werkrevisor 0.15.0: critical paths give ORANGE #15

2026-10-05T20:54:13+02:00

claude-code commented

2026-10-05 20:54:13 +02:00

werkrevisor 0.15.0: critical paths give ORANGE.

New section [hard_orange] paths: a change there needs a deliberate human review; the comment names the paths first.
hsadmin-ng and werkprobe move RBAC, authentication, permission and secret paths from [hard_yellow] to [hard_orange].
werkrevisor's own critical modules follow after the deploy.

Details: the PR document under docs/prs/.

🤖 Generated with Claude Code

werkrevisor 0.15.0: critical paths give ORANGE. - New section `[hard_orange] paths`: a change there needs a deliberate human review; the comment names the paths first. - hsadmin-ng and werkprobe move RBAC, authentication, permission and secret paths from `[hard_yellow]` to `[hard_orange]`. - werkrevisor's own critical modules follow after the deploy. Details: the PR document under `docs/prs/`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-code added 4 commits 2026-10-05 20:54:13 +02:00

docs: PR#15 document for critical paths that give ORANGE 7934bd9292

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

werkrevisor 0.15.0: [hard_orange] paths give ORANGE f9ad6763c8

A changed file, or the old path of a renamed one, that matches [hard_orange] paths
gives ORANGE with one aggregated reason; such a file is not listed under the YELLOW tiers.
The section is required; the repository layer only adds paths.
hsadmin-ng and werkprobe move RBAC, authentication and secrets to [hard_orange].

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs: [hard_orange] in the README, the operator docs and the PR#15 document 010b4c1885

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

config: hsadmin-ng treats RBAC, permission and secret patterns of every spelling as critical paths

werkator build succeeded after 00:08

Details

ai-review/assessment AI findings; a developer approval after checking them unlocks the merge; review requested from mi

Details

ai-review/gate build succeeded after 00:17

Details

b5bb590a20

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-code marked the pull request as ready for review 2026-10-05 20:54:14 +02:00

ai-reviewer commented

2026-10-05 20:54:31 +02:00

🟠 werkrevisor: ORANGE / FINDINGS

Change kind: mixed.

Reasons

ORANGE model reports 2 findings of medium severity ([review] orange_min_medium = 2)
YELLOW test changes are not purely additive: tests/test_config_layers.py:83 changes an existing test line, tests/test_config_layers.py:84 removes a test or assertion, tests/test_config_layers.py:86 removes a test or assertion and 2 more
YELLOW change kind 'mixed' (main code, tests, other files, docs); AI-approvable are only: docs only, tests only added, docs and tests, refactoring with unchanged tests, feature with purely additive tests, harmless files only, mechanical changes only
YELLOW risky paths changed: config/hsadmin-ng.toml (config/), config/werkprobe.toml (config/), config/werkrevisor.toml (config/**) and 1 more
YELLOW 2 changed files were given to the AI only as diff, not in full, so it could not check them against the rest of their file (all full files together would exceed [review] max_full_files_chars = 120000): werkrevisor/config.py, werkrevisor/rules.py
YELLOW model recommends merge with caution

Findings

[medium] Test placed after unittest.main() at tests/test_config_source_and_isolation.py:154-161

MissingSectionTest.test_a_config_without_hard_orange_is_refused sits in a class defined after the unittest.main() call under if __name__ == "__main__". Running the file directly (python tests/test_config_source_and_isolation.py) never executes it. With python -m unittest discovery it does run, so the impact is limited to direct runs. The class existed before this PR; the new test inherits the placement.
[medium] PR doc contradicts the hsadmin-ng config at docs/prs/2026-10-05-PR#15-hard-orange-paths.md:170-173

The Solution lists only the upper-case patterns (**/*Auth* etc.) as moved to [hard_orange] and says the lower-case patterns, e.g. **/*auth*, stay in [hard_yellow]. In config/hsadmin-ng.toml the lower-case patterns **/*rbac*, **/*auth* and **/*secret*, plus the secret paths **/*.pem, **/*.key, .env* and .tc-environment, are in [hard_orange]. The PR description also says secrets move to ORANGE, so the Solution's list is incomplete or wrong. The German operator docs likewise list **/*auth* under ORANGE. A reader of the document learns the wrong tiers.
[low] Confusing "Harte Regeln" bullet at docs/anleitung-dev.hostsharing.net.md:118-119

The bullet "Harte Regeln, Vorschlag" contains only a sentence about two tiers and has no list items of its own. The proposal bullets follow as separate siblings, so the structure is unclear.

