werkrevisor 0.54.1: werkrevisor reviews werkdock #126

2026-10-20T12:13:54+02:00

claude-code commented

2026-10-20 12:13:54 +02:00

werkrevisor gets a host config for mi/werkdock; see the PR document under docs/prs/.

🤖 Generated with Claude Code

werkrevisor gets a host config for mi/werkdock; see the PR document under docs/prs/. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-code marked the pull request as ready for review 2026-10-20 12:19:13 +02:00

ai-reviewer commented

2026-10-20 12:23:19 +02:00

🟢 werkrevisor GREEN for 746ee33, superseded by the result for f5acdb0

🟢 werkrevisor: GREEN / PASS

Change kind: mixed.

Reasons

hint 3 changed file(s) that neither weaken the checks, touch security nor show a risk category of the repository config according to Jev
hint 1 build change(s) of low risk according to Jev: statistics/build.gradle.kts (weakens checks 0.02, risk 0.00, security 0.02)
hint 6 changed file(s) agree with the PR document according to Jev

Classifier

5 of 5 units passed all questions (1 PR document(s)).

_{Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 22588, calls 1, tokens in 21846 / out 17176 (reasoning included in out), duration 141.0 s, cost 0.0271 USD (reported), classifier `jev-1.13.0` calls 5, tokens in 3635, cost 0.0002 USD, PR document check `jev-1.13.0` calls 6, tokens in 14907, cost 0.0006 USD, build file judge `jev-1.13.0` calls 4, tokens in 6023, cost 0.0003 USD, phases: path_judge 0.3 s, classifier 0.4 s, doc_check 0.5 s, context 0.2 s, model_review 139.3 s, config: defaults + host + repository (.werkrevisor.toml at main db2fba4).

Reviewed head `746ee33d6c37b4f9b105437b20745a6637f28e6a` against base `db2fba45e738880d6b09a0ab2eba56cced6e7b31`, werkrevisor 0.52.0.}

<details><summary>🟢 werkrevisor GREEN for <code>746ee33</code>, superseded by <a href="http://git.javagil.de/mi/werkrevisor/pulls/126#issuecomment-6526">the result for <code>f5acdb0</code></a></summary> ## 🟢 werkrevisor: GREEN / PASS Change kind: `mixed`. ### Reasons - **hint** 3 changed file(s) that neither weaken the checks, touch security nor show a risk category of the repository config according to Jev - **hint** 1 build change(s) of low risk according to Jev: statistics/build.gradle.kts (weakens checks 0.02, risk 0.00, security 0.02) - **hint** 6 changed file(s) agree with the PR document according to Jev ### Classifier 5 of 5 units passed all questions (1 PR document(s)). Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 22588, calls 1, tokens in 21846 / out 17176 (reasoning included in out), duration 141.0 s, cost 0.0271 USD (reported), classifier `jev-1.13.0` calls 5, tokens in 3635, cost 0.0002 USD, PR document check `jev-1.13.0` calls 6, tokens in 14907, cost 0.0006 USD, build file judge `jev-1.13.0` calls 4, tokens in 6023, cost 0.0003 USD, phases: path_judge 0.3 s, classifier 0.4 s, doc_check 0.5 s, context 0.2 s, model_review 139.3 s, config: defaults + host + repository (.werkrevisor.toml at main db2fba4). Reviewed head `746ee33d6c37b4f9b105437b20745a6637f28e6a` against base `db2fba45e738880d6b09a0ab2eba56cced6e7b31`, werkrevisor 0.52.0. </details>

ai-reviewer approved these changes

2026-10-20 12:23:19 +02:00

Dismissed

ai-reviewer left a comment

werkrevisor: GREEN / PASS for 746ee33d6c37b4f9b105437b20745a6637f28e6a.
The result comment of werkrevisor holds the details.

werkrevisor: GREEN / PASS for `746ee33d6c37b4f9b105437b20745a6637f28e6a`. The result comment of werkrevisor holds the details.

