werkprobe/docs/prs/2026-10-09-PR#12-risk-categories.md

PR#12: werkrevisor Asks the Risk Categories That Fit werkprobe

This document describes the change of this pull request at the time it was made. Later pull requests may change the behaviour without updating it.

The Problem

Since werkrevisor 0.30.0, a repository chooses a template of risk categories in its .werkrevisor.toml and tunes it. Jev then asks each category for each changed file; a category above its threshold holds the PR for a human. So far the host config on the review machine chooses jvm-spring-backend for werkprobe, with all 16 categories. Several of them ask about things werkprobe does not have. werkprobe also has no agent instructions and no PR documents, so the workflow of werkrevisor's reviews is not written down here.

The Solution

• .werkrevisor.toml chooses jvm-spring-backend. This choice replaces the risk_template of the host config, which drops it after the merge. werkrevisor reads .werkrevisor.toml at the head of main, so this PR's own review still asks all 16 categories. The host config keeps [path_judge] scope = "all", which a repository cannot set: Jev judges every changed file.
• It switches off 8 categories that cannot apply here:
  • werkprobe runs no web server and has no users: authentication, authorization, object_level_authorization, input_validation and api_compatibility.
  • Its databases live in throwaway containers: schema_migration and data_correction.
  • It has no business rules: business_invariants.
• It keeps sql_injection, sensitive_data_exposure, transaction_integrity, concurrency, error_handling, external_integration, and the hints performance and architecture.
• AGENTS.md describes the project, the build, the writing style and the pull-request workflow, as in werkcrappit; CLAUDE.md imports it.
• From this PR on, each PR has a document under docs/prs/.

Measurement

Jev judged the 21 changed files of the 9 merged PRs with all 16 categories. No category reached its threshold in the template: 0.95 for most, 0.9 for concurrency and 0.85 for data_correction. The highest values were architecture 0.68 (a hint), data_correction 0.54 and concurrency 0.34. So switching off categories hides no finding of the past PRs; the reasons to switch them off are the ones above. .werkrevisor.toml can also change a threshold, but nine PRs are too few for that, so this PR changes none.

Related Links

• werkcrappit PR#46: the same change for werkcrappit.
• werkrevisor PR#63: each repository chooses and tunes its risk categories.