claude
a926383827
The 2026-08-10 audit asked for three analyzers. V-682 wired the first as `make vuln`. The other two were still absent: neither was installed on the box and no target ran them, so every reachability claim in the audit stood unchecked. `make lint` runs staticcheck v0.7.0 and `make deadcode` runs deadcode v0.48.0. Both are pinned in the Makefile beside GO_VERSION and installed into deps/bin the way govulncheck is, because a tool is not a dependency of the module. Both carry the CGO env `test` carries, or the four CGO daemons fail to load and the analyzer reports a build error instead of a finding. `make analyze` runs all three. None joins `make test`: they install over the network and `test` has to pass on a box with no route out. Neither reports zero, so neither fails on its own output. staticcheck finds 20 and deadcode finds 13, and the audit asked for an allowlist by name, because three of deadcode's eleven production symbols are deliberate and an unannotated list invites deleting them. The accepted set lives in scripts/analyzers/*.baseline, one line per finding with the reason it stays, and scripts/analyzer-gate.sh gives the verdict. A key holds file, check id and message, never a line number: a line number goes stale on the next edit above it, and a gate that reports moved findings as new ones teaches the reader to skip it. An entry whose finding is gone also fails, so a fix that leaves its line behind does not pass. deadcode runs with -test, because a test is a caller. Without the flag the report is 172 lines, most of internal/router/eval, and none of it is a mistake. With it, the 11 symbols the audit listed come back exactly, plus two test helpers it did not count. Three staticcheck findings were checked and are false positives, recorded as such: the iCal determinism test must call RenderICal twice, the morning hedge loop breaks after the first rune on purpose, and the SA9009 line is prose about //go:embed with the real directive below it. One is V-687 already. The remaining 17 are V-701 with the judgement on each. The analyzers caveat is deleted rather than edited. What replaces it is the limit that is now true: the gates are green against a baseline, not against zero.
47 lines
3.8 KiB
Plaintext
47 lines
3.8 KiB
Plaintext
# staticcheck — the findings this repo accepts today.
|
|
#
|
|
# Keyed "<file>\t<check>\t<message>", tab separated, no line numbers.
|
|
# Generated from the first gated run on 2026-08-11 and edited by hand since.
|
|
# `make lint` fails on anything absent here and on any entry left behind after
|
|
# its finding is fixed, so emptying this file is done one line at a time.
|
|
#
|
|
# The sweep that empties it is V-701, which carries the judgement on each
|
|
# entry. What follows is the short reason only.
|
|
|
|
# V-687. The dedupe check runs after the phraser has already been paid.
|
|
cmd/mavend/tick_digest.go SA4006 this value of deduped is never used
|
|
|
|
# V-686, the eleven unreachable symbols the 2026-08-10 audit listed, seen from
|
|
# the other side. Three of them must stay: docs/caveats/layering.md#deadcode.
|
|
cmd/mavend/replier_llm_test.go U1000 func assertStub is unused
|
|
cmd/mavwaked/vad_test.go U1000 func frameRMSQuick is unused
|
|
cmd/mavweb/handlers_test.go U1000 field signalErr is unused
|
|
internal/voice/errors.go U1000 func jsonMarshal is unused
|
|
internal/voice/errors.go U1000 func jsonUnmarshal is unused
|
|
|
|
# False positives, checked. The code is right and the check cannot see why.
|
|
# RenderICal is called twice because rendering twice is the assertion. The
|
|
# morning loop reads the first rune after the hedge and breaks on purpose. The
|
|
# task_phrases line is prose about //go:embed and the real directive is below it.
|
|
internal/calendar/ical_render_test.go SA4000 identical expressions on the left and right side of the '!=' operator
|
|
internal/morning/plan_test.go SA4004 the surrounding loop is unconditionally terminated
|
|
internal/router/task_phrases.go SA9009 ineffectual compiler directive due to extraneous space: "// go:embed, so the single-binary deploy is unchanged: the JSON is compiled into"
|
|
|
|
# At EOF the wake loop trims partial and returns, so audio past one frame is
|
|
# dropped. Harmless where it sits, misleading to read. V-701.
|
|
cmd/mavwaked/main.go SA4006 this value of partial is never used
|
|
|
|
# Cosmetic and mechanical. V-701 sweeps them.
|
|
cmd/mavweb/voiceproxy.go ST1013 should use constant http.StatusMethodNotAllowed instead of numeric literal 405
|
|
cmd/mavweb/voiceproxy.go ST1013 should use constant http.StatusServiceUnavailable instead of numeric literal 503
|
|
internal/ipc/client.go S1016 should convert r (type chatResp) to ChatReply instead of using struct literal
|
|
internal/ipc/server.go S1016 should convert reply (type ChatReply) to chatResp instead of using struct literal
|
|
internal/memory/behavior_test.go S1011 should replace loop with obs = append(obs, habitHistory("calendar_event_20260804_standup", time.Tuesday, 10, 0, 3, now)...)
|
|
internal/memory/behavior_test.go S1011 should replace loop with obs = append(obs, habitHistory("cooldown:water", time.Tuesday, 9, 0, 3, now)...)
|
|
cmd/mavend/continuation_test.go SA1012 do not pass a nil Context, even if a function permits it; pass context.TODO if you are unsure about which Context to use
|
|
|
|
# Deprecated since Go 1.25. Replacing it means rewriting both guards on
|
|
# golang.org/x/tools/go/packages, which is a decision and not a sweep.
|
|
internal/ipc/maperr_test.go SA1019 parser.ParseDir has been deprecated since Go 1.25 and an alternative has been available since Go 1.11: ParseDir does not consider build tags when associating files with packages. For precise information about the relationship between packages and files, use golang.org/x/tools/go/packages, which can also optionally parse and type-check the files too.
|
|
internal/phraser/persona_floor_test.go SA1019 parser.ParseDir has been deprecated since Go 1.25 and an alternative has been available since Go 1.11: ParseDir does not consider build tags when associating files with packages. For precise information about the relationship between packages and files, use golang.org/x/tools/go/packages, which can also optionally parse and type-check the files too.
|