werkrevisor/docs/prs/2026-10-10-PR#71-security-concern-false.md

PR#71: An Answer "No" Without Quotes Is No Security Concern

WARNING: This document describes only the change applied in this PR. It may already be outdated once the next PR is merged. Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.

Related Links

• werkcrappit PR#52, head 76d4ee2: YELLOW with the single reason "model reports a security concern: False".

The Problem

PR-Agent answers security_concerns with "No" or with a text that describes the concern. When the model writes security_concerns: No without a block scalar or quotes, the YAML loader of PR-Agent reads the value as the bool False. werkrevisor made the text "False" of it and compared only with "no". So a review without a security concern became YELLOW, with the reason "model reports a security concern: False".

Non-Goals

• No change to the verdict of a real concern: it stays YELLOW and quoted.
• No interpretation of free text such as "No security concerns found": it stays a concern, as before.

The Scenarios

Feature: an answer without a security concern gives no reason

Scenario#71.01: every spelling of "no" gives no reason

So that the bool of the YAML loader and the case of the answer do not decide the verdict.

• Given the model answers security_concerns with the bool False, "False", "false", "no", "No.", "None" or nothing
• When werkrevisor assesses the answer
• Then the verdict is GREEN
• And no reason model_security is given

Verified by

• test_verdict.ModelMappingTest.test_no_security_concern_in_any_spelling_gives_no_reason

Scenario#71.02: the unquoted YAML answer "No" of a real PR-Agent run is no concern

So that the fix covers the value as the YAML loader of PR-Agent 0.47.0 gives it.

• Given the model answer holds the line security_concerns: No
• When PR-Agent loads the answer and werkrevisor assesses it
• Then the assessment holds no security concern

Verified by

• test_pr_agent_run.PrAgentRunTest.test_unquoted_no_is_no_security_concern

The Solution

• parse_model_review maps the bool False, None and the texts "no", "false" and "none", in any case and with an optional final ".", to an empty concern.
• assess_model gives the reason model_security only for a non-empty concern.
• The bool True stays the concern "True": YELLOW, as before.
• The README says so; the Werkbaum adds the item as done.
• Version 0.31.5.