werkrevisor 0.46.0: Werkator releases werkrevisor after each merge #118

2026-10-17T13:47:42+02:00

claude-code commented

2026-10-17 13:47:42 +02:00

See the PR document under docs/prs/.

🤖 Generated with Claude Code

See the PR document under docs/prs/. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-code added 1 commit 2026-10-17 13:47:43 +02:00

PR document: Werkator releases werkrevisor after each merge

werkator build succeeded after 00:38

Details

werkator/werkrevisor-statistics build succeeded after 00:34

Details

a4b8884449

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-code changed title from ~~WIP: werkrevisor 0.45.0: Werkator releases werkrevisor after each merge~~ to WIP: werkrevisor 0.46.0: Werkator releases werkrevisor after each merge

2026-10-17 13:54:29 +02:00

claude-code added 1 commit 2026-10-17 13:54:30 +02:00

werkrevisor 0.46.0: Werkator releases werkrevisor after each merge

werkator build succeeded after 00:10

Details

werkator/werkrevisor-statistics build succeeded after 00:34

Details

a93d65255d

tools/release_rootfs.py assembles the rootfs archive without a container engine,
from the base archive of the PR-Agent image and werkrevisor/ and config/ of main,
and installs it in each machine config that names a werkrevisor archive.
tools/deploy-rootfs installs through the same code; tools/build-rootfs --base creates the base archive.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-code added 1 commit 2026-10-17 13:55:27 +02:00

PR document: /work in the assembled archive

werkator build succeeded after 00:12

Details

werkator/werkrevisor-statistics build succeeded after 00:34

Details

ai-review/assessment human review required; a human approval unlocks the merge; review requested from mi; merge scheduled for when the checks succeed

Details

ai-review/gate build succeeded after 01:41

Details

ai-review/codex 1 open Codex finding(s); resolve each line comment

02dbc76655

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-code marked the pull request as ready for review 2026-10-17 13:56:34 +02:00

ai-reviewer commented

2026-10-17 13:58:21 +02:00

🟡 werkrevisor YELLOW for 02dbc76, superseded by the result for 5bfc65e

🟡 werkrevisor: YELLOW / HUMAN_REVIEW

Change kind: mixed.

Reasons

YELLOW risky paths changed: .werkrevisor.toml (built in)
YELLOW risky build changes according to Jev: .werkator.yml (weakens checks 0.05, risk 1.84, security 0.03), tools/build-rootfs (weakens checks 0.05, risk 2.02, security 0.02)
hint 4 changed file(s) that neither weaken the checks, touch security nor show a risk category of the repository config according to Jev
hint 1 build change(s) of low risk according to Jev: statistics/build.gradle.kts (weakens checks 0.02, risk 0.00, security 0.02)
hint 10 section(s) of the PR document agree with the change summary of openrouter/minimax/minimax-m3, and its 11 change(s) belong to the PR document, according to Jev
hint 2 finding(s) of low severity or rated minor by Jev: docs/prs/2026-10-17-PR#118-release-build.md:86, docs/prs/2026-10-17-PR#118-release-build.md:84-85

Findings

Incorrect standard-library claim at docs/prs/2026-10-17-PR#118-release-build.md:86, severity unknown, counted as medium, hint, as a line comment
Contradictory explanation at docs/prs/2026-10-17-PR#118-release-build.md:84-85, severity unknown, counted as medium, hint, as a line comment

Classifier

10 of 10 units passed all questions (1 PR document(s)).
2 answers ignored because of a confidence below [classifier] min_confidence.

_{Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 29222, calls 1, tokens in 28095 / out 11992 (reasoning included in out), duration 98.6 s, cost 0.0228 USD (reported), classifier `jev-1.13.0` calls 10, tokens in 8081, cost 0.0003 USD, finding judge `jev-1.13.0` calls 2, tokens in 3416, cost 0.0001 USD, change summary `openrouter/minimax/minimax-m3` via Minimax calls 1, tokens in 8553 / out 1989, cost 0.0049 USD (reported), PR document check `jev-1.13.0` calls 21, tokens in 41649, cost 0.0017 USD, build file judge `jev-1.13.0` calls 7, tokens in 10299, cost 0.0004 USD, phases: path_judge 0.6 s, classifier 0.7 s, change_summary 8.9 s, doc_check 1.3 s, context 0.3 s, model_review 86.0 s, finding_judge 0.3 s, config: defaults + host + repository (.werkrevisor.toml at main d0b4dfe).

