# What shipped at Anyshift Week of August 17, 2026 PagerDuty on-call, incidents, and alerts are now graph queries. Cloudflare exposure adds origin reachability. Annie CLI flags updates. Author: Anyshift Published: 2026-08-24 Source: https://anyshift.io/blog/anyshift-shipped-week-of-2026-08-17 The week of August 17, 2026 covered 4 product areas across [Annie](/product) and the [Anyshift Product Updates](/blog/series/anyshift-product-updates) series. The headline is **PagerDuty as graph queries**: who is on call, which incidents are open, which alerts are firing, and what else is related, from Annie CLI, [Graph API](/graph-api), or the SDK. [Last week](/blog/anyshift-shipped-week-of-2026-08-10) shipped Cloudflare Exposure Beta. This week extends those paths with origin reachability, EKS platform hops, and WAF change evidence. 2 releases carry most of the path: Graph API v0.2.77 and Annie CLI v0.8.50. ## PagerDuty on the graph [PagerDuty](https://docs.anyshift.io/pages/integration/pagerduty) incidents already triggered Annie investigations. This week the stored operational evidence is queryable on the same graph as the rest of your infrastructure. After you connect PagerDuty, [Annie CLI](https://docs.anyshift.io/pages/product/integration/cli#query-the-graph) answers on-call and incident questions without a PagerDuty-specific namespace: ```bash annie graph alerts --provider pagerduty --status firing annie graph incidents --provider pagerduty --status active annie graph incidents --provider pagerduty --responder "Jane Doe" annie graph oncall --at now annie graph oncall --person "Jane Doe" --at now annie graph triage checkout --since 2h ``` `--person` and `--responder` accept a display name, canonical person ID, email (including `+` aliases), or PagerDuty user ID. Matching is exact and case-insensitive. Duplicate evidence from multiple PagerDuty identities is collapsed. If a user or service cannot be mapped, the result stays unresolved instead of guessing. `annie graph triage` is deterministic evidence, not an Annie chat. Optional `incident_context` hops cover the incident, alerts, service (`AFFECTS` / `RESOLVES_TO`), on-call, responders, and similar reviewed history. Empty hops are omitted. Graph API [v0.2.77](https://github.com/anyshift-io/graph-api/releases/tag/v0.2.77) and Annie CLI [v0.8.50](https://github.com/anyshift-io/annie-cli/releases/tag/v0.8.50) carry the workflow. These reads do not acknowledge, reassign, or resolve incidents. For on-call product context, see also [On-call](/on-call). ## Cloudflare exposure goes further [Cloudflare Exposure Beta](https://docs.anyshift.io/pages/integration/cloudflare) still traces a public hostname toward its origin. The new work is what the path can prove once it gets there. [Origin reachability](https://docs.anyshift.io/pages/product/graph-api/origin-reachability) tells you whether an ALB or NLB origin accepts traffic from outside Cloudflare, by comparing security-group ingress to pinned Cloudflare IP ranges. A `restricted_to_cloudflare` verdict means the evaluated listeners only allow Cloudflare. `directly_reachable` means at least one world-open or non-Cloudflare CIDR can hit the origin. The field is evidence on the path. It does not rewrite the overall exposure verdict. ```bash annie graph exposure api.example.com --type CLOUDFLARE_HOSTNAME ``` Paths can now show when traffic lands on EKS-backed Kubernetes, with platform attribution and hop freshness from a live [anyshift-k8s-agent](https://docs.anyshift.io/pages/integration/kubernetes) sync. Exposure controls also stamp WAF action, phase, and enabled state, and managed-ruleset updates show up as first-class change events you can investigate against a hostname. Coding agents keep using `get_exposure` on [Graph MCP](https://docs.anyshift.io/pages/product/integration/graph_mcp). Upgrade Annie CLI to v0.8.50+ for the matching local render of origin reachability. ## Annie CLI install page and update checks in annie-cli v0.8.50 The public install page is [annie-cli.anyshift.io](https://annie-cli.anyshift.io/). It lists the four supported platform downloads and stays in sync with the latest stable release. Interactive sessions can tell you a newer Annie CLI is out. The TUI keeps the available version in the status bar, and a successful human-readable command may print one reminder every 24 hours. Check on demand: ```bash annie update check annie update check --output json ``` Annie reports the installed version, the latest version, and the release URL. It does not download or install the update. JSON output, pipes, CI, help, and