[sergo] Sergo Report: STALE-CACHE-RECONCILE + Library-Family Parity Probe - 2026-09-08

[github-actions[bot]]

Executive summary

This run (R61) prioritized reconciling a ~2-month stale local cache against live repository state before generating any new findings, and hit a real infrastructure gap: Serena MCP tools were entirely absent this session (0 of the 23 tools recorded in prior-run cache), so all analysis fell back to Grep/Read/Bash. That gap has been reported via missing_tool.

No new issues were filed this run — after auditing six previously-untouched linters and reconciling the open backlog, nothing surfaced that cleared the "concrete, non-duplicate, high-confidence" bar. That's a legitimate outcome, not a shortfall: the codebase has been audited exhaustively across 60+ prior runs, and forcing a weak finding to hit a quota would cost more in reviewer time than it returns.

Tool inventory changes

Area	Prior cache (R60, 2026-07-08)	This run (R61, 2026-09-08)
Serena MCP tools	23 tools (activate_project, find_symbol, ...)	0 present — filed missing_tool
Linter registry entry point	cmd/linters/main.go (grep -c Analyzer = 43)	cmd/linters/main.go now just calls linters.All(); registry lives in pkg/linters/registry.go
Registered analyzer count	43	67 (+24)

The old "registry delta" detector (grep -c Analyzer cmd/linters/main.go) is now silently broken — it would report 0. Future runs should detect drift via pkg/linters/registry.go's analyzer list or the "All N active analyzers" count in pkg/linters/doc.go's header comment.

Strategy: 50/50 cached-reuse + new-exploration

Cached-reuse component (proven pattern: sibling-family parity probing). The repo has a recurring, well-confirmed bug class: linters that belong to a structural "family" (same skip-logic scaffolding) drift out of sync when one gets a fix the others don't. I re-ran this lens against the "library-scoped" family (osexitinlibrary, panic-in-library-code, rawloginlib, osgetenvlibrary, ossetenvlibrary, logfatallibrary) and against the SuggestedFix-compile-correctness pattern that previously caught the writebytestring bug (sg60a1).

New-exploration component. Of the +24 newly-registered analyzers, five had zero issue history anywhere in the tracker: mapdeletecheck, logfatallibrary, ioutildeprecated, sprintfbool, bytesbufferstring, plus nilctxpassed. These got a full read-through for the standard failure modes (syntactic vs. type-resolved package matching, SuggestedFix assignability, comment-overlap guards, nolint/test-skip parity).

Targets/success criteria set at start: reconcile backlog against gh api, confirm/deny the sg60a1 fix landed, find 0–2 new high-confidence issues from the fresh-linter sweep, and produce an accurate coverage map for future runs.

Backlog reconciliation (all 4 open sergo issues re-verified against current code)

#	Title	Status
#59122	internal/nolint: space-prefixed // nolint:x directives ignored	Confirmed still present. pkg/linters/internal/nolint/nolint.go:59-60 does strings.TrimPrefix(comment.Text, "//") then requires strings.HasPrefix(text, "nolint:") — a comment written as // nolint:foo (space after //, the common style) leaves a leading space and never matches. This is the single highest-leverage open bug in the tracker: it silently breaks suppression for all 67 linters for anyone using the conventional spaced style.
#58376	13 linters build SuggestedFix edits without HasOverlappingComment guard	Confirmed, and the count has grown. Re-counting today: only 7 of the 25 linters that emit SuggestedFixes call astutil.HasOverlappingComment first; 18 now lack it (was 13 when filed), including newly-registered bytesbufferstring and mapclearloop. Growth is expected as new autofix linters get added without copying the guard — worth a lint-of-the-linters check if the team wants to stop the bleed.
#58150	goroutinemissingrecover: recover-after-risky-code accepted as safe	Confirmed still present. hasTopLevelRecoverDefer (pkg/linters/goroutinemissingrecover/goroutinemissingrecover.go:97-125) scans the entire top-level statement list for any deferred recover, with no check that it appears before the panic-risking statements — a defer at the bottom of the closure is treated identically to one at the top.
#57606	generatedyamlheredoc: << inside a quoted shell string misreported as heredoc	Confirmed still present. lineContainsShellHeredoc (pkg/linters/generatedyamlheredoc/generatedyamlheredoc.go:78-103) tracks arithmetic-expression quoting state only in the substring before the <<, never checking whether the << itself sits inside an open single/double-quoted run on the same line.

sg60a1 (writebytestring compile-correctness) — confirmed landed. pkg/linters/writebytestring/writebytestring.go now has a correct isExactString (*types.Basic check, not Underlying()-based) and buildStringExpr wraps named string types in string(...) before emitting the fix. The bug class this represented (an Underlying()==String check copied from a core-type-accepting API onto an exact-type-requiring API) has not recurred in any of the newer autofix linters I read this run.