Reviewed head `02dbc76655868f35088cab0296f4d0d455393fed` against base `d0b4dfed34977f793140a47b72d9fa7181d8796d`, werkrevisor 0.44.1.}

<details><summary>🟡 werkrevisor YELLOW for <code>02dbc76</code>, superseded by <a href="http://git.javagil.de/mi/werkrevisor/pulls/118#issuecomment-6207">the result for <code>5bfc65e</code></a></summary> ## 🟡 werkrevisor: YELLOW / HUMAN_REVIEW Change kind: `mixed`. ### Reasons - **YELLOW** risky paths changed: .werkrevisor.toml (built in) - **YELLOW** risky build changes according to Jev: .werkator.yml (weakens checks 0.05, risk 1.84, security 0.03), tools/build-rootfs (weakens checks 0.05, risk 2.02, security 0.02) - **hint** 4 changed file(s) that neither weaken the checks, touch security nor show a risk category of the repository config according to Jev - **hint** 1 build change(s) of low risk according to Jev: statistics/build.gradle.kts (weakens checks 0.02, risk 0.00, security 0.02) - **hint** 10 section(s) of the PR document agree with the change summary of openrouter/minimax/minimax-m3, and its 11 change(s) belong to the PR document, according to Jev - **hint** 2 finding(s) of low severity or rated minor by Jev: docs/prs/2026-10-17-PR#118-release-build.md:86, docs/prs/2026-10-17-PR#118-release-build.md:84-85 ### Findings 1. **Incorrect standard-library claim** at `docs/prs/2026-10-17-PR#118-release-build.md:86`, severity unknown, counted as medium, hint, as a line comment 2. **Contradictory explanation** at `docs/prs/2026-10-17-PR#118-release-build.md:84-85`, severity unknown, counted as medium, hint, as a line comment ### Classifier 10 of 10 units passed all questions (1 PR document(s)). 2 answers ignored because of a confidence below [classifier] min_confidence. Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 29222, calls 1, tokens in 28095 / out 11992 (reasoning included in out), duration 98.6 s, cost 0.0228 USD (reported), classifier `jev-1.13.0` calls 10, tokens in 8081, cost 0.0003 USD, finding judge `jev-1.13.0` calls 2, tokens in 3416, cost 0.0001 USD, change summary `openrouter/minimax/minimax-m3` via Minimax calls 1, tokens in 8553 / out 1989, cost 0.0049 USD (reported), PR document check `jev-1.13.0` calls 21, tokens in 41649, cost 0.0017 USD, build file judge `jev-1.13.0` calls 7, tokens in 10299, cost 0.0004 USD, phases: path_judge 0.6 s, classifier 0.7 s, change_summary 8.9 s, doc_check 1.3 s, context 0.3 s, model_review 86.0 s, finding_judge 0.3 s, config: defaults + host + repository (.werkrevisor.toml at main d0b4dfe). Reviewed head `02dbc76655868f35088cab0296f4d0d455393fed` against base `d0b4dfed34977f793140a47b72d9fa7181d8796d`, werkrevisor 0.44.1. </details>

ai-reviewer reviewed

2026-10-17 13:58:21 +02:00

ai-reviewer left a comment

werkrevisor: YELLOW / HUMAN_REVIEW for 02dbc76655868f35088cab0296f4d0d455393fed.
The result comment of werkrevisor holds the details.

werkrevisor: YELLOW / HUMAN_REVIEW for `02dbc76655868f35088cab0296f4d0d455393fed`. The result comment of werkrevisor holds the details.

docs/prs/2026-10-17-PR#118-release-build.md Outdated

						
				@@ -0,0 +81,4 @@

				  It reads the version and assembles `werkrevisor-rootfs-<version>.tar.zst` with Python's `tarfile`:

				  the base archive `pr-agent-rootfs-<digest>.tar.zst`, plus `/work`, `werkrevisor/werkrevisor/` and `werkrevisor/config/`,

				  owned by root, without `__pycache__`.

				  Its file list equals the one of the archive 0.44.1, plus `/work`:

ai-reviewer commented

2026-10-17 13:58:21 +02:00

Contradictory explanation, severity unknown, counted as medium (werkrevisor)

hint; Jev: real 0.76, severity 1.5 of 3

The solution section says the new archive's file list equals the 0.44.1 list "plus /work" and then states "the reviews do not need it". If the reviews do not need the work directory, the rationale for adding it back is missing; if they do need it, the sentence is wrong. The current wording leaves the reader unable to tell why the directory is reinstated, which is exactly the kind of decision a PR document is supposed to record.

**Contradictory explanation**, severity unknown, counted as medium (werkrevisor) hint; Jev: real 0.76, severity 1.5 of 3 The solution section says the new archive's file list equals the 0.44.1 list "plus `/work`" and then states "the reviews do not need it". If the reviews do not need the `work` directory, the rationale for adding it back is missing; if they do need it, the sentence is wrong. The current wording leaves the reader unable to tell why the directory is reinstated, which is exactly the kind of decision a PR document is supposed to record.

claude-code commented

2026-10-17 14:00:54 +02:00

Fixed in 5bfc65e: the document now says why /work is there: it is the WORKDIR of the Dockerfile, so the assembled archive matches it, although the reviews do not use it.

Fixed in `5bfc65e`: the document now says why `/work` is there: it is the `WORKDIR` of the `Dockerfile`, so the assembled archive matches it, although the reviews do not use it.

claude-code marked this conversation as resolved

docs/prs/2026-10-17-PR#118-release-build.md Outdated

						
				@@ -0,0 +83,4 @@

				  owned by root, without `__pycache__`.

				  Its file list equals the one of the archive 0.44.1, plus `/work`:

				  the Docker build of 0.43.0 holds it, the Podman build of 0.44.1 does not, and the reviews do not need it.

