SIS CLI

Intended-Use Assessment Guide (`sis assess`)

sis assess classifies observed AI-ingestion risk independently of the malware verdict. It is a bounded risk projection, not a certificate that a document is safe or a complete consumer/action/destination decision. The only supported --for value today is ai-ingest.

sis assess sample.html --for ai-ingest --json
sis assess sample.html --deep --risk-dimensions --json

JSON carries label, action, basis, carriers, instruction_classes and visible_directive_facts. --risk-dimensions includes the additional risk roll-up. No detected instruction is not proof that none exists: inspect analysis limits and the source evidence using sis docs verdict and sis explain members.

What the label covers

The label is about HIDDEN or TRANSFORMED instruction carriers: a hidden or transformed channel (ActualText, hidden layers, invisible, off-page or near-background text, encoded payloads, Unicode smuggling, metadata and comment channels), a divergence between views (including OCR text that differs from the extracted text), or an ingestion-targeted carrier. the analyser does not judge the meaning of visible prose. Directive-like phrasing in ordinary visible text is a non-verdict fact: it is counted in visible_directive_facts (count, kinds, terms) and has no effect on the label, the action or the exit code. A none label is not proof of absence; whether visible text may instruct a model is the consuming guard’s decision.

Labels, recommendations and exits

Label	Recommended action	Default exit	Consumer obligation if accepting the recommendation
`none`	`allow`	0	No instruction-bearing content detected on the analysed axes; retain the analysis limits
`indeterminate`	`allow_logged`	5	Some content could not be examined; explicitly accept and log that uncertainty, or refuse it
`instruction_bearing`	`allow_logged`	10	Instruction-bearing content in a structural channel without a paired concealment finding; log it, or require review
`hidden_instruction`	`strip_then_allow`	20	Produce and inspect a derivative with identified spans removed before ingesting; do not ingest the original
`poisoning_likely`	`block`	30	Refuse ingestion

These are analyser recommendations. Your consumer policy decides whether to accept them. In particular, allow_logged does not mean complete analysis, and strip_then_allow does not mean that the command already performed removal. Transformation failure must not fall back to the original.

The default exit ladder belongs to this command. A comparison such as [ "$status" -lt 10 ] accepts indeterminate exit 5. It is unsuitable for a consumer that refuses uncertainty.

Strict ingestion consumer

A strict consumer allows only a successful none assessment. Generic mode returns 0 only for none; every other risk label returns 1. Capture output before acting, and route any command failure to refusal as well:

if sis assess sample.html --for ai-ingest --exit-code-mode generic --json > assessment.json; then
  echo 'Assessment passed; retain its evidence and coverage before ingestion.'
else
  echo 'Ingestion refused: risk, uncertainty, or assessment failure.' >&2
  exit 1
fi

This example does not ingest anything. An actual loader must bind the assessed bytes to the bytes it subsequently consumes. A zero result remains a bounded observation, not a universal safety guarantee.

Capture and defer logged uncertainty

Capture the assessment even when its ladder exit is nonzero:

status=0
sis assess sample.html --for ai-ingest --json > assessment.json || status=$?
case "$status" in
  0) echo 'No instruction-bearing content detected on the analysed axes.' ;;
  5|10) echo 'Review assessment.json; ingestion needs explicit acceptance and logging.'; exit 