Prepare Actions
Copy the company metadata template and replace it with 5 to 25 proposed automated actions from one workflow.
Open company kitEvaluation Flow
What a reviewer actually does
The goal is to decide whether SMERC is worth a bounded shadow-mode pilot, not to claim production readiness from a synthetic test.
Choose The Right Pack
Use general automation, cloud-admin, or Financial Runtime/SMERC-F depending on the workflow being reviewed.
Open workflowReview The Report
Inspect posture counts, failed trust gates, highest-exposure actions, routes, controls, ledger validity, and autonomy state.
Open reportDecide Pilot Fit
If the output changes reviewer judgment, move to one workflow in observe mode with weekly labels.
Open pilot pathWhat SMERC Scores
The evaluation is about recoverability before execution
SMERC evaluates whether an automated action has enough evidence, containment, rollback capacity, and authority clarity to proceed. The output is not a legal approval or compliance certification. It is a replayable runtime posture that reviewers can compare against their existing process.
Irreversible exposureHow much harm remains if the action is wrong, late to cancel, broadly scoped, or difficult to roll back.
Reversible capacityHow much recovery path exists through rollback, containment, scoped execution, cancel reliability, and evidence quality.
Risk-adjusted authorizationWhether the action has enough recoverability and confidence to support a posture above block or freeze.
Autonomy budgetWhether the action stream is consuming too much risk, scope, or blocked/held attempts to continue independently.
Three Entry Points
A company reviewer should not need to decode the whole repo.
Pick the workflow family first, run the matching example second, and only consider a pilot if the report changes reviewer judgment.
Start with `examples/customer_eval_actions.json` for ordinary agent, deployment, tool-call, and high-impact workflow review.
Start with `examples/cloud_admin_customer_eval_actions.json` for IAM, network, Kubernetes, DNS, database, and backup actions.
Start with `examples/smerc_f_customer_eval_actions.json` for payment, refund, treasury, stablecoin, tokenized-collateral, wallet-policy, transaction-limit, and reserve-status actions.
Run `python -m reference_engine.complete_lifecycle_proof` to see the assembled loop: admission, pause, unlock, permit, execution result, and ledger.
Good Candidate Actions
- AI coding agent proposes a production deployment.
- MCP tool call can modify or delete customer data.
- Cloud automation expands IAM permission scope.
- Security automation quarantines systems or revokes access.
- Finance workflow moves funds, issues refunds, or changes payment state.
Bad Candidate Inputs
- Raw customer data or regulated records.
- Production logs containing sensitive data.
- Secrets, credentials, tokens, wallet keys, or private keys.
- Full source-code dumps.
- Anything the reviewer would not place in a normal security-review packet.
GitHub Actions Usage
Copy the workflow into a review repository and run it manually against a metadata-only JSON file.
name: SMERC Runtime Customer Evaluation
on:
workflow_dispatch:
inputs:
action_file:
required: true
default: examples/customer_eval_actions.json
permissions:
contents: read
jobs:
evaluate-customer-actions:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: actions/setup-python@v6
with:
python-version: "3.12"
- run: python -m reference_engine.customer_evaluation "${{ inputs.action_file }}" \
--json-output smerc-customer-evaluation/customer_evaluation_report.json \
--markdown-output smerc-customer-evaluation/Customer_Evaluation_Report.md
- uses: actions/upload-artifact@v4
with:
name: smerc-customer-evaluation-report
path: smerc-customer-evaluationWhat A Positive Result Looks Like
A positive evaluation does not mean SMERC is production-ready. It means reviewers found that recoverability scoring revealed meaningful differences from existing allow/deny review, identified useful constraints, or created a clearer escalation path for high-impact automated actions.