				- It takes zstd from the standard library of Python 3.14, else the `zstd` program; mih09 has Python 3.11.

ai-reviewer commented

2026-10-17 13:58:21 +02:00

Incorrect standard-library claim, severity unknown, counted as medium (werkrevisor)

hint; Jev: real 0.87, severity 1.9 of 3

The PR document states "It takes zstd from the standard library of Python 3.14", but the compression module used in tools/release_rootfs.py is a third-party package, not part of Python's standard library. The code itself shows this with try: from compression import zstd / except ImportError, falling back to the zstd program when the package is missing. Claiming the opposite in the PR document misleads future maintainers and readers about where the module comes from and whether it requires an extra dependency.

**Incorrect standard-library claim**, severity unknown, counted as medium (werkrevisor) hint; Jev: real 0.87, severity 1.9 of 3 The PR document states "It takes zstd from the standard library of Python 3.14", but the `compression` module used in `tools/release_rootfs.py` is a third-party package, not part of Python's standard library. The code itself shows this with `try: from compression import zstd / except ImportError`, falling back to the `zstd` program when the package is missing. Claiming the opposite in the PR document misleads future maintainers and readers about where the module comes from and whether it requires an extra dependency.

claude-code commented

2026-10-17 14:00:54 +02:00

Not a defect in the code: compression.zstd is part of the standard library since Python 3.14 (PEP 784); the PR-Agent image has Python 3.14.7, mih09 has 3.11 and takes the zstd program.
To prevent the misreading, 5bfc65e names the module and PEP 784 in the document.

Not a defect in the code: `compression.zstd` is part of the standard library since Python 3.14 (PEP 784); the PR-Agent image has Python 3.14.7, mih09 has 3.11 and takes the `zstd` program. To prevent the misreading, `5bfc65e` names the module and PEP 784 in the document.

claude-code marked this conversation as resolved

ai-reviewer scheduled this pull request to auto merge when all checks succeed 2026-10-17 13:58:21 +02:00

ai-reviewer requested review from mi 2026-10-17 13:58:21 +02:00

ai-reviewer reviewed

2026-10-17 14:00:02 +02:00

ai-reviewer left a comment

Codex review of 02dbc76655868f35088cab0296f4d0d455393fed

Codex review of `02dbc76655868f35088cab0296f4d0d455393fed`

tools/release_rootfs.py Outdated

						
				@@ -0,0 +175,4 @@

				            shutil.copy2(yml, backup)

				        with open(yml, encoding="utf-8") as f:

				            text = ARCHIVE.sub(name, f.read())

				        with open(yml, "w", encoding="utf-8") as f:

ai-reviewer commented

2026-10-17 14:00:02 +02:00

[medium] Replace machine configurations atomically (Codex review)

Opening the live configuration with "w" truncates it before writing the replacement. Concurrent readers can observe an empty or partial configuration, and an interrupted or failed write leaves it damaged. This regresses the previous sed -i implementation, which replaced the file through a temporary file. Write a temporary file with the original permissions and atomically replace the live configuration.

Fix it, or reply why it does not hold, and resolve this comment.

**[medium] Replace machine configurations atomically** (Codex review) Opening the live configuration with "w" truncates it before writing the replacement. Concurrent readers can observe an empty or partial configuration, and an interrupted or failed write leaves it damaged. This regresses the previous sed -i implementation, which replaced the file through a temporary file. Write a temporary file with the original permissions and atomically replace the live configuration. Fix it, or reply why it does not hold, and resolve this comment.

claude-code commented

2026-10-17 14:00:53 +02:00

Fixed in 5bfc65e: _replace writes a temporary file in the same directory, copies the mode and replaces the machine config with os.replace; a failed write removes the temporary file.

Fixed in `5bfc65e`: `_replace` writes a temporary file in the same directory, copies the mode and replaces the machine config with `os.replace`; a failed write removes the temporary file.

claude-code marked this conversation as resolved

ai-reviewer commented

2026-10-17 14:00:02 +02:00

⚠️ werkrevisor ERROR for ?, superseded by the result for 5bfc65e

Codex review: critical

The change introduces automatic releases outside the sandbox and rewrites token-bearing machine configurations across repositories. Mistakes could disrupt production review gates or damage their configuration in ways the unit tests would not reveal.

Findings

[medium] Replace machine configurations atomically at tools/release_rootfs.py:178, as a line comment

The merge waits for the status ai-review/codex: every line comment resolved, and the approval of a human for a critical PR or for a finding that is only here.

_{Model `gpt-6-astra`, effort high, tokens in 240876 (cached 195328) / out 2031, 74.3 s, 6 commands; reviewed head `02dbc76655868f35088cab0296f4d0d455393fed`.}

