go-concurrency-safety

Injectable Skill: Go Concurrency Safety

L1 trigger: L1_PATTERN=true AND target language = Go Inject Into: Every L1 depth agent working on Go code, in addition to the main skill Finding prefix: [GO-N] Status: v0.1 draft, Round 4 exemplars pending

When This Skill Activates

Supplement to the main L1 skills when the target is written in Go. It codifies the Go-specific traps that turn otherwise-correct logic into production bugs. These are drawn from the Cosmos-SDK, Geth, Erigon, and CometBFT bug histories.

1. Map Iteration Non-Determinism

Go maps iterate in unspecified order. Production bug class: any consensus computation that ranges over a map[K]V and uses the order in its output will produce different results on different nodes.

Detection:

• Ast-grep for $_, $_ := range $MAP where $MAP is declared as map[...]...
• For each hit in a consensus-critical path, check if the iteration result affects any stored state, signed message, or hash input

Fix pattern:

keys := make([]string, 0, len(m))
for k := range m {
    keys = append(keys, k)
}
sort.Strings(keys)
for _, k := range keys {
    v := m[k]
    // use (k, v)
}

Alternative: use btree or sort.SliceStable on a converted slice.

Tag: [GO-MAP-ITER:{loc}:{consumer}]

2. Goroutine Leaks

Goroutines that are started but never terminated. Over hours/days, a leak accumulates and eventually OOMs the node.

Common patterns:

• Goroutine blocked on <-ch where the sender path can return without sending
• Goroutine blocked on http.Get / network call without context timeout
• Goroutine in a for loop without a cancellation check
• Goroutine spawned inside a handler that outlives the handler's parent context

Detection:

• Ast-grep go $FUNC(...) / go func() { ... }()
• For each, trace the function body: is there a termination condition? Is it guaranteed to fire?
• Check every select inside: does it have a case <-ctx.Done()?

Tag: [GO-GOROUTINE-LEAK:{spawn-loc}:{blocked-on}]