AnyForge

Accept a production-error signal — the operator approval that turns it into a governed INCIDENT under the company's KTLO program. The target codebase resolves from codebaseId → repo → the signal's service; if none resolves the call returns codebase_required. Requires `write` scope.

Attach a bounded context snapshot to a prepared prompt. No code execution; explicitly identify local versus remote provenance.

Attach up to 5 files to a work item, as the Console's Files panel does: images, PDF, text, logs, Markdown, CSV, JSON, XML, HTML pages, zip, Office documents and MP4/WebM/MOV video. SVG and other types are refused. Give each file exactly one of: text (the content as a string), contentBase64 (the bytes, base64-encoded) or path (a local file, stdio server only); name is required with text or contentBase64. Files start internal (not shared with the client). All or nothing: one refused file attaches none. One call carries at most 10 MB of request, which is about 7 MB of files once base64-encoded; for a larger file use anyforge_start_file_upload (up to 1 GB). A file already on the item with the same name and size is not attached again: it comes back with alreadyAttached: true. A same-name file of another size is refused (file_name_exists) unless onNameConflict is "keep_both". Give originalCreatedAt to keep the date a file was created in another tool. Requires the write scope and a key owner who is an editor or above. Returns { files } with each file's id. Pass an idempotencyKey to retry safely: a repeat with the same key and files returns the stored files ({ replayed: true }). Only call when the person asked to attach these files.

Continue & finish: send a crew waiting at its HIL gate back to the engineer with guidance — it resumes work on the SAME PR (capped at the amend limit). This is the "Continue" option alongside submit_approval APPROVE (ship) / REJECT (stop). Requires `approve` scope. Only call when the operator explicitly asks to amend/continue — never on your own judgement of the reviews.

Start Phase-1 codebase analysis for one or more repos. Idempotent — already-analyzed repos return `already_analyzed`, in-flight ones `already_running` (never re-run). Up to 25 repos per call; chunk larger sets or use anyforge_start_coverage_sweep instead. Requires `write` scope.

Approve the proposed backlog for an initiative (HIL #1). Promotes its BACKLOG items to READY and moves the initiative to IN_PROGRESS. Pass `deferItemIds` to leave chosen proposed items out of the approval: they stay in the backlog marked deferred, are never promoted or auto-dispatched, and come back through anyforge_update_work_item action='undefer'. Refused with a 400 and nothing written when an id is not one of this plan's proposed items (defer_item_not_proposed), is the integration-validation item (defer_item_not_deferrable), would defer every item (defer_all_items), or is a dependency of an item being approved (defer_breaks_dependency). Requires `approve` scope.

Approve the program's rolled-up solution architecture: one review approves EVERY BACKLOG_PROPOSED initiative backlog in the program (this is HIL #1 for each), each through the canonical backlog approval. Hold initiatives back with excludeInitiativeIds. Auto-dispatch keeps its default unless you pass autoDispatch: false to approve the plans but hold the crews. Requires `approve` scope and a key holder who can dispatch crews.

Approve a mid-flight task proposal card, materialising a READY work item. Requires `approve` scope.

Run program-level architecture planning: kick the architect decomposition for EVERY still-DRAFT initiative in the program in one step (already-planned and standing-maintenance initiatives are skipped, reported per row). This spends tokens, the same tier as a single anyforge_dispatch_architect. Gated on the program brief clearing 100% ICE — a below-bar brief returns 409 `program_brief_below_bar` with the score and gaps; an OWNER may waive it with allowBriefBelowBar. Requires `write` scope and a key holder who can dispatch crews.

Archive a page (or restore it with `archived: false`). An archived page is kept, with its history, and hidden from the page tree and search. Only call when the person asked for it.

Archive all of your own unarchived Studio sessions (CI auto-fix monitors excluded). Transcripts are kept and each session can be unarchived with update_studio_session. Call again while remaining is true.

Ask the AnyForge Oracle a question about this workspace: programs, initiatives, codebases, analyzed-codebase docs, releases, recorded decisions — AND live data from the connected integrations (e.g. "top 10 payment errors in production over the last 7 days" via a connected Datadog). The Oracle runs its own multi-step research loop server-side and returns one final, source-cited answer, so ask the FULL question in one call instead of decomposing it yourself. Read-only; answers are company-scoped. A research turn can take a few minutes, so this call waits up to ~40s: if the result has status "done" it carries the answer; if it has status "running", call anyforge_get_oracle_answer with its askId (repeat while it stays "running"). Do NOT call anyforge_ask_oracle again for the same question — that starts a second turn. A turn that runs out of time is continued server-side automatically (up to maxContinuations extra turns, default 2), so long answers such as a full program brief arrive whole: keep polling rather than asking "continue". A "done" answer with investigationTruncated: true used every continuation; ask a narrower follow-up for what it left out.