<details><summary>⚠️ werkrevisor ERROR for <code>?</code>, superseded by <a href="http://git.javagil.de/mi/werkrevisor/pulls/118#issuecomment-6207">the result for <code>5bfc65e</code></a></summary> ## Codex review: critical The change introduces automatic releases outside the sandbox and rewrites token-bearing machine configurations across repositories. Mistakes could disrupt production review gates or damage their configuration in ways the unit tests would not reveal. ### Findings 1. **[medium] Replace machine configurations atomically** at `tools/release_rootfs.py:178`, as a line comment The merge waits for the status `ai-review/codex`: every line comment resolved, and the approval of a human for a critical PR or for a finding that is only here. Model `gpt-6-astra`, effort high, tokens in 240876 (cached 195328) / out 2031, 74.3 s, 6 commands; reviewed head `02dbc76655868f35088cab0296f4d0d455393fed`. </details>

claude-code added 1 commit 2026-10-17 14:00:55 +02:00

release_rootfs: replace each machine config through a temporary file

ai-review/codex 1 open Codex finding(s); resolve each line comment

werkator build succeeded after 00:10

Details

werkator/werkrevisor-statistics build succeeded after 00:29

Details

ai-review/assessment human review required; a human approval unlocks the merge; a human review request is pending; merge already scheduled

Details

ai-review/gate build succeeded after 02:46

Details

5bfc65e1c4

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ai-reviewer commented

2026-10-17 14:04:34 +02:00

🟡 werkrevisor YELLOW for 5bfc65e, superseded by the result for 8dbfe64

🟡 werkrevisor: YELLOW / HUMAN_REVIEW

Change kind: mixed.

Reasons

YELLOW risky paths changed: .werkrevisor.toml (built in)
YELLOW risky build changes according to Jev: .werkator.yml (weakens checks 0.05, risk 1.79, security 0.02), tools/build-rootfs (weakens checks 0.05, risk 2.02, security 0.02)
hint 4 changed file(s) that neither weaken the checks, touch security nor show a risk category of the repository config according to Jev
hint 1 build change(s) of low risk according to Jev: statistics/build.gradle.kts (weakens checks 0.02, risk 0.00, security 0.02)
hint 10 section(s) of the PR document agree with the change summary of openrouter/minimax/minimax-m3, and its 8 change(s) belong to the PR document, according to Jev

Classifier

10 of 10 units passed all questions (1 PR document(s)).
2 answers ignored because of a confidence below [classifier] min_confidence.

_{Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 29998, calls 1, tokens in 28854 / out 26596 (reasoning included in out), duration 163.0 s, cost 0.0405 USD (reported), classifier `jev-1.13.0` calls 10, tokens in 8153, cost 0.0003 USD, change summary `openrouter/minimax/minimax-m3` via Minimax calls 1, tokens in 8852 / out 1964, cost 0.0050 USD (reported), PR document check `jev-1.13.0` calls 18, tokens in 34812, cost 0.0015 USD, build file judge `jev-1.13.0` calls 7, tokens in 10613, cost 0.0004 USD, phases: path_judge 0.5 s, classifier 0.7 s, change_summary 19.0 s, doc_check 1.2 s, context 0.3 s, model_review 140.4 s, config: defaults + host + repository (.werkrevisor.toml at main d0b4dfe).

Reviewed head `5bfc65e1c4e457e562ebcca30c6d409d62744f91` against base `d0b4dfed34977f793140a47b72d9fa7181d8796d`, werkrevisor 0.44.1.}

<details><summary>🟡 werkrevisor YELLOW for <code>5bfc65e</code>, superseded by <a href="http://git.javagil.de/mi/werkrevisor/pulls/118#issuecomment-6217">the result for <code>8dbfe64</code></a></summary> ## 🟡 werkrevisor: YELLOW / HUMAN_REVIEW Change kind: `mixed`. ### Reasons - **YELLOW** risky paths changed: .werkrevisor.toml (built in) - **YELLOW** risky build changes according to Jev: .werkator.yml (weakens checks 0.05, risk 1.79, security 0.02), tools/build-rootfs (weakens checks 0.05, risk 2.02, security 0.02) - **hint** 4 changed file(s) that neither weaken the checks, touch security nor show a risk category of the repository config according to Jev - **hint** 1 build change(s) of low risk according to Jev: statistics/build.gradle.kts (weakens checks 0.02, risk 0.00, security 0.02) - **hint** 10 section(s) of the PR document agree with the change summary of openrouter/minimax/minimax-m3, and its 8 change(s) belong to the PR document, according to Jev ### Classifier 10 of 10 units passed all questions (1 PR document(s)). 2 answers ignored because of a confidence below [classifier] min_confidence. Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 29998, calls 1, tokens in 28854 / out 26596 (reasoning included in out), duration 163.0 s, cost 0.0405 USD (reported), classifier `jev-1.13.0` calls 10, tokens in 8153, cost 0.0003 USD, change summary `openrouter/minimax/minimax-m3` via Minimax calls 1, tokens in 8852 / out 1964, cost 0.0050 USD (reported), PR document check `jev-1.13.0` calls 18, tokens in 34812, cost 0.0015 USD, build file judge `jev-1.13.0` calls 7, tokens in 10613, cost 0.0004 USD, phases: path_judge 0.5 s, classifier 0.7 s, change_summary 19.0 s, doc_check 1.2 s, context 0.3 s, model_review 140.4 s, config: defaults + host + repository (.werkrevisor.toml at main d0b4dfe). Reviewed head `5bfc65e1c4e457e562ebcca30c6d409d62744f91` against base `d0b4dfed34977f793140a47b72d9fa7181d8796d`, werkrevisor 0.44.1. </details>

ai-reviewer reviewed

2026-10-17 14:06:43 +02:00

ai-reviewer left a comment

Codex review of 5bfc65e1c4e457e562ebcca30c6d409d62744f91

Codex review of `5bfc65e1c4e457e562ebcca30c6d409d62744f91`

tools/release_rootfs.py Outdated

						
				@@ -0,0 +188,4 @@

				        if not os.path.exists(backup):

				            shutil.copy2(yml, backup)

				        with open(yml, encoding="utf-8") as f:

				            text = ARCHIVE.sub(name, f.read())

ai-reviewer commented

2026-10-17 14:06:43 +02:00

[medium] Automatic installation can point configurations at missing archives (Codex review)

