werkrevisor/docs/prs/2026-10-09-PR#67-security-concern-text.md

PR#67: The Result Comment Names the Security Concern of the Model

WARNING: This document describes only the change applied in this PR. It may already be outdated once the next PR is merged. Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.

The Problem

PR-Agent answers security_concerns with "No" or with a text that describes the concern. werkrevisor makes any other answer than "No" YELLOW, with the reason "model reports a security concern". The text of the concern is lost: PR#63 got YELLOW for one, and neither the author nor the reviewer could see what it was.

Non-Goals

• No change to the verdict: a security concern of the model stays YELLOW.
• No line comment for the concern: PR-Agent gives it no file and no line.

The Scenarios

Feature: the reason of a security concern holds its text

Scenario#67.01: the reason quotes the concern

So that the reviewer can judge the concern without a new model run.

• Given the model answers security_concerns with "SQL injection: the query concatenates the user name."
• When werkrevisor assesses the answer
• Then the verdict is YELLOW
• And the reason reads "model reports a security concern: SQL injection: the query concatenates the user name."

Verified by

• test_verdict.ModelMappingTest.test_security_concern_is_yellow_and_quoted

Scenario#67.02: a long concern is shortened to one line

So that a long answer does not push the other reasons out of view.

• Given the model answers security_concerns with several lines and more than 400 characters
• When werkrevisor assesses the answer
• Then the reason holds the concern on one line, cut after 400 characters and marked with "…"

Verified by

• test_verdict.ModelMappingTest.test_a_long_security_concern_is_one_shortened_line

The Solution

• The reason model_security quotes the concern on one line, at most 400 characters.
• The README says so; the Werkbaum marks the item as done.
• Version 0.31.1.