AnyForge

Launch a hands-off, paced analysis sweep: runs Phase 1 across every repo, then Phase 2, keeping at most `concurrency` analyses in flight so the operator OAuth token window is never exhausted. Seed from a programId (derives repos from its initiatives) or an explicit repos list. Re-seeding overwrites the current sweep. Requires `write` scope.

Seed a fleet-wide escrow deposit sweep over all escrow-scoped codebases (codebase escrow.enabled). Requires `write` scope. A 10-minute server tick advances it at ≤concurrency deposits in flight. Options: onlyStale (default true — skip fresh deposits), clientTag (one beneficiary only), concurrency (1–5), verifyBuilds (also measure a build+test run per codebase alongside the deposit). Pass {status: true} to just read current sweep progress without seeding.

Start a DIRECT UPLOAD of one file (up to 1 GB) to a work item, initiative or program. Returns `uploadUrl`, a one-time Storage URL that accepts exactly `size` bytes for 24 hours, and a `curl` command that sends them. After the PUT succeeds, call anyforge_complete_file_upload with the `uploadId`; the file is not attached until then. Accepted: images, video, PDF, Office documents, text, Markdown, CSV, JSON, XML, HTML pages, logs, HAR captures and zip; the extension decides the type. On a work item the file is added INTERNAL. When a file with the same name and size is already on the record, the answer is { alreadyAttached: true, file } and there is nothing to upload; a same-name file of another size is refused (file_name_exists, 409) unless onNameConflict is "keep_both". Requires `write` scope and an Editor or above. On the local (stdio) server, anyforge_upload_local_file does all three steps for a file on disk.

Start a durable coding run in the remote workspace. Can spend tokens and edit files. External runs are limited to audited coding, reads and reviews; hosted shell, browser, outbound connectors, Oracle and crew/workflow/approval actions require the browser Studio surface. Use planned=true for analysis only. Dedicated Git push and draft PR tools need studio:publish; ready/merge require confirmation in Code Studio.

Submit a decision on a HIL approval. APPROVED resumes the crew past the gate; REJECTED sends it back. Requires a key with the `approve` scope.

Run or continue a Support Triage interview: classify the issue (incident / bug / enhancement / misconfiguration / new_feature), score it against that type's readiness rubric, resolve the likely owning team from the code graph, and return a paste-ready rendering plus the structured draft. Pass the SAME sessionId returned by a prior call to continue the SAME interview — the server owns the conversation, the caller only ever sends the newest message. Never files or writes anything; take `rendered` and file it wherever you actually track issues.

Update an existing initiative — only the fields you provide change. Use to rename, re-prioritise, retarget, adjust the token budget, move it under a program, set its owning team (teamId), record the team's own estimate (estimate), or set its repositories (defaultGithubRepo, additionalGithubRepos) and branch. An argument this tool does not declare is refused with the valid names and nothing is changed, so a success means every field you passed was applied. Requires `write` scope. (System-managed initiatives are read-only and reject edits.)

Update a key result, including recording a new READING — send current as { value, asOf, source }. Always cite a source: a measure with no source fails delivery condition 2, which is what stops one number being quoted two ways. Requires `write` scope.

Update an objective: statement, description, owner, parent pillar, order, or archived. Requires `write` scope.

Update an existing opportunity — edit its RICE inputs, stage, theme assignment, program link, or other fields. At least one field must be provided. Requires `write` scope.

Save a new version of a page: a new title, a new body, or both, with an optional change note. `ifVersion` is the version you read with anyforge_get_page; if someone saved since, this is refused with 409 and you should read the page again. This replaces the text directly, everyone sees it at once: to propose a change for an editor to accept instead, use anyforge_propose_page_edit. Only call when the person asked for this change.

Change a space as its admin: settings, access, owners, review cadence, main page (homePageId; null clears it), or archive/restore (archived). Read its revision with anyforge_list_pages and pass ifRevision; stale settings are refused with 409. The key cannot change. Access fields merge with existing settings; member/owner/team arrays replace the old arrays. Only call when the person asked for these changes.

Update a pillar: name, description, lead (ownerUid), order, or archived. Requires `write` scope.

Update an existing program — only the fields you provide change. Edit its name, description, status, owner, lead, whether it is long-lived, target date, coverage goal, tags, or whether its work items need test evidence before they can be marked Done. Incoming requests are switched with anyforge_set_program_request_intake. Requires `write` scope.

Enrich one existing initiative within a program. Prefer initiativeId; repoFullName is allowed only when that repository has one initiative in the program. Pass appendContext for factual context, or change description/priority. A description change on an ICE-spec initiative is rejected with the revise_program_initiative_scope replacement. The result reports changed fields or a structured no-op.

Change an Insights report: its title, description or settings, and its widgets. Edit single widgets by id without resending the rest: `addWidgets` appends new widgets, `replaceWidgets` swaps each named widget in place, `removeWidgetIds` deletes widgets. Or send `widgets` to replace the whole list in render order (a widget left out is deleted); `widgets` cannot be combined with the single-widget edits. Every widget is validated as the Console validates it: an invalid query is refused with 400 `invalid_widget_query` (the widget id and the validator's code in `detail`) and nothing is saved. Preview each new query with anyforge_preview_report_query first. If the report changed since you read it, a single-widget edit is refused with 409 `report_modified`: read it again. If the report has a live share link, the people holding it see the change. Requires `write` scope and a role that edits reports. Only call when the person asked for this change. Each report carries `url`, its Console page; when you show a report to the user, render its title as a link to that url.

