cimiento 0.1.1

Cimiento — a governed AI-infrastructure control plane: intent XML → sense/plan/ground/compile/secure/govern-deploy/operate on Kubernetes, with machine-checked safety invariants (INV-22..32).

---

license: other license_name: cimiento-commercial license_link: LICENSE tags:

• kubernetes
• control-plane
• ai-infrastructure
• mlops
• llm-serving
• fine-tuning
• agents
• governance library_name: cimiento pipeline_tag: other

---

Cimiento

A governed control plane for AI infrastructure. You declare what you want in a short intent file; Cimiento senses the live cluster, plans the endpoints, proves the plan fits the measured capacity (or abstains), compiles hardened Kubernetes manifests, applies them through a governed gate with a tamper-evident journal, and then operates them — watching SLO, drift, and cost. Every stage is guarded by a machine-checked invariant with teeth: disable the guard and its check goes red.

It is not a YAML templater and it is not an "IaC copilot." It is a small, auditable reasoning layer that refuses to ship a plan it cannot justify against the cluster in front of it.

Commercial software — free for 90 days. After the trial a signed license key is required. For a key, contact [e-mail].

pip install cimiento

---

Measured, not promised

Everything below was run end-to-end on a 4×A100-80GB RKE2 cluster and the machine-checked test suite — no mock-ups:

Result	Detail
Qwen3-8B served live	governed deploy … --live --apply → 4 pods, /v1/chat/completions → HTTP 200
LoRA fine-tune to completion	Qwen3-1.7B, 30 steps in 63 s on 1×A100, train_loss 1.519 (governed K8s Job)
Governed agent	CPU agent server calling the cluster's own model; invoked an allow-listed tool only
Grounding refuses over-ask	the pramāṇa gate abstains when the measured hardware can't satisfy the plan
11 invariants with teeth	INV-22..32 over 70 states — 27/27 injected bugs caught, 0 guards pass when broken
131 tests green	full suite, including the licensing crack-defense tests

The pipeline

intent.xml → SENSE → PLAN → GROUND → COMPILE → SECURE → DEPLOY → OPERATE
             (INV-23)(INV-22)(INV-24)(INV-25/27)(INV-27/29)(INV-26/30)(INV-28)

One pipeline compiles three verticals from the same intent grammar:

• Serving — vLLM / TGI / NIM, GPU-placed, readiness-gated, ingress + Service.
• Fine-tune — a PEFT-LoRA run-to-completion Job (reuses the serving image, no extra pull).
• Agents — a stdlib agent server with a hard tool allow-list, model id auto-discovered.

Quick start

pip install "cimiento[k8s]"

cimiento plan     examples/policy-rag.xml            # what would be deployed (no cluster changes)
cimiento ground   examples/policy-rag.xml            # prove it fits the live cluster, or abstain
cimiento deploy   examples/policy-rag.xml --live --apply --yes   # governed apply (gate → token → journal)
cimiento verify   --teeth                            # run every machine-checked invariant, with teeth

A minimal intent:

<intent name="policy-rag" useCase="serving">
  <model repo="Qwen/Qwen3-8B" task="chat"/>
  <slo latencyMsP95="1500" minReplicas="1"/>
  <gpu type="A100" count="1"/>
  <security airGap="true" dataResidency="eu"/>
</intent>

Architecture

Cimiento is a thin, auditable layer over a reasoning kernel (antahkarana):

• antahkarana.spanda.padartha — the typed ontology categories the plan is expressed in.
• antahkarana.spanda.qbackend — the QUBO annealer used for grounded placement (CPU or GPU).

The control-plane logic (sense/plan/ground/compile/secure/deploy/operate, the invariant checker, the CLI) lives in cimiento. Only the public verification key of the licensing system is shipped; keys are minted out-of-band by the vendor.

Licensing

Cimiento is commercial software with a built-in 90-day free trial. After the trial, a signed Ed25519 license key is required. The trial and key checks are pure-Python, zero-dependency, and resistant to clock-rollback and state-tampering (monotonic high-water mark + checksummed, redundant state).

cimiento-license status                 # trial days remaining / license state
cimiento-license install <KEY>          # install a signed key

To obtain a key, contact [e-mail].

License

Proprietary / commercial. See LICENSE. Not open source.

---

Cimiento — Spanish for "foundation."