Running in production · Argo & Kargo
Kargo opens more pull requests than anyone can read and merges a good share of them on a version-shaped policy that cannot see what is in the diff. Bosun renders what the change actually deploys, blocks what breaks, repairs what is provable, and hands a human the rest — with the file, the key and the choice named.
Ten recorded incidents, replayed against a 27B model on one workstation. Every case really happened.
- externalSecrets.defaultVersion: 0.10.3
+ externalSecrets.defaultVersion: 2.9.0
blocking A CustomResourceDefinition stopped serving a version
externalsecrets.external-secrets.io no longer serves
v1alpha1, v1beta1 repaired
39 manifests migrated to v1, pushed to the branch. No model involved.
The text diff was one line. This is what it actually deployed.
The gap
A one-line version bump renders perfectly and stops serving an API every manifest in your repository still declares. A values-layer edit adds a whole cluster to an addon’s scope without the selector changing — the labels it matches did. Nothing in the text diff shows either. A merge policy that reads version numbers cannot see them, and a human reading their fortieth bump of the week will not either.
v1alpha1 and v1beta1.The shape
A boatswain’s job is not repair, it is inspection and repair: daily rounds of the hull and rigging, fixing what they find on their own authority and reporting to the captain what they cannot. The inspection is the larger half, and it is what makes the repair authority safe to grant.
What it does
Every bootstrap ApplicationSet expanded for every cluster, at the base revision and at the head. The diff of those two renders is what the pull request actually does. Charts whose version moved are pulled at both versions and diffed down to the field.
A cluster-targeting change, a moved source, project or namespace, an object’s apiVersion moving, and a CRD dropping a served version your manifests still declare. Everything else is reported, not blocked — that is what a version bump legitimately does.
When the only blocking finding is dropped served versions, no judgement is needed. The report names the kind, the dropped versions and the survivor; the same package that wrote that line parses it back and migrates every declaring manifest. The re-run gate re-counts them.
Not an announcement. Which file and key to open, what the choice is,
and the one fact that stopped a mechanical fix. Then the
needs-human label goes on and it stops. It never closes a
pull request and its own status is never a failure.
The safety model
It returns a structured verdict and a proposed edit set. The service applies those edits deterministically behind a path allowlist and a deny-list its own configuration cannot remove from. So “never edit the gate, never weaken a policy to go green” is an invariant the service enforces, not an instruction the model is asked to respect — a model that ignores the prompt entirely still cannot touch CI configuration.
A model with file-edit tools can make a red gate green by deleting the check, and that failure is indistinguishable from success. That is the whole design.
Install
The chart consumes existing Secrets by name and creates none — bring your own secret manager. Nothing here hardcodes a cluster, domain, namespace, CNI, git host or model provider.
helm install bosun oci://ghcr.io/jamesatintegratnio/charts/bosun \ --namespace bosun --create-namespace \ -f my-values.yamlWhere to go next
One pull request, from a version appearing to the change verified running. Start here if you want the story rather than the reference.
The judgement, with worked examples — including the two that were reclassified after they went wrong on a live pull request.
The blocking rules, the exit codes, and what it deliberately does not check.
Why a 9B model is viable here, the five levers that made it so, and the measurement behind each one.
Watching for the promotions that never happened, because absence of an event is not observed by default.
Eight ADRs on why it is built this way, and what each decision cost.
Licence
PolyForm Internal Use 1.0.0. Run it for your own business, commercially, in production, without asking anyone. You may not distribute it — not sold, not bundled, not offered as a hosted service. Installing the chart and image from the registry is use, not distribution. What that means in practice →