Workstream Review Findings

Workstream review findings are durable review observations attached to a BMO workstream. They are for code-review state that should survive a session: defects, risks, accepted risks, duplicates, and resolved findings.

Use this when a review finding belongs to the workstream itself rather than to the current chat transcript or a Markdown checklist.

What it stores

Each finding is stored in bmo.db under the workstream id with stable fields: file path, optional line range, severity, title, body, status, source session, source agent run, and resolution metadata.

Statuses are:

Status	Meaning
open	Still needs action or a decision.
resolved	Fixed or otherwise closed.
accepted_risk	Kept intentionally with a resolution note.
duplicate	Superseded by another finding.

Severities are info, low, medium, high, and critical.

CLI

bmo workstream findings list <workstream-id> [--open]
bmo workstream findings add <workstream-id> --file <path> --title <title>
bmo workstream findings resolve <workstream-id> <finding-id> --status resolved
bmo workstream findings delete <workstream-id> <finding-id> --reason "<why>"
bmo workstream findings deletions <workstream-id> [--json]
bmo workstream findings import <workstream-id> --file findings.json

Use --json on list when recipes, scripts, or other agents need stable machine-readable output.

bmo workstream findings delete removes one durable finding row and writes an append-only audit entry with actor, reason, timestamp, and a JSON snapshot of the deleted finding. Use bmo workstream findings deletions <workstream-id> --json (alias: audit) to inspect those audit entries later. The TUI viewer remains read-only, and there is still no HTTP or MCP write API for findings.

TUI

The status bar shows WS review: N open when the current session has a workstream with review findings.

Open /workstream_findings to inspect the session workstream’s durable finding list. Aliases: /ws_findings, /ws_review, and /workstream-review.

Import format

bmo workstream findings import reads a JSON array. Required fields are file_path, severity, and title. Optional fields include line_start, line_end, body, status, source_session_id, and source_agent_run_id.

[
  {
    "file_path": "internal/pkg/example.go",
    "line_start": 42,
    "severity": "high",
    "title": "Possible nil dereference",
    "body": "The handler can receive a nil request under retry."
  }
]

The full import fails if any row is invalid, and the error names the 1-based row number.

Boundaries

Workstream findings are not session-local todos, Markdown checkboxes, Journal entries, or patch proposals.

Patch proposals track code-change candidates and apply state. Workstream findings track review observations that may later drive a proposal, a manual fix, or an accepted-risk decision.

Implementation details and invariants live in the implementation reference workstream-review-findings.md.