[sergo] Sergo Report: CACHED-reconcile+NEWEXPLORE-registry-mechanism-audit - 2026-09-05

[github-actions[bot]]

Executive Summary

Strategy this run: CACHED-reconcile-expired-issues + NEW-EXPLORE registry-mechanism-change audit. Reconciled all 5 open sergo issues against current code (all still valid, none duplicated), discovered the linter registry mechanism changed since the last recorded strategy entry, and audited 8 previously-unreviewed/edge-case linters. Filed 1 new issue: a re-file of a self-expired, still-unfixed bug.

Tool & Registry Changes

• Registry detection mechanism changed. cmd/linters/main.go no longer enumerates individual analyzers — it now just calls multichecker.Main(linters.All()...). The old detector (grep -c Analyzer main.go) is dead (returns 0). The canonical analyzer count now lives in pkg/linters/registry.go's allAnalyzers slice: 67 analyzers, cross-checked against the doc.go:3 "All 67 active analyzers" header — they agree.
• This is a large jump from the last recorded count (43, R60, 2026-07-08) across many runs whose individual deltas weren't captured in the bounded 3-entry strategy window.
• Serena's 23 LSP tools remain unchanged.

Strategy Split

Cached (reconcile): Pulled all sergo-labeled issues via gh api (open + a sample of closed) and cross-referenced against current code, rather than assuming closed = fixed or open = still-actionable.

• 5 open issues confirmed live and un-duplicated: 13 linters build SuggestedFix TextEdits without HasOverlappingComment guard (silent comment deletion on -fix) #58376 (13-linter HasOverlappingComment guard gap), goroutinemissingrecover: recover-defer placed after risky code is accepted as safe, but never protects earlier statements #58150 (goroutinemissingrecover recover-after-risky-code), generatedyamlheredoc: literal << inside a quoted shell string is misreported as a heredoc #57606 (generatedyamlheredoc quoted-heredoc false positive), stringsconcatloop: self-referential ASSIGN form misses map-index/selector accumulators #57340 (stringsconcatloop map-accumulator gap), sprintferrdot: verb-set check still wrong both directions after issue 40434 closed #57339 (sprintferrdot verb-set check).
• One closed issue (errorfwrapv: BasicLit-only format-string check misses concatenated fmt.Errorf calls, hides a real percent-v vs percent-w bug #56533) turned out to be auto-expired unfixed (state_reason: not_planned), not landed — see finding below.

New exploration: Deep-read 8 linters with no prior dedicated bug audit or a fresh look at edge cases: nilctxpassed, trimleftright, ioutildeprecated, logfatallibrary, httpstatuscode, excessivefuncparams, fmterrorfnoverbs, goroutinemissingrecover.

Findings

1. Re-filed: errorfwrapv/fmterrorfnoverbs concatenated-format-string blind spot hides a live %v-vs-%w bug (new issue)

pkg/cli/audit_run_pipeline.go:317-325's cacheRecoveryError still formats its trailing err argument with %v instead of %w, breaking errors.Is/errors.As chain inspection — even though the same file relies on errors.Is(err, ErrNoArtifacts) elsewhere for control flow. This was first filed as #56533; that issue auto-expired on 2026-09-03 with state_reason: not_planned and zero code change. Re-verified today: the bug is unchanged, and both errorfwrapv and fmterrorfnoverbs still extract format strings via call.Args[0].(*ast.BasicLit) only, so neither can see through the message+"..." concatenation to check it. A repo-wide grep confirms this is the only production call combining a concatenated format string with a %v-formatted error argument today.

Findings that were investigated and ruled clean / already covered (not filed):

• httpstatuscode: only narrow-heuristic coverage gaps (e.g., named integer types without "http"+"status" in the name skip the variable-name fallback) — a design limitation, not a bug.
• logfatallibrary and 4 sibling linters mix pass.Fset.Position() and pass.Fset.PositionFor(pos, false) for the generated-file-skip check — investigated and ruled out: filecheck.BuildGeneratedIndex deliberately indexes both the original and (lineadjusted/redacted) filenames, so either call convention resolves correctly.
• goroutinemissingrecover's "any top-level defer/recover anywhere in the body" check matches goroutinemissingrecover: recover-defer placed after risky code is accepted as safe, but never protects earlier statements #58150 exactly (already open, not re-filed).
• nilctxpassed, trimleftright, ioutildeprecated, excessivefuncparams: read in full, no correctness bugs found.

Generated Task

1. Fix cacheRecoveryError (pkg/cli/audit_run_pipeline.go:317-325) to wrap err with %w, and harden errorfwrapv/fmterrorfnoverbs format-string extraction to resolve constant-foldable string concatenation via a shared astutil helper (tracked in the new issue).

Metrics

• Findings this run: 2 (1 filed, several ruled clean/duplicate)
• Issues created: 1
• Tasks generated: 1
• Success score: 8/10 (solid reconciliation + one concrete, evidence-backed re-filed bug; new-exploration pool mostly came back clean, which is itself useful signal)

Historical Context

• Total runs: 61 · Total findings: 410 · Total tasks: 110 · Avg success score: 8.75
• Key lesson banked for future runs: a closed sergo issue is not proof of a fix — issues carry a self-expiry checkbox and auto-close with state_reason: not_planned if nobody acts before the deadline. Both directions (open-but-landed, and closed-but-unfixed) require re-grepping the actual code before trusting issue status.

Next-Run Focus

• Re-verify the new issue lands (re-grep pkg/cli/audit_run_pipeline.go for %w).
• Continue auditing linters newly added since the 43→67 registry jump that haven't had a dedicated bug pass yet.
• Watch pkg/linters/registry.go analyzer count vs. doc.go header for the next registry delta.

References:

• §33942680641

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · 271 AIC · ⌖ 8.31 AIC · ⊞ 6.8K · ◷

• expires on Sep 5, 2026, 7:57 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Sergo - Serena Go Expert.

A newer discussion is available at Discussion #58915.