[sergo] Sergo Report: STABLE-67-newexplore-CI-enforcement-guard-cross-cutting-audit - 2026-08-26

[github-actions[bot]]

Overview

R61. Registry relocated from cmd/linters/main.go to pkg/linters/registry.go but stayed STABLE at 67 analyzers (no delta since R60's 43→ now 67, count detector updated accordingly). doc.go and README both match the registry — no doc-sync drift. Zero open sergo-labeled issues going into this run. Since nearly all 67 linters have already been individually audited by prior runs, this run pivoted to a cross-cutting CI-enforcement-guard audit rather than another single-linter bug hunt, and found a real one: a native/wasm enforcement asymmetry that the guard built to prevent exactly this kind of drift cannot detect.

Key finding — 1 issue filed

[#aw_sg61a1] contextcancelnotdeferred enforced on native CI, absent from wasm LINTER_FLAGS — .github/workflows/cgo.yml lints twice (native line 1457, wasm line 1460 scoped to 5 packages). The two flag strings are otherwise identical, but -contextcancelnotdeferred only appears on the native line. TestCIEnforcedLintersMatchRegistry in doc_sync_test.go regex-matches both LINTER_FLAGS lines and unions every flag into one set, so an analyzer enforced on only one target still passes the check — the exact guard that closed #55628 (registry/CI drift) has a blind spot for per-target asymmetry. Currently latent (no live *_wasm.go violations found), but any future wasm-path cancellable-context leak would pass CI silently.

Full analysis detail

Strategy split (50/50 rule): New-exploration selected. Rationale: cross-referencing issue history showed the per-linter "probe for bugs" vein for most of the 67 registered analyzers has already been exhausted across R42–R60; the highest-value unexplored surface was the CI-enforcement guard machinery itself rather than another individual analyzer.

Investigated and correctly rejected: A shallow grep suggested contextcancelnotdeferred, fileclosenotdeferred, and manualmutexunlock might lack nolint suppression wiring. Reading pkg/linters/internal/resourcetracker/resourcetracker.go in full showed all three share this framework, which wires internal/nolint centrally (line 184) and correctly stops AST descent at FuncLit boundaries (matching the established-correct deferinloop pattern). Abandoned as a false lead rather than filed.

Also audited clean: goroutinemissingrecover (219 lines) — type-resolved via pass.TypesInfo, correct FuncLit handling on both the goroutine-detection and recover-detection sides. No bug found.

Sandbox note: this environment has no Go/Node installed, so every LSP-backed Serena tool (find_symbol, find_referencing_symbols, get_diagnostics_for_file, rename_symbol, find_declaration, find_implementations, safe_delete_symbol, replace_in_files) failed. get_diagnostics_for_file explicitly instructs "Stop, do not attempt workarounds" on LSP failure — honored, fell back to Grep/Read for all analysis instead of installing toolchains.

Metrics

Metric	Value
Registry size	67 analyzers (relocated to pkg/linters/registry.go)
Findings this run	5 (1 filed, 1 false lead rejected, 1 clean audit, plus doc-sync + registry-drift checks)
Issues created	1 (sg61a1)
Success score	8/10
Total runs (all-time)	61
Total findings (all-time)	413
Total tasks (all-time)	110
Avg success score (all-time)	8.74

Historical context

This continues a run of clean registry states (STABLE at 42 for R58–R59, +1 new linter at R60, now relocated-but-STABLE at 67 for R61) with zero doc-sync drift. The CI-enforcement-guard blind spot found here is a new pattern class (ci_flag_union_blind_spot) distinct from previously catalogued classes like scope_boundary_funclit, syntactic_stdlib_match, and suppression_enforce_gap.

Next-run focus (R62)

1. Re-verify sg61a1 landed (native/wasm LINTER_FLAGS parity + guard hardening).
2. Probe other CI-enforcement checks for the same union-vs-per-target blind spot — any workflow step that repeats a flag list across a differently-scoped build target is a candidate.
3. Watch for a 68th registered linter.

References:

• §32928475496

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · 297.7 AIC · ⌖ 8.68 AIC · ⊞ 6.8K · ◷

• expires on Aug 26, 2026, 8:20 PM UTC-08:00