🦔 SmartRoute

Route only what you trust. Gate agents and tools with trust scores and guardrails.

IAIso §5 · Orchestration · SmartTasks.cloud · the Smart* family

You're managing ten agents you have no reason to trust.

As AI reshapes how we work, a new gap opens: untrusted, uncoordinated agents create risk and rework. SmartRoute closes it — route at the exact moment the gap bites, and it works the second you clone it (a synthetic demo ships in demo/).

Install

SmartRoute is not published on PyPI or any other package registry yet. Until this section says otherwise, a package called sf-smartroute on any registry is not ours, and neither is smartroute.

Install from a clone (Python 3.10 or later):

git clone https://github.com/SmartTasksOrg/sf-smartroute
cd sf-smartroute
python -m venv .venv
. .venv/bin/activate          # Windows PowerShell: .\.venv\Scripts\Activate.ps1
python -m pip install .
sf-smartroute --demo

Status

• Version 3.0.0, experimental. A small deterministic command-line tool with a bundled synthetic demo and two smoke tests.
• Published: nowhere yet; install from a clone (above).
• Tested: the 2 smoke tests in tests/ on Python 3.12, Linux, on every push to master and every pull request (.github/workflows/ci.yml).
• Not tested: Windows and macOS; Python versions other than 3.12.
• Security review: none independent. Report vulnerabilities as described in SECURITY.md.

Run it in your stack

What's in this repo

• Core engine — src/sf_smartroute/: trust() -> TrustScore; gate() -> Decision. Deterministic, dependency-free.
• CLI — sf-smartroute --demo (and --version): a deterministic demo of the core.
• Language ports — ports/: native Go, Java, Node, PHP implementations that reproduce the Python reference, with a shared conformance harness.
• Framework integrations — integrations/: Flowise, OpenAI/Anthropic function-calling, GitHub Action, LangChain, LlamaIndex, MCP server, pre-commit, VS Code extension — each a thin wrapper over one adapter.py bound to the core.
• Also included — a runnable demo/, examples/, the IAIso mapping spec/iaiso-map.json, a browser site/playground.html, plus public smoke tests in tests/.

How it works

SmartRoute works at two altitudes, one trust model — both deterministic, dependency-free, and fail-loud:

• Agent-level — trust(agent) / route() score an agent by its declared capabilities (read, write, delete, exec, network): coarse, "should this agent be allowed to act at all."
• Per-call — gate(request) scores one concrete tool-access request and returns an allow/block Decision with a 0..1 trust score and the exact ROUTE-* signals that moved it. Every request starts fully trusted (1.0); each signal subtracts its weight; the call is granted when score >= 0.5 (MIN_SCORE) and nothing hard-blocks.

Rule IDs are namespaced ROUTE-* so output reads kin to the rest of the family (SmartPangolin's SEC-*, SmartPrompt's PROMPT-*). risk bands the per-call score: low >= 0.75, medium >= 0.5, else high.

The data objects (UML)

These are real dataclasses in src/sf_smartroute/models.py — the diagram and the code are the same thing:

classDiagram
    class Agent {
      +name: str
      +capabilities: list[str]
    }
    class TrustScore {
      +agent: str
      +score: float
      +allowed: bool
    }
    class RouteDecision {
      +agent: str
      +allowed: bool
      +reason: str
    }
    class Signal {
      +rule: str
      +weight: float
      +reason: str
    }
    class Decision {
      +granted: bool
      +score: float
      +risk: str
      +signals: list[Signal]
    }
    class IAIsoControl {
      +section: str
      +name: str
    }
    Decision "1" *-- "many" Signal : records
    RouteDecision ..> IAIsoControl : conforms to
    Decision ..> IAIsoControl : conforms to

Where it sits in the architecture

SmartRoute doesn't stand alone — it stacks with the family, and everything conforms to the IAIso standard — the same standard that governs SmartTasks' own apps, while each tool here stays standalone and drops into your architecture:

graph LR
    IAIso([IAIso standard]):::std
    Cloud([SmartTasks.cloud]):::cloud
    SmartPangolin[SmartPangolin]:::tool
    SmartPrompt[SmartPrompt]:::tool
    SmartCheck[SmartCheck]:::tool
    SmartSeal[SmartSeal]:::tool
    SmartStandard[SmartStandard]:::tool
    SmartSim[SmartSim]:::tool
    SmartMoat[SmartMoat]:::tool
    SmartRoute[SmartRoute]:::tool
    SmartFeed[SmartFeed]:::tool
    SmartPangolin -->|emits clean artifacts to| SmartSeal
    SmartPrompt -->|hands secret/PII flags to| SmartPangolin
    SmartPrompt -->|enforces prompt rules from| SmartStandard
    SmartCheck -->|stamps verified output with| SmartSeal
    SmartCheck -->|checks against rules from| SmartStandard
    SmartSeal -->|issues receipts consumed by| SmartCheck
    SmartSeal -->|issues receipts consumed by| SmartRoute
    SmartStandard -->|supplies rule sets to| SmartPrompt
    SmartStandard -->|supplies rule sets to| SmartCheck
    SmartSim -->|feeds role forecasts to| SmartMoat
    SmartSim -->|draws signals from| SmartFeed
    SmartMoat -->|consumes forecasts from| SmartSim
    SmartRoute -->|verifies receipts from| SmartSeal
    SmartRoute -->|enforces the standard from| SmartStandard
    SmartFeed -->|feeds signals to| SmartSim
    SmartFeed -->|feeds signals to| SmartMoat
    SmartPangolin -.conforms.-> IAIso
    SmartPangolin -.shares IAIso with.-> Cloud
    SmartPrompt -.conforms.-> IAIso
    SmartPrompt -.shares IAIso with.-> Cloud
    SmartCheck -.conforms.-> IAIso
    SmartCheck -.shares IAIso with.-> Cloud
    SmartSeal -.conforms.-> IAIso
    SmartSeal -.shares IAIso with.-> Cloud
    SmartStandard -.conforms.-> IAIso
    SmartStandard -.shares IAIso with.-> Cloud
    SmartSim -.conforms.-> IAIso
    SmartSim -.shares IAIso with.-> Cloud
    SmartMoat -.conforms.-> IAIso
    SmartMoat -.shares IAIso with.-> Cloud
    SmartRoute -.conforms.-> IAIso
    SmartRoute -.shares IAIso with.-> Cloud
    SmartFeed -.conforms.-> IAIso
    SmartFeed -.shares IAIso with.-> Cloud
    IAIso -.governs.-> Cloud
    classDef tool fill:#1c232d,stroke:#f5b83d,color:#efe9f5;
    classDef std fill:#04121f,stroke:#46d6c8,color:#46d6c8;
    classDef cloud fill:#1a1327,stroke:#a78bfa,color:#a78bfa;
    style SmartRoute stroke-width:3px,stroke:#ff6b6b;

• SmartRoute verifies receipts from SmartSeal →
• SmartRoute enforces the standard from SmartStandard →

Open site/playground.html for the interactive version.

Part of the Smart* family

One system, not nine projects — same mascot, same manifesto voice, same rule-ID style, all aligned to the IAIso standard. Each is an independent, open-source, single-purpose tool you can integrate into your own architecture:

Backed by the standard: SmartRoute implements IAIso §5 · Orchestration. Open-source edition: this repo is the simplified, single-purpose version, built for any org to integrate into its own architecture. SmartTasks' desktop app and SmartTasks.cloud run a more advanced, deeply-integrated implementation of the same IAIso governance — a separate product, not this code bundled.

Who's behind this

• Roen Branham — CEO & AI Strategy Architect · CISSP-certified AI, security & governance architect; author of IAIso and sole inventor of the Z4 Semantic Fabric patent application. LinkedIn
• Le Vu Tanh — CTO & Core Engineering Lead · Chief architect of the Cortex engine; large-scale system reliability and low-latency infrastructure — the engineer who ships what gets architected. LinkedIn

The team behind IAIso & SmartTasks: a CISSP-certified security & governance architect and a large-scale systems engineer — 20+ years shipping secure, AI-driven platforms for regulated, blue-chip environments (Allianz, BMW, Rolls-Royce, Heidenhain).

Runs on governed local models

Each card ships an OWASP-mapped red-team result and an agent_hint, so an orchestrator can trust-gate a model before wiring it into a loop — exactly SmartRoute's job.

This tool is local-first, so pair it with models you can actually vet. SmartTasks publishes 21+ governance-validated GGUF builds on Hugging Face — each with a machine-readable scorecard (capability tiers L1 Layman → L5 Agentic, IAIso conformance invariants (pass/warn/fail), OWASP-mapped garak red-team, transparency probes (viewpoint-alignment / over-refusal), and per-file SHA-256). Gate model selection on evidence, not vibes — and every finding, including warnings, is published in full.

→ SmartTasks on Hugging Face · Qwen3.6-27B (L5 agentic) · react-agent-coder-llama-3.1-8b (agentic coder) · gpt-oss-20b (open reasoning)

Get in touch

• Companies & enterprises: enterprise@smarttasks.cloud — we help teams integrate SmartRoute + IAIso into their architecture so governance and audit-readiness become a byproduct of how they already work.
• The standard: IAIso · iaiso.org
• The product: SmartTasks.cloud

Built by SmartTasks Lab. Apache-2.0. Contributions welcome.