The loop
Flux watches the repository, renders the manifests and applies them. Each top-level path is one reconciliation unit with its own interval and health checks. Failure is alerted on the outcome — still not ready after fifteen minutes — rather than on every attempt, because a controller that retries is working, not broken.
The runners that test the repository are pods in the cluster the repository describes, spawned by the Actions Runner Controller and discarded after the job. A bad change can break the thing that validates the next change. The pipeline is tested against reality, not a hosted runner with different network rules than production.
Who may merge what
The agent can open pull requests anywhere it has access. It may merge its own skills repository, because that's its own knowledge and reviewing every line of my own notes would grind the loop to a halt. It may not merge the cluster repository. That's mine.
It's also not my account doing the pushing. Its identity is its own app installation, so the author and the reviewer are genuinely different identities, and the commit history says which one did what. Before that change, "the agent opened this" and "I opened this" were indistinguishable.
An agent that can merge its own infrastructure changes is an agent that can authorise its own widening. The one thing it must never be able to do is approve the change that gives it more room. That's why the admission policies on its identity exist as well as the merge rule: two independent ways of saying no.
assets/img/shots/agent-pr.png
A pull request opened by the agent. The thing to capture is the
author — it shows the app identity, not your account — plus the checks going green
and the merge button being yours.
The unattended version of the loop
When an alert wakes it, the loop is: read the alert, look at the resources and logs involved, answer in the notification channel, and — if a manifest change is the fix — open a pull request and stop. It runs with exactly the same access as any other session, so the worst an unattended run can do is investigate and talk. The merge waits for the human who was asleep.
The prompt says so, and the branch rules say so too: the agent is not the code owner, so it cannot supply the approval its own pull request needs. A rule the model can be talked out of is not a control, and neither is a rule the credential could ignore.
The mechanics that waste an afternoon
- CI filters by path. If the repository's check workflow doesn't watch the directory you changed, no check attaches to your pull request and it reads as blocked forever. "Wait for CI" becomes an infinite wait, and the fix is to widen the filter in its own change — never to smuggle an unrelated file into the pull request to trip it.
- A narrowly scoped token can't touch its own pipeline. An app installation that can push code still can't push a workflow file without an extra permission, which is the correct default and a confusing error. Sometimes the honest answer is "this one needs a human".
- One risk per command. Bundling several checks into one shell line trains whoever is reading to approve without reading. Splitting them is slower and that's the point.
- Read the manifests, not the memory. Half the wrong statements in a document come from describing what something did last month. The repository is what's true. A checkout that's a week behind is a source of confident nonsense.
Its knowledge is versioned too
The agent doesn't carry a personality file it was born with. It loads task-specific skills — how to triage a stuck pod, how the alerting tree is shaped, how to publish this site — from files in a repository, on demand. Each is a short document with the actual commands and the mistakes that cost time.
When a task teaches it something, it updates the skill and commits that, in the same session. That's where most of the lessons on this site came from: something broke, the fix went in the repository, and the next session starts already knowing.
Every figure here is a Mermaid source file in the repository, rendered to SVG by a pinned image. Editing a diagram is editing text, reviewing it is reviewing a diff, and it cannot quietly drift from what the prose says — which is the failure mode of every diagram I have ever seen go stale.