# PR#12: werkrevisor Asks the Risk Categories That Fit werkprobe

> This document describes the change of this pull request at the time it was made.
> Later pull requests may change the behaviour without updating it.

## The Problem

Since werkrevisor 0.30.0, a repository chooses a template of risk categories in its `.werkrevisor.toml` and tunes it.
Jev then asks each category for each changed file; a category above its threshold holds the PR for a human.
So far the host config on the review machine chooses `jvm-spring-backend` for werkprobe, with all 16 categories.
Several of them ask about things werkprobe does not have.
werkprobe also has no agent instructions and no PR documents, so the workflow of werkrevisor's reviews is not written down here.

## The Solution

- `.werkrevisor.toml` chooses `jvm-spring-backend`.
  This choice replaces the `risk_template` of the host config, which drops it after the merge.
  werkrevisor reads `.werkrevisor.toml` at the head of `main`, so this PR's own review still asks all 16 categories.
  The host config keeps `[path_judge] scope = "all"`, which a repository cannot set: Jev judges every changed file.
- It switches off 8 categories that cannot apply here:
  - werkprobe runs no web server and has no users:
    `authentication`, `authorization`, `object_level_authorization`, `input_validation` and `api_compatibility`.
  - Its databases live in throwaway containers: `schema_migration` and `data_correction`.
  - It has no business rules: `business_invariants`.
- It keeps `sql_injection`, `sensitive_data_exposure`, `transaction_integrity`, `concurrency`, `error_handling`,
  `external_integration`, and the hints `performance` and `architecture`.
- `AGENTS.md` describes the project, the build, the writing style and the pull-request workflow, as in werkcrappit;
  `CLAUDE.md` imports it.
- From this PR on, each PR has a document under `docs/prs/`.

## Measurement

Jev judged the 21 changed files of the 9 merged PRs with all 16 categories.
No category reached its threshold in the template: 0.95 for most, 0.9 for `concurrency` and 0.85 for `data_correction`.
The highest values were `architecture` 0.68 (a hint), `data_correction` 0.54 and `concurrency` 0.34.
So switching off categories hides no finding of the past PRs; the reasons to switch them off are the ones above.
`.werkrevisor.toml` can also change a threshold, but nine PRs are too few for that, so this PR changes none.

## Related Links

- [werkcrappit PR#46](https://git.javagil.de/mi/werkcrappit/pulls/46): the same change for werkcrappit.
- [werkrevisor PR#63](https://git.javagil.de/mi/werkrevisor/pulls/63): each repository chooses and tunes its risk categories.