Update an accepted risk: change its status (e.g. MATERIALISED or CLOSED), owner, review date, mitigation or follow-up work items. Only the fields you pass change. Requires `write` scope.

Update an existing signal — edit its status, linked opportunity, source, or other fields. At least one field must be provided. Requires `write` scope.

Update metadata or mark a session branch PR as draft using its exact expectedHeadSha. Open Code Studio to review and confirm ready/merge; tool arguments cannot authorize those actions.

Record a finding disposition with rationale and the revision containing a claimed fix. A fixed status does not imply independent verification; request a linked re-review to verify.

Update a session title, repository, branch, additional repositories or initiative. Does not execute code. additionalRepos replaces the whole list; null or [] clears it.

Update a theme (a.k.a. cluster — the same record as its delivery program): name, status/horizon, colour, and the CHARTER lines (standsToday, fundingSource, stopCondition, waitsFor, dependsOnThemeIds). A theme carries no strategy link: the objectives it serves are derived from the key results its program's initiatives name (anyforge_set_initiative_key_results). fundingSource + stopCondition are what delivery condition 4 checks; dependsOnThemeIds is what condition 5 walks. Changing `status` MOVES the cluster between horizons and is the only place that can be done. At least one field must be provided. Requires `write` scope.

Edit one triageEvalCases entry in place — only the fields you provide change. Use to fix a case's ticket text, expected classification, expected owning team, or metadata. To update many cases at once, prefer anyforge_upsert_triage_eval_cases (pass each case's id). Requires `write` scope.

Mutate one work item. `action` is one of advance, approve_refinement, approve-and-route, move-initiative, dispatch, complete, update, reorder, archive, unarchive, close-as-fixed, reopen, mark-incident, drop, undrop, confirm-repo, assign, begin, dismiss-automation-suggestion, expedite, block, unblock, link-external, verification, add-evidence, remove-evidence, share-evidence, undefer, set-cycle, scope-change, link-pull-request, unlink-pull-request, link-work-item, or unlink-work-item. Each action takes only its own fields: a field the action does not read is refused with 400 unsupported_fields, naming the field and the actions that do read it, and nothing is changed — so a success means every field you passed was applied. To move an item BACK (or between BACKLOG, REFINED and READY), send `status` with NO action: it takes BACKLOG, REFINED or READY, from one of those statuses or from work a person began (IN_PROGRESS with no crew) — the Console status menu's plain move, with the same role and initiative-steward rules, recorded in the item's history. Any other move is refused with 409 raw_status_not_allowed, naming allowedStatuses and the action to use instead (useAction): reopen for DONE, undrop for DROPPED, begin for IN_PROGRESS, complete for DONE, dispatch for a crew, drop; an item a crew carries moves with its crew. anyforge_get_work_item returns `nextActions.statusMoves`, the exact arguments for each move you may make now. Forward moves have their own actions too: advance, approve_refinement, begin, dispatch, complete. Use action='set-review' with inReview (true or false) to put work a person began (IN_PROGRESS, no crew) in or out of review; begin also takes inReview: true to start an item already in review. Use action='assign' with assigneeUid (a member uid or their email; anyforge_list_members lists both) to set the human executor. Use action='block' with blockReason (what the item is waiting on), blockCategory and optionally blockerOwnerUid (who is chasing it, u…

Upload test-coverage measurements for one or many repos (e.g. synced from SonarQube). Requires `write` scope. Each item needs repo ("owner/name") and either percent (0–100) or a raw lcov report. percent is LINE coverage: from SonarQube read the `line_coverage` measure, not `coverage`, which also counts branch conditions and so does not compare with other sources. Optionally send branch and measuredAt (the analysis date) per item: a reading for a non-default branch, or older than the stored figure, is kept as history only. Writes coverage to the matching codebase + the org repo index, so a Program Genesis quality program can scope "repos below X%". Batch up to 200 items per call — chunk larger syncs. Map SonarQube projects to owner/repo via their GitHub binding before calling; ask the operator about any you can't map.

Upload a file from THIS machine to a work item, initiative or program and attach it: starts a direct upload, sends the bytes straight to Storage and completes it, for files up to 1 GB. Local (stdio) server only; the hosted connection refuses it with `local_files_unavailable`, use anyforge_start_file_upload there. Confirm the exact file with the user before sending it: the file leaves this machine. A file with the same name and size already on the record is not sent again ({ alreadyAttached: true, file }).

Create or update triageEvalCases in bulk — pass every case in ONE call, including a full corpus. Each case needs `input` (the ticket text) and `expectedType` (incident / bug / enhancement / misconfiguration / new_feature); `expectedTeamId` is optional and, when set, ALSO scores routing accuracy. Pass an existing case's `id` to update it in place — re-uploading the same corpus updates rather than duplicates. Returns `created` (the cases that saved) and `errors` (per-index validation failures) — a bad row does not fail the whole batch.

Withdraw a pending invitation by email address. Requires an API key with the `people:invite` scope, held by an owner. An accepted invitation and an owner invitation cannot be withdrawn this way; another company's invitation reads as not found. Only call when the operator asked to withdraw it.

Create an empty file or save a file's complete content in the live remote workspace, without a model run. Name the repository, branch and revision you read, so a changed workspace is refused. Each write saves a checkpoint first. Does not commit or push.