[sergo] Sergo Report: Gap-Recovery & Named-Type Message Audit - 2026-08-15

[github-actions[bot]]

Executive Summary

This run (R61) opened with a major memory-gap discovery: the pkg/linters/ registry grew from 43 to 64 analyzers (+21) since the last recorded Sergo memory update (R60, 2026-07-08), via the linter-miner daily automation, with issue numbers climbing from roughly #43465 to #52627 in between — meaning many runs happened without repo-memory being persisted. This run prioritized (1) reconciling all currently-open sergo-labeled issues against live code before doing any new exploration, and (2) a fresh finding in stringbytesroundtrip, following a strict 50/50 cached-reuse / new-exploration split. One new issue was filed; three existing open issues were verified still valid and were not re-filed.

Tool Updates

• Serena LSP tool list: stable at 23 tools (no interface change detected).
• pkg/linters/registry.go: 64 analyzers registered (was 43 at last recorded check). doc.go's "All 64 active analyzers" header was cross-checked line-by-line against the allAnalyzers slice and confirmed accurate — no doc-sync bug this run, despite that being a historically recurring bug class.
• internal/filecheck.ShouldSkipFilename now calls IsTestFile internally and is used uniformly across linters — this obsoletes the old suppression_enforce_gap memory pattern (previously: some linters were missing test-file skip checks). Memory updated to reflect this.

Strategy & Split (50/50)

Cached-reuse (50%): Pulled the 3 currently-open sergo issues via gh api .../issues?labels=sergo&state=open and re-read the exact flagged code paths to confirm each is still unfixed before deciding whether to act on them further:

• httpnoctx: enclosing-scope walk crosses non-go/defer FuncLit boundaries (same bug class already fixed in sibling ctx-family lint [Content truncated due to length] #52627 (httpnoctx) — confirmed still present. hasContextInEnclosingFunc iterates all enclosing FuncDecl/FuncLit ancestors via cursor.Enclosing without breaking at the nearest FuncLit boundary, unlike the corrected sibling execcommandwithoutcontext pattern (fixed under execcommandwithoutcontext: enclosing-scope walk crosses non-go/defer FuncLit boundaries — false positives + misleading fix (same [Content truncated due to length] #43683) and unlike this repo's own correctly-implemented stringsconcatloop.enclosingLoop / goroutinemissingrecover.containsRecoverCall. Valid, left open.
• regexpdynamicpattern: zero-violation, type-resolved linter ready for CI enforcement — missing from LINTER_FLAGS #52429 (regexpdynamicpattern) — confirmed code is clean and type-resolved; still just awaiting a CI LINTER_FLAGS wire-up. Valid, left open.
• hardcodedfilepath: Exported()-only const filter excludes same-package unexported constants, causing misleading 'extract new cons [Content truncated due to length] #52428 (hardcodedfilepath) — confirmed the Exported()-only filter in collectKnownPathConsts still excludes same-package unexported constants. Valid, left open.
• 3 unrelated probeN-DELETE-ME issues (probe3-DELETE-ME #52229-52231) identified as test artifacts, not real findings — ignored.

New exploration (50%): Read ~15 linter implementations not previously covered in recent memory (stringbytesroundtrip, mapclearloop, stringsconcatloop, regexpdynamicpattern, goroutinemissingrecover, nilctxpassed, internal/nolint, internal/coverage, httpnoctx, plus re-verifying writebytestring's prior fix) looking for the recurring exact-type-vs-Underlying() assignability bug class first surfaced in sg60a1.

Findings

New issue filed: stringbytesroundtrip's reportRedundantRoundTrip hardcodes the literal diagnostic text "string([]byte(...))" regardless of the actual outer/inner conversion's type names, because its type check (roundTripUnderlyingTypes) only compares .Underlying(). A round-trip built from named types (e.g. myString([]byte(ms))) is flagged with a message that doesn't match the source and implies both conversions can be bare-removed — which fails to compile for named types, per Go assignability rules. This is the same root-cause bug class as sg60a1 (writebytestring, already fixed via isExactString), but here it has no SuggestedFix to catch it at compile time, so it manifests purely as an inaccurate/misleading diagnostic message. Distinct from the already-closed #47704, which covered the other round-trip arm ([]byte(string(b)), a false-positive-verdict bug, not a message-accuracy bug). testdata/.../stringbytesroundtrip.go:30-36's badNamedTypes case only assigns the flagged expression to _, so this gap has no golden-file coverage.

Verified clean (no finding filed): mapclearloop (Go-version gating of the clear builtin — theoretical, non-actionable since this repo's go.mod already targets go1.26.5), stringsconcatloop (enclosingLoop correctly stops at FuncLit boundaries), regexpdynamicpattern (constant-pattern and package-identity detection both correct), goroutinemissingrecover (containsRecoverCall correctly FuncLit-scoped), nilctxpassed (correct variadic + exact-type nil/context handling), internal/nolint and internal/coverage (no defects found).

Generated Tasks

1. Fix stringbytesroundtrip.reportRedundantRoundTrip to use the actual outer/inner conversion type names in its message (mirroring writebytestring.isExactString), and add a named-outer-type testdata case. (New issue filed this run.)
2. Land a fix for httpnoctx: enclosing-scope walk crosses non-go/defer FuncLit boundaries (same bug class already fixed in sibling ctx-family lint [Content truncated due to length] #52627 (httpnoctx FuncLit-boundary crossing) using the same isGoOrDeferClosure-style guard already proven in execcommandwithoutcontext (execcommandwithoutcontext: enclosing-scope walk crosses non-go/defer FuncLit boundaries — false positives + misleading fix (same [Content truncated due to length] #43683).
3. Wire regexpdynamicpattern (regexpdynamicpattern: zero-violation, type-resolved linter ready for CI enforcement — missing from LINTER_FLAGS #52429) into .github/workflows/cgo.yml's LINTER_FLAGS — it is clean and CI-enforcement-ready.

Metrics

• Total Sergo runs: 61 (was 60)
• Total findings (cumulative): 416 (+8 this run)
• Total tasks generated (cumulative): 110 (+1 this run)
• Average success score: 8.74 (was 8.75)
• This run's success score: 8/10 — solid reconciliation + one well-evidenced new finding, docked slightly for the large unrecorded memory gap discovered at startup and for being unable to execute the linter binary in-sandbox to get live true-positive counts (static-analysis-only this run, consistent with sandbox constraints noted in prior runs).

Historical Context

The registry has nearly doubled in analyzer count since the last memory checkpoint (43→64), which strongly suggests several Sergo runs occurred in the interim without their strategy/stats being persisted back to memory/sergo. This run's memory writes prioritize correcting that drift (registry count, obsolete suppression_enforce_gap pattern, current open-issue state) within the 10KB total patch-size budget, using surgical edits and an append-only strategy log rather than full-file rewrites.

Recommendations & Next-Run Focus (R62)

• Re-verify this run's new issue and all 3 reconciled open issues are still accurate/unfixed at the next checkpoint.
• Prioritize auditing the ~21 linters added during the unrecorded gap for the same exact-type-vs-Underlying() assignability bug class (now confirmed to recur across at least two linters: writebytestring, stringbytesroundtrip).
• Consider whether repo-memory persistence itself needs a more robust checkpoint cadence, given how large a gap accumulated between R60 and R61.

Generated by 🤖 Sergo - Serena Go Expert · agent · 255 AIC · ⌖ 2.25 AIC · ⊞ 5.9K · ◷

• expires on Aug 15, 2026, 8:13 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Sergo - Serena Go Expert.

A newer discussion is available at Discussion #53032.