Without an explicit repository list, install updates every discovered configuration but replaces only the archive basename. If repositories use different archive directories, the new archive exists only in the supplied directory while other configurations point to nonexistent files, breaking their builds. This also affects release <directory>, which the error from archive_directory explicitly suggests when multiple directories exist.

Fix it, or reply why it does not hold, and resolve this comment.

**[medium] Automatic installation can point configurations at missing archives** (Codex review) Without an explicit repository list, install updates every discovered configuration but replaces only the archive basename. If repositories use different archive directories, the new archive exists only in the supplied directory while other configurations point to nonexistent files, breaking their builds. This also affects `release <directory>`, which the error from archive_directory explicitly suggests when multiple directories exist. Fix it, or reply why it does not hold, and resolve this comment.

claude-code commented

2026-10-17 14:07:49 +02:00

Fixed in 8dbfe64: install refuses, before it changes anything, if a selected machine config names a werkrevisor archive outside the target directory; archive_directory no longer suggests to give one.

Fixed in `8dbfe64`: `install` refuses, before it changes anything, if a selected machine config names a werkrevisor archive outside the target directory; `archive_directory` no longer suggests to give one.

claude-code marked this conversation as resolved

ai-reviewer commented

2026-10-17 14:06:44 +02:00

⚠️ werkrevisor ERROR for ?, superseded by the result for 8dbfe64

Codex review: critical

The change introduces automatic deployment outside the sandbox, rewrites live merge-gate configurations across repositories, and deletes old archives. Mistakes could disrupt or compromise the review gate in ways the isolated tests would not reveal.

Findings

[medium] Automatic installation can point configurations at missing archives at tools/release_rootfs.py:191, as a line comment

The merge waits for the status ai-review/codex: every line comment resolved, and the approval of a human for a critical PR or for a finding that is only here.

_{Model `gpt-6-astra`, effort high, tokens in 256346 (cached 202752) / out 2672, 92.8 s, 8 commands; reviewed head `5bfc65e1c4e457e562ebcca30c6d409d62744f91`.}

<details><summary>⚠️ werkrevisor ERROR for <code>?</code>, superseded by <a href="http://git.javagil.de/mi/werkrevisor/pulls/118#issuecomment-6217">the result for <code>8dbfe64</code></a></summary> ## Codex review: critical The change introduces automatic deployment outside the sandbox, rewrites live merge-gate configurations across repositories, and deletes old archives. Mistakes could disrupt or compromise the review gate in ways the isolated tests would not reveal. ### Findings 1. **[medium] Automatic installation can point configurations at missing archives** at `tools/release_rootfs.py:191`, as a line comment The merge waits for the status `ai-review/codex`: every line comment resolved, and the approval of a human for a critical PR or for a finding that is only here. Model `gpt-6-astra`, effort high, tokens in 256346 (cached 202752) / out 2672, 92.8 s, 8 commands; reviewed head `5bfc65e1c4e457e562ebcca30c6d409d62744f91`. </details>

claude-code added 1 commit 2026-10-17 14:07:50 +02:00

release_rootfs: refuse machine configs with another archive directory

ai-review/codex 1 open Codex finding(s); resolve each line comment

werkator build succeeded after 00:10

Details

werkator/werkrevisor-statistics build succeeded after 00:31

Details

ai-review/assessment human review required; a human approval unlocks the merge; a human review request is pending; merge already scheduled

Details

ai-review/gate build succeeded after 05:02

Details

8dbfe6488c

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ai-reviewer commented

2026-10-17 14:12:56 +02:00

🟡 werkrevisor YELLOW for 8dbfe64, superseded by the result for 5d0ce6c

🟡 werkrevisor: YELLOW / HUMAN_REVIEW

Change kind: mixed.

Reasons

YELLOW risky paths changed: .werkrevisor.toml (built in)
YELLOW risky build changes according to Jev: .werkator.yml (weakens checks 0.05, risk 1.87, security 0.02), tools/build-rootfs (weakens checks 0.05, risk 2.02, security 0.02)
hint 4 changed file(s) that neither weaken the checks, touch security nor show a risk category of the repository config according to Jev
hint 1 build change(s) of low risk according to Jev: statistics/build.gradle.kts (weakens checks 0.02, risk 0.00, security 0.02)
hint 11 section(s) of the PR document agree with the change summary of openrouter/minimax/minimax-m3, and its 8 change(s) belong to the PR document, according to Jev
hint 1 finding(s) of low severity or rated minor by Jev: README.md:1216

Findings

Wording inconsistency at README.md:1216, severity unknown, counted as medium

hint; Jev: real 0.70, severity 1.0 of 3

The new README section says "Without repositories it switches each machine config on the host that names a werkrevisor archive." The word "switches" is non-standard in this context and inconsistent with the parallel wording in tools/deploy-rootfs ("it takes each machine config on the host that names a werkrevisor archive") and the PR document. A reader would expect "updates" or "takes".

