From a chat request to an opened pull request — verifying GitHub App install callbacks, deciding between PR and kubectl per resource, steering the LLM with ModelRetry and a one-line history memo instead of prompts, code-chosen edits for plain YAML and Kustomize, and render comparison against an expected result.
Three days after the self-hosted runner went live, the weak point it shipped with turned into an incident — terraform apply moved to a throwaway CodeBuild runner, a leftover review buffer re-posted one PR’s comment into later reviews, the fix that gives every job its own container with a registration token minted by a GitHub App, Claude Code baked into the image after the installer started returning 429, and the docker.sock risk that is still left.
What ArgoCD actually does in the Kukie dev cluster — the two repositories it reads, the GitHub App that lets it read them, the loop that turns a merge into cluster state, the controllers that take over after it, and the checks at the API server that decide what it may put in.