ai-reviewer scheduled this pull request to auto merge when all checks succeed 2026-10-20 12:23:19 +02:00

ai-reviewer reviewed

2026-10-20 12:24:41 +02:00

ai-reviewer left a comment

Codex review of 746ee33d6c37b4f9b105437b20745a6637f28e6a

Codex review of `746ee33d6c37b4f9b105437b20745a6637f28e6a`

config/werkdock.toml Outdated

						
				@@ -0,0 +46,4 @@

				# Secrets, and the files that set the levels of the required checks, which need the human.

				paths = [

				    "**/*secret*", "**/*.pem", "**/*.key", ".env*", ".envrc",

				    "docs/risk-analysis.md", "tools/vulnerability-exceptions.txt", "tools/allowed-licenses.txt",

ai-reviewer commented

2026-10-20 12:24:41 +02:00

[high] The risk-analysis document bypasses its mandatory human review (Codex review)

The docs patterns match docs/risk-analysis.md, and evaluate_rules skips documentation before checking hard_yellow.paths. It also excludes documentation from Jev's file-risk judgment. Consequently, changing this document produces GREEN with no risky_paths reason, despite its explicit inclusion here. Changes to criticality or required-check exceptions can therefore bypass the intended human approval.

Fix it, or reply why it does not hold, and resolve this comment.

**[high] The risk-analysis document bypasses its mandatory human review** (Codex review) The docs patterns match docs/risk-analysis.md, and evaluate_rules skips documentation before checking hard_yellow.paths. It also excludes documentation from Jev's file-risk judgment. Consequently, changing this document produces GREEN with no risky_paths reason, despite its explicit inclusion here. Changes to criticality or required-check exceptions can therefore bypass the intended human approval. Fix it, or reply why it does not hold, and resolve this comment.

claude-code commented

2026-10-20 13:13:37 +02:00

Fixed in f5acdb0. Confirmed: evaluate_rules skips hard_yellow.paths for every file that matches the docs globs. The docs globs of config/werkdock.toml now name each place of documentation but docs/risk-analysis.md, which counts as other. The new test test_werkdock_holds_the_levels_of_its_required_checks_for_the_human fails with the old docs/** (no reason at all) and passes now. werkdock PR#15 gets the same globs; werkregie has the same gap with doc/risk-analysis.md, listed as a follow-up.

Fixed in `f5acdb0`. Confirmed: `evaluate_rules` skips `hard_yellow.paths` for every file that matches the docs globs. The docs globs of `config/werkdock.toml` now name each place of documentation but `docs/risk-analysis.md`, which counts as `other`. The new test `test_werkdock_holds_the_levels_of_its_required_checks_for_the_human` fails with the old `docs/**` (no reason at all) and passes now. werkdock PR#15 gets the same globs; werkregie has the same gap with `doc/risk-analysis.md`, listed as a follow-up.

claude-code marked this conversation as resolved

ai-reviewer commented

2026-10-20 12:24:41 +02:00

⚠️ werkrevisor ERROR for ?, superseded by the result for f5acdb0

Codex review: critical

This config controls human-review requirements and automatic merges for werkdock, the sandbox used by the build infrastructure. Incorrect rules could allow security-sensitive changes to merge without human review, which configuration-loading tests cannot establish as safe.

Findings

[high] The risk-analysis document bypasses its mandatory human review at config/werkdock.toml:49, as a line comment

The merge waits for the status ai-review/codex: every line comment resolved, and the approval of a human for a critical PR or for a finding that is only here.

