cimiento 0.1.0

Cimiento — a governed AI-infrastructure control plane: intent XML → sense/plan/ground/compile/secure/govern-deploy/operate on Kubernetes, with machine-checked safety invariants (INV-22..32).

---

license: other license_name: cimiento-commercial license_link: LICENSE tags:

• kubernetes
• control-plane
• ai-infrastructure
• mlops
• llm-serving
• fine-tuning
• agents
• governance library_name: cimiento pipeline_tag: other

---

Cimiento

A governed control plane for AI infrastructure. You declare what you want in a short intent file; Cimiento senses the live cluster, plans the endpoints, proves the plan fits the measured capacity (or abstains), compiles hardened Kubernetes manifests, applies them through a governed gate with a tamper-evident journal, and then operates them — watching SLO, drift, and cost. Every stage is guarded by a machine-checked invariant with teeth: disable the guard and its check goes red.

It is not a YAML templater and it is not an "IaC copilot." It is a small, auditable reasoning layer that refuses to ship a plan it cannot justify against the cluster in front of it.

pip install cimiento — pure-Python, no heavyweight runtime deps. 90-day free trial, then a signed key. See Licensing below.

---

Why it exists

Most infra automation fails open: it renders a manifest and hopes the cluster can run it. Cimiento fails closed. Grounding runs a quantum-inspired QUBO placement over the capacity it actually measured; if the workload does not fit, the deploy abstains rather than half-applying. The apply step is gated (dry-run → signed token → journal → rollback), so every change is attributable and reversible.

Proven live, not on a slide

Everything below was run end-to-end on a 4×A100-80GB RKE2 cluster and the machine-checked test suite — no mock-ups:

Result	Detail
Qwen3-8B served live	governed deploy … --live --apply → 4 pods, /v1/chat/completions → HTTP 200
LoRA fine-tune to completion	Qwen3-1.7B, 30 steps in 63 s on 1×A100, train_loss 1.519 (governed K8s Job)
Governed agent	CPU agent server calling the cluster's own model; invoked an allow-listed tool only
17.8× placement speedup	GPU QUBO annealer vs CPU @ n=512 (grounding)
11 invariants with teeth	INV-22..32 — each guard is falsifiable and the suite injects the bug
131 tests green	full suite, including the licensing crack-defense tests

The pipeline

intent.xml → SENSE → PLAN → GROUND → COMPILE → SECURE → DEPLOY → OPERATE
             (INV-23)(INV-22)(INV-24)(INV-25/27)(INV-27/29)(INV-26/30)(INV-28)

One pipeline compiles three verticals from the same intent grammar:

• Serving — vLLM / TGI / NIM, GPU-placed, readiness-gated, ingress + Service.
• Fine-tune — a PEFT-LoRA run-to-completion Job (reuses the serving image, no extra pull).
• Agents — a stdlib agent server with a hard tool allow-list, model id auto-discovered.

Quick start

pip install "cimiento[k8s]"

# see what would be deployed (no cluster changes)
cimiento plan     examples/policy-rag.xml

# prove it fits the live cluster, or abstain
cimiento ground   examples/policy-rag.xml

# governed apply: dry-run gate → signed token → tamper-evident journal
cimiento deploy   examples/policy-rag.xml --live --apply --yes

# run every machine-checked invariant, with teeth
cimiento verify --teeth

A minimal intent:

<intent name="policy-rag" useCase="serving">
  <model repo="Qwen/Qwen3-8B" task="chat"/>
  <slo latencyMsP95="1500" minReplicas="1"/>
  <gpu type="A100" count="1"/>
  <security airGap="true" dataResidency="eu"/>
</intent>

Architecture

Cimiento is a thin, auditable layer over a reasoning kernel (antahkarana):

• antahkarana.spanda.padartha — the typed ontology categories the plan is expressed in.
• antahkarana.spanda.qbackend — the QUBO annealer used for grounded placement (CPU or GPU).

The control-plane logic (sense/plan/ground/compile/secure/deploy/operate, the invariant checker, the CLI) lives in cimiento. Only the public verification key of the licensing system is shipped; keys are minted out-of-band by the vendor.

Licensing

Cimiento is commercial software with a built-in 90-day free trial. After the trial, a signed Ed25519 license key is required. The trial and key checks are pure-Python, zero-dependency, and resistant to clock-rollback and state-tampering (monotonic high-water mark + checksummed, redundant state).

cimiento-license status                 # trial days remaining / license state
cimiento-license install <KEY>          # install a signed key

To obtain a key, contact [e-mail].

License

Proprietary / commercial. See LICENSE. Not open source.

---

Cimiento — Spanish for "foundation."