The loop does not end at the merge.
It ends at the healthy pod.

Noktron closes the gap between "merged" and "done".

Your coding agent thinks "merged" means "done". Your cluster disagrees. Noktron turns a labelled GitHub issue into a manifest change, delivers it the way your team has agreed to accept changes, watches the Argo CD rollout, and verifies health in the cluster — scoped to exactly what changed.

status pre-release license Apache‑2.0 go 1.26 kubernetes ≥ 1.29 helm OCI chart artifacts cosign signed

The problem

The agent stops at the pull request. The cluster hasn't.

What happens next — does Argo CD actually sync it? does the pod actually come up? is it still healthy two minutes later? — is left to a human staring at a dashboard.

Without Noktron

Agent writes manifests, opens a PR, and the loop is declared finished. A human watches Argo CD, checks the pod, debugs the CrashLoop, and feeds the failure back by hand.

With Noktron

The same issue becomes a delivered, verified rollout. If it breaks, the classified failure goes straight back to the agent as the next iteration's context. A run is only SUCCEEDED when Noktron can name the resources it watched go green, and for how long.

How it works

From a labelled issue to a verified pod

1
GitHub issue — label: noktron
The trigger. One label, nothing else to learn.
2
Agent job — sandboxed · manifests only
The agent works inside the environment's configured paths. No application code, no secrets.
3
Pre-flight: kubeconform + conftest
Against the rendered output — what gets validated is what Argo CD will actually apply, not the templates.
4
Delivery — push · auto-merge · PR
The way your team agreed to accept changes. A failure never reaches your repo on pre-flight.
5
Argo CD sync
Delivered. Now it has to actually land.
6
Observer — scoped health check
Resolved down to the individual resources the change touched. Waits for sync, then requires healthy and stable for a window.
7
Failure → classified diagnosis → back to the agent
Image pull, CrashLoop, schema rejection, quota… classified before it reaches the next iteration.
SUCCEEDED — healthy + stable
Noktron names the resources that went green, and for how long.

A human can steer without leaving GitHub — comment on the issue, review the PR, or push to the branch yourself. Noktron picks all three up and never force-pushes over your work.

Why it's different

Built for the part that's usually left to a human

🔍

Pre-flight on rendered output

kubeconform and conftest run against rendered manifests, so what's validated is what Argo CD applies — not the templates.

🚀

Delivery your way

Direct-push, auto-merge, or manual — enabled explicitly at install time and per environment.

🧬

Scoped verification

The observer resolves the Argo CD application down to the resources the change actually touched — not the whole app.

Stability window

Resources must be healthy and stay healthy for a window. A green check is a list of resources you can read, not a vibe.

🧠

Classified failures

A failure is classified (image pull, CrashLoop, schema rejection, quota…) before it goes back to the agent.

🛡

Allowed to give up

When a fix is outside the repo's reach — a secret a human must create, a missing permission — Noktron escalates with copy-pasteable instructions instead of burning iterations.

🤝

Human in the loop, in GitHub

Comments, PR reviews, pushes to the branch — all picked up as input. No separate console to learn.

🔒

No force-push. Ever.

Human commits on a work branch survive. A human push pauses automation (HUMAN_TAKEOVER) until @noktron continue.

Human channel

Talking to a run

Everything happens in the issue or the pull request. There is no separate console to learn.

You doNoktron does
@noktron stopstops after the current iteration
@noktron restartthrows the branch away and starts over
@noktron reopenreactivates a run that already ended
@noktron continueresumes after a manual fix or a takeover
Leave a PR review or inline commenta review iteration on the same branch, then a reply in the thread and resolve when addressed
Push to the work branch yourselfautomation pauses; your commits are never force-pushed over

Quick start

Install → first verified run in ≤ 15 minutes

Secrets are referenced by name only — Noktron never reads them, and nothing secret belongs in your Git repo.

