# Criticality and Risk Analysis of werkregie

The section "Required Checks" of [agentic-workflow.md](agentic-workflow.md) requires this document.
Only the human sets or changes the criticality.

## Criticality

**high**, set by the human on 2026-10-13.

- The server is reachable from the internet, at https://werkregie.javagil.de.
- It holds credentials of other systems: Gitea tokens, the Taiga password, Werkator's control token.
- It shows excerpts of private work: Claude Code transcripts, Matrix messages, private repositories.

So a known vulnerability of a dependency fails the build from CVSS 4.

## What werkregie Handles

- **Server on mih09:**
  - data: pull requests, builds, review costs, Taiga items, the relays' reports, the Werkjournal of 400 days;
  - credentials: the access token, Gitea tokens, the Taiga password, Werkator's control token, the OpenRouter key.
- **Werkator on mih09:** the deploy key, which opens nothing but the receiver of the runtime bundle.
- **Relay on think:**
  - data: Claude Code and Codex sessions, the ends of their transcripts, Matrix messages;
  - credentials: the relay's copy of the access token, the Matrix device session and its keys, the Jev key.
- **Browser:** the last state of the dashboard in `localStorage`, and the access token as cookie.

Texts leave the machines only to the server, to Jev (at most 3000 characters of a message),
and to OpenRouter (tooltip texts over 160 characters).

## Who Reaches It

- Anyone on the internet reaches the server through Hostsharing's Apache, which terminates TLS.
  Without the access token, the server shows invented demo data only.
- The access token is 24 random bytes, compared in constant time; the relay endpoint refuses the cookie.
- The server binds to 127.0.0.1; the relay only sends, nothing from the network reaches into it.
- werkregie only reads the tools it shows; it writes only its own state,
  and reactions and messages into Matrix by `matrix react` and `matrix send`,
  which only a process of the user on the relay's machine can run, as `matrix read`:
  the relay takes them on the socket `control.sock` in the directory of the device's keys (0700, the socket 0600),
  and only these three commands.
- Werkator's build `deploy` reaches the server's user over ssh, with a key whose forced command is the receiver;
  it installs only a commit of `main` whose build was green.

## What a Breach Would Cost

- Read access to the Gitea instances, Taiga and Werkator in the name of the user.
- Disclosure of private work, of customers' names in the Werkjournal, and of Matrix messages.
- No money and no production data of customers: werkregie writes to no other system but Matrix, and there only reactions.

## Risks

| Risk | Measure |
|------|---------|
| a vulnerable dependency, e.g. of Jackson, Ktor or Trixnity | OWASP Dependency-Check from CVSS 4: a PR's own, main each night |
| a dependency under a license the user cannot accept | license check against the allowlist in each build |
| the access token leaks, e.g. through a script on the page | no foreign scripts, each text escaped; rotate by deleting |
| a cross-site request with the cookie of a logged-in browser | writing endpoints take the token only as bearer header |
| native code, sqlite-jdbc and vodozemac | both under OWASP Dependency-Check; updated with the other libraries |
| a wrong reaction in a Matrix room, e.g. on the wrong announcement | only own messages, the text not followed by a letter or digit; no reaction twice |
| another process on the relay's machine sends reactions or messages, or reads rooms, through `control.sock` | only processes of the user reach the socket, which could run the commands themselves; it takes only `react`, `send` and `read` |
| an agent sends a wrong message into a room | plain text only, sent in the user's name; the agent asks the human before each message |
| a change whose tests do not check it | mutation tests with werkcrappit: the changed classes in each build, all of main each night |

Open risk: the server sends no security headers, e.g. Content-Security-Policy or Strict-Transport-Security.

## Deviations from the Defaults of the Required Checks

- None.