Skip to content

Pimatika documentation

Everything here is for someone using Pimatika: writing a Build Intent Manifest, signing it, judging egress against it, or verifying a proof bundle it produced.

Nothing here depends on anything unpublished.

Start here

  • Getting Started — from nothing to a working allow and a working deny: write a BIM, sign it, judge two requests
  • Reference — the full CLI, the pimatika-core library API, signing-key resolution, and the crate layout

Understanding it

  • Architecture — the five-brick chain, the BIM schema in full, the enforcer call-flow, drift and JAQ overlays, evidence
  • Security model — the trust boundary, the signature model, and the DNS and redirect limits. Read this before you rely on a verdict: where the workload runs decides what the guarantee is

Pimatika is a judge, not a proxy. It returns a verdict; something has to honour it. In a NaZelo sandbox the kernel does, because the manifest is compiled into an eBPF allow-list. On a bare host the host process is responsible, and a program that never calls Pimatika can still open a connection.

Verifying what it produced

The bundle format is published so a third party can verify a decision offline — pinning only a root public key, with no shared secret and no dependency on the tooling that produced it.

  • Proof bundle format — the layout, BIM canonicalization, the verification algorithm, and what a bundle does not prove

Bindings and integrations

These ship beside the code they bind, so they stay honest about it:

Working on Pimatika itself

The licence invites it: you may read, build, run and audit the engine, and modify it for your own use. What you need for that is published — the build, the crate layout and the open-core boundary are in Reference.

Licence

pimatika-core and pimatika-cli are source-available, not open source: Business Source License 1.1, converting to Apache-2.0 on 2030-07-30. You may read, build, run in production and audit them; you may not offer them to a third party as a hosted service.

For alternative arrangements: support@pimatika.dev

Questions and issues: https://github.com/theAIstep/pimatika/issues