Before a blacksmith forges a new slide, the design goes on the anvil. Dimensions, materials, safety margins, expected number of kids per minute. If you skip the anvil and just start hammering, you end up with a slide that doesn't fit the playground, costs three times what was budgeted, and nobody knows whether it's safe. The Anvil is the same thing for AI cartridges.
The Anvil answers four questions before the Forge starts work:
If you can answer those four, the Forge can build the cartridge. If you cannot, the cartridge is not ready to build yet, and forcing it would produce something the platform cannot operate.
salesforce-sandbox for staging, salesforce-production for prod. Per-user connections via Setup tab.internal. Pipeline data is non-public but not regulated PII. Existing platform encryption is sufficient.soql, describe. From the AI stack: chat completion via the Console's model router.One signed-off document. That document is the input to the Forge. The Anvil sheet contains everything the Forge needs to scaffold the cartridge folder, write the initial Terraform, generate the SDK-using handler, and propose a frontend. If the Anvil sheet is wrong, the Forge produces the wrong cartridge; if the Anvil sheet is missing, the Forge cannot start.
| Without an Anvil | With an Anvil |
|---|---|
| "Just build it, we'll figure out the OAuth later." Then OAuth blocks the launch. | OAuth providers identified up front; pre-requisites (like Connected App creation in Salesforce admin) start in parallel. |
| "It's not that expensive." Then the first month's bill is twice the department's AI budget. | Cost estimate signed off before any code lands. |
| "It might touch PII, we'll handle it." Then it does, and we have a notification incident. | Data classification declared at the Anvil; if it's pii, the cartridge is gated until the content lockbox is wired. |
| "It's basically the same as the chatbot." Three months later it shares nothing. | Capabilities mapped to the SDK's existing surface; gaps surface as new SDK work items. |
Today, the Anvil is manual. We write a doctrine doc (the Step 6.* series) that captures the same fields. Step 6.l is the Anvil sheet for the code-agents cartridge. Step 6.n is the Anvil sheet for the OAuth abstraction.
The next iteration is an Anvil UI inside the Console. A guided form that walks an operator through the four questions, auto-fills capabilities from registered providers, runs the cost estimate against current Bedrock pricing, and produces a signed sheet ready for the Forge.
Skipping the Anvil produces cartridges that look fast to start and cost a fortune to operate. The Anvil takes a couple hours upfront. It saves weeks of "wait, where does this data go" and "we never budgeted for that" later. Every cartridge ships faster because the platform compounds; the Anvil is what keeps the compounding clean.
The Anvil concept underpins the cartridge manifest in Step 6.i (cartridge metadata). Concrete examples of Anvil sheets that became real cartridges: Step 6.l (code-agents) and Step 6.n (OAuth).