Telegram Control Plane — Run Forge From a Chat Message

The job

Most platforms answer “how do I change this?” with “open the dashboard.” That is a fine answer when you are at a desk. It is a poor one at 11pm, on a phone, when the only thing you want is to push tomorrow’s run back a day.

The interesting property of an autonomous system is that it mostly runs without you. The moments you do need it are short, sharp, and rarely at your desk — approve this, retry that, change the cadence, tell me what happened. Making those moments require a browser tab is what turns “autonomous” back into “attended.”

What it does

Message the bot the way you would message a colleague:

“for Forge Control: reconfigure the Daily Engineering Digest workflow to run once every three days instead of daily”

The bot resolves the instruction, shows you what it understood, and waits for a confirm press. Then it reports what it changed — and what it deliberately did not:

1
2
3
4
5

Done. Reconfigured the Forge Engineering Digest schedule (daily-digest):
- Was:  0 0 * * *   — every day at 00:00 UTC
- Now:  0 0 */3 * * — every 3 days at 00:00 UTC
Next run — 2026-07-31 00:00 UTC.
I did not touch the workflow itself or its brief, only the frequency.

That last line is the part that matters. A control surface you cannot see the boundaries of is not one you will trust with anything important.

What you can do from chat

Safety is the whole design

A chat message that can delete an agent is a privileged action, so the control plane is built as gates rather than good intentions:

• A control grant per person. A Telegram identity is bound to an organisation with explicit scopes. Without a grant you get read-only. With a partial grant, an unauthorised write is rejected and the bot tells you which scope was missing instead of pretending it worked.
• Confirmation before every write. The classifier’s guess never fires on its own. You see the interpretation and press a button.
• Destructive operations show their blast radius behind that confirm, rather than executing quietly.
• Everything mutating is audited, and a rate guard bounds bursts.
• Pre-write snapshots make changes reversible — this is what undo_last restores.

Under the hood

• Actionable Notifications — the other half: escalations arrive with buttons
• Autonomous & Scheduled Workflows — what the schedules you are editing actually drive
• Character Agents — what “create an agent” creates
• Git-Backed Audit — the record behind every run you ask about