[sergo] Sergo Report: REGISTRY-43to67-resync+cached-not-enforced-audit(cgo.yml-diff)+newexplore-closed-issue-reconciliation - 2026-08-31

[github-actions[bot]]

Executive summary

Registry check: 67/67 analyzers registered and documented (pkg/linters/registry.go vs pkg/linters/doc.go header) — no doc-sync drift. Since the last logged run (R60, 2026-07-08) the registry grew from 43 → 67 analyzers across untracked intervening runs; this run re-synced the baseline rather than treating the jump as a single new delta.

Filed 2 new issues, both concrete, evidence-backed gaps in currently un-enforced linters (not yet wired into cgo.yml LINTER_FLAGS), found by reconciling closed-issue titles against the actual code instead of trusting closure status.

Tool inventory

No Serena tool-surface change (still 23 tools, same params/gotchas as prior runs).

Strategy: 50/50 split

• Cached reuse (50%): diffed the full 67-analyzer registry against cgo.yml's native LINTER_FLAGS list to rebuild the not-yet-enforced set (12 names), then reconciled every closed sergo issue title touching those linters against current source — the proven "closed ≠ landed" reconciliation pattern from prior runs.
• New exploration (50%): full-file reads of sprintferrdot, stringsconcatloop, excessivefuncparams, largefunc, and hardcodedfilepath — five not-enforced linters with no or thin recent audit coverage — cross-checked against their test fixtures for uncovered edge cases.

Findings

7 evidence items collected (2 filed as issues, 5 reconciled as already-fixed or too-minor)

1. sprintferrdot — verb-set bug unfixed despite closed sprintferrdot precision: verb handling {s,v} is wrong in both directions — %#v false positive, %q/%x/%X false negative #40434. parseSimpleFormatVerbs (sprintferrdot.go:142) discards the # flag without recording it, so %#v is indistinguishable from %v → false positive (flags .Error() under %#v as redundant when it isn't: %#v invokes GoStringer, not Error()). Separately, the accepted-verb check (sprintferrdot.go:75) excludes q/x/X, which the fmt package's error-interface special case also covers → false negative. No test fixture exists for any of these forms. Filed.
2. stringsconcatloop — self-referential = form misses map/selector accumulators. selfReferentialConcatLHS (stringsconcatloop.go:117-134), added to close stringsconcatloop: ADD_ASSIGN-only matcher lets contributors bypass the lint rule with x = x + y — already happening in open P [Content truncated due to length] #49046's x = x + y gap, requires a bare *ast.Ident on both sides. m[k] = m[k] + v and obj.Field = obj.Field + v silently pass, even though the sibling += path already handles arbitrary expression shapes. No prod instances found (grep swept pkg/**/*.go), so latent. Filed.
3. writebytestring's sg60a1 bug (isStringType matching named types for an exact-string API) is confirmed fixed — buildStringExpr now wraps string(...) via a correct isExactString (Basic-kind check).
4. stringbytesroundtrip's isExactString (closed stringbytesroundtrip: isExactString is a no-op alias of isStringType — latent risk of the sg60a1 (writebytestring) bug class #54718, alleged "no-op alias") is confirmed fixed — now isStringType(types.Unalias(t)), correctly distinguishing named types from the predeclared string.
5. excessivefuncparams's old test-file gap (Threshold linters: excessivefuncparams lints test files (every sibling FuncDecl linter skips them); largefunc & excessivefuncpar [Content truncated due to length] #40734) is confirmed fixed — filecheck.ShouldSkipFilename now wraps IsTestFile.
6. largefunc re-audited for the double_traversal_dup bug class (nodeFilter over both FuncDecl+FuncLit) — clean: each node gets its own span via the inspector's single pass, no manual recursion.
7. hardcodedfilepath's enclosingCallIsLogPrint only checks the nearest enclosing call, missing cases where a path literal is nested inside a non-log call (e.g. fmt.Sprintf) that is itself passed to a log call — real but purely cosmetic (only suppresses an informational message suffix, not the diagnostic itself), so not filed as an issue this run.

Generated tasks (2)

#	Linter	Type	Effort
sg61a1	sprintferrdot	correctness (FP + FN)	Small
sg61a2	stringsconcatloop	coverage gap (latent)	Small–Medium

Issues filed

Both labeled sergo, both self-contained with file:line evidence, repro snippets, recommendation, and validation checklist. No duplicates skipped this run — reconciliation confirmed the two open pre-existing sergo issues (#56533 errorfwrapv, #55932 contextcancelnotdeferred/wasm) are unrelated to this run's targets.

Metrics

• Findings this run: 7 (2 filed, 5 reconciled/clean)
• Issues created: 2 / 3 max
• Success score: 8/10 (solid evidence, no duplicates, but no production-violation counts available this run — linter execution against pkg/ wasn't possible in this sandbox, see below)

Historical context

• Total runs (est., includes untracked gap): 61
• Total findings to date: ~414
• Total tasks to date: ~111
• Avg success score: 8.75/10

Known limitation this run

Could not execute go run ./cmd/linters ... ./pkg/... to get live production-violation counts for the audited linters — the sandbox requires interactive approval for that command shape and none was available in this unattended run. Findings above are based on static code reading plus targeted grep sweeps, not a live lint pass. Recommend a follow-up run (or CI artifact review) to get exact violation counts for sprintferrdot/stringsconcatloop before wiring either into LINTER_FLAGS.

Next-run focus (R62)

• Verify sg61a1 / sg61a2 land in code (not just issue closure).
• Fresh pass on manualpathconcat, packagelevelmutableslicemap, seenmapbool — heavily audited historically but may have residual narrow-pattern gaps in the same family as sg61a2.
• Consider identifying, per-linter, which of the 24 analyzers added between R60 and R61 have never had a dedicated audit (the aggregate registry delta was resynced this run, but individual audit history for that batch isn't tracked).

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · 417.8 AIC · ⌖ 8.3 AIC · ⊞ 6.8K · ◷

• expires on Aug 31, 2026, 8:05 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Sergo - Serena Go Expert.

A newer discussion is available at Discussion #57607.