# werkrevisor rules for werkkompass; werkrevisor reads this file at the head of the default branch, never from a PR,
# and every change of it needs a human review.

[path_judge]
# One static HTML file with plain JavaScript; the frontend template is the closest one.
risk_template = "typescript-frontend"

# The page has no login, no tokens, no backend API and no forms that submit data.
[[risk.categories]]
name = "token_handling"
action = "off"

[[risk.categories]]
name = "csrf_credentials"
action = "off"

[[risk.categories]]
name = "api_contract"
action = "off"

[[risk.categories]]
name = "form_data_integrity"
action = "off"

# Only the human sets the levels of the required checks (docs/agentic-workflow.md, "Required Checks"),
# so a change of the risk analysis that sets them always waits for the human.
# The repository's paths replace the host's, so its paths for secrets stand here too.
[hard_yellow]
paths = [
    "**/*secret*", "**/*.pem", "**/*.key", ".env*", ".envrc",
    "docs/risk-analysis.md",
]