werkregie/doc/prs/2026-10-10-PR#10-werkrevisor-rules.md

PR#10: werkrevisor Asks the Risk Categories That Fit werkregie

WARNING: This document describes only the change applied in this PR. It may already be outdated once the next PR is merged. Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.

Related Links

• werkrevisor PR#79: the host config for werkregie.

Problem

werkrevisor reviews werkregie with its host config, which asks Jev only whether a file touches security or weakens the checks. The risk template jvm-spring-backend names the risk more precisely, but some of its categories do not fit a dashboard with one user.

Non-Goals

• No own category for werkregie yet.

Solution

• .werkrevisor.toml chooses jvm-spring-backend and switches off object_level_authorization, transaction_integrity and business_invariants: the dashboard has one user and no business transactions. It does run SQL on Codex' SQLite state and stores the Matrix session in H2, so the categories on SQL, schema and stored data stay.
• Measured with Jev on the 28 changed files of werkregie PR#2, #5, #6, #8 and #9: only PR#8, the Matrix login with the user's own account, reached a threshold (authentication 0.98, security 0.97); the closest other value was error_handling 0.94 on dashboard/gradlew.bat, below its 0.95.
• The Werkbaum sets #ops.werkator to [^] and #ops.werkrevisor to [~].
• Version 0.4.2 of the dashboard.

Additional Changes

• The first Werkator build of werkregie failed: its build sandbox has Debian's OpenJDK, not Temurin. The runtime bundle needs Temurin, whose JRE starts on Hostsharing's hosts with their older glibc. As in Werkator, the Foojay resolver in dashboard/settings.gradle.kts lets Gradle download Temurin 21; version 1.0.0, since 0.8.0 fails on Gradle 9.