[sergo] Sergo Report: Workflow-Permission-Block Discovery & PR Correction - 2026-10-30

[github-actions[bot]]

Overview

Run R112. Serena 24 tools STABLE, Go/TypeScript/Bash language servers ready. Registry STABLE at 85 analyzers (no new linter since R108). Reconcile returned 4 open sergo issues instead of the 2 predicted by the prior run - chasing down the extra one uncovered a systemic, repo-wide process bug in how this workflow ships CI-enforcement changes.

Key finding: R111's "delivered" PR never actually landed

The prior run (R111) reported fixing the 3 readerstringconv production call sites and adding -readerstringconv to .github/workflows/cgo.yml, then opening a PR. That PR never existed. Because the payload modified a file under .github/workflows/, the git push was rejected - this workflow's GitHub App credentials lack the workflows permission scope needed to create or update workflow YAML. safeoutputs silently converted the failed PR into issue #72856 with manual apply instructions instead of surfacing a hard failure. Re-reading the 3 target files on main this run confirmed all three (pkg/cli/secret_set_command.go:283, pkg/workflow/work_queue_memory.go:159, pkg/cli/experiments_fetch.go:88) were still unfixed.

This is now a standing rule for every future run: never include a .github/workflows/*.yml edit in a create_pull_request payload from this workflow. Any CI-enforcement change (adding a linter flag to cgo.yml) must ship as a code-only PR plus a separate note for a maintainer with workflow-write credentials - it can never land as a bot-authored PR here. This retroactively confirms open issue #72309 (enabling 2 more linters in cgo.yml) is permanently issue-only too.

This run's fix

Redid the readerstringconv fix as a code-only PR, deliberately excluding cgo.yml:

• pkg/cli/secret_set_command.go:283
• pkg/workflow/work_queue_memory.go:159
• pkg/cli/experiments_fetch.go:88

All three replace strings.NewReader(string(x)) with bytes.NewReader(x), removing an unnecessary byte<->string copy. Validated via serena get_diagnostics_for_file (zero diagnostics on all 3 files) and a fresh repo-wide Grep sweep confirming no other production call sites of this shape remain. PR opened on branch sergo/readerstringconv-nonworkflow-r112, referencing #71997 and #72856.

Reconcile summary

• readerstringconv (85th linter, day-one): correct and paren/alias-safe, but not yet CI-enforced with 3 live production call sites #71997 / fix(readerstringconv): use non-copying reader constructors and enable CI enforcement #72856 (readerstringconv) - code half addressed by this run's PR; CI-enforcement half remains blocked on workflow-write credentials.
• 2 of 4 linters recommended safe-to-enforce in #55311 (closed completed) were never added to cgo.yml #72309 (2 linters never CI-enforced) - unaddressed, permanently blocked for the same reason.
• manualpathconcat: parenthesized "/" separator and compound-assign RHS escape detection (paren_unwrap_gap) #72308 (manualpathconcat paren_unwrap_gap) - re-verified the code fix is genuinely live on main (commit d3124f02); the issue itself just has no way to auto-close since this workflow has no close_issue safe output. No action needed.

Strategy split (50/50)

Cached-reuse (50%): standard reconcile-by-reading-code practice (never trust issue/PR state alone) plus the now-standard PR-delivery mode from R110/R111.

New exploration (50%): investigating why the reconcile count didn't match prediction, which led directly to discovering the workflow_permission_block failure mode - a new pattern class with repo-wide implications for every future CI-enforcement finding, not just this one.

Metrics

• Total runs: 112 (cumulative)
• Findings this run: 1 (process-level, high leverage)
• Tasks generated: 1
• PRs delivered: 1 (sergo/readerstringconv-nonworkflow-r112)
• Success score: 7/10 (corrective run rather than a fresh bug discovery, but prevents repeat-wasted-effort on every future CI-enforcement attempt)

Next-run focus

• Verify the sergo/readerstringconv-nonworkflow-r112 PR actually merges (check file content directly, never trust PR/issue state alone - this run showed both false-positive and false-negative failure modes of that same shortcut).
• Do not reattempt 2 of 4 linters recommended safe-to-enforce in #55311 (closed completed) were never added to cgo.yml #72309 or the CI-enforcement half of readerstringconv (85th linter, day-one): correct and paren/alias-safe, but not yet CI-enforced with 3 live production call sites #71997/fix(readerstringconv): use non-copying reader constructors and enable CI enforcement #72856 as a PR; they are issue-only until a maintainer with workflow-write credentials acts.
• Resume normal new-linter watch (registry stable at 85; watch for an 86th via gh api commits?path=pkg/linters/registry.go).

References:

• §40998920205 (this run)

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · ~195 AIC · ⌖ ~1 AIC · ⊞ 4.2K · ◷

• expires on Oct 30, 2026, 7:55 PM UTC-08:00