[sergo] Sergo Report: REGISTRY-GAP-RECONCILE(43to64)+cachedpattern-ctxfamily-FuncLit-boundary-holdout-audit - 2026-08-14

[github-actions[bot]]

Overview

Run R61 opened with a ~5-week memory gap (last tracked run: R60, 2026-07-08). The linter registry grew from 43 to 64 analyzers in that window, so this run's first job was reconciling stale cached assumptions against current repo state before doing new analysis. Strategy: 50% cached (reapply the proven ctx-family FuncLit-boundary-holdout pattern from R58/R59 across the full, now much larger registry) / 50% new (full registry diff + reconciliation, since memory only knew about 43 linters).

Result: 1 new issue filed, 1 memory-gap reconciliation completed, 6 candidate linters reviewed and ruled out.

Key metrics

Metric	Value
Total runs (cumulative)	61
Total findings (cumulative)	413
Total tasks created (cumulative)	110
Avg success score	8.75
This run's success score	9
Registry size	64 analyzers (was 43 at last tracked run)
CI-enforced	46 / 64

Issue filed

httpnoctx: enclosing-scope walk crosses non-go/defer FuncLit boundaries — pkg/linters/httpnoctx/httpnoctx.go:146-158

hasContextInEnclosingFunc walks every lexically enclosing FuncDecl/FuncLit for a context.Context param and returns on the first hit, without stopping at a plain (non-go/defer) closure boundary. This is the exact bug class already found and fixed in every other ctx/scope-sensitive linter in the repo: execcommandwithoutcontext, timesleepnocontext, ctxbackground, panicinlibrarycode, wgdonenotdeferred, httprespbodyclose, seenmapbool. httpnoctx was the sole holdout never given the astutil.IsGoOrDeferClosure guard.

Impact: a synchronous callback closure (e.g. an http.HandlerFunc literal) with no context param of its own will incorrectly inherit an unrelated outer function's context.Context, producing a misleading "propagate context" suggestion when the correct fix is actually r.Context(). Currently latent — no http.NewRequest/Get/Post call sites exist under pkg/ today — but the fix is a direct ~4-line port of the already-landed pattern.

Full evidence and before/after fix

Before (httpnoctx.go:146-158):

func hasContextInEnclosingFunc(pass *analysis.Pass, cursor inspector.Cursor) bool {
	for enclosing := range cursor.Enclosing((*ast.FuncDecl)(nil), (*ast.FuncLit)(nil)) {
		fnType := astutil.EnclosingFuncType(enclosing.Node())
		if fnType == nil || fnType.Params == nil {
			continue
		}
		if _, ok := astutil.ContextParamName(pass, fnType); ok {
			return true
		}
	}
	return false
}

After (mirroring execcommandwithoutcontext.go:68-79):

for enclosing := range cursor.Enclosing((*ast.FuncDecl)(nil), (*ast.FuncLit)(nil)) {
	fnType := astutil.EnclosingFuncType(enclosing.Node())
	if fnType == nil {
		continue
	}
	if _, ok := astutil.ContextParamName(pass, fnType); ok {
		return true
	}
	if _, isFuncLit := enclosing.Node().(*ast.FuncLit); isFuncLit && !astutil.IsGoOrDeferClosure(enclosing) {
		return false
	}
}
return false

Evidence: pkg/linters/httpnoctx/testdata/src/httpnoctx/httpnoctx.go has zero FuncLit/closure test cases in either direction — the gap has no test coverage at all. Sibling linters execcommandwithoutcontext.go:68-79 and timesleepnocontext.go:59-70 carry the guard already.

Registry gap reconciliation

What changed since the last tracked run (R60 → R61)

• Registry detector changed: cmd/linters/main.go no longer lists Analyzer literally (now just multichecker.Main(linters.All()...)). New detector: allAnalyzers slice count in pkg/linters/registry.go.
• Registry grew 43 → 64 analyzers. pkg/linters/doc.go header count confirmed in sync (64 == 64).
• CI-enforcement list moved: it now lives only in .github/workflows/cgo.yml's LINTER_FLAGS (two occurrences: native + wasm builds), not in main.go. 46 of 64 registered analyzers are CI-enforced.
• gh api reconciliation against the sergo label found 2 real open issues (#52429 regexpdynamicpattern enforce-ready, #52428 hardcodedfilepath false-positive) plus 3 stray probeN-DELETE-ME issues (#52229-#52231) that are not Sergo findings — flagging as a repo hygiene item, not something this run created or should dedupe against.
• Confirmed ssljson's missing nolint wiring is not a bug: it validates JSON config files rather than per-line Go source, so the suppression mechanism doesn't apply there.

Candidates reviewed and ruled out

6 linters read in full, no finding filed

• httpstatuscode — heuristic-based design, no new bug found.
• stringsconcatloop — already correctly handles both assignment forms and is FuncLit-exempt.
• httprespbodyclose — already correctly FuncLit-scoped via separate analysis roots (fixed previously in httprespbodyclose: FuncDecl-only scope + FuncLit skip misses responses closed inside closures (goroutines/handlers) — false nega [Content truncated due to length] #43465).
• excessivefuncparams — correctly uses filecheck.ShouldSkipFilename (a stale memory note claiming otherwise was corrected).
• ssljson — see reconciliation note above; justified design difference, not a bug.
• ctxbackground / nilctxpassed — different (more conservative) design or don't perform enclosing-func walks at all; not the same bug shape.

Next-run focus (R62)

• Verify aw_httpctx1 (httpnoctx fix) landed.
• Sweep the newest linters (55th–64th in registry order) for the syntactic-stdlib-match and SuggestedFix compile-correctness bug classes — these haven't been probed yet at the new registry size.
• Consider a batched enforce-readiness issue for the 11 non-enforced linters with no open issue, if violation counts can be confirmed (this run's go build/go vet were blocked by sandbox approval gating, so all analysis was static/read-only — no linter binary was actually executed).

References:

• Sibling fixes this pattern mirrors: execcommandwithoutcontext (fix(execcommandwithoutcontext): stop enclosing-scope walk at non-go/defer FuncLit boundaries #43692/execcommandwithoutcontext: enclosing-scope walk crosses non-go/defer FuncLit boundaries — false positives + misleading fix (same [Content truncated due to length] #43683), timesleepnocontext (timesleepnocontext: stop crossing non-go/defer FuncLit boundaries when attributing time.Sleep #42946), ctxbackground (ctxbackground: fix false negative and unsafe autofix for closures #41187), wgdonenotdeferred (wgdonenotdeferred precision: non-deferred wg.Done() inside a goroutine launched in a loop escapes detection (FuncLit scope bound [Content truncated due to length] #40947), httprespbodyclose (httprespbodyclose: FuncDecl-only scope + FuncLit skip misses responses closed inside closures (goroutines/handlers) — false nega [Content truncated due to length] #43465), seenmapbool (fix(seenmapbool): eliminate duplicate diagnostics for set-maps in closures #40741)

Generated by 🤖 Sergo - Serena Go Expert · agent · 264.1 AIC · ⌖ 30.1 AIC · ⊞ 5.9K · ◷

• expires on Aug 14, 2026, 8:37 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Sergo - Serena Go Expert.

A newer discussion is available at Discussion #52827.