The job
“Something has been quietly getting worse for a month. We will find out when it pages someone at 3am.”
Every team has more signal than attention. Dashboards show what you look at; the slow regressions live in what you don’t. Reviews get scheduled, then bumped — and the work isn’t hard, it’s just never the most urgent thing on any given day.
The reason automated scanning usually fails is not detection. It is noise: a bot that files the same twelve issues every Monday gets muted within a month, and then the real one is muted with it.
What Forge does
A scheduled sweep that ends in something actionable — deduplicated, and pointed at code:
The DevOps agent pulls metrics and filters error logs over a recent window and reports anomalies — which service, what the signal is, how far it deviates, and the representative log lines.
The developer agent locates the responsible code by reading the repository, then decides: file an issue, or — if you have enabled it and the change is small and well understood — implement a minimal fix.
The QA agent checks the output is worth a human’s attention: the code location exists, the suggestion is plausible, it isn’t a duplicate. This step exists to protect the one thing that makes the whole loop viable — that the issue stream stays worth reading.
Anything above safe autonomy — schema changes, cross-service work, infrastructure, anything ambiguous — is filed with a needs-human label instead of touched. When in doubt it files, because a wrong automatic fix is worse than an issue.
Evidence
We run this against our own fleet. The honest state of it:
- Shipped and running: the scheduled sweep, read-only cloud metrics and log access with server-side credential resolution, code correlation, and fingerprint-deduplicated issue filing.
- Gated: the fix-right-away path exists and is bounded by an autonomy budget; a human merges.
- Being extended: we are widening the source list beyond cloud metrics and logs, and building resource discovery so a sweep does not depend on a hand-maintained list of resource names — a limitation we hit on our own fleet, where log groups are non-standard and function names carry generated suffixes.
That last point is the sort of thing you only learn by running it on yourself, which is why we do.
What you control
- Cadence. Twice a week, nightly, whatever matches how fast your system changes.
- Scope. Which services, which signals, which repository.
- Autonomy. Issues only, or fixes too — bounded by a budget, with approval checkpoints when it is spent.
- The credential. Read-only, resolved server-side, never in the model’s context.
Under the hood
- Autonomous & Scheduled Workflows — schedules and the autonomy budget
- Secrets & Egress — why the cloud key never reaches the agent
- Git-Backed Audit — what the sweep saw and why it concluded what it did
- Multi-Agent Pipeline — the dev→QA→PR path a fix travels