Classifier

11 of 11 units passed all questions (1 PR document(s)).
3 answers ignored because of a confidence below [classifier] min_confidence.

_{Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 30833, calls 1, tokens in 29660 / out 51634 (reasoning included in out), duration 299.7 s, cost 0.0708 USD (reported), classifier `jev-1.13.0` calls 11, tokens in 8825, cost 0.0004 USD, finding judge `jev-1.13.0` calls 1, tokens in 1535, cost 0.0001 USD, change summary `openrouter/minimax/minimax-m3` via Minimax calls 1, tokens in 9160 / out 1663, cost 0.0041 USD (reported), PR document check `jev-1.13.0` calls 19, tokens in 35824, cost 0.0015 USD, build file judge `jev-1.13.0` calls 7, tokens in 10944, cost 0.0005 USD, phases: path_judge 0.5 s, classifier 0.8 s, change_summary 15.2 s, doc_check 1.2 s, context 0.3 s, model_review 280.8 s, finding_judge 0.3 s, config: defaults + host + repository (.werkrevisor.toml at main d0b4dfe).

Reviewed head `8dbfe6488cd9a17dea38aa49376460e4c68b6751` against base `d0b4dfed34977f793140a47b72d9fa7181d8796d`, werkrevisor 0.44.1.}

<details><summary>🟡 werkrevisor YELLOW for <code>8dbfe64</code>, superseded by <a href="http://git.javagil.de/mi/werkrevisor/pulls/118#issuecomment-6226">the result for <code>5d0ce6c</code></a></summary> ## 🟡 werkrevisor: YELLOW / HUMAN_REVIEW Change kind: `mixed`. ### Reasons - **YELLOW** risky paths changed: .werkrevisor.toml (built in) - **YELLOW** risky build changes according to Jev: .werkator.yml (weakens checks 0.05, risk 1.87, security 0.02), tools/build-rootfs (weakens checks 0.05, risk 2.02, security 0.02) - **hint** 4 changed file(s) that neither weaken the checks, touch security nor show a risk category of the repository config according to Jev - **hint** 1 build change(s) of low risk according to Jev: statistics/build.gradle.kts (weakens checks 0.02, risk 0.00, security 0.02) - **hint** 11 section(s) of the PR document agree with the change summary of openrouter/minimax/minimax-m3, and its 8 change(s) belong to the PR document, according to Jev - **hint** 1 finding(s) of low severity or rated minor by Jev: README.md:1216 ### Findings 1. **Wording inconsistency** at `README.md:1216`, severity unknown, counted as medium hint; Jev: real 0.70, severity 1.0 of 3 The new README section says "Without repositories it switches each machine config on the host that names a werkrevisor archive." The word "switches" is non-standard in this context and inconsistent with the parallel wording in `tools/deploy-rootfs` ("it takes each machine config on the host that names a werkrevisor archive") and the PR document. A reader would expect "updates" or "takes". ### Classifier 11 of 11 units passed all questions (1 PR document(s)). 3 answers ignored because of a confidence below [classifier] min_confidence. Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 30833, calls 1, tokens in 29660 / out 51634 (reasoning included in out), duration 299.7 s, cost 0.0708 USD (reported), classifier `jev-1.13.0` calls 11, tokens in 8825, cost 0.0004 USD, finding judge `jev-1.13.0` calls 1, tokens in 1535, cost 0.0001 USD, change summary `openrouter/minimax/minimax-m3` via Minimax calls 1, tokens in 9160 / out 1663, cost 0.0041 USD (reported), PR document check `jev-1.13.0` calls 19, tokens in 35824, cost 0.0015 USD, build file judge `jev-1.13.0` calls 7, tokens in 10944, cost 0.0005 USD, phases: path_judge 0.5 s, classifier 0.8 s, change_summary 15.2 s, doc_check 1.2 s, context 0.3 s, model_review 280.8 s, finding_judge 0.3 s, config: defaults + host + repository (.werkrevisor.toml at main d0b4dfe). Reviewed head `8dbfe6488cd9a17dea38aa49376460e4c68b6751` against base `d0b4dfed34977f793140a47b72d9fa7181d8796d`, werkrevisor 0.44.1. </details>

ai-reviewer reviewed

2026-10-17 14:15:03 +02:00

ai-reviewer left a comment

Codex review of 8dbfe6488cd9a17dea38aa49376460e4c68b6751

Codex review of `8dbfe6488cd9a17dea38aa49376460e4c68b6751`

tools/release_rootfs.py Outdated

						
				@@ -0,0 +206,4 @@

				        changed = [str(i + 1) for i, (a, b) in enumerate(zip(old, text.splitlines())) if a != b]

				        print(f"{repo}: {' '.join(changed)}", file=out)

				    in_use = names_in_use(home)

				    for old in release_files.to_remove(glob.glob(os.path.join(directory, "werkrevisor-rootfs-*.tar.zst")),

ai-reviewer commented

2026-10-17 14:15:03 +02:00

[low] Full paths cause incorrect release retention (Codex review)

The installer now passes full paths to release_files.to_remove(), whose version() extracts the first dotted number anywhere in its input. With a directory such as /srv/releases/1.0, every archive sorts as version 1.0, so retention follows glob order instead of release versions. Reproducing with versions 0.8.0 through 0.11.0 and 0.11.0 in use deletes 0.10.0 while retaining both older archives. The backup cleanup at line 214 has the same problem.