Classifier

15 of 15 units passed all questions (1 PR document(s)).
2 answers ignored because of a confidence below [classifier] min_confidence.

_{Usage: model `openrouter/anthropic/claude-sonnet-5.5`, LLM done, tokens counted before the call 75244, calls 1, tokens in 77243 / out 826 (reasoning included in out), duration 16.1 s, cost 0.1627 USD (reported), classifier `jev-1.13.0` calls 15, tokens in 13556, cost 0.0006 USD, config: defaults + host + repository (.werkrevisor.toml at base e8b256e).

Reviewed head `b5bb590a20599fe7d7a69aac3ff2a9accf7c5221` against base `e8b256ef92ad88780065ce295ababfe9e188e826`, werkrevisor 0.14.0.}

## 🟠 werkrevisor: ORANGE / FINDINGS Change kind: `mixed`. ### Reasons - **ORANGE** model reports 2 findings of medium severity ([review] orange_min_medium = 2) - **YELLOW** test changes are not purely additive: tests/test_config_layers.py:83 changes an existing test line, tests/test_config_layers.py:84 removes a test or assertion, tests/test_config_layers.py:86 removes a test or assertion and 2 more - **YELLOW** change kind 'mixed' (main code, tests, other files, docs); AI-approvable are only: docs only, tests only added, docs and tests, refactoring with unchanged tests, feature with purely additive tests, harmless files only, mechanical changes only - **YELLOW** risky paths changed: config/hsadmin-ng.toml (config/**), config/werkprobe.toml (config/**), config/werkrevisor.toml (config/**) and 1 more - **YELLOW** 2 changed files were given to the AI only as diff, not in full, so it could not check them against the rest of their file (all full files together would exceed [review] max_full_files_chars = 120000): werkrevisor/config.py, werkrevisor/rules.py - **YELLOW** model recommends merge with caution ### Findings 1. **[medium] Test placed after unittest.main()** at `tests/test_config_source_and_isolation.py:154-161` `MissingSectionTest.test_a_config_without_hard_orange_is_refused` sits in a class defined after the `unittest.main()` call under `if __name__ == "__main__"`. Running the file directly (`python tests/test_config_source_and_isolation.py`) never executes it. With `python -m unittest` discovery it does run, so the impact is limited to direct runs. The class existed before this PR; the new test inherits the placement. 2. **[medium] PR doc contradicts the hsadmin-ng config** at `docs/prs/2026-10-05-PR#15-hard-orange-paths.md:170-173` The Solution lists only the upper-case patterns (`**/*Auth*` etc.) as moved to `[hard_orange]` and says the lower-case patterns, e.g. `**/*auth*`, stay in `[hard_yellow]`. In `config/hsadmin-ng.toml` the lower-case patterns `**/*rbac*`, `**/*auth*` and `**/*secret*`, plus the secret paths `**/*.pem`, `**/*.key`, `.env*` and `.tc-environment`, are in `[hard_orange]`. The PR description also says secrets move to ORANGE, so the Solution's list is incomplete or wrong. The German operator docs likewise list `**/*auth*` under ORANGE. A reader of the document learns the wrong tiers. 3. **[low] Confusing "Harte Regeln" bullet** at `docs/anleitung-dev.hostsharing.net.md:118-119` The bullet "Harte Regeln, Vorschlag" contains only a sentence about two tiers and has no list items of its own. The proposal bullets follow as separate siblings, so the structure is unclear. ### Classifier 15 of 15 units passed all questions (1 PR document(s)). 2 answers ignored because of a confidence below [classifier] min_confidence. Usage: model `openrouter/anthropic/claude-sonnet-5.5`, LLM done, tokens counted before the call 75244, calls 1, tokens in 77243 / out 826 (reasoning included in out), duration 16.1 s, cost 0.1627 USD (reported), classifier `jev-1.13.0` calls 15, tokens in 13556, cost 0.0006 USD, config: defaults + host + repository (.werkrevisor.toml at base e8b256e). Reviewed head `b5bb590a20599fe7d7a69aac3ff2a9accf7c5221` against base `e8b256ef92ad88780065ce295ababfe9e188e826`, werkrevisor 0.14.0.