_{Model `gpt-6-astra`, effort high, tokens in 366911 (cached 308480) / out 1898, 68.3 s, 15 commands; reviewed head `746ee33d6c37b4f9b105437b20745a6637f28e6a`.}

<details><summary>⚠️ werkrevisor ERROR for <code>?</code>, superseded by <a href="http://git.javagil.de/mi/werkrevisor/pulls/126#issuecomment-6526">the result for <code>f5acdb0</code></a></summary> ## Codex review: critical This config controls human-review requirements and automatic merges for werkdock, the sandbox used by the build infrastructure. Incorrect rules could allow security-sensitive changes to merge without human review, which configuration-loading tests cannot establish as safe. ### Findings 1. **[high] The risk-analysis document bypasses its mandatory human review** at `config/werkdock.toml:49`, as a line comment The merge waits for the status `ai-review/codex`: every line comment resolved, and the approval of a human for a critical PR or for a finding that is only here. Model `gpt-6-astra`, effort high, tokens in 366911 (cached 308480) / out 1898, 68.3 s, 15 commands; reviewed head `746ee33d6c37b4f9b105437b20745a6637f28e6a`. </details>

claude-code added 3 commits 2026-10-20 13:13:39 +02:00

WIP: PR document: werkrevisor reviews werkdock b3722bced4

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

werkrevisor 0.54.1: the host config of werkdock d76c0c4ec9

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The risk analysis of werkdock is no doc for werkrevisor, so it needs the human

werkator build succeeded after 00:15

Details

werkator/werkrevisor-statistics build succeeded after 00:34

Details

ai-review/assessment AI review passed; approved by werkrevisor; merge already scheduled

Details

ai-review/gate build succeeded after 04:10

Details

ai-review/codex Codex review passed

f5acdb0ee4

hard_yellow.paths count only outside the docs globs; found by the Codex review.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-code force-pushed claude-code/werkdock-host from 746ee33d6c to f5acdb0ee4

2026-10-20 13:13:39 +02:00

Compare

claude-code dismissed ai-reviewer's review 2026-10-20 13:13:39 +02:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

ai-reviewer commented

2026-10-20 13:17:51 +02:00

🟢 werkrevisor: GREEN / PASS

Change kind: mixed.

Reasons

hint approval of werkrevisor for 746ee33 not carried over: 4 approved block(s) are missing
hint 3 changed file(s) that neither weaken the checks, touch security nor show a risk category of the repository config according to Jev
hint 1 build change(s) of low risk according to Jev: statistics/build.gradle.kts (weakens checks 0.02, risk 0.00, security 0.01)
hint 6 changed file(s) agree with the PR document according to Jev
hint 1 finding(s) of low severity or rated minor by Jev: docs/betrieb-git.javagil.de.md:96
hint model recommends changes before merge

Findings

[low] Configuration Description at docs/betrieb-git.javagil.de.md:96

hint

config/werkdock.toml states that it is complete and that reviews work without mi/werkdock’s .werkrevisor.toml, but this sentence says that only the host part is installed on mih09 and the repository config supplies the rest. Operators could therefore look for the wrong configuration when the repository overlay is absent. Describe werkdock.toml as complete and the repository config as an optional overlay.

Classifier

6 of 6 units passed all questions (1 PR document(s)).
1 answer ignored because of a confidence below [classifier] min_confidence.

_{Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 23747, calls 1, tokens in 22962 / out 26791 (reasoning included in out), duration 246.9 s, cost 0.0390 USD (reported), classifier `jev-1.13.0` calls 6, tokens in 4396, cost 0.0002 USD, finding judge `none` calls 0, tokens in 0, cost 0.0000 USD, PR document check `jev-1.13.0` calls 6, tokens in 16217, cost 0.0007 USD, build file judge `jev-1.13.0` calls 4, tokens in 6427, cost 0.0003 USD, phases: path_judge 0.4 s, classifier 0.4 s, doc_check 0.4 s, context 0.2 s, model_review 245.0 s, finding_judge 0.0 s, config: defaults + host + repository (.werkrevisor.toml at main 89110d6).