version commands stay quiet. Turn passive checks off with `annie config set update_check false` or `ANNIE_UPDATE_CHECK=off`. Full detail is in [Stay up to date](https://docs.anyshift.io/pages/product/integration/cli#stay-up-to-date). ## VictoriaMetrics shows up in the connected list [VictoriaMetrics](https://docs.anyshift.io/pages/integration/victoriametrics) was already a queryable source (see the [June 15 changelog](/blog/anyshift-shipped-week-of-2026-06-15)). Connected-integration summaries and the Annie CLI banner were still omitting it, so a project whose only live-data source was Victoria could look empty. Those summaries now include VictoriaMetrics. Browse the catalog from [Integrations](/integrations) or open **Integrations → Monitoring → VictoriaMetrics** in the app. ## FAQ ### What shipped at Anyshift the week of August 17, 2026? Four customer-facing updates. PagerDuty on-call, incidents, and alerts are queryable through Annie CLI, Graph API, and the Graph SDK. Cloudflare exposure paths add origin reachability plus EKS platform hops and WAF change evidence. Annie CLI publishes a public install page and tells interactive users when a newer release is available. Connected-integration summaries now list VictoriaMetrics. ### How do I query PagerDuty from Annie CLI? After connecting PagerDuty, use annie graph alerts, annie graph incidents, and annie graph oncall. Search responders by display name or email. annie graph triage checkout --since 2h assembles stored incident_context hops for that resource. The same evidence is on Graph API and the Graph SDK. These reads do not acknowledge or resolve incidents. ### What is Cloudflare origin reachability? On a public exposure path that ends at an AWS load balancer, originReachability tells you whether the origin accepts traffic from outside Cloudflare, based on security-group ingress compared to pinned Cloudflare IP ranges. Use annie graph exposure or Graph MCP get_exposure. It does not change the overall exposure verdict. ### How does Annie CLI tell me about updates? Interactive Annie CLI sessions can show a newer release in the TUI and an occasional reminder after a successful command. Run annie update check or annie update check --output json whenever you want the status. Annie does not download or install the update. Turn passive checks off with annie config set update_check false. ### What changed for VictoriaMetrics this week? VictoriaMetrics was already a queryable Annie source. Connected-integration summaries and the Annie CLI banner now include it, so a project that only has Victoria no longer looks like it has no live-data integration. Ready to try it? Open [app.anyshift.io](https://app.anyshift.io) or start from the [docs](https://docs.anyshift.io). ## What shipped at Anyshift the week of August 17, 2026? Four customer-facing updates. PagerDuty on-call, incidents, and alerts are queryable through Annie CLI, Graph API, and the Graph SDK. Cloudflare exposure paths add origin reachability plus EKS platform hops and WAF change evidence. Annie CLI publishes a public install page and tells interactive users when a newer release is available. Connected-integration summaries now list VictoriaMetrics. ## How do I query PagerDuty from Annie CLI? After connecting PagerDuty, use annie graph alerts, annie graph incidents, and annie graph oncall. Search responders by display name or email. annie graph triage checkout --since 2h assembles stored incident_context hops for that resource. The same evidence is on Graph API and the Graph SDK. These reads do not acknowledge or resolve incidents. ## What is Cloudflare origin reachability? On a public exposure path that ends at an AWS load balancer, originReachability tells you whether the origin accepts traffic from outside Cloudflare, based on security-group ingress compared to pinned Cloudflare IP ranges. Use annie graph exposure or Graph MCP get_exposure. It does not change the overall exposure verdict. ## How does Annie CLI tell me about updates? Interactive Annie CLI sessions can show a newer release in the TUI and an occasional reminder after a successful command. Run annie update check or annie update check --output json whenever you want the status. Annie does not download or install the update. Turn passive checks off with annie config set update_check false. ## What changed for VictoriaMetrics this week? VictoriaMetrics was already a queryable Annie source. Connected-integration summaries and the Annie CLI banner now include it, so a project that only has Victoria no longer looks like it has no live-data integration.