Fresh-linter audit (zero prior issue history) — all clean

Read in full: mapdeletecheck, logfatallibrary, ioutildeprecated, sprintfbool, bytesbufferstring, nilctxpassed. Checked each against the standard failure catalogue (syntactic ident.Name == "pkg" matching instead of astutil.IsPkgSelector, SuggestedFix assignability, missing HasOverlappingComment, nolint/test-skip parity, ancestor-walk scope-boundary bugs). All six use astutil.IsPkgSelector/type-resolved matching correctly, and the ones that emit fixes (sprintfbool, bytesbufferstring) build sound edits — sprintfbool guards with both QualifierShadowed and HasOverlappingComment; bytesbufferstring correctly excludes *bytes.Buffer (pointer) specifically because nil receivers would change panic-vs-"<nil>" behavior.

One asymmetry surfaced but was not filed: rawloginlib is missing the strings.HasSuffix(pkgPath, ".test") skip that its five siblings in the "library-scoped" family all carry with an explicit "Skip test files" comment. I traced the actual risk surface, though: filecheck.ShouldSkipFilename already excludes every _test.go file's content per-call for all six linters, and the .test-suffixed package is only the Go-toolchain-synthesized test-binary main (no real source lives there). So the gap is real but inert — no concrete input reproduces a wrong diagnostic. Flagging it in this report rather than as an issue, per the "don't force a weak finding" rule.

Metrics

• Findings this run: 5 (4 backlog reconciliations + 1 non-actionable parity note)
• Issues created: 0 (quality bar not met; see above)
• Tasks generated: 0
• Success score: 6/10 — solid reconciliation and a real infra gap caught (missing_tool), but the new-exploration lane didn't produce a filable bug this cycle
• Cache updated: sergo-tools-list.json, sergo-strategies.jsonl, sergo-stats.json (validated within the 12 KB patch budget via push_repo_memory)

Historical context

Total runs: 61 (60 previously cached + this one). Cumulative findings: 413. The tracker currently sits at only 4 open sergo issues against 60+ closed, meaning most of the "easy" bug classes (syntactic package matching, SuggestedFix comment-overlap, FuncLit scope-boundary over-attribution, enforce-readiness sweeps) have already been found and fixed across the linter family. Marginal new findings are getting harder to source — expect lower per-run issue counts going forward unless the registry keeps growing at its current pace (+24 analyzers since the last cached checkpoint).

Recommendations / next-run focus

1. internal/nolint: HasDirectiveForLinter ignores space-prefixed nolint directives #59122 (nolint space-prefix) deserves priority attention — it's foundational and silently defeats suppression comments for every one of the 67 linters when written in the conventional // nolint:x style. Worth escalating outside the normal issue queue if it isn't already being worked.
2. Fix the registry-delta detector before next run: switch from grep -c Analyzer cmd/linters/main.go (now always 0) to counting .Analyzer, entries in pkg/linters/registry.go or parsing the doc.go header count.
3. Re-verify Serena MCP availability at the start of next run before assuming the tool loadout matches the cached snapshot — this run's absence may have been transient.
4. If 13 linters build SuggestedFix TextEdits without HasOverlappingComment guard (silent comment deletion on -fix) #58376's guard-count keeps growing (13→18 in two months), consider whether a HasOverlappingComment requirement belongs in a lint-of-the-linters check rather than being caught retroactively per new analyzer.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · 354.3 AIC · ⌖ 8.24 AIC · ⊞ 6.8K · ◷

• expires on Sep 8, 2026, 8:05 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Sergo - Serena Go Expert.

A newer discussion is available at Discussion #59628.