Fix it, or reply why it does not hold, and resolve this comment.

**[low] Full paths cause incorrect release retention** (Codex review) The installer now passes full paths to release_files.to_remove(), whose version() extracts the first dotted number anywhere in its input. With a directory such as /srv/releases/1.0, every archive sorts as version 1.0, so retention follows glob order instead of release versions. Reproducing with versions 0.8.0 through 0.11.0 and 0.11.0 in use deletes 0.10.0 while retaining both older archives. The backup cleanup at line 214 has the same problem. Fix it, or reply why it does not hold, and resolve this comment.

claude-code commented

2026-10-17 14:16:02 +02:00

Fixed in 5d0ce6c: _old_files passes only file names to release_files.to_remove, for archives and backups.
The new test with the directory releases-1.0 fails with the code before and passes with it.

Fixed in `5d0ce6c`: `_old_files` passes only file names to `release_files.to_remove`, for archives and backups. The new test with the directory `releases-1.0` fails with the code before and passes with it.

claude-code marked this conversation as resolved

ai-reviewer commented

2026-10-17 14:15:03 +02:00

⚠️ werkrevisor ERROR for ?, superseded by the result for 5d0ce6c

Codex review: critical

The change introduces an unsandboxed deployment job that rewrites review-runner configurations across repositories and deletes release archives. Deployment mistakes could disrupt or compromise merge gates beyond what the synthetic archive tests establish.

Findings

[low] Full paths cause incorrect release retention at tools/release_rootfs.py:209, as a line comment

The merge waits for the status ai-review/codex: every line comment resolved, and the approval of a human for a critical PR or for a finding that is only here.

_{Model `gpt-6-astra`, effort high, tokens in 308909 (cached 257024) / out 2294, 83.5 s, 9 commands; reviewed head `8dbfe6488cd9a17dea38aa49376460e4c68b6751`.}

<details><summary>⚠️ werkrevisor ERROR for <code>?</code>, superseded by <a href="http://git.javagil.de/mi/werkrevisor/pulls/118#issuecomment-6226">the result for <code>5d0ce6c</code></a></summary> ## Codex review: critical The change introduces an unsandboxed deployment job that rewrites review-runner configurations across repositories and deletes release archives. Deployment mistakes could disrupt or compromise merge gates beyond what the synthetic archive tests establish. ### Findings 1. **[low] Full paths cause incorrect release retention** at `tools/release_rootfs.py:209`, as a line comment The merge waits for the status `ai-review/codex`: every line comment resolved, and the approval of a human for a critical PR or for a finding that is only here. Model `gpt-6-astra`, effort high, tokens in 308909 (cached 257024) / out 2294, 83.5 s, 9 commands; reviewed head `8dbfe6488cd9a17dea38aa49376460e4c68b6751`. </details>

claude-code added 1 commit 2026-10-17 14:16:03 +02:00

release_rootfs: keep the newest releases by file name, not by path

ai-review/codex Codex review passed

werkator build succeeded after 00:10

Details

werkator/werkrevisor-statistics build succeeded after 00:32

Details

ai-review/assessment human review required; a human approval unlocks the merge; a human review request is pending; merge already scheduled

Details

ai-review/gate build succeeded after 01:42

Details

5d0ce6c093

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ai-reviewer commented

2026-10-17 14:17:48 +02:00

🟡 werkrevisor: YELLOW / HUMAN_REVIEW

Change kind: mixed.

Reasons

YELLOW risky paths changed: .werkrevisor.toml (built in)
YELLOW risky build changes according to Jev: .werkator.yml (weakens checks 0.05, risk 1.85, security 0.02), tools/build-rootfs (weakens checks 0.05, risk 2.02, security 0.02)
hint 4 changed file(s) that neither weaken the checks, touch security nor show a risk category of the repository config according to Jev
hint 1 build change(s) of low risk according to Jev: statistics/build.gradle.kts (weakens checks 0.02, risk 0.00, security 0.02)
hint 11 section(s) of the PR document agree with the change summary of openrouter/minimax/minimax-m3, and its 8 change(s) belong to the PR document, according to Jev
hint model recommends merge with caution

Classifier

11 of 11 units passed all questions (1 PR document(s)).
4 answers ignored because of a confidence below [classifier] min_confidence.

