[sergo] Sergo Report: DELTA-72to73-newlinter-audit(uncheckedsliceindex)+reverse-phantom-refile(bufioscannererunchecked) - 2026-09-22

[github-actions[bot]]

Sergo Report: newlinter-audit(uncheckedsliceindex) + reverse-phantom-refile(bufioscannererunchecked) — 2026-09-22

Executive summary
Run R74. The linter registry grew 72->73 with a new linter (uncheckedsliceindex, PR #62408). First-ever audit found a systemic Ident-only equality bug that defeats bounds-check and loop-safety recognition for any struct-field slice or string base, confirmed with 2 live production false-positive sites. Separately, the 7th reverse-phantom-reconcile instance was caught: issue #60738 (bufioscannererunchecked, filed at run R66) auto-expired to closed/not_planned with the underlying bug still 100 percent present, so it was refiled with fresh evidence. 2 new issues created this run, both deduplicated via gh api search before filing.

Tool updates

• Serena: 24 tools, stable, activate_project OK for go/typescript/bash, no approval prompts.
• Linter registry: 72 -> 73 analyzers (grep -c Analyzer,$ pkg/linters/registry.go). New: uncheckedsliceindex (added 2026-09-21).

Strategy: 50/50 split

• Cached (50%): Reconciled all 13 previously-open sergo issues via gh api. One (bufioscannererunchecked (70th linter): per-block Err() check misses checks placed in an enclosing block #60738) had auto-expired without any code fix; re-verified the underlying block_scope_state_reset bug in bufioscannererunchecked.go is unchanged and refiled it.
• New exploration (50%): First-ever full audit of the newest (73rd) linter, uncheckedsliceindex, the most sophisticated control-flow-aware analyzer in the registry (per-file parent maps, if/for/range/terminating-guard recognition, real bound arithmetic).

Findings

1. uncheckedsliceindex: selector-based bases defeat all safety recognition (new issue)

sameExpr (pkg/linters/unchecked-slice-index/uncheckedsliceindex.go:366-371) requires both compared expressions to reduce to a bare *ast.Ident. Every safety check built on top of it, isLenOf, isInRangeLoop, isInBoundedForLoop, and writesObjects, inherits this limitation. Any base that is a selector expression (obj.Field) can never be matched back to its own len() bound, so a struct-field slice or string index is always reported as unchecked, even when properly guarded.

Confirmed live production false positives:

• pkg/workflow/skills_ref_resolution.go:30-31: if i < len(data.SkillReferences) { data.Skills[i] = data.SkillReferences[i].Skill }
• pkg/workflow/cache_memory.go:355-356: for i := 1; i < len(config.Caches); i++ { ... config.Caches[i] ... }

Not yet CI-enforced, but this is a foundational gap rather than an edge case, and it will generate broad noise the moment the linter is enabled, since its own testdata never indexes anything but bare local variables.

2. bufioscannererunchecked: block-scope Err() gap, 7th reverse-phantom (refiled)

Issue #60738 (filed at run R66) auto-expired to closed/not_planned on 2026-09-21 with zero code change. hasScannerErrCheck (bufioscannererunchecked.go:72-98) still only searches for a trailing scanner.Err() call within the same statement slice as the loop, so an Err() check placed in an enclosing block (after an if/for/switch wrapping the scan loop) remains invisible. This is the 7th time this project has seen an issue auto-expire while the underlying defect was never touched.

Generated tasks (2)

1. Generalize sameExpr in uncheckedsliceindex to handle SelectorExpr bases (compare Sel.Name plus the resolved base object) so obj.Field[i] guarded by len(obj.Field) is recognized as safe. Medium effort.
2. Thread the remaining statements of the enclosing block into hasScannerErrCheck so an Err() check one block level up from the scan loop is still found, the same fix shape as the still-open bufferresetbeforereuse companion issue. Small effort.

Metrics

• Findings this run: 5 (2 filed as issues, 3 audited-clean or structurally-immune paths recorded in memory)
• Issues created: 2, both deduplicated with zero prior coverage confirmed
• Success score: 9/10, a fresh systemic bug in a brand-new linter plus a confirmed unresolved reverse-phantom, both code-verified with live reproductions
• Totals to date: 74 runs, 473 findings, 129 tasks, average success score 8.8

Historical context
This is run 74 of a continuing series. 6 prior reverse-phantom instances (nolint space-prefix, the 4-linter main-guard gap, manualmutexunlock selector-collapse, slicemakezerolength var-vs-make, and bufferresetbeforereuse per-block-state) share the same root pattern: an issue auto-expires and closes as not_planned while the code defect is never addressed. #60738 is the 7th. The new ident_only_equality_gap pattern class is distinct from the previously catalogued paren_unwrap_gap: that class is about missing ParenExpr unwrapping before an otherwise-adequate type assertion, while this one is about an equality helper refusing to handle anything but a bare identifier, even after full unwrapping.

Recommendations and next-run focus

• Verify both new issues land as filed.
• Re-tally all 14 open sergo issues at the start of the next run.
• If the registry grows again, audit the newest linter fresh before anything else.
• If no new linter appears, extend the uncheckedsliceindex audit: check whether hasTerminatingGuardBefore and invalidBounds share the same Ident-only limitation for early-return guards on selector-based indices, likely the same root cause, which would argue for one shared fix rather than a second issue.

References:

• run 35684470805: https://github.com/github/gh-aw/actions/runs/35684470805

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · 232.6 AIC · ⌖ 8.31 AIC · ⊞ 7K · ◷

• expires on Sep 22, 2026, 7:59 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Sergo - Serena Go Expert.

A newer discussion is available at Discussion #62863.