[sergo] Sergo Report: 50-50 Registry-Refactor-Reverify + Manualpathconcat-First-Audit - 2026-08-23

[github-actions[bot]]

Executive summary

R61 found the linter registry has grown substantially since the last recorded run (R60, 2026-07-08): 42/43 → 67 registered analyzers, via a refactor that moved analyzer registration out of cmd/linters/main.go (now a two-line multichecker.Main(linters.All()...) shim) into a new pkg/linters/registry.go. This broke the old delta-detection heuristic (grep -c Analyzer main.go), which is now replaced with grep -c Analyzer pkg/linters/registry.go cross-checked against the doc.go header count.

All 196 historical sergo-labeled issues are closed (zero open pre-run) — the team keeps pace with findings. Cross-referencing every issue title against the 67 registered linters turned up exactly one analyzer that has never been the subject of a Sergo issue: manualpathconcat. Deep-diving it surfaced a genuine, evidence-backed coverage gap, filed as a new issue.

Tool & registry changes

• Serena LSP tool surface: unchanged (23 tools).
• Linter registry: 42/43 (R60) → 67 (R61), confirmed via pkg/linters/doc.go's "67 active analyzers" header and 67 linter subdirectories under pkg/linters/.
• Registration mechanism refactored: cmd/linters/main.go no longer contains per-analyzer wiring; it now delegates to pkg/linters.All() in pkg/linters/registry.go. The old grep -c Analyzer main.go delta detector is dead and has been replaced in memory.

Strategy: 50/50 split

Cached reuse (50%) — re-verify previously-filed, high-confidence bug classes rather than re-discovering them:

• Re-checked sg60a1 (writebytestring's isExactString compile-correctness bug from R60): landed correctly — isExactString now type-asserts *types.Basic on the raw (non-.Underlying()) type, correctly distinguishing string from named string types before emitting the io.WriteString autofix.
• Re-checked the sibling bug in stringbytesroundtrip (issue stringbytesroundtrip: isExactString is a no-op alias of isStringType — latent risk of the sg60a1 (writebytestring) bug class #54718, "isExactString is a no-op alias"): also fixed correctly — it resolves type aliases via types.Unalias before the same raw-type *types.Basic check, matching its own doc comment precisely.
• Both audits came back clean; no new finding in this vein this run.

New exploration (50%) — target completely unaudited territory:

• Enumerated all 67 registered linters and diffed against all 196 historical sergo issue titles.
• manualpathconcat (flags manual dir + "/" + file-style path concatenation, suggesting filepath.Join) had zero prior coverage — genuinely novel target.

Findings

manualpathconcat: the += (compound-assignment) form of manual path concatenation is structurally undetectable.

• matchSlashSeparator (pkg/linters/manualpathconcat/manualpathconcat.go:86-105) requires the left operand of the outer + to itself be a *ast.BinaryExpr ending in a "/" literal. This holds for X + "/" + Y chains, but x += "/" + y desugars to an AssignStmt{Tok: ADD_ASSIGN} whose RHS is only the two-operand expression "/" + y — there is no nested BinaryExpr for the matcher to find, because the implicit x + prefix from += never materializes in the AST.
• Confirmed a real production false negative: pkg/workflow/checkout_config_parser.go:316 — absPath += "/" + relPath — goes completely unflagged today.
• This is the mirror image of a previously-fixed sibling bug in stringsconcatloop (stringsconcatloop: ADD_ASSIGN-only matcher lets contributors bypass the lint rule with x = x + y — already happening in open P [Content truncated due to length] #49046), which originally matched only the ADD_ASSIGN form and missed plain +. Here the gap runs the opposite direction.
• manualpathconcat is not yet wired into .github/workflows/cgo.yml's LINTER_FLAGS, so this is a good time to close the gap before CI enforcement is turned on.

Task generated

1. Fix manualpathconcat's ADD_ASSIGN blind spot — add an *ast.AssignStmt case that recognizes x += "/" + y, reusing the existing isSlashLiteral helper against the RHS's X operand directly (rather than requiring it to be a nested BinaryExpr), with a new testdata case and re-audit of pkg/ for other +=-form manual joins. Effort: small, single-file.

Issue created

• manualpathconcat: += form of manual "/" path concatenation is never detected (labeled sergo, temporary_id: #54983)

Metrics

Metric	This run	Historical (61 runs)
Findings	3	411
Tasks created	1	110
Issues created	1	—
Open sergo issues pre-run	0 / 196	—
Success score	8/10	avg 8.75/10

Historical context (last 3 recorded strategies)

• R58 (2026-07-06): ctx-family FuncLit-boundary audit — execcommandwithoutcontext over-attributed outer context across closure boundaries (execcommandwithoutcontext: enclosing-scope walk crosses non-go/defer FuncLit boundaries — false positives + misleading fix (same [Content truncated due to length] #43683). Score 9.
• R59 (2026-07-07): syntactic stdlib-package-match regression sweep across all linters — found 5 holdouts still comparing ident.Name instead of using astutil.IsPkgSelector (Linter precision (regression): the syntactic stdlib-package-match migration never landed — 5 holdouts remain, 3 CI-enforced (#40 [Content truncated due to length] #43934, landed). Score 9.
• R60 (2026-07-08): 43rd-linter (writebytestring) audit — SuggestedFix emitted non-compiling code for named string types (#aw_sg60a1). Score 9.
• R61 (this run, 2026-08-23): registry-refactor detection + re-verification of R60/stringbytesroundtrip: isExactString is a no-op alias of isStringType — latent risk of the sg60a1 (writebytestring) bug class #54718 fixes (both clean) + first-ever audit of manualpathconcat, finding a real ADD_ASSIGN coverage gap. Score 8.

Recommendations & next-run focus (R62)

• Adopt grep -c Analyzer pkg/linters/registry.go (not main.go) as the linter-count delta detector going forward.
• If the registry is stable at 67, run a systematic sweep of newer linters (everything added since R60) for the same class of bug found this run: node-filter/pattern-set narrowness around alternate syntactic forms (ADD_ASSIGN, IncDecStmt, composite literals) that achieve the same semantic effect as the linter's primary target pattern but bypass the AST shape it matches on.
• Given the ~46-day gap between R60 and R61 memory entries despite the registry nearly doubling in that window, consider whether intermediate runs are landing in a different memory location — worth a quick sanity check next run if the gap recurs.

Generated by 🤖 Sergo - Serena Go Expert · agent · 155.1 AIC · ⌖ 9.88 AIC · ⊞ 6.8K · ◷

• expires on Aug 23, 2026, 8:09 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-24T04:09:02.297Z.

Closed by Workflow