Skip to main content

M7 - Specialist Review Agents

Status: delivered (v0.7.0). Bloom can run opt-in Architecture, Security, and QA review lenses beside the Product Owner review, publish advisory findings to GitHub, and surface compact status in the dashboard and proactive digest context.

Product outcome​

M7 gives Bloom a more realistic review loop for mixed human and AI teams. The Product Owner still owns the merge decision, but configured specialist reviewers add focused checks for architectural fit, security risk, and QA coverage before work reaches the user as done.

The feature is advisory by design:

  • Specialist findings inform the Product Owner review.
  • Specialists never assign work, mutate status:* or eng:* labels, approve, request changes, or merge a PR.
  • Human specialists remain native GitHub collaborators. AI specialists publish through App-authored GitHub review/comment surfaces.

Delivered issues​

M7-1 - Specialist reviewer actor model and policy​

Added typed specialist reviewer roles (architecture, security, qa), AI/human actor kinds, advisory mode, output capabilities, and BLOOM_SPECIALIST_REVIEWERS parsing. The model is opt-in and disabled by default.

M7-2 - Specialist review orchestration and aggregation​

Added a fail-soft fan-out orchestrator that runs enabled specialists, captures per-role errors, and aggregates results in configured roster order.

M7-3 - Architecture specialist reviewer​

Added an architecture lens for modularity, boundaries, coupling, maintainability, and alignment with the documented architecture.

M7-4 - Security specialist reviewer​

Added a security lens for authentication, authorization, secret handling, input validation, dependency risk, and least-privilege concerns.

M7-5 - QA specialist reviewer​

Added a QA lens for acceptance criteria coverage, test gaps, regression risk, and verification evidence.

M7-6 - Publish specialist review output to GitHub​

Specialist rounds now publish a COMMENT review on the PR. Valid diff-line findings are posted inline; file-level, out-of-diff, and rejected inline comments fall back to the review body so the round still lands.

M7-7 - Surface specialist review status​

Project detail and proactive digest context now expose compact specialist role status, keeping full analysis in GitHub while giving the user a concise project-level signal.

M7-8 - Docs, PRD reconcile and version bump (0.7.0)​

Updated the PRD, architecture docs, coordination docs, changelog, and version metadata to reflect M7 as delivered. M6's production-grade engineering engine remains future work and was not shipped as part of this milestone.

Configuration​

BLOOM_SPECIALIST_REVIEWERS=architecture,security,qa

Entries default to AI reviewers. Use :<kind> for human specialists:

BLOOM_SPECIALIST_REVIEWERS=security,architecture:human

Unsupported roles or actor kinds fail at startup instead of silently disabling review.

Limits​

  • Specialist reviews are advisory in v0.7.0.
  • blocking specialist mode exists as a typed future value but is not enforced.
  • Specialist reviewers do not replace human GitHub reviewers or CODEOWNERS.
  • Specialist reviewers do not change human or agent assignment ownership.
  • The production-grade engineering engine behind the swarm remains future work.