SMERC Primary Pilot Path

GitHub Actions shadow-mode recoverability scoring

A narrow first deployment for security and platform teams: score one AI-assisted code, deployment, or infrastructure workflow in observe mode before considering recommendations or enforcement.

ALLOW THROTTLE FREEZE DENY ESCALATE
Request pilot Review console Live demo AI overview Discovery

Implementation Proof

GitHub Actions integration is represented in the public repo

The public repository includes the recoverability engine, authenticated pilot API, tenant-scoped audit store, local and remote action modes, immutable reviewer evidence, denominator-aware metrics, action-bound permits, signed control evidence, GitHub OIDC support, a permit-consuming deployment adapter, workflow tests, synthetic shadow-mode scenarios, and pilot materials that support a controlled GitHub Actions evaluation.

View integration Open review console Current CI status Metrics contract Pilot one-pager Deployment adapter Synthetic pilot report

Why This Pilot

AI coding agents and workflow automations can now propose changes that deploy code, modify infrastructure, access sensitive data, or trigger operational workflows. Existing controls often decide whether an action is allowed. SMERC adds a runtime posture before the action executes.

  • Run in shadow mode first.
  • Compare SMERC postures against existing reviewer decisions.
  • Measure where throttle, freeze, or escalate is more useful than block.

Three Modes

Observe Score the action, write a report, never fail the workflow.
Recommend Surface constraints and reason codes for reviewer use.
Enforce Fail or route selected high-risk postures after calibration.

Workflow Example

Use the integration as a local action inside a repository pilot.

- name: Evaluate proposed agent action
  id: smerc
  uses: ./integrations/github_actions
  with:
    action-file: integrations/github_actions/sample_action_request.json
    mode: observe
    output-file: smerc-decision.json
    fail-on: DENY,FREEZE

Current Demonstration Evidence

The repository replays synthetic GitHub Actions scenarios through the current engine. Several receive a constraint, pause, or review posture rather than ALLOW. This demonstrates repeatable mechanics and report generation; it does not establish production accuracy or customer demand.

Read the report Inspect scenarios

What The Report Shows

  • posture: ALLOW, THROTTLE, FREEZE, DENY, or ESCALATE
  • risk score and confidence score
  • reason codes
  • recommended constraints
  • replay ID for audit and comparison

Success Evidence

  • Reviewer agreement rate
  • False release and false constraint rate
  • Approval latency impact
  • Useful constraint rate for high-impact actions
  • Repeatable policy changes discovered during pilot

Commercial Claim

SMERC should be bought only if recoverability scoring changes real workflow decisions. The first pilot is designed to test that claim without requiring immediate enforcement or replacement of existing controls.

Review pilot options