowed-function false positive — textbook-correct scope handling.
• ctxbackground / deferinloop: both respect the FuncLit scope boundary correctly per the established scope_boundary_funclit pattern from prior runs.

Generated task

1 issue filed (see below) covering 4 linters as one enforce-readiness task — CI config change only, no source edits required, small effort.

Issues created

• Enforce-readiness: 4 clean, type-resolved linters have zero production violations — uncheckedflushreturn, bytescomparestring, ni [Content truncated due to length] #50178 — Enforce-readiness: 4 clean, type-resolved linters have zero production violations (uncheckedflushreturn, bytescomparestring, nilctxpassed, stringbytesroundtrip)

Metrics

• Findings this run: 8 (reconciliation + enforce-readiness gap + 4 linter-level verifications + 2 clean audits)
• Issues created: 1 (batched, 4 linters)
• Tasks generated: 1
• Success score: 9/10
• Cumulative: 61 runs, 416 findings, 110 tasks, avg success 8.75

Next-run focus (R62)

Probe the remaining 19 unenforced-and-unaudited linters for enforce-readiness or latent bugs: appendbytestring, excessivefuncparams, fileclosenotdeferred, httprespbodyclose, httpstatuscode, largefunc, lenstringzero, seenmapbool, sortslice, sprintferrdot, sprintferrorsnew, ssljson, stringsconcatloop, timesleepnocontext, errorfwrapv, errormessage. Also verify the 4 flags from sg61a1 actually landed in cgo.yml.

References:

• §30878629010

Generated by 🤖 Sergo - Serena Go Expert · agent · 234 AIC · ⌖ 31.8 AIC · ⊞ 6K · ◷

• expires on Aug 4, 2026, 9:03 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-05T05:03:47.966Z.

Closed by Workflow