# Workstream Tasks

See every CVE fix in a workstream and which ones need you, then approve plans, make decisions, and merge pull requests from the Tasks tab.

<PrivatePreview>
  The Tasks tab is part of CVE remediation, which is in Private Preview with limited availability. Contact your Factory account team to request access.
</PrivatePreview>

The **Tasks** tab lists every task in a workstream that runs [CVE remediation](/automations/cve-remediation), and shows which ones need you. Each task is one fix in one repository, with its own fix droid. You use the tab in the Factory App.

## Open the task list

The tab appears in the right pane of a workstream's orchestrator once `/cve-remediation` has run and the first task exists. It opens on its own when you open the workstream. To open it yourself, select **+** in the right pane and choose **Tasks**.

The number on the tab counts the tasks waiting on you that you haven't acted on yet.

## Sections

<PropertyList>
  <Property name='Waiting on you'>
    Tasks that need your decision, approval, merge, or answer, and tasks whose fix failed.
  </Property>
  <Property name='Agents working'>
    Tasks a fix droid is working on right now.
  </Property>
  <Property name='Waiting on agents'>
    Tasks waiting for a fix droid to start triage, and merged fixes waiting for the scanner to confirm them.
  </Property>
  <Property name='Done'>
    Fixed tasks, plus a folded group of tasks closed without a fix. Done tasks stay in the list for 30 days. After that, the section only counts them.
  </Property>
</PropertyList>

Within a section, the tasks closest to done come first. Each row shows the task's title, its status, a link to its plan or pull request, and how long ago it last changed. Use **Search tasks** to find one.

## Statuses

| Status | Section | What it means |
| --- | --- | --- |
| **Needs decision** | Waiting on you | Triage needs you to choose, for example between a fix and closing the task as not affected. |
| **Needs a check** | Waiting on you | The scanner still reports the finding after the merge, or the finding was fixed some other way before this task's pull request merged. |
| **Plan needs approval** | Waiting on you | The plan is ready for your review. |
| **PR ready to merge** | Waiting on you | The pull request's checks passed. |
| **Fix failed** | Waiting on you | The fix droid couldn't fix it, CI keeps failing after three rounds of fixes, or someone closed the pull request. |
| **Droid has a question** | Waiting on you | The fix droid needs a fact only you have. |
| **Triaging**, **Writing plan**, **Revising plan**, **Creating PR**, **Revising PR**, **Watching CI**, **Fixing CI**, **Merging** | Agents working | The fix droid is on that step. |
| **Waiting to triage** | Waiting on agents | The task is new or was reopened, and its fix droid hasn't started yet. |
| **Waiting for rescan** | Waiting on agents | The pull request merged. The task is fixed once a poll no longer finds the finding. |
| **Fixed** | Done | The scanner no longer reports the finding, or you closed the task as fixed. |
| **Closed** | Done | Closed without a fix, as **Won't fix**, **Not affected**, **Accepted risk**, or **Deferred**. A discarded task closes as **Won't fix**. |

## Open a task

Select a task to open it in a tab next to the orchestrator chat. The header shows the task ID, its status, and how long it has been in that status. The task has three views:

<PropertyList>
  <Property name='Overview'>
    What the task needs from you and the key facts: severity, the vulnerabilities and whether they're in the CISA Known Exploited Vulnerabilities catalog, the package and versions, the repository, the plan, and the pull request. Below that are the scanner findings, triage's notes, and a timeline of everything that happened.
  </Property>
  <Property name='Plan'>
    The fix droid's plan: the change, any breaking changes, the risk, how it will validate the fix, and how to roll it back. The view shows the plan's revision and who approved it.
  </Property>
  <Property name='Pull request'>
    The pull request's checks and approvals, and who merged it.
  </Property>
</PropertyList>

## Act on a task

The bar at the bottom of a task shows what you can do now, with the main action on the right.

