# PR#126: werkrevisor Reviews werkdock

> **WARNING:** This document describes only the change applied in this PR.
> It may already be outdated once the next PR is merged.
> Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.

## Related Links

- [werkdock PR#15](https://git.javagil.de/mi/werkdock/pulls/15): werkdock takes the shared workflow and its `.werkrevisor.toml`.

## Problem

werkdock, the sandbox CLI that Werkator and werkrevisor run in, follows the shared workflow from werkdock PR#15 on.
werkrevisor has no host config for it, so its PRs get no review.

## Non-Goals

- No branch protection and no machine config on mih09; the human sets them up.
- No change of werkrevisor's code.

## Solution

- `config/werkdock.toml` is the host config for `mi/werkdock`, derived from that of werkcrappit,
  with `require_wip_transition` and `automerge`.
- Its categories fit a Go module: `*_test.go` and `testdata/` are tests, every other `.go` file is main code.
- Hard YELLOW are the paths for secrets and the files that set the levels of werkdock's required checks:
  `docs/risk-analysis.md`, `tools/vulnerability-exceptions.txt` and `tools/allowed-licenses.txt`.
- werkrevisor checks `hard_yellow.paths` only for files outside the docs globs,
  so the docs globs name each place of documentation but `docs/risk-analysis.md` (found by the Codex review).
  A test proves it red/green: with `docs/**`, a change of the risk analysis gave no reason at all.
- Judged paths are the CI files, `tools/**`, `go.mod` and `go.sum`:
  werkdock allows a third-party dependency only with an RFC.
- The review instructions describe werkdock and point to the hard invariants in its `AGENTS.md`.
- werkdock's own `.werkrevisor.toml` from werkdock PR#15 loads over this file without an error.
- `docs/betrieb-git.javagil.de.md` counts eight repositories.
- The tests of the example configs include it.
- Version 0.54.1, above 0.53.0 of PR#124 and 0.54.0 of PR#125.

After the merge, the human sets up on Gitea and mih09:

1. The machine config `~/werkdock/.git/werkator/.werkator.yml` on mih09 with the build `ai-review`,
   its secrets and `config/werkdock.toml` as `WERKREVISOR_CONFIG_TOML`.
2. The branch protection of `main` with `tools/branch-protection`: contexts `werkator` and `ai-review/gate`,
   approvers `ai-reviewer,mi`; after the merge of werkdock PR#15 also `werkator/dependencies`,
   since Werkator reads that status context from `main` only.

`ai-reviewer` is a collaborator with write access in `mi/werkdock` since 2026-10-20.

## Open Questions

None.

## Follow-up PRs

- werkregie lists `doc/risk-analysis.md` under `hard_yellow.paths` too, but its docs glob `doc/**` covers it,
  so a change of its risk analysis needs no human either.