[sergo] Sergo Report: stale-cache-reconcile plus pkg-boundary-syntactic-match - 2026-09-09

[github-actions[bot]]

Overview

Ran Sergo R61 after an undetected roughly 2-month cache gap (the last recorded run in repo-memory was R60 on 2026-07-08, despite roughly 40 additional sergo issues having been filed and mostly closed by the team in the interim). Reconciled the cache against live GitHub state, detected a linter-registry refactor that broke the old delta-detector, applied one cached bug-hunting vein to a new target validated across six never-before-audited linters, and filed one high-confidence, evidence-backed issue.

Key metrics

• Sergo issues in repo history: about 150 (gh api, 2 pages), 3 open pre-run, 4 open after this run
• Linter registry: 43 cached vs 67 actual - migrated from cmd/linters/main.go to pkg/linters/registry.go
• Serena tool set: 23 to 24 (added find_declaration, find_implementations, get_diagnostics_for_file, open_dashboard, rename_memory, replace_in_files, safe_delete_symbol; removed the three think_about_* tools, check_onboarding_performed, find_file, list_dir)
• LSP availability this run: unavailable (Go and Node are not installed in this sandbox) - degraded to Read and Grep tools, which was sufficient
• Issues filed: 1 of a maximum 3
• Self-assessed success score: 8/10

Strategy split (50/50)

• Cached component: re-applied an established bug class from memory - a syntactic proxy standing in for a semantic, type-resolved check (the same vein behind historical issues like Linter precision (regression): the syntactic stdlib-package-match migration never landed — 5 holdouts remain, 3 CI-enforced (#40 [Content truncated due to length] #43934, Linter precision: migrate the 3 remaining CI-enforced linters that match stdlib packages by identifier name to astutil.IsPkgSele [Content truncated due to length] #40243, Linter precision: two newest linters (fileclosenotdeferred, contextcancelnotdeferred) match stdlib packages by identifier name — [Content truncated due to length] #40435 for stdlib-package identifier matching) - to a new target: the cmd-entry-point boundary check shared by six library-scope linters.
• New-exploration component: cross-referenced all 67 registered linters against roughly 150 historical issue titles to find linters never mentioned in any prior Sergo issue. Found six: bytesbufferstring, ioutildeprecated, logfatallibrary, mapdeletecheck, nilctxpassed, sprintfbool. Read all six in full.

Findings

1. Filed as an issue: osexitinlibrary, panicinlibrarycode, rawloginlib, and logfatallibrary all gate on strings.HasSuffix(pkgPath, "/main") || strings.Contains(pkgPath, "/cmd/") alone. Sibling linters osgetenvlibrary/ossetenvlibrary (both CI-enforced) already prepend pass.Pkg.Name() == "main". Concrete evidence: internal/tools/actions-build/main.go and internal/tools/generate-action-metadata/main.go are real package main executables outside cmd/, with 6 total os.Exit(1) call sites that would be misclassified as library violations the moment these linters run against ./internal/... (currently latent, since the default LINTER_PACKAGES is ./cmd/... ./pkg/...).
2. bytesbufferstring builds an unguarded SuggestedFix with no HasOverlappingComment check, but it is already named in open issue 13 linters build SuggestedFix TextEdits without HasOverlappingComment guard (silent comment deletion on -fix) #58376 likely-affected list, so no new issue was filed for it (would be a duplicate).
3. mapdeletecheck, nilctxpassed, sprintfbool: read in full, all correctly type-resolved (TypesInfo-based, not syntactic identifier matching), already wired for nolint directives and comment-overlap guards where relevant. sprintfbool has one minor unfiled precision gap - a backtick raw-string %t format literal is not matched, since ast.BasicLit.Value preserves the source delimiter - but there are zero live occurrences in the repo, so it was judged too weak to file on its own.
4. ioutildeprecated: correct dual qualified-selector and dot-import handling, fully type-resolved via pass.TypesInfo, no issues found.

Registry and cache reconciliation detail

• The old detector, grep -c Analyzer cmd/linters/main.go, now returns 0 because main.go was refactored to multichecker.Main(linters.All()...). The canonical source of truth is now pkg/linters/registry.go, whose allAnalyzers slice lists 67 entries.
• The repo-memory cache (sergo-strategies.jsonl and sergo-stats.json) had not been updated since 2026-07-08, despite dozens of real issues being filed and closed in the interim (visible via gh api but absent from the JSON cache) - most likely repeated silent write or push failures. The new-linter detector and the stale cache entries have been corrected in this run.
• 3 issues were already open at the start of this run and were left untouched: internal/nolint: HasDirectiveForLinter ignores space-prefixed nolint directives #59122 (nolint space-prefixed directive), 13 linters build SuggestedFix TextEdits without HasOverlappingComment guard (silent comment deletion on -fix) #58376 (13-linter HasOverlappingComment gap), goroutinemissingrecover: recover-defer placed after risky code is accepted as safe, but never protects earlier statements #58150 (goroutinemissingrecover early-recover placement).

Next-run focus

• Verify sg61a1 landed, then re-run the gh api reconciliation for the 3 pre-existing open issues.
• If the registry grew again, recompute the delta from the allAnalyzers count in pkg/linters/registry.go, not from main.go.
• Retest Serena LSP availability (Go and Node); if restored, revisit get_diagnostics_for_file and find_implementations against the remaining registered linters not yet cross-validated with real compiler diagnostics.

References:

• Sergo run 34308401798
• Issue #58376 - HasOverlappingComment gap
• Issue #59122 - nolint space-prefixed directive

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · 377.6 AIC · ⌖ 6.57 AIC · ⊞ 6.8K · ◷

• expires on Sep 9, 2026, 8:02 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Sergo - Serena Go Expert.

A newer discussion is available at Discussion #59876.