The shared agentic workflow, and the required checks for Go (0.12.1) #15
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: mi/werkdock#15
Reference in New Issue
Block a user
Brings the shared agentic workflow of the Werk family into werkdock; see the PR document under docs/prs/.
🤖 Generated with Claude Code
WIP: The shared agentic workflowto The shared agentic workflow, and the required checks for Go (0.12.1)🟠 werkrevisor ORANGE for
7a3f806, superseded by the result for7d81221🟠 werkrevisor: ORANGE / FINDINGS
Change kind:
mixed.Reasons
govulncheckfindings are treated as calls, allowing a branch that introduces a real call to an already-present vulnerable symbol to evade the merge-base comparison.Findings
[high] Findings Rejected at
tools/vulncheck/main.go:102-104, ORANGE, as a line comment[high] Call Misclassification at
tools/vulncheck/main.go:165-167, ORANGE, as a line commentClassifier
8 of 8 units passed all questions (1 PR document(s)).
Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 35655, calls 1, tokens in 34354 / out 17533 (reasoning included in out), duration 146.6 s, cost 0.0313 USD (reported), classifier `jev-1.13.0` calls 8, tokens in 6427, cost 0.0003 USD, finding judge `jev-1.13.0` calls 2, tokens in 2706, cost 0.0001 USD, build file judge `jev-1.13.0` calls 5, tokens in 6539, cost 0.0003 USD, phases: path_judge 0.5 s, classifier 0.5 s, context 0.4 s, model_review 143.9 s, finding_judge 0.2 s, config: defaults + host.2 answers ignored because of a confidence below [classifier] min_confidence.
Reviewed head `7a3f80646713a43cb71469223295adf514a214d2` against base `ea30cbe79c10e3ef201e36c8e703ed7a5a0b4641`, werkrevisor 0.54.1.
werkrevisor: ORANGE / FINDINGS for
7a3f80646713a43cb71469223295adf514a214d2.The result comment of werkrevisor holds the details.
@@ -8,3 +7,1 @@that changes behavior sets the version in `internal/cli/cli.go` (what`werkdock version` prints) and titles its section here with that version andthe merge date, before it is merged. Nothing on main is ever "unreleased".A release is a merge to main; there is no separate release step. So eachWriting rule: more than one sentence on a line (werkrevisor writing rule)
Fix the line, or reply why it stays, and resolve this comment.
Stays: CHANGELOG.md wraps its prose at 72 columns in every section since 0.2.0; one sentence per line in two sections only would break that.
Since
7d81221, the writing rules of.werkrevisor.tomlleave out CHANGELOG.md.@@ -11,0 +7,4 @@A release is a merge to main; there is no separate release step. So eachbranch sets the version in `internal/cli/cli.go` (what `werkdock version`prints) and titles its section here with that version and the merge date,before it is merged. Nothing on main is ever "unreleased". A branch thatWriting rule: more than one sentence on a line (werkrevisor writing rule)
Fix the line, or reply why it stays, and resolve this comment.
Stays: CHANGELOG.md wraps its prose at 72 columns in every section since 0.2.0; one sentence per line in two sections only would break that.
Since
7d81221, the writing rules of.werkrevisor.tomlleave out CHANGELOG.md.@@ -11,0 +14,4 @@Internal: werkdock follows the shared agentic workflow of the Werkrepositories, with reviews by werkrevisor, and its build checks thelicenses and the called vulnerabilities of its dependencies. The CLI isWriting rule: more than one sentence on a line (werkrevisor writing rule)
Fix the line, or reply why it stays, and resolve this comment.
Stays: CHANGELOG.md wraps its prose at 72 columns in every section since 0.2.0; one sentence per line in two sections only would break that.