| Status | Main action | Other actions |
| --- | --- | --- |
| **Needs decision** or **Needs a check** | The recommended choice | **Other choices** or **Close as…** for the rest. |
| **Plan needs approval** | **Approve plan** | **Request changes** sends your note to the fix droid, which revises the plan (**Revising plan**). **Discard** closes the task. |
| **PR ready to merge** | **Merge PR** | **Request changes** sends your note to the fix droid. **Close PR** closes the task and has the fix droid close the pull request. |
| **Fix failed** | **Retry**, or **Retry with guidance** when CI keeps failing | **Discard**, or **Close PR** while a pull request is open. |
| **Droid has a question** | **Answer** | **Discard**, or **Close PR** while a pull request is open. |
| Agents working | **Watch session** opens the fix droid's session in a tab. | None. Nothing needs you. |
| **Fixed** | **View on GitHub** | None. |
| **Closed** | **Reopen** sends the task back to triage with a new fix droid. | None. |

Every task also has **Continue in chat**, which brings the orchestrator chat to the front so you can talk the task through. When the bar has no way to drop a task, use **Discard task** in the **Task actions** menu next to its title.

Each decision choice opens an optional note before you send it. **Request changes**, **Answer**, and **Retry with guidance** need a note.

**Merge PR** asks the fix droid to merge the pull request. If the pull request has an approval, the bar shows who approved it. The fix droid checks that the approvals and required checks that branch protection needs are in place, then merges with the method the repository usually uses. If the branch is behind, the fix droid updates it, which can need a new approval. If an approval is missing, the task comes back as **Droid has a question**.

<Warning>
  Factory doesn't enforce plan or merge approval. Turn on branch protection with required reviews and required status checks for every repository in scope. See [Security and access](/automations/cve-remediation#security-and-access).
</Warning>

## After you send an action

Your action goes to the orchestrator, which applies it and passes it on to the fix droid. The bar shows its progress:

1. **Sending to the orchestrator…**
2. **Sent. Waiting for the board to update…**
3. When the action is applied, the bar shows the outcome and the section the task moved to. It then offers the next task waiting on you, or says **Nothing else waiting on you** with **Close tab**.

Other results:

{/* sweep-allow: term-bullets */}

- **Not applied.** The task changed since you opened it, so the action no longer fits. The bar gives the reason. Select **Review again** to see the task as it is now.
- **No response.** The orchestrator hasn't confirmed the action after 2 minutes. It may still apply it. Select **Continue in chat** to check, **Send again**, or **Dismiss**. Each action carries the version of the task you saw, so it isn't applied twice.
- **Couldn't send.** The orchestrator session isn't reachable. Select **Retry** once it's back.

You can also act on a task by telling the orchestrator in its chat, for example `merge the PR for FIX-3f9a2c1b`. The orchestrator is instructed to refuse task actions that other agents send.

## Troubleshooting

<Troubleshooting>
  <TroubleshootingItem title="No tasks yet">
    The listener hasn't created a task. Open the listener's chat to check that setup finished, and ask the orchestrator for `/cve-remediation status` to see when the last poll ran.
  </TroubleshootingItem>

  <TroubleshootingItem title="Tasks can't be read">
    The task list in the shared folder isn't in a format this version of the app understands. Update the Factory App, or ask the orchestrator to check the task list.
  </TroubleshootingItem>

  <TroubleshootingItem title="A task isn't moving">
    If a task stays under **Agents working** for a long time, select **Watch session** to see what its fix droid is doing, or ask the orchestrator. A fix droid that stops responding isn't detected on its own.
  </TroubleshootingItem>

  <TroubleshootingItem title="A change made on GitHub or GitLab doesn't show">
    Merging, closing, or reviewing a pull request directly on GitHub or GitLab updates the task only when its fix droid notices. Act from the Tasks tab when you can.
  </TroubleshootingItem>
</Troubleshooting>

<RelatedLinks>
  <RelatedLink href='/automations/cve-remediation' title='CVE Remediation'>
    Set up the listener, scanners, and fix droids.
  </RelatedLink>
  <RelatedLink href='/workstreams/pull-requests' title='Pull requests'>
    Track every pull request the workstream opens.
  </RelatedLink>
</RelatedLinks>