werkrevisor/docs/prs/2026-10-20-PR#126-werkdock-host.md

PR#126: werkrevisor Reviews werkdock

WARNING: This document describes only the change applied in this PR. It may already be outdated once the next PR is merged. Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.

Related Links

• werkdock PR#15: werkdock takes the shared workflow and its .werkrevisor.toml.

Problem

werkdock, the sandbox CLI that Werkator and werkrevisor run in, follows the shared workflow from werkdock PR#15 on. werkrevisor has no host config for it, so its PRs get no review.

Non-Goals

• No branch protection and no machine config on mih09; the human sets them up.
• No change of werkrevisor's code.

Solution

• config/werkdock.toml is the host config for mi/werkdock, derived from that of werkcrappit, with require_wip_transition and automerge.
• Its categories fit a Go module: *_test.go and testdata/ are tests, every other .go file is main code.
• Hard YELLOW are the paths for secrets and the files that set the levels of werkdock's required checks: docs/risk-analysis.md, tools/vulnerability-exceptions.txt and tools/allowed-licenses.txt.
• werkrevisor checks hard_yellow.paths only for files outside the docs globs, so the docs globs name each place of documentation but docs/risk-analysis.md (found by the Codex review). A test proves it red/green: with docs/**, a change of the risk analysis gave no reason at all.
• Judged paths are the CI files, tools/**, go.mod and go.sum: werkdock allows a third-party dependency only with an RFC.
• The review instructions describe werkdock and point to the hard invariants in its AGENTS.md.
• werkdock's own .werkrevisor.toml from werkdock PR#15 loads over this file without an error.
• docs/betrieb-git.javagil.de.md counts eight repositories.
• The tests of the example configs include it.
• Version 0.54.1, above 0.53.0 of PR#124 and 0.54.0 of PR#125.

After the merge, the human sets up on Gitea and mih09:

1. The machine config ~/werkdock/.git/werkator/.werkator.yml on mih09 with the build ai-review, its secrets and config/werkdock.toml as WERKREVISOR_CONFIG_TOML.
2. The branch protection of main with tools/branch-protection: contexts werkator and ai-review/gate, approvers ai-reviewer,mi; after the merge of werkdock PR#15 also werkator/dependencies, since Werkator reads that status context from main only.

ai-reviewer is a collaborator with write access in mi/werkdock since 2026-10-20.

Open Questions

None.

Follow-up PRs

• werkregie lists doc/risk-analysis.md under hard_yellow.paths too, but its docs glob doc/** covers it, so a change of its risk analysis needs no human either.