[sergo] Sergo Report: STABLE-73 Reconcile + Never-Audited Backlog Exhaustion - 2026-09-26

[github-actions[bot]]

Overview

Run R78 (workflow run 36215881512). Registry held steady at 73 analyzers (no new linter since R74). All 13 pre-run open sergo issues were reconciled and confirmed still open, with zero reverse-phantom flips for the first time since R73 - a quiet run on the reconcile side. New-exploration work solo-audited the final 6 never-before-audited linters, exhausting that backlog, and turned up 2 new confirmed bugs in the well-established paren_unwrap_gap pattern class.

Key Findings

1. httpstatuscode: parenthesized status-code literals escape a CI-enforced linter (issue filed, temp id aw_sg78a1). extractStatusLiteral and the switch-case branch of run both use a bare *ast.BasicLit assertion on the literal side with no astutil.UnwrapParenExpr call, so resp.StatusCode == (404) or case (404): silently escapes detection. Confirmed CI-enforced in both native and wasm custom-linter runs.
2. seenmapbool: isBoolTrue misses parenthesized (true), causing false negatives (issue filed, temp id aw_sg78a2). Same missing-unwrap shape, but here it is the inverse direction of the usual pattern: a parenthesized true value makes a genuinely set-shaped map[string]bool invisible to the linter instead of causing a false positive. Affects both call sites of the helper. Not currently CI-enforced.
3. Backlog exhausted: ioutildeprecated and ssljson audited clean this run; errormessage and mapclearloop each have only a very weak, unrealistic paren-wrap shape not worth filing. Every linter in the registry has now had at least one solo bug-focused audit pass.

Strategy Split (50/50)

• Cached (reconcile): Re-verified all 13 open sergo issues against current code via direct Read/Grep. All confirmed still open and unfixed - no code changes landed for any of them since they were filed, so no reverse-phantom refiling was needed this run.
• New exploration: Solo-audited the 6 remaining never-audited linters flagged as a punch list in the R77 report, closing out that backlog entirely.

Generated Issues (2)

Issue	Linter	Class	CI-enforced
aw_sg78a1	httpstatuscode	paren_unwrap_gap	native + wasm
aw_sg78a2	seenmapbool	paren_unwrap_gap (false-negative variant)	no

Full evidence and recommendations

httpstatuscode (pkg/linters/httpstatuscode/httpstatuscode.go): extractStatusLiteral (163-171) does expr.X.(*ast.BasicLit) / expr.Y.(*ast.BasicLit), and the switch-case handling in run (126) does caseExpr.(*ast.BasicLit) - both without unwrapping ast.ParenExpr first. Fix: call astutil.UnwrapParenExpr before each assertion, matching the idiom already used in walkfuncerrshadow.go, mapdeletecheck.go, and typeassertionokdiscarded.go.

seenmapbool (pkg/linters/seenmapbool/seenmapbool.go): isBoolTrue (248-251) does a bare expr.(*ast.Ident) assertion for the identifier true. Both call sites - findNonSetMaps (191) and markIfNonSetLiteral (223) - rely on this to decide whether a write is a true-set-write; a parenthesized (true) fails the assertion and gets treated as a non-set write, suppressing a valid finding for that map variable.

Metrics

• Total runs: 78 (avg success score 8.76)
• Total findings to date: 491
• Total tasks generated to date: 137
• Open sergo issues after this run: 15 (13 unchanged + 2 new)
• Registry: 73 analyzers, stable since R74

Historical Context

This is the second run (after R73) with zero reverse-phantom flips on reconcile, suggesting either team attention has shifted elsewhere or the backlog of easy auto-expiring issues has thinned. The paren_unwrap_gap pattern class now has confirmed instances across 9+ linters and 2 shared helpers (astutil.StringLitValue/IsStringLiteral), making it the single most productive recurring vein this project has found. This run also produced the first known false-negative-direction instance of the class (seenmapbool), broadening its documented shape.

Next-Run Focus

The never-solo-audited linter backlog is now empty. R79 should either (a) re-probe already-audited-clean linters for bug classes distinct from whichever one they were originally checked against, or (b) wait for the registry to grow past 73 and audit any new linter fresh. Also worth periodically pruning the oldest tool_change_RXX entries in the tools-list cache file, which has grown to roughly 96 KB across memory files.

References:

• §36215881512

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · 207.4 AIC · ⌖ 8.5 AIC · ⊞ 7K · ◷

• expires on Sep 26, 2026, 7:58 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Sergo - Serena Go Expert.

A newer discussion is available at Discussion #63769.