Sympozium

Infrastructure for agents you have every reason to distrust.

We build the layer that decides what agent systems are allowed to do — coordination between them, isolation around them, and the physics of the hardware underneath. Kubernetes-native, open source, and boringly explicit about where each boundary sits.

One question, one home

AI systems on Kubernetes decompose into three layers with three different jobs. We build two of them, and deliberately not the third.

Layer	Owns	Decides
Sympozium — coordination	Agent identity, execution, policy, membrane, ensembles, memory	What agents do
llmfit-dra — capability	Accelerator inventory, fit physics, claims, placement	Where compute happens
Serving engines (vLLM, SGLang, llama.cpp)	Batching, KV cache, disaggregation runtime	How tokens move

Every proposed feature gets one question: does it decide what agents do, where compute happens, or how tokens move? If the answer isn't the layer it's being added to, it belongs elsewhere — even when we could technically host it.

Projects

sympozium · Go

A coordination layer for multi-agent AI on Kubernetes. Every agent is an ephemeral Pod, every policy a CRD, every execution a Job — so identity, RBAC, network policy and retry semantics are things Kubernetes already knows how to do, rather than things we reinvented. Ensembles, channels, shared memory, lifecycle hooks, and a TUI, web UI and CLI over all of it.

celln · Rust · Apache-2.0

Agents run in isolated cells that borrow verified tools instead of rebuilding Linux environments. Tools are lent in read-only as digest-pinned images and revoked on dissolve; nothing is installed and nothing persists.

The part worth reading about: authority is decided per call, not per binary. An attested python handed code a model just wrote keeps its hash and loses its authority for that invocation — which closes a hole every path- and binary-based allowlist shares.

llmfit-dra · Go

A Kubernetes DRA driver that publishes what each accelerator can do and lets the stock kube-scheduler place workloads against physics — "this model at 20 tok/s" — with exclusive allocation and explainable failures. Models get claimed, not placed: no bespoke placement machinery, no hostname pinning.

ergoz · Go

Vendor-neutral accelerator power telemetry for Kubernetes. Because you cannot reason about the cost of an agent fleet you cannot measure.

Research

The Synthetic Membrane: A Shared Permeable Boundary for Multi-Agent AI Systems (April 2026)

Multi-agent systems are usually broken at the coordination layer rather than in the models or the prompts. Frameworks standardise how agents talk and not what they share. The paper introduces a shared, gated, persistent medium as a primitive — selective permeability, provenance tracking, token budgets, circuit breakers and time decay — and it ships in Sympozium as an optional layer over shared workflow memory.

One AgentRun moving through its lifecycle phases, with hook points along the way.

Here on the Hub

Sympozium concept browser — an interactive read of the isolation and coordination concepts, written for people who have never run an agent on Kubernetes.

More to come: a Celln trust-model simulator, and the measured local-inference work that feeds llmfit.

Getting started

brew tap sympozium-ai/sympozium && brew install sympozium
# or
curl -fsSL https://deploy.sympozium.ai/install.sh | sh

sympozium install          # CRDs, controllers, built-in ensembles
sympozium                  # the TUI
sympozium serve            # the web dashboard

Documentation: deploy.sympozium.ai · Celln docs: sympozium-ai.github.io/celln