1

Install the chart

Standard helm install from the OCI registry.
helm install noktron oci://ghcr.io/fakieheelflip/charts/noktron \
--namespace noktron --create-namespace \
--set github.mode=pat \
--set github.pat.secretRef.name=noktron-github-pat \
--set reconciler.argocd.authTokenSecretRef.name=noktron-argocd \
--set llm.apiKeySecretRef.name=noktron-llm
2

Declare a project

One Project per config repo. paths is the hard boundary the agent may write inside — and the scope verification is resolved against.
apiVersion: noktron.io/v1alpha1
kind: Project
metadata:
  name: platform
  namespace: noktron
spec:
  configRepo: { url: https://github.com/your-org/your-gitops-repo }
  auth: { githubAppRef: { name: noktron-github-pat } }
  agentProfileRef: { name: default }   # ships with the chart
  environments:
    - name: sandbox
      paths: ["apps/**"]
      argoApplication: app-sandbox
      deliveryMode: manual             # manual | auto-merge | direct-push
3

Label an issue noktron

That is the trigger. Watch it in the embedded UI:
kubectl -n noktron port-forward svc/noktron 8090:8090
⚠ The UI has no authentication of its own in v0.1. It can pause every run and it shows the prompts that were sent. Put it behind your ingress auth (forward-auth, OIDC proxy) or leave it on port-forward.

What "verified" means

After delivery, the observer resolves the Argo CD application down to the individual resources the change actually touched, waits for the sync, and then requires them to be healthy and stay healthy for a stability window. The run records that scope, and the UI shows it under "Why green?" — so a green check is a list of resources you can read, not a vibe.

Architecture

One Go binary, two workloads, PostgreSQL

Deployed as two workloads with PostgreSQL for everything that must outlive a pod.

ingest
GitHub webhooks and polling; issue labels, comments, reviews, pushes
orchestrator
run lifecycle, agent jobs, prompts, delivery
observer
Argo CD sync + in-cluster health verification, scoped to the change
apiserver / uiapi
internal API for agent pods, REST + SSE for the UI
CRDs
Project, NoktronRun, AgentProfile (noktron.io/v1alpha1)

Security model

Noktron never reads a Kubernetes Secret

Not in the control plane, not in the observer, not via the agent proxy. The relevant boundaries:

No secrets access
The curated read-only ClusterRole contains no secrets rule, and the proxy refuses to start if one ever appears (ADR-0005).
Untrusted agent pods
Separate namespace, Pod Security restricted, resource quota, egress NetworkPolicy, no Kubernetes API access by default.
Redaction everywhere
Before persistence and before every LLM call: tokens, keys, connection strings, JWTs, base64 blobs, k8s Secret data. Counts shown, never contents.
Path policy, twice
Enforced in the runner pre-flight and server-side before delivery. The agent can only change files under the environment's configured paths.
No force-push, ever
Human commits on a work branch survive; a human push pauses automation (HUMAN_TAKEOVER) until @noktron continue.
Loop guards
Iteration/cost/wall-clock budgets, identical-diff guard, circuit breaker, global kill switch.
Auditable
Kill-switch changes, merges, escalations, raw-prompt access and bundle exports land in an append-only audit table.
Cosign-signed releases
Images and the chart are signed with cosign.

Report vulnerabilities via GitHub private vulnerability reporting — not public issues. Pre-1.0: only the latest minor release receives fixes.

Roadmap

Where Noktron is going

⚠ Pre-release, under active development. The CRD API (noktron.io/v1alpha1) may still change. It is being run against a real cluster daily.

v0.1
The loop as described. GitHub → agent → delivery → Argo CD → in-cluster verification → feedback; human channel; embedded UI.
v0.2
App-repo writes (image-bump chain), in-app auth/RBAC for the UI, replay-an-iteration debugging, OpenAI/LiteLLM as first-class providers, Slack escalations.
v0.3
Flux reconciler, GitLab, multi-cluster projects.