Workstream Tasks
Private PreviewSee every CVE fix in a workstream and which ones need you, then approve plans, make decisions, and merge pull requests from the Tasks tab.
The Tasks tab is part of CVE remediation, which is in Private Preview with limited availability. Contact your Factory account team to request access.
The Tasks tab lists every task in a workstream that runs CVE remediation, and shows which ones need you. Each task is one fix in one repository, with its own fix droid. You use the tab in the Factory App.
Open the task list
The tab appears in the right pane of a workstream's orchestrator once /cve-remediation has run and the first task exists. It opens on its own when you open the workstream. To open it yourself, select + in the right pane and choose Tasks.
The number on the tab counts the tasks waiting on you that you haven't acted on yet.
Sections
Waiting on youTasks that need your decision, approval, merge, or answer, and tasks whose fix failed.
Agents workingTasks a fix droid is working on right now.
Waiting on agentsTasks waiting for a fix droid to start triage, and merged fixes waiting for the scanner to confirm them.
DoneFixed tasks, plus a folded group of tasks closed without a fix. Done tasks stay in the list for 30 days. After that, the section only counts them.
Within a section, the tasks closest to done come first. Each row shows the task's title, its status, a link to its plan or pull request, and how long ago it last changed. Use Search tasks to find one.
Statuses
| Status | Section | What it means |
|---|---|---|
| Needs decision | Waiting on you | Triage needs you to choose, for example between a fix and closing the task as not affected. |
| Needs a check | Waiting on you | The scanner still reports the finding after the merge, or the finding was fixed some other way before this task's pull request merged. |
| Plan needs approval | Waiting on you | The plan is ready for your review. |
| PR ready to merge | Waiting on you | The pull request's checks passed. |
| Fix failed | Waiting on you | The fix droid couldn't fix it, CI keeps failing after three rounds of fixes, or someone closed the pull request. |
| Droid has a question | Waiting on you | The fix droid needs a fact only you have. |
| Triaging, Writing plan, Revising plan, Creating PR, Revising PR, Watching CI, Fixing CI, Merging | Agents working | The fix droid is on that step. |
| Waiting to triage | Waiting on agents | The task is new or was reopened, and its fix droid hasn't started yet. |
| Waiting for rescan | Waiting on agents | The pull request merged. The task is fixed once a poll no longer finds the finding. |
| Fixed | Done | The scanner no longer reports the finding, or you closed the task as fixed. |
| Closed | Done | Closed without a fix, as Won't fix, Not affected, Accepted risk, or Deferred. A discarded task closes as Won't fix. |
Open a task
Select a task to open it in a tab next to the orchestrator chat. The header shows the task ID, its status, and how long it has been in that status. The task has three views:
OverviewWhat the task needs from you and the key facts: severity, the vulnerabilities and whether they're in the CISA Known Exploited Vulnerabilities catalog, the package and versions, the repository, the plan, and the pull request. Below that are the scanner findings, triage's notes, and a timeline of everything that happened.
PlanThe fix droid's plan: the change, any breaking changes, the risk, how it will validate the fix, and how to roll it back. The view shows the plan's revision and who approved it.
Pull requestThe pull request's checks and approvals, and who merged it.
Act on a task
The bar at the bottom of a task shows what you can do now, with the main action on the right.
| Status | Main action | Other actions |
|---|---|---|
| Needs decision or Needs a check | The recommended choice | Other choices or Close as… for the rest. |
| Plan needs approval | Approve plan | Request changes sends your note to the fix droid, which revises the plan (Revising plan). Discard closes the task. |
| PR ready to merge | Merge PR | Request changes sends your note to the fix droid. Close PR closes the task and has the fix droid close the pull request. |
| Fix failed | Retry, or Retry with guidance when CI keeps failing | Discard, or Close PR while a pull request is open. |
| Droid has a question | Answer | Discard, or Close PR while a pull request is open. |
| Agents working | Watch session opens the fix droid's session in a tab. | None. Nothing needs you. |
| Fixed | View on GitHub | None. |
| Closed | Reopen sends the task back to triage with a new fix droid. | None. |
Every task also has Continue in chat, which brings the orchestrator chat to the front so you can talk the task through. When the bar has no way to drop a task, use Discard task in the Task actions menu next to its title.
Each decision choice opens an optional note before you send it. Request changes, Answer, and Retry with guidance need a note.
Merge PR asks the fix droid to merge the pull request. If the pull request has an approval, the bar shows who approved it. The fix droid checks that the approvals and required checks that branch protection needs are in place, then merges with the method the repository usually uses. If the branch is behind, the fix droid updates it, which can need a new approval. If an approval is missing, the task comes back as Droid has a question.
Factory doesn't enforce plan or merge approval. Turn on branch protection with required reviews and required status checks for every repository in scope. See Security and access.
After you send an action
Your action goes to the orchestrator, which applies it and passes it on to the fix droid. The bar shows its progress:
- 1Sending to the orchestrator…
- 2Sent. Waiting for the board to update…
- 3When the action is applied, the bar shows the outcome and the section the task moved to. It then offers the next task waiting on you, or says Nothing else waiting on you with Close tab.
Other results:
- Not applied. The task changed since you opened it, so the action no longer fits. The bar gives the reason. Select Review again to see the task as it is now.
- No response. The orchestrator hasn't confirmed the action after 2 minutes. It may still apply it. Select Continue in chat to check, Send again, or Dismiss. Each action carries the version of the task you saw, so it isn't applied twice.
- Couldn't send. The orchestrator session isn't reachable. Select Retry once it's back.
You can also act on a task by telling the orchestrator in its chat, for example merge the PR for FIX-3f9a2c1b. The orchestrator is instructed to refuse task actions that other agents send.