Since
7d81221, the writing rules of.werkrevisor.tomlleave out CHANGELOG.md.@@ -0,0 +99,4 @@cmd := exec.Command("go", "run", govulncheck, "-format", "json", "./...")cmd.Dir = dircmd.Stderr = os.Stderrstdout, err := cmd.Output()[high] Findings Rejected (werkrevisor)
ORANGE; Jev: real 0.86, severity 3.0 of 3
govulncheckexits nonzero when its report contains vulnerability findings, even in JSON mode, while still producing the JSON stream.scantreats anycmd.Outputerror as a tool failure and discards that stream before parsing it. Since currentmainalready has called vulnerabilities, even-baseaborts atHEADbefore baseline filtering, and an excepted vulnerability cannot be suppressed.Does not hold, no change.
govulncheck v1.8.0,
cmd/govulncheck/doc.go, "Exit codes": it "exits successfully if the 'format -json' ... is provided, regardless of the number of detected vulnerabilities".Measured: on this branch, whose merge base has 7 called vulnerabilities of the standard library of go1.26.8,
go run ./tools/vulncheckprinted all 7 and failed with its own message, and the CI builddependenciesof275f619and7a3f806parsed the stream and passed with "vulncheck: no called vulnerability".A nonzero exit of govulncheck therefore means that the scan itself failed, and then the check must fail.
@@ -0,0 +162,4 @@if f.FixedVersion != "" {v.Fixed = f.FixedVersion}if len(f.Trace) > 0 && f.Trace[0].Function != "" {[high] Call Misclassification (werkrevisor)
ORANGE; Jev: real 0.82, severity 2.9 of 3
govulncheckemits symbol-level findings with a function in the first trace frame as well as call-level findings with caller frames. A symbol-only finding does not mean that the function is invoked, but this marks it as called. If the merge base has a symbol-level finding and HEAD adds a real call under the same OSV ID, the baseline comparison skips the newly reachable vulnerability. Add symbol-only test coverage and distinguish call-level findings.Does not hold, no change.
govulncheck emits module, package and symbol level findings; a symbol level finding, the only one with
functionin the first frame, is emitted when the code calls a vulnerable symbol (internal/govulncheck/govulncheck.go,type Finding: "Multiple symbol level findings can be emitted when multiple symbols of the same vuln are called").The scenario, a second call to a vulnerability that the merge base already calls, is intended: the shared workflow fails a PR only on what it brings, "a vulnerability found anew in a dependency of main must not stop unrelated work", and the nightly build
vulnerability-datareports it on main.TestParseMarksOnlyCalledVulnerabilitiescovers a package level finding without a function.🟡 werkrevisor YELLOW for
7d81221, superseded by the result forf170544🟡 werkrevisor: YELLOW / HUMAN_REVIEW
Change kind:
mixed.Reasons
Findings
[medium] Documentation Inconsistency at
docs/prs/2026-10-20-PR#15-agentic-workflow.md:33hint; Jev: real 0.89, severity 1.8 of 3
The PR document states "docs/agentic-workflow.md is the master copy of werkregie," but the agentic-workflow.md file itself says "werkregie holds the master copy, as doc/agentic-workflow.md." The werkdock file is a copy of the master located in werkregie, not the master itself (notice the differing path:
doc/in werkregie vs.docs/here). A reader who takes the PR document at face value could believe edits to the werkdock file propagate to other repositories, when in fact each repository keeps its own copy and the master lives in werkregie. The wording contradicts the cross-reference in the agentic-workflow.md and the PR document's own Related Links section, which points to werkregie'sdoc/agentic-workflow.mdas the master.Classifier
8 of 8 units passed all questions (1 PR document(s)).
Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 35850, calls 1, tokens in 34521 / out 19368 (reasoning included in out), duration 103.6 s, cost 0.0336 USD (reported), classifier `jev-1.13.0` calls 8, tokens in 6449, cost 0.0003 USD, finding judge `jev-1.13.0` calls 1, tokens in 1796, cost 0.0001 USD, build file judge `jev-1.13.0` calls 5, tokens in 6539, cost 0.0003 USD, phases: path_judge 0.5 s, classifier 0.5 s, context 0.3 s, model_review 101.3 s, finding_judge 0.2 s, config: defaults + host.2 answers ignored because of a confidence below [classifier] min_confidence.
Reviewed head `7d81221d2d722495443b218457d3e4ec70dfb85c` against base `ea30cbe79c10e3ef201e36c8e703ed7a5a0b4641`, werkrevisor 0.54.1.