Book, change or clear cells of your own timesheet: up to 100 at once, ALL OR NOTHING. Every cell is checked by the same rules as the Timesheets grid before any is written; if one is refused, none is, and the error names it by index. A cell that already has time is replaced (mode set, the default) or added to (mode add); minutes 0 clears it; cells you do not send are left alone. Minutes are rounded to the workspace step. A day may not pass 24 hours. Refusals: not_bookable with a reason (date_in_future, period_closed, initiative_closed, no_current_quarter_key_result, not_linked, enabling_work, initiative_not_in_program), day_over_limit, initiative_not_found, duplicate_entry (the same initiative and day twice), time_recording_disabled. Use the initiativeId values anyforge_get_timesheet_week lists. An empty list writes nothing and returns written: 0.

Fork a session with explicit conversation/files/both scope. File scope also requires studio:execute and checkpoints; rewind requires exact workspace revisions. Does not undo external GitHub actions. For branch, reuse the same idempotencyKey when retrying; inspect incomplete preparation before retrying.

Call one tool on a connected server listed by anyforge_list_connected_tools. A read tool runs now and returns its result. A write tool (`access: "write"`), or any tool marked `needsApproval`, does NOT run: AnyForge records the exact arguments and asks a person to approve it on the Approvals page or in Slack, then runs it. You get `status: "pending_approval"` and a `callId`; tell the user, do not call it again, and check the outcome later with anyforge_get_connected_tool_call. Never put a credential in `arguments`.

Cancel queued starts; already active crews require separate stop actions. Also requires studio:publish.

Check what would stop a crew starting, without launching one. Pass `workItemId` to run every dispatch gate for that work item (its id or its code) and get ALL the blockers at once in `blockers` (role, item state, who may dispatch it, the initiative's task tracker, approval, program brief, spec and plan, intake, write scope, repository, team, dependencies, analysis, GitHub connection); `ready` is true only when there are none. Pass only `repoFullName` to check just that repository's Phase 1 + Phase 2 analysis gate. GitHub scopes and permissions, the base branch and the budget are still checked when the crew is started.

Early-close one initiative in a program with completed-elsewhere, wont-do, duplicate, or superseded. Call action=preview first, present the returned impact, then call action=execute with only the proposalToken. The operation yields CLOSED, cancels active crews, and drops outstanding work items.

Batch-close unique, non-terminal work items already fixed outside AnyForge. Call action=preview with closures, present the linked impact, then call action=execute with only proposalToken. Each closure needs workItemId and closedReason; closedAsFixedByWorkItemId is optional.

Commit reviewed remote changes. Read changes and confirm file scope before committing; does not push.

Compact the session's stored history: older messages are replaced by one summary so the next run starts lean. Deletes the summarized messages and cannot be undone. Spends a small model call on your credential. Refused while a run is active.

Attach a file whose bytes were PUT to the `uploadUrl` from anyforge_start_file_upload. Only the key holder who started the upload may complete it; completing twice returns the first result. `upload_incomplete` (409): the bytes have not all arrived. `upload_expired` (410): more than 24 hours passed; start again. `upload_size_mismatch` (400): the stored size differs, the bytes were discarded. If the same file (name and size) was attached meanwhile, the answer is that file with alreadyAttached: true and the new bytes are discarded; a same-name file of another size is `file_name_exists` (409) unless the start said keep_both.

Pause, cancel, resume, steer or answer a pending question. Answer requires its current questionId. Resuming may execute code and spend tokens.

Create an initiative (optionally under a program). MUST be connected to a repository — pass `codebaseId` (preferred) or `defaultGithubRepo` ("owner/name"); without one the request is rejected (repo_required) because its crews would have no workspace — unless `taskTracker` is set, since people deliver that work and no crew runs under it. De-dupes on name within the same codebase or program+repo, so re-runs return the existing one. Starts in DRAFT; dispatch the architect to decompose it into a backlog — unless `operatorPlanned` or `taskTracker` is set, in which case it starts IN_PROGRESS with no planner. Requires `write` scope.

Create a key result under an objective. Set direction to "down" for measures that must FALL (cost, latency, days-to-live) or attainment reads improvement as failure. Without a baseline AND a target the measure cannot be scored and reports as not-measured rather than 0%. Set derivedMetric to have AnyForge compute it instead of a person entering readings. Requires `write` scope.

Create an objective under a pillar. Rejects a pillarId that does not exist. Nothing rolls up to a new objective until a cluster is tagged with it via anyforge_update_theme. Requires `write` scope.

