Don't Let the Model Write the YAML: Deterministic, Minimal-Diff GitOps Remediation from LLM-Proposed Field Changes

Separating semantic intent from syntactic editing for safe, unattended GitOps automation

Pruthvi Davineni· 2026· DOI 10.48550/arXiv.2609.00227

The core problem

LLM agents are increasingly deployed to diagnose incidents and propose remediations in production systems. In GitOps workflows, applying a fix requires editing a version-controlled configuration file, typically a Kubernetes manifest. The intuitive implementation—having the model author the edited file or a unified diff—is the first approach practitioners reach for. This work evaluates that choice on real Kubernetes manifests and finds that no text-generation strategy is safe for unattended automation. The authors argue for separating the semantic decision (which resource, field, and value to change) from the syntactic act of editing the file, and present a deterministic, fail-closed application contract for GitOps remediation. The contribution is scoped to faithful application of a known change; whether the change itself is correct remains subject to human PR review.

Unified diffs are unsafe for unattended automation. Under strict patching, almost none apply, but this is an artifact of strictness. A tolerant tool such as GNU patch applies 96% of diffs, yet silently misapplies about 1 in 7 (14-20%) with no error signal. Full-file rewrite is capability-dependent: a small model corrupts the file, while a frontier model is usually correct but non-deterministic—it silently drops a field or edits a neighbor on some runs—and must regenerate the whole file, costing O(file size) per edit. In contrast, the deterministic pipeline achieves correct and deterministic application independent of the model, with minimal diffs and preserved formatting and comments. The generation cost is O (1) per edit, as the model only emits a structured intent rather than the full file or a diff.

LLM agents are increasingly deployed to diagnose incidents and propose remediations in production systems. In GitOps workflows, applying a fix requires editing a version-controlled configuration file, typically a Kubernetes manifest. The intuitive implementation—having the model author the edited file or a unified diff—is the first approach practitioners reach for. This work evaluates that choice on real Kubernetes manifests and finds that no text-generation strategy is safe for unattended automation. The authors argue for separating the semantic decision (which resource, field, and value to change) from the syntactic act of editing the file, and present a deterministic, fail-closed application contract for GitOps remediation. The contribution is scoped to faithful application of a known change; whether the change itself is correct remains subject to human PR review.

The evaluation compares two LLM-driven text-generation strategies against a proposed deterministic pipeline. First, unified diffs are tested under strict patching and tolerant patching (GNU patch). Second, full-file rewrite is assessed across a small model and a frontier model. The proposed alternative has the agent emit only a structured field-change intent. A deterministic pipeline then indexes manifests by (kind, name), locates the target scalar's exact character span using the YAML parser's node position marks, and replaces only that span in the raw text. Because the file is never re-serialized, the diff is minimal by construction, formatting and comments are preserved, and the edit is correct and deterministic independent of the model, at O (1) generation cost. The implementation is released as KubeAstra (Apache-2.0) along with a benchmark.

The findings highlight a fundamental flaw in relying on LLM text generation for syntactic file editing in GitOps. The silent misapplication rate of 14-20% under tolerant patching is particularly dangerous because it provides no error signal, potentially leading to undetected configuration drift or outages. Full-file rewrite, while sometimes correct, is non-deterministic and scales poorly with file size. The proposed separation of concerns—LLM for semantic intent, deterministic pipeline for syntactic application—addresses these issues by making the edit fail-closed and minimal by construction. This approach aligns with the principle of least privilege for automation: the model proposes, but a deterministic system disposes. The authors implement this in KubeAstra and release a benchmark, providing a foundation for further research. The claim is scoped to faithful application of a known change; the correctness of the change itself remains a human responsibility during PR review. This work suggests that future LLM-based remediation systems should adopt similar deterministic application contracts to ensure safety and reliability.

CS practitioners and researchers

Opening member content…