🟠 werkrevisor ORANGE for
f170544, superseded by the result for5b81e7d🟠 werkrevisor: ORANGE / FINDINGS
Change kind:
mixed.Reasons
verdictsuppresses all head findings for an OSV ID whenever any finding for that ID was called at the merge base. A changed Go or dependency version that remains covered by the advisory, or a newly reachable symbol covered by the same advisory, can therefore pass the branch vulnerability check.Findings
[high] Advisory Collision at
tools/vulncheck/main.go:89-90, ORANGE, as a line comment[medium] Conflicting Release Rule at
docs/prs/README.md:3-4hint; Jev: real 0.60, severity 2.0 of 3
This guide says every PR must have a document, while
docs/agentic-workflow.mdexplicitly says a pure release PR needs none when the build does not derive its version.werkdockkeepsVersionmanually, so a version-and-changelog-only PR gives agents contradictory instructions, and no automated presence check resolves the conflict. State which rule werkdock uses consistently.[low] Changelog History at
docs/prs/2026-10-20-PR#15-agentic-workflow.md:90-91hint
The
Additional Changessection calls this the introduction ofCHANGELOG.md, but the file and its earlier release already exist in the base. This PR only changes the policy text and adds the 0.12.1 section, so the snapshot misstates when the changelog process began. Describe it as an update to the existing changelog.Classifier
8 of 8 units passed all questions (1 PR document(s)).
Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 35860, calls 1, tokens in 34553 / out 40854 (reasoning included in out), duration 315.4 s, cost 0.0594 USD (reported), classifier `jev-1.13.0` calls 8, tokens in 6462, cost 0.0003 USD, finding judge `jev-1.13.0` calls 2, tokens in 2266, cost 0.0001 USD, build file judge `jev-1.13.0` calls 5, tokens in 6539, cost 0.0003 USD, phases: path_judge 0.5 s, classifier 0.5 s, context 0.4 s, model_review 313.1 s, finding_judge 0.3 s, config: defaults + host.2 answers ignored because of a confidence below [classifier] min_confidence.
Reviewed head `f170544f1956cc823483d2be14cf92d3492e8b78` against base `ea30cbe79c10e3ef201e36c8e703ed7a5a0b4641`, werkrevisor 0.54.1.
werkrevisor: ORANGE / FINDINGS for
f170544f1956cc823483d2be14cf92d3492e8b78.The result comment of werkrevisor holds the details.
@@ -0,0 +86,4 @@if !v.Called || exceptions[id] != "" {continue}if baseline != nil && baseline[id].Called {[high] Advisory Collision (werkrevisor)
ORANGE; Jev: real 0.85, severity 3.0 of 3
parsecollapses every symbol-level finding for one OSV ID into a singleCalledflag, andverdictskips the ID whenever that flag is true in the baseline. If the merge base already calls one affected symbol and the branch newly calls another under the same advisory, or updates Go or a dependency to another affected version, the head finding is treated as pre-existing and the branch passes. Preserve the module, version, package, and function identity when comparing findings, and add a same-ID collision test.Fixed in
5b81e7d: a call is now module@version package.function; with -base, a branch fails on each call that the merge base lacks, so another symbol of the same advisory or another affected version fails. New test TestVerdictWithBaselineFailsOnAnotherCallOfTheSameAdvisory covers both cases.🟡 werkrevisor: YELLOW / HUMAN_REVIEW
Change kind:
mixed.Reasons
Classifier
8 of 8 units passed all questions (1 PR document(s)).
Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 37141, calls 1, tokens in 35737 / out 34275 (reasoning included in out), duration 223.1 s, cost 0.0518 USD (reported), classifier `jev-1.13.0` calls 8, tokens in 6494, cost 0.0003 USD, build file judge `jev-1.13.0` calls 5, tokens in 7054, cost 0.0003 USD, phases: path_judge 0.4 s, classifier 0.5 s, context 0.4 s, model_review 221.2 s, config: defaults + host.2 answers ignored because of a confidence below [classifier] min_confidence.
Reviewed head `5b81e7d02b1efe251c0639fd86997b9739d69637` against base `ea30cbe79c10e3ef201e36c8e703ed7a5a0b4641`, werkrevisor 0.54.1.