[sergo] Sergo Report: REGISTRY-REFACTOR-DETECT+newexplore-not_planned-reconcile-audit - 2026-08-24

[github-actions[bot]]

Executive summary

R61 opened with a breaking-change surprise: the historical registry-delta detector (grep -c Analyzer cmd/linters/main.go) is dead. main.go is now a 14-line multichecker.Main(linters.All()...) wrapper; the analyzer registry lives in pkg/linters/registry.go's allAnalyzers slice, currently 67 entries (up from 43 at R60 — several batched merges happened between runs). doc.go + a new doc_sync_test.go now auto-enforce registry/doc/README parity, permanently closing the old "doc-sync gap" finding vein.

Strategy split: 50% cached-context reuse (loaded last 3 strategy entries, re-verified prior not_planned candidates against current source), 50% new exploration (registry-refactor detection, CI-enforcement-gap mapping, a meta-audit of the not_planned closure reason).

1 issue filed, 0 skipped as duplicates (zero open sergo issues pre-run).

Tool/registry updates

• Detector fixed: use pkg/linters/registry.go allAnalyzers count (67) going forward, not main.go grep.
• CI enforcement mapped: 52/67 linters gated in .github/workflows/cgo.yml (LINTER_FLAGS, -test=false); 15 not enforced (see details).

Not CI-enforced (15) — probe targets for future runs

errorfwrapv, errormessage, excessivefuncparams, generatedyamlheredoc, hardcodedfilepath, httprespbodyclose, httpstatuscode, largefunc, lenstringzero, manualpathconcat, packagelevelmutableslicemap, seenmapbool, sprintferrdot, ssljson, stringsconcatloop

Findings

1. [filed] ssljson.ValidateDoc missing dup-ID + scene_id graph-integrity checks — the SSL Pass-4 spec (.github/skills/ssl/ssl.json) requires unique IDs and full graph integrity; ValidateDoc (ssljson.go:98-158) never detects duplicate scene/step IDs (map silently overwrites) and never validates step.SceneID against the scene set (field decoded, never read). See filed issue for full evidence.
2. [re-verified, already fixed] httpstatuscode (httpstatuscode: context detection gates on hardcoded identifier spellings (status/statusCode/.StatusCode), not on type — false n [Content truncated due to length] #42004: type-resolved via types.Named, no longer pure identifier matching) and manualmutexunlock (manualmutexunlock false negative: distinct struct instances sharing a mutex field collapse to one tracking key (Selections.Obj() [Content truncated due to length] #41376: mutexKey{base,field} composite key present) — both not_planned-closed issues describe bugs that genuinely no longer exist in current source.
3. [audited clean, no action] generatedyamlheredoc, manualpathconcat, packagelevelmutableslicemap, walkfuncerrshadow, jsonmarshalignoredeerror, lenstringsplit — read in full, no defects found.

Meta-finding: state_reason: not_planned is not a reliable proxy for "handled"

About a third of recent sergo-labeled issues close with not_planned. This reason is used for two very different situations:

• Genuinely rejected/superseded findings (fine to trust as closed).
• Issues auto-expired by the repo's bot (gh-aw-expires: marker, "Issue Monster" auto-triage) without ever being fixed — confirmed via issue timelines for ssljson (29th linter) graph-integrity gap: logic-step scene_id is parsed but never validated — orphan steps pass silently #39493/ssljson precision: duplicate scene/step IDs are silently deduped by map[string]bool — the spec's "unique IDs" Pass-4 rule is uni [Content truncated due to length] #39494, which describe the exact ssljson gap re-filed today.

Spot-checking in both directions this run: httpstatuscode/manualmutexunlock's not_planned closures turned out to be legitimate (bug fixed elsewhere), while ssljson's turned out to be expiration-without-fix. Conclusion: not_planned closures need individual source re-verification, not a blanket trust in either direction — this refines the existing phantom_reconcile pattern, which only covered the opposite failure mode (landed-but-still-open).

Generated tasks

1. ssljson.go: add duplicate-ID tracking to the sceneIDs/stepIDs build loops (report on first repeat) and a new Rule 8 validating step.SceneID resolves via setutil.Contains(sceneIDs, ...). Small, single-file + testdata change. Filed as issue (aw_sg61a1).

Metrics

• Total runs: 61 (was 60)
• Total findings: 413 (was 408)
• Total tasks: 110 (was 109)
• This run success score: 8/10 (strong single well-evidenced finding; docked slightly for spending significant budget re-verifying already-fixed candidates before landing on the fresh one)
• Running avg success score: 8.74

Historical context

R58-R60 exhausted the ctx-family FuncLit-boundary vein and the syntactic-stdlib-match vein (both fully migrated/fixed or filed). R60's writebytestring SuggestedFix-correctness finding (aw_sg60a1) status is unconfirmed this run — worth a landed-check next time. R61's registry jump (43→67) suggests multiple linter-adding PRs merged in the ~7 weeks since R60; no per-linter changelog was available to attribute which merge added which analyzer.

Recommendations / next-run focus

• Re-verify aw_sg60a1 (writebytestring) landed.
• Continue the not_planned individual re-verification queue: nolint-suppression parity gap: 5 linters still have no (nolint/redacted) support, blocking CI enforcement #41844/nolint parity gap: 4 non-enforced context-family linters have no internal/nolint suppression (execcommandwithoutcontext, ctxback [Content truncated due to length] #41377 (nolint-suppression parity), panicinlibrarycode: init() and documented-contract exemptions cross FuncLit boundaries — false negatives for panics in nested cl [Content truncated due to length] #41606 (panicinlibrarycode FuncLit boundary), ctxbackground: enclosing-scope walk only inspects *ast.FuncDecl, skipping FuncLit boundaries — false negative for closures with [Content truncated due to length] #41164 (ctxbackground FuncLit boundary), wgdonenotdeferred precision: non-deferred wg.Done() inside a goroutine launched in a loop escapes detection (FuncLit scope bound [Content truncated due to length] #40947 (wgdonenotdeferred FuncLit-in-loop), rawloginlib precision: isRawLog matches the identifier name "log" syntactically — shadowing FP and alias-import FN in a CI-enfor [Content truncated due to length] #39981/regexpcompileinfunction precision: isRegexpCompileCall matches the identifier name "regexp" syntactically — alias import (re "re [Content truncated due to length] #39733 (alias-import gaps in rawloginlib/regexpcompileinfunction).
• With 24 newly-registered analyzers since R60 unaudited, next run should prioritize a first-pass sweep of whichever of the 15 not-CI-enforced linters haven't been read yet, plus identify what the 24 new analyzers actually are (registry.go diff against this run's file would need a non-shallow clone or a stored list — this run stored the full 67-name list is not persisted verbatim due to the 10KB memory patch cap; only the not-enforced-15 subset was persisted).

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · 215.1 AIC · ⌖ 7.47 AIC · ⊞ 6.8K · ◷

• expires on Aug 24, 2026, 8:16 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-25T04:16:22.184Z.

Closed by Workflow