ai-reviewer requested review from mi 2026-10-05 20:54:31 +02:00

claude-code added 1 commit 2026-10-05 20:55:34 +02:00

PR#15 doc lists the hsadmin-ng tiers as configured; the guide's tier bullets are clear; a test no longer sits after unittest.main()

ai-review/assessment AI findings; a developer approval after checking them unlocks the merge; a human review request is pending

Details

ai-review/gate build succeeded after 00:14

Details

werkator/server build succeeded after 00:00

Details

werkator build succeeded after 00:13

Details

werkator/werkrevisor-statistics build succeeded after 00:00

Details

3e6c6b5424

Fixes the three findings of the self-review.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ai-reviewer commented

2026-10-05 20:55:57 +02:00

🟠 werkrevisor: ORANGE / FINDINGS

Change kind: mixed.

Reasons

ORANGE model reports 2 findings of medium severity ([review] orange_min_medium = 2)
YELLOW test changes are not purely additive: tests/test_config_layers.py:83 changes an existing test line, tests/test_config_layers.py:84 removes a test or assertion, tests/test_config_layers.py:86 removes a test or assertion and 4 more
YELLOW change kind 'mixed' (main code, tests, other files, docs); AI-approvable are only: docs only, tests only added, docs and tests, refactoring with unchanged tests, feature with purely additive tests, harmless files only, mechanical changes only
YELLOW risky paths changed: config/hsadmin-ng.toml (config/), config/werkprobe.toml (config/), config/werkrevisor.toml (config/**) and 1 more
YELLOW spec: docs/prs/2026-10-05-PR#15-hard-orange-paths.md Scenario#15.04 implementation_details (0.63 > yellow_above = 0.6)
YELLOW 2 changed files were given to the AI only as diff, not in full, so it could not check them against the rest of their file (all full files together would exceed [review] max_full_files_chars = 120000): werkrevisor/config.py, werkrevisor/rules.py
YELLOW model recommends merge with caution

Findings

[medium] Test hunk broke file structure at tests/test_config_source_and_isolation.py:140-160

The hunk removes the if __name__ == "__main__" block from the middle of the file and moves it to the end; that is fine. However, test_a_config_without_hard_orange_is_refused calls build_config(host, {}). With an empty repo dict this checks the host only, so the test is valid. The file also keeps extra blank lines (three blank lines before MissingSectionTest) and local imports inside tests. This is cosmetic only and has no behavior impact.
[medium] Critical DB-schema exemption not tested for built-in path at werkrevisor/rules.py:208-215

A file that matches [hard_orange] is skipped before the BUILTIN_DB_SCHEMA_PATHS check, so a critical .sql file no longer yields a db_schema reason. This is intended. But the built-in .werkrevisor.toml risky-path rule is also placed after the continue. If an operator lists .werkrevisor.toml or a matching glob (e.g. .*, **/*.toml) in [hard_orange], the "always needs a human" guarantee for repository config changes is reported only as critical. The verdict stays at least ORANGE, so the human gate still holds in the approval mode. The behavior is unverified by a test.

Classifier

Unit	Question	Problem	Confidence	Verdict
docs/prs/2026-10-05-PR#15-hard-orange-paths.md Scenario#15.04	implementation_details	0.63	–	YELLOW

14 of 15 units passed all questions (1 PR document(s)).
2 answers ignored because of a confidence below [classifier] min_confidence.

_{Usage: model `openrouter/anthropic/claude-sonnet-5.5`, LLM done, tokens counted before the call 76053, calls 1, tokens in 78161 / out 640 (reasoning included in out), duration 13.1 s, cost 0.1627 USD (reported), classifier `jev-1.13.0` calls 15, tokens in 13599, cost 0.0006 USD, config: defaults + host + repository (.werkrevisor.toml at base e8b256e).

