[sergo] Sergo Report: STABLE-73 Reverse-Phantom Double-Refile - 2026-09-23

[github-actions[bot]]

Overview

Run §35815762269 (R75 in Sergo history). Linter registry held STABLE at 73 analyzers (no new linter since R74s uncheckedsliceindex). Reconcile found 2 of the 14 pre-run open sergo issues had auto-expired (closed/not_planned) without any code change landing, so both were refiled with fresh code citations. A cached-vein follow-up confirmed a known root-cause bug extends further into the newest linter, but that finding was folded into an existing open issue instead of a duplicate filing.

Key metrics

• Registry: STABLE at 73 analyzers (grep -c Analyzer, pkg/linters/registry.go = 73, unchanged since R74)
• Serena tools: STABLE at 24, activate_project OK for go/typescript/bash, no approval prompts
• Open sergo issues pre-run: 14 -> 2 reverse-phantom refiles -> 14 post-run (net unchanged, both replacements)
• Issues created this run: 2
• Reverse-phantom count to date: 8 overall lineages (4th generation specifically for the nolint space-prefix bug)

Strategy: 50/50 split

Cached component (reconcile-driven, ~50%): Re-verify all pre-run open issues against current code before deciding whether new findings are needed. Two issues had flipped to closed/not_planned since the last run:

• internal/nolint space-prefix directive bug (originally internal/nolint: HasDirectiveForLinter ignores space-prefixed nolint directives #59122, refiled internal/nolint: space-prefixed "// nolint:" directive still silently ignored (issue 59122 auto-expired, bug unfixed) #61023, both auto-expired) - re-read nolint.go:59-60 and confirmed strings.TrimPrefix(comment.Text, "//") still leaves a leading space for the common // nolint:x spelling, which then fails strings.HasPrefix(text, "nolint:"). Byte-for-byte unchanged. Refiled.
• blankassigncomma idiom-reflag (originally blankassigncomma (71st linter): flags 14+ production sites that are deliberate idiomatic error-discards #61024) - re-read blankassigncomma.go:52-57 and confirmed no allow-list or comment-aware exception was added; the same 14+ production _, _ = f() sites (the codebases manual substitute for a disabled errcheck exclude-list) are still re-flagged. Refiled.

New-exploration component (~50%): Followed up on last runs suggested next step - whether uncheckedsliceindex.gos hasTerminatingGuardBefore/invalidBounds/writesObjects functions share the sameExpr Ident-only root cause already filed as #62540. Confirmed they do (same helper, same limitation, lines 325/356/359/466). Since this strengthens rather than duplicates an already-open issue, no new issue was filed from it - it is logged as a candidate follow-up comment on #62540 if that issue stays open.

Findings this run

Finding 1: internal/nolint space-prefix directive bug (4th reverse-phantom)

pkg/linters/internal/nolint/nolint.go:59-60 treats // nolint:linter (with the gofmt-normal single space after //) as a non-directive plain comment, because TrimPrefix(comment.Text, "//") leaves the leading space attached and the subsequent HasPrefix(text, "nolint:") check then fails. This is shared infrastructure used by every one of the 73 registered linters, so any contributor using the spaced style gets silently unsuppressed diagnostics. This is the 4th time this exact bug has been filed and auto-expired without a fix landing.

Finding 2: blankassigncomma re-flags established codebase idiom (2nd reverse-phantom)

pkg/linters/blankassigncomma/blankassigncomma.go:52-57 still has no allow-list or comment-aware exception, so it continues to flag 14+ production sites where _, _ = f() is the deliberate, already-adopted workaround for .golangci.yml:37s disabled errcheck exclude-functions mechanism (e.g. hash.Hash.Write, which never errors in practice). Not yet CI-enforced, but the underlying design gap is unchanged from the first audit.

Finding 3 (no new issue): uncheckedsliceindex early-return guard shares the same root cause as #62540

hasTerminatingGuardBefore, invalidBounds, and writesObjects all call the same sameExpr helper (Ident-only equality) already diagnosed in #62540s selector-base blind spot. A single fix to sameExpr would resolve both the previously-filed bounds-check gap and this early-return-guard gap at once. Logged for a follow-up comment rather than a duplicate issue.

Tasks generated (2)

1. [internal/nolint: space-prefixed "// nolint:" directive still silently ignored (issue 61023 auto-expired, 4th reverse-phantom, bu #62861] Strip the leading space before the nolint: prefix check in internal/nolint/nolint.go, add a spaced-directive testdata fixture.
2. [blankassigncomma: still re-flags 14+ deliberate idiomatic error-discards (issue 61024 auto-expired, 2nd reverse-phantom, no allo #62862] Add an allow-list or comment-aware exception to blankassigncomma before considering it for CI enforcement.

Historical context

This run continues a long-running pattern: several sergo-filed bugs get auto-expired (closed/not_planned) by repository automation without the underlying code changing. This is the 8th confirmed instance of that pattern across different bug lineages, and the 4th generation specifically for the nolint space-prefix bug. Total across all 75 runs: 477 findings, 131 tasks generated, average success score 8.8/10.

Recommendations

• Treat closed/not_planned as a signal to re-verify code, not as evidence of a fix - stale-issue automation appears to auto-close sergo issues on a timer independent of remediation.
• Prioritize the internal/nolint space-prefix fix: it is shared infrastructure affecting every linters suppression mechanism, the highest-leverage open item in the backlog.
• Consider consolidating the 4 prior refiles of the nolint bug into a single pinned/exempted issue so automation does not keep auto-expiring a known, unfixed, high-leverage bug.

Next-run focus (R76)

Re-verify #62541, #62540, #62304, #62115, #62114, #61948, #61947, #61715, #61714, #61519, #61518, #61265 plus this runs sg75a1/sg75a2. If the registry grows to 74 analyzers, audit the new linter fresh. If #62540 is still open, add a follow-up comment citing this runs hasTerminatingGuardBefore confirmation rather than filing a new issue.

References:

• §35815762269

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · 151.3 AIC · ⌖ 9.48 AIC · ⊞ 7K · ◷

• expires on Sep 23, 2026, 7:56 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-24T03:56:15.996Z.

Closed by Workflow