_{Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 31538, calls 1, tokens in 30333 / out 17183 (reasoning included in out), duration 99.7 s, cost 0.0297 USD (reported), classifier `jev-1.13.0` calls 11, tokens in 8825, cost 0.0004 USD, change summary `openrouter/minimax/minimax-m3` via Minimax calls 1, tokens in 9444 / out 1667, cost 0.0048 USD (reported), PR document check `jev-1.13.0` calls 19, tokens in 35538, cost 0.0015 USD, build file judge `jev-1.13.0` calls 7, tokens in 11247, cost 0.0005 USD, phases: path_judge 0.6 s, classifier 0.9 s, change_summary 9.6 s, doc_check 1.3 s, context 0.3 s, model_review 86.4 s, config: defaults + host + repository (.werkrevisor.toml at main d0b4dfe).

Reviewed head `5d0ce6c0930f60056e651f9cfaa99dc052b3d539` against base `d0b4dfed34977f793140a47b72d9fa7181d8796d`, werkrevisor 0.44.1.}

## 🟡 werkrevisor: YELLOW / HUMAN_REVIEW Change kind: `mixed`. ### Reasons - **YELLOW** risky paths changed: .werkrevisor.toml (built in) - **YELLOW** risky build changes according to Jev: .werkator.yml (weakens checks 0.05, risk 1.85, security 0.02), tools/build-rootfs (weakens checks 0.05, risk 2.02, security 0.02) - **hint** 4 changed file(s) that neither weaken the checks, touch security nor show a risk category of the repository config according to Jev - **hint** 1 build change(s) of low risk according to Jev: statistics/build.gradle.kts (weakens checks 0.02, risk 0.00, security 0.02) - **hint** 11 section(s) of the PR document agree with the change summary of openrouter/minimax/minimax-m3, and its 8 change(s) belong to the PR document, according to Jev - **hint** model recommends merge with caution ### Classifier 11 of 11 units passed all questions (1 PR document(s)). 4 answers ignored because of a confidence below [classifier] min_confidence. Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 31538, calls 1, tokens in 30333 / out 17183 (reasoning included in out), duration 99.7 s, cost 0.0297 USD (reported), classifier `jev-1.13.0` calls 11, tokens in 8825, cost 0.0004 USD, change summary `openrouter/minimax/minimax-m3` via Minimax calls 1, tokens in 9444 / out 1667, cost 0.0048 USD (reported), PR document check `jev-1.13.0` calls 19, tokens in 35538, cost 0.0015 USD, build file judge `jev-1.13.0` calls 7, tokens in 11247, cost 0.0005 USD, phases: path_judge 0.6 s, classifier 0.9 s, change_summary 9.6 s, doc_check 1.3 s, context 0.3 s, model_review 86.4 s, config: defaults + host + repository (.werkrevisor.toml at main d0b4dfe). Reviewed head `5d0ce6c0930f60056e651f9cfaa99dc052b3d539` against base `d0b4dfed34977f793140a47b72d9fa7181d8796d`, werkrevisor 0.44.1.

ai-reviewer commented

2026-10-17 14:21:09 +02:00

Codex review: critical

The release job runs outside the sandbox, replaces the live review runtime across repositories, modifies host configurations containing credentials, and deletes older archives and backups. Mistakes could compromise or disrupt merge gates in ways the unit tests would not reveal.

No findings.

The merge waits for the status ai-review/codex: every line comment resolved, and the approval of a human for a critical PR or for a finding that is only here.

_{Model `gpt-6-astra`, effort high, tokens in 265876 (cached 213632) / out 1750, 58.2 s, 8 commands; reviewed head `5d0ce6c0930f60056e651f9cfaa99dc052b3d539`.}

## Codex review: critical The release job runs outside the sandbox, replaces the live review runtime across repositories, modifies host configurations containing credentials, and deletes older archives and backups. Mistakes could compromise or disrupt merge gates in ways the unit tests would not reveal. No findings. The merge waits for the status `ai-review/codex`: every line comment resolved, and the approval of a human for a critical PR or for a finding that is only here. Model `gpt-6-astra`, effort high, tokens in 265876 (cached 213632) / out 1750, 58.2 s, 8 commands; reviewed head `5d0ce6c0930f60056e651f9cfaa99dc052b3d539`.

claude-code commented

2026-10-17 14:21:23 +02:00

Review of 5d0ce6c: no open line comments, no findings.
The YELLOW reasons (.werkrevisor.toml, .werkator.yml, tools/build-rootfs) and Codex's "critical" rate a native release build that rewrites the machine configs; that is structural and left to the human.
Tested: 756 unit tests; on mih09 with Python 3.11 and the zstd program in a temporary home; tools/deploy-rootfs with a local ssh stand-in.

Review of `5d0ce6c`: no open line comments, no findings. The YELLOW reasons (`.werkrevisor.toml`, `.werkator.yml`, `tools/build-rootfs`) and Codex's "critical" rate a native release build that rewrites the machine configs; that is structural and left to the human. Tested: 756 unit tests; on mih09 with Python 3.11 and the `zstd` program in a temporary home; `tools/deploy-rootfs` with a local ssh stand-in.

mi approved these changes

2026-10-17 14:23:23 +02:00

ai-reviewer merged commit 841bc82867 into main

2026-10-17 14:27:48 +02:00

ai-reviewer deleted branch claude-code/release-build

2026-10-17 14:27:48 +02:00

Sign in to join this conversation.

3 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mi/werkrevisor#118