[sergo] Sergo Report: Deliver-Tested-PR (readerstringconv enforcement) - 2026-10-29

[github-actions[bot]]

Overview

This run operated in deliver-a-tested-PR mode rather than the usual file-1-3-issues mission: implement and validate the best evidence-backed improvement directly instead of filing/refiling an issue.

Reconcile found 2 open sergo-labeled issues (not 3 as R110 predicted) plus one important correction: #72308 (sg109a1, manualpathconcat paren_unwrap_gap) shows as still open on GitHub, but its underlying fix is already live on main via commit d3124f02 - PR #72566 that proposed it shows state=CLOSED/mergedAt=null in gh pr view, yet the committed code matches the PR diff exactly (verified by reading manualpathconcat.go directly). PR state alone is not reliable proof of whether a fix landed; this run now treats it as resolved without re-touching it (no close-issue tool is available to this workflow).

Key metrics / issues

Issue	Status this run
#72308 sg109a1 manualpathconcat paren_unwrap_gap	Code fix already live on main (commit d3124f02); issue left open (no close tool available), not re-worked
#71997 sg108a1 readerstringconv enforce-readiness	Fixed and PR opened this run
#72309 sg109a2 manualpathconcat + packagelevelmutableslicemap never CI-enforced	Deferred - see rationale below

This run's PR (branch sergo/readerstringconv-enforce-r111): fixes the 3 known production call sites and wires CI enforcement for readerstringconv in one commit.

• pkg/cli/secret_set_command.go:283 - strings.NewReader(string(body)) -> bytes.NewReader(body) (body already []byte from json.Marshal).
• pkg/workflow/work_queue_memory.go:159 - strings.NewReader(string(encoded)) -> bytes.NewReader(encoded).
• pkg/cli/experiments_fetch.go:88 - strings.NewReader(string(data)) -> bytes.NewReader(data) (data already a []byte parameter).
• Added -readerstringconv to both native and wasm LINTER_FLAGS in .github/workflows/cgo.yml in the same commit, avoiding the recurring ci_target_asymmetry class seen previously with contextcancelnotdeferred/consolestderr.

Why readerstringconv over the other open issue (sg109a2)

#72309 asks to add manualpathconcat and packagelevelmutableslicemap to CI enforcement. manualpathconcat's known bug is now fixed (see above), but packagelevelmutableslicemap flags package-level slice/map mutation anywhere in the repo - a pattern with an unknown, potentially large violation surface across a codebase this size. go build/go test/go version/make fmt were all denied outright by this run's Bash sandbox (consistent with R110's experience), so the actual custom linter could not be executed to confirm zero or an acceptable/triaged set of violations before enabling it in CI. Enabling an unverified repo-wide analyzer blind risks breaking CI immediately. readerstringconv's scope, by contrast, was bounded to exactly 3 named production call sites (re-confirmed via a fresh repo-wide Grep sweep - all other matches are in _test.go files, the linter's own testdata, or a doc comment, all correctly out of scan scope) plus one CI config line, making it verifiable without a Go toolchain.

Validation (sandbox limitations)

go build/go test/go version were denied outright by the Bash permission layer this run. Validated instead via:

• serena get_diagnostics_for_file (gopls-backed, language server confirmed ready) on all 3 modified files - zero compile/type errors (2 pre-existing, unrelated hints remain in experiments_fetch.go, predating this change).
• Manual import-usage check confirming strings is still used elsewhere in all 3 files and bytes was only added where missing (work_queue_memory.go already imported it).
• A full repo-wide Grep re-scan for both readerstringconv-flagged call shapes, confirming no other production sites exist that CI enforcement would newly catch.

A maintainer should run go test ./pkg/cli/... ./pkg/workflow/... ./pkg/linters/readerstringconv/... and the native+wasm make golint-custom targets for a real green/red signal, since this sandbox could not execute the Go toolchain.

Next actions

• Maintainer: run the Go test suite and golint-custom targets on the new PR before merge.
• Re-check #72308 for closure once confirmed the fix is genuinely on main (already verified this run).
• #72309 (packagelevelmutableslicemap + manualpathconcat CI enablement) remains open, blocked on a future run having working go toolchain access to verify the violation surface before enabling blind.

References:

• §40813689240

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · ~224 AIC · ⌖ ~1 AIC · ⊞ 4.2K · ◷

• expires on Oct 29, 2026, 7:56 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Sergo - Serena Go Expert.

A newer discussion is available at Discussion #73100.