Reviewed head `3e6c6b54243444d271dfc9c17ddc652a0c8f6941` against base `e8b256ef92ad88780065ce295ababfe9e188e826`, werkrevisor 0.14.0.}

## 🟠 werkrevisor: ORANGE / FINDINGS Change kind: `mixed`. ### Reasons - **ORANGE** model reports 2 findings of medium severity ([review] orange_min_medium = 2) - **YELLOW** test changes are not purely additive: tests/test_config_layers.py:83 changes an existing test line, tests/test_config_layers.py:84 removes a test or assertion, tests/test_config_layers.py:86 removes a test or assertion and 4 more - **YELLOW** change kind 'mixed' (main code, tests, other files, docs); AI-approvable are only: docs only, tests only added, docs and tests, refactoring with unchanged tests, feature with purely additive tests, harmless files only, mechanical changes only - **YELLOW** risky paths changed: config/hsadmin-ng.toml (config/**), config/werkprobe.toml (config/**), config/werkrevisor.toml (config/**) and 1 more - **YELLOW** spec: docs/prs/2026-10-05-PR#15-hard-orange-paths.md Scenario#15.04 implementation_details (0.63 > yellow_above = 0.6) - **YELLOW** 2 changed files were given to the AI only as diff, not in full, so it could not check them against the rest of their file (all full files together would exceed [review] max_full_files_chars = 120000): werkrevisor/config.py, werkrevisor/rules.py - **YELLOW** model recommends merge with caution ### Findings 1. **[medium] Test hunk broke file structure** at `tests/test_config_source_and_isolation.py:140-160` The hunk removes the `if __name__ == "__main__"` block from the middle of the file and moves it to the end; that is fine. However, `test_a_config_without_hard_orange_is_refused` calls `build_config(host, {})`. With an empty repo dict this checks the host only, so the test is valid. The file also keeps extra blank lines (three blank lines before `MissingSectionTest`) and local imports inside tests. This is cosmetic only and has no behavior impact. 2. **[medium] Critical DB-schema exemption not tested for built-in path** at `werkrevisor/rules.py:208-215` A file that matches `[hard_orange]` is skipped before the `BUILTIN_DB_SCHEMA_PATHS` check, so a critical `.sql` file no longer yields a `db_schema` reason. This is intended. But the built-in `.werkrevisor.toml` risky-path rule is also placed after the `continue`. If an operator lists `.werkrevisor.toml` or a matching glob (e.g. `.*`, `**/*.toml`) in `[hard_orange]`, the "always needs a human" guarantee for repository config changes is reported only as critical. The verdict stays at least ORANGE, so the human gate still holds in the approval mode. The behavior is unverified by a test. ### Classifier | Unit | Question | Problem | Confidence | Verdict | |---|---|---|---|---| | docs/prs/2026-10-05-PR#15-hard-orange-paths.md Scenario#15.04 | implementation_details | 0.63 | – | YELLOW | 14 of 15 units passed all questions (1 PR document(s)). 2 answers ignored because of a confidence below [classifier] min_confidence. Usage: model `openrouter/anthropic/claude-sonnet-5.5`, LLM done, tokens counted before the call 76053, calls 1, tokens in 78161 / out 640 (reasoning included in out), duration 13.1 s, cost 0.1627 USD (reported), classifier `jev-1.13.0` calls 15, tokens in 13599, cost 0.0006 USD, config: defaults + host + repository (.werkrevisor.toml at base e8b256e). Reviewed head `3e6c6b54243444d271dfc9c17ddc652a0c8f6941` against base `e8b256ef92ad88780065ce295ababfe9e188e826`, werkrevisor 0.14.0.

claude-code commented

2026-10-05 21:33:39 +02:00

Replaced by PR#16: dangerous paths give YELLOW there, not ORANGE; ORANGE now means a probably real finding.

claude-code closed this pull request

2026-10-05 21:33:39 +02:00

Pull request closed

Please reopen this pull request to perform a merge.

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mi/werkrevisor#15