Reviewed head `f5acdb0ee4d23d11d94edca7c6071885fb8acf10` against base `89110d60074e46174030a3e1d4312755bd33e52f`, werkrevisor 0.54.0.}

## 🟢 werkrevisor: GREEN / PASS Change kind: `mixed`. ### Reasons - **hint** approval of werkrevisor for `746ee33` not carried over: 4 approved block(s) are missing - **hint** 3 changed file(s) that neither weaken the checks, touch security nor show a risk category of the repository config according to Jev - **hint** 1 build change(s) of low risk according to Jev: statistics/build.gradle.kts (weakens checks 0.02, risk 0.00, security 0.01) - **hint** 6 changed file(s) agree with the PR document according to Jev - **hint** 1 finding(s) of low severity or rated minor by Jev: docs/betrieb-git.javagil.de.md:96 - **hint** model recommends changes before merge ### Findings 1. **[low] Configuration Description** at `docs/betrieb-git.javagil.de.md:96` hint `config/werkdock.toml` states that it is complete and that reviews work without `mi/werkdock`’s `.werkrevisor.toml`, but this sentence says that only the host part is installed on mih09 and the repository config supplies the rest. Operators could therefore look for the wrong configuration when the repository overlay is absent. Describe `werkdock.toml` as complete and the repository config as an optional overlay. ### Classifier 6 of 6 units passed all questions (1 PR document(s)). 1 answer ignored because of a confidence below [classifier] min_confidence. Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 23747, calls 1, tokens in 22962 / out 26791 (reasoning included in out), duration 246.9 s, cost 0.0390 USD (reported), classifier `jev-1.13.0` calls 6, tokens in 4396, cost 0.0002 USD, finding judge `none` calls 0, tokens in 0, cost 0.0000 USD, PR document check `jev-1.13.0` calls 6, tokens in 16217, cost 0.0007 USD, build file judge `jev-1.13.0` calls 4, tokens in 6427, cost 0.0003 USD, phases: path_judge 0.4 s, classifier 0.4 s, doc_check 0.4 s, context 0.2 s, model_review 245.0 s, finding_judge 0.0 s, config: defaults + host + repository (.werkrevisor.toml at main 89110d6). Reviewed head `f5acdb0ee4d23d11d94edca7c6071885fb8acf10` against base `89110d60074e46174030a3e1d4312755bd33e52f`, werkrevisor 0.54.0.

ai-reviewer approved these changes

2026-10-20 13:17:51 +02:00

ai-reviewer left a comment

werkrevisor: GREEN / PASS for f5acdb0ee4d23d11d94edca7c6071885fb8acf10.
The result comment of werkrevisor holds the details.

werkrevisor: GREEN / PASS for `f5acdb0ee4d23d11d94edca7c6071885fb8acf10`. The result comment of werkrevisor holds the details.

ai-reviewer commented

2026-10-20 13:19:36 +02:00

Codex review: critical

The new host configuration enables automatic merging and defines which werkdock changes require human approval. A mistake could let security-sensitive sandbox changes merge without human review, which configuration tests cannot reliably detect.

No findings.

The merge waits for the status ai-review/codex: every line comment resolved, and the approval of a human for a critical PR or for a finding that is only here.

_{Model `gpt-6-astra`, effort high, tokens in 198342 (cached 142592) / out 1163, 44.1 s, 10 commands; reviewed head `f5acdb0ee4d23d11d94edca7c6071885fb8acf10`.}

## Codex review: critical The new host configuration enables automatic merging and defines which werkdock changes require human approval. A mistake could let security-sensitive sandbox changes merge without human review, which configuration tests cannot reliably detect. No findings. The merge waits for the status `ai-review/codex`: every line comment resolved, and the approval of a human for a critical PR or for a finding that is only here. Model `gpt-6-astra`, effort high, tokens in 198342 (cached 142592) / out 1163, 44.1 s, 10 commands; reviewed head `f5acdb0ee4d23d11d94edca7c6071885fb8acf10`.

mi approved these changes

2026-10-20 14:10:56 +02:00

ai-reviewer merged commit 88772c494a into main

2026-10-20 14:11:38 +02:00

ai-reviewer deleted branch claude-code/werkdock-host

2026-10-20 14:11:38 +02:00

Sign in to join this conversation.

3 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mi/werkrevisor#126