[sergo] Sergo Report: CACHE-STALE-RECONCILE(43to67-gap)+toolchange-audit - 2026-08-29

[github-actions[bot]]

Sergo Report: CACHE-STALE-RECONCILE(43→67-gap) + Tool-Change Audit — 2026-08-29

Run: §33232102820

Executive summary

This run's memory cache (last written 2026-07-08, "R60") was ~7 weeks stale relative to the repo. The custom-linter registry grew from 43 → 67 analyzers in that gap via other bots, and cmd/linters/main.go was refactored so the old registry-drift detector no longer works. Separately, this sandbox has no Go or Node.js installed, which disables every Serena tool that depends on a language server — including all three brand-new tools added this cycle. Given both the saturation of pkg/linters by ~8 other recurring bots and the loss of compile/LSP-backed verification, I did not find a finding strong and independently verifiable enough to file as a new issue. 0 issues created, 1 missing_tool reported.

Serena tool-roster change (23 → 24)

• Added: find_declaration, find_implementations, get_diagnostics_for_file, open_dashboard, rename_memory, replace_in_files, safe_delete_symbol
• Removed: check_onboarding_performed, find_file, list_dir, think_about_collected_information, think_about_task_adherence, think_about_whether_you_are_done
• Environment blocker: every LSP-backed tool (the entire "Added" list plus find_symbol, find_referencing_symbols, rename_symbol, replace_symbol_body, insert_before/after_symbol) failed with "language server manager is not initialized" — root cause: go and node are absent from this container. Only search_for_pattern and the memory tools worked. Reported via missing_tool.
• No Go toolchain also meant I could not go build/go test/run cmd/linters directly, which blocked the enforce-readiness / SuggestedFix-compile-correctness style verification this workflow has historically used (e.g. the sg60a1 → Linter precision (regression): the syntactic stdlib-package-match migration never landed — 5 holdouts remain, 3 CI-enforced (#40 [Content truncated due to length] #43934 finding). All findings below are static Grep/Read review only.

Strategy: 50/50 split

• Cached (reconcile): re-derive current repo state against the stale cache — reconcile open sergo issues, re-detect the linter registry size and detection method, and confirm whether the R60 finding (sg60a1/writebytestring) actually landed.
• New exploration: since the registry-drift detector (grep -c Analyzer cmd/linters/main.go) is now permanently broken (main.go was refactored to multichecker.Main(linters.All()...)), audit and replace it, then spot-check a handful of linters added during the untracked gap for the bug classes this workflow has previously found (message hardcoding, package-identity syntactic matching, nolint-wiring gaps, doc/registry drift).

Findings detail

1. Registry-drift detection method is dead, replacement identified. cmd/linters/main.go no longer lists analyzers — it calls linters.All() from a new pkg/linters/registry.go. grep -c Analyzer main.go now returns 0. The correct method going forward: count *.Analyzer, entries in registry.go's allAnalyzers slice (67) and cross-check pkg/linters/doc.go's // All N active analyzers: header (also 67 — no drift). doc_sync_test.go now has an automated guard tying linters.All() ↔ cgo.yml LINTER_FLAGS ↔ notYetEnforced (landed via doc-sync guard is incomplete: {registry, spec_test} and {doc.go, README} are two disconnected clusters — a linter present in cod [Content truncated due to length] #47190/Registry-CI-enforcement drift: no automated guard ties linters.All() to cgo.yml LINTER_FLAGS #55628/Guard custom linter registry-to-CI enforcement drift #55636), so this class of drift is much better guarded than in the R44–R60 era.
2. Two open sergo issues confirmed, not duplicated: errorfwrapv: BasicLit-only format-string check misses concatenated fmt.Errorf calls, hides a real percent-v vs percent-w bug #56533 (errorfwrapv misses concatenated-format-string fmt.Errorf calls) and contextcancelnotdeferred is enforced on native CI but absent from wasm LINTER_FLAGS - the registry-drift guard cannot detect it #55932 (contextcancelnotdeferred enforced natively but missing from the wasm LINTER_FLAGS, so the drift guard can't see it). Both are distinct from anything found this run.
3. Spot-checked several linters added during the untracked gap — all clean, no bugs found:
   • walkfuncerrshadow: correctly uses astutil.IsPkgSelector(pass, sel, "path/filepath") before matching Walk/WalkDir.
   • httpstatuscode: fully type-resolved (named-type name heuristic, struct-field heuristic, plain-var heuristic all gated behind pass.TypesInfo).
   • ioutildeprecated: zero production io/ioutil usages found repo-wide (both qualified and dot-import paths are type-checked via pass.TypesInfo).
   • contextcancelnotdeferred / fileclosenotdeferred / manualmutexunlock: don't import internal/nolint directly, but suppression is handled by the shared resourcetracker framework they're built on — not a gap.
   • ssljson: correctly has no nolint wiring — it validates static ssl.json config files, not suppressible source lines.
   • Spot-verified lenstringzero's hardcoded-message fix (issue lenstringzero: diagnostic message hardcodes literal "s"/"len(s)" text, misreporting every violation's actual expression #54717) is actually present in code, confirming this repo's team does land and close fixes reliably (not just phantom-closes).

Metrics

Metric	Value
Findings this run	3 (methodology/environment, no new code bugs)
Issues created	0
Tasks generated	0
missing_tool reports	1
Success score (self-assessed)	6/10

Next-run focus

1. Check go/node availability first. If restored, resume the SuggestedFix compile-correctness probe (the sg60a1 bug class — named-type vs exact-type assignability in autofixes) across bytesbufferstring, httpstatuscode, nilctxpassed, mapclearloop, mapdeletecheck — none of these have had that specific check yet.
2. If tooling is still degraded, stay static: doc/registry-drift and nolint-wiring checks remain reliable without a compiler; enforce-readiness "zero violations" claims should not be asserted without a way to actually run the linter.
3. pkg/linters is now mined continuously by ~8 other bots (linter-miner, deep-report, lint-monster, doc-sync, duplicate-code, Code Quality, test-parallel, spec-librarian) — check gh api search/issues -f q='repo:github/gh-aw <linter-name> in:title,body' before spending time auditing any single linter, coverage is very high already.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · 259.8 AIC · ⌖ 3.8 AIC · ⊞ 6.8K · ◷

• expires on Aug 29, 2026, 8:01 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Sergo - Serena Go Expert.

A newer discussion is available at Discussion #57053.