Create an opportunity — a validated problem or possibility worth pursuing. Opportunities are the bridge between raw signals and themed roadmap work. Requires `write` scope.

Create a page in a space you can edit, owned by you. `space` is the space key; `parentId` puts it under another page in that space; `content` is the body in markdown. Only call when the person asked for this page.

Create a Pages space. Workspace Owners only; the creator owns it unless ownerUids are supplied. The key is permanent. Access defaults to company readers and all editors. Only call when the person asked for this space.

Create a strategy pillar. Requires `write` scope.

Create a program (the cross-initiative grouping). Use this to set up a body of work before adding initiatives under it. To have it take incoming requests, call anyforge_set_program_request_intake afterwards. Requires `write` scope.

Create an empty Insights report, owned by you. Add widgets afterwards with anyforge_update_report. Requires `write` scope and a role that edits reports. Only call when the person asked for this report. Each report carries `url`, its Console page; when you show a report to the user, render its title as a link to that url.

Record an accepted risk on a program, initiative or work item. A risk NEVER blocks: it does not change status or dispatchability, is not a dependency and does not touch the critical path. Requires an owner (defaults to you) and either `reviewBy` or `acceptedUntilMilestoneId`. Requires `write` scope.

Capture a signal — a raw data point, customer quote, support ticket, or market observation that may inform product direction. Signals are refined into opportunities. Requires `write` scope.

Add ONE skill to the company library: an instruction every Code Studio and Crew agent reads verbatim when it applies. Use it to turn a team's documents into skills: one skill per distinct procedure or rule set (never one per paragraph, never one giant skill), keeping only what the document says. Show the person the skills you will add and add them only after they agree. name is unique in the library; category is lower-case and hyphenated (coding-standards, workflow, governance, communication); description is ONE line saying when the skill applies; content is up to 8000 characters (split a longer document by topic). Never put credentials, tokens, customer data or personal data in a skill. Errors to handle: 409 duplicate_skill (a skill has that name: pick another name or leave it), 409 similar_skill (one already covers the same rule: tell the person; pass force: true only if they want both), 409 skill_content_flagged (the text asks an agent to weaken a safeguard: rewrite it, or the person saves it from the Skills page). The skill is not offered to the Oracle until an Owner or Operator turns that on. Requires `write` scope and the Owner, Operator or Editor role.

Capture remote workspace files, including staged and untracked changes, as a persistent checkpoint.

Create or reuse a draft PR for the persisted session branch after checking its exact pushed HEAD. Uses your connected GitHub identity. Does not mark ready or merge.

Prepare a direct coding session or attach it to an existing initiative. Does not start execution. Context is a reference; local edits are not uploaded to the remote checkout. To hand over uncommitted local changes as well, run `anyforge studio create --uncommitted` in the checkout instead. additionalRepos needs an explicit repoFullName.

Create a theme — a.k.a. a CLUSTER, and the same record as the delivery program it drives. Themes give the roadmap structure above individual initiatives and are what the strategy layer ties to. Requires `write` scope.

Create a new work item in the backlog (status BACKLOG). Requires `write` scope.

Approve or deny the permission a crew in PERMISSION_PENDING is waiting on (see pendingPermissionRequest on anyforge_get_crew). A tool permission applies for the rest of the run; an MCP write approval decides that one call. Pass approvalId to refuse a decision on a newer request. Requires `approve` scope. Only call when the operator decides.

Delete a DRAFT initiative by id. Only DRAFT initiatives can be deleted — once decomposed / in progress, archive it via anyforge_update_initiative (status ARCHIVED) instead. Requires `write` scope.

Permanently delete a key result. IRREVERSIBLE — the reading history goes with it. Consider archiving instead. Requires `write` scope.

Permanently delete an objective. IRREVERSIBLE. Refuses with 409 `objective_has_key_results` while measures still hang off it; work reaches an objective only through those, so nothing else is affected. Requires `write` scope.

Permanently hard-delete an opportunity by ID. This is irreversible — prefer archiving (anyforge_update_opportunity with archived: true) unless you are certain. Requires `write` scope.

Permanently delete a pillar. IRREVERSIBLE, and refuses with 409 `pillar_has_objectives` while any objective still sits under it — move or delete those first. Requires `write` scope.

Delete a program by id. By default its child initiatives are detached (kept, unlinked); pass deleteChildren: true to also delete every child initiative and its work items. This is irreversible. Requires `write` scope.

Permanently hard-delete a signal by ID. This is irreversible — prefer archiving (anyforge_update_signal with archived: true) unless you are certain. Requires `write` scope.

Permanently hard-delete a theme by ID. This is irreversible — prefer archiving (anyforge_update_theme with archived: true) unless you are certain. Requires `write` scope.

Delete one triageEvalCases entry by id.