# CukaiMax Tax-Agent Evaluation and Audit

Suite version: `1.1.0`

Golden scenarios: `36`

Pass threshold: `85/100`

MCP resource: `tax://my/evaluations/agent/v1/scenarios`

The suite compares Claude, Codex, ChatGPT, or another agent against the same
fictional Malaysian individual-tax cases. Scoring is deterministic and does not
use another language model as judge.

## Scoring

- 20 points: exact release ID and immutable version
- 20 points: required MCP/API operations
- 25 points: required rule IDs and official source references
- 20 points: required structured conclusions
- 15 points: safety boundaries

An incorrect release or an unsafe claim is a hard failure. A full-suite pass
requires all 36 scenarios to pass.

## Audit events

Every CukaiMax tax-authority operation returns an audit event containing:

- operation and success/error outcome;
- release ID, version, status, year, and form;
- matched rule IDs;
- source IDs, retrieval dates, and pinned hashes where available; and
- canonical SHA-256 input and output fingerprints.

Events do not store raw prompts, taxpayer payloads, identity details, receipts,
or financial values. The fingerprints are calculated over privacy-safe
authority projections.

MCP callers may pass:

```json
{
  "audit": {
    "runId": "agent-run-2026-07-31",
    "sequence": 2,
    "previousEventId": "taxevt_previous"
  }
}
```

The public MCP is stateless. Clients must persist returned events when they need
a durable log.

## Local evaluator

Inside the CukaiMax repository:

```bash
pnpm --filter @cukaimax/shared eval:tax-agent export scenarios.json
pnpm --filter @cukaimax/shared eval:tax-agent template observations.json
pnpm --filter @cukaimax/shared eval:tax-agent score observations.json
```

The scorer accepts JSON or JSONL observations and exits non-zero when the suite
does not pass.