Noktron closes the gap between "merged" and "done".
Your coding agent thinks "merged" means "done". Your cluster disagrees. Noktron turns a labelled GitHub issue into a manifest change, delivers it the way your team has agreed to accept changes, watches the Argo CD rollout, and verifies health in the cluster — scoped to exactly what changed.
The problem
What happens next — does Argo CD actually sync it? does the pod actually come up? is it still healthy two minutes later? — is left to a human staring at a dashboard.
Agent writes manifests, opens a PR, and the loop is declared finished. A human watches Argo CD, checks the pod, debugs the CrashLoop, and feeds the failure back by hand.
The same issue becomes a delivered, verified rollout. If it breaks, the classified failure goes straight back to the agent as the next iteration's context. A run is only SUCCEEDED when Noktron can name the resources it watched go green, and for how long.
How it works
A human can steer without leaving GitHub — comment on the issue, review the PR, or push to the branch yourself. Noktron picks all three up and never force-pushes over your work.
Why it's different
kubeconform and conftest run against rendered manifests, so what's validated is what Argo CD applies — not the templates.
Direct-push, auto-merge, or manual — enabled explicitly at install time and per environment.
The observer resolves the Argo CD application down to the resources the change actually touched — not the whole app.
Resources must be healthy and stay healthy for a window. A green check is a list of resources you can read, not a vibe.
A failure is classified (image pull, CrashLoop, schema rejection, quota…) before it goes back to the agent.
When a fix is outside the repo's reach — a secret a human must create, a missing permission — Noktron escalates with copy-pasteable instructions instead of burning iterations.
Comments, PR reviews, pushes to the branch — all picked up as input. No separate console to learn.
Human commits on a work branch survive. A human push pauses automation (HUMAN_TAKEOVER) until @noktron continue.
Human channel
Everything happens in the issue or the pull request. There is no separate console to learn.
| You do | Noktron does |
|---|---|
| @noktron stop | stops after the current iteration |
| @noktron restart | throws the branch away and starts over |
| @noktron reopen | reactivates a run that already ended |
| @noktron continue | resumes after a manual fix or a takeover |
| Leave a PR review or inline comment | a review iteration on the same branch, then a reply in the thread and resolve when addressed |
| Push to the work branch yourself | automation pauses; your commits are never force-pushed over |
Quick start
Secrets are referenced by name only — Noktron never reads them, and nothing secret belongs in your Git repo.
helm install noktron oci://ghcr.io/fakieheelflip/charts/noktron \ --namespace noktron --create-namespace \ --set github.mode=pat \ --set github.pat.secretRef.name=noktron-github-pat \ --set reconciler.argocd.authTokenSecretRef.name=noktron-argocd \ --set llm.apiKeySecretRef.name=noktron-llm
apiVersion: noktron.io/v1alpha1 kind: Project metadata: name: platform namespace: noktron spec: configRepo: { url: https://github.com/your-org/your-gitops-repo } auth: { githubAppRef: { name: noktron-github-pat } } agentProfileRef: { name: default } # ships with the chart environments: - name: sandbox paths: ["apps/**"] argoApplication: app-sandbox deliveryMode: manual # manual | auto-merge | direct-push
kubectl -n noktron port-forward svc/noktron 8090:8090
After delivery, the observer resolves the Argo CD application down to the individual resources the change actually touched, waits for the sync, and then requires them to be healthy and stay healthy for a stability window. The run records that scope, and the UI shows it under "Why green?" — so a green check is a list of resources you can read, not a vibe.
Architecture
Deployed as two workloads with PostgreSQL for everything that must outlive a pod.
Security model
Not in the control plane, not in the observer, not via the agent proxy. The relevant boundaries:
Report vulnerabilities via GitHub private vulnerability reporting — not public issues. Pre-1.0: only the latest minor release receives fixes.
Roadmap
⚠ Pre-release, under active development. The CRD API (noktron.io/v1alpha1) may still change. It is being run against a real cluster daily.