4.1 KiB
4.1 KiB
Criticality and Risk Analysis of werkregie
The section "Required Checks" of agentic-workflow.md requires this document. Only the human sets or changes the criticality.
Criticality
high, set by the human on 2026-10-13.
- The server is reachable from the internet, at https://werkregie.javagil.de.
- It holds credentials of other systems: Gitea tokens, the Taiga password, Werkator's control token.
- It shows excerpts of private work: Claude Code transcripts, Matrix messages, private repositories.
So a known vulnerability of a dependency fails the build from CVSS 4.
What werkregie Handles
- Server on mih09:
- data: pull requests, builds, review costs, Taiga items, the relays' reports, the Werkjournal of 400 days;
- credentials: the access token, Gitea tokens, the Taiga password, Werkator's control token, the OpenRouter key.
- Werkator on mih09: the deploy key, which opens nothing but the receiver of the runtime bundle.
- Relay on think:
- data: Claude Code and Codex sessions, the ends of their transcripts, Matrix messages;
- credentials: the relay's copy of the access token, the Matrix device session and its keys, the Jev key.
- Browser: the last state of the dashboard in
localStorage, and the access token as cookie.
Texts leave the machines only to the server, to Jev (at most 3000 characters of a message), and to OpenRouter (tooltip texts over 160 characters).
Who Reaches It
- Anyone on the internet reaches the server through Hostsharing's Apache, which terminates TLS. Without the access token, the server shows invented demo data only.
- The access token is 24 random bytes, compared in constant time; the relay endpoint refuses the cookie.
- The server binds to 127.0.0.1; the relay only sends, nothing from the network reaches into it.
- werkregie only reads the tools it shows; it writes only its own state,
and reactions and messages into Matrix by
matrix reactandmatrix send, which only a process of the user on the relay's machine can run, asmatrix read: the relay takes them on the socketcontrol.sockin the directory of the device's keys (0700, the socket 0600), and only these three commands. - Werkator's build
deployreaches the server's user over ssh, with a key whose forced command is the receiver; it installs only a commit ofmainwhose build was green.
What a Breach Would Cost
- Read access to the Gitea instances, Taiga and Werkator in the name of the user.
- Disclosure of private work, of customers' names in the Werkjournal, and of Matrix messages.
- No money and no production data of customers: werkregie writes to no other system but Matrix, and there only reactions.
Risks
| Risk | Measure |
|---|---|
| a vulnerable dependency, e.g. of Jackson, Ktor or Trixnity | OWASP Dependency-Check from CVSS 4: a PR's own, main each night |
| a dependency under a license the user cannot accept | license check against the allowlist in each build |
| the access token leaks, e.g. through a script on the page | no foreign scripts, each text escaped; rotate by deleting |
| a cross-site request with the cookie of a logged-in browser | writing endpoints take the token only as bearer header |
| native code, sqlite-jdbc and vodozemac | both under OWASP Dependency-Check; updated with the other libraries |
| a wrong reaction in a Matrix room, e.g. on the wrong announcement | only own messages, the text not followed by a letter or digit; no reaction twice |
another process on the relay's machine sends reactions or messages, or reads rooms, through control.sock |
only processes of the user reach the socket, which could run the commands themselves; it takes only react, send and read |
| an agent sends a wrong message into a room | plain text only, sent in the user's name; the agent asks the human before each message |
| a change whose tests do not check it | mutation tests with werkcrappit: the changed classes in each build, all of main each night |
Open risk: the server sends no security headers, e.g. Content-Security-Policy or Strict-Transport-Security.
Deviations from the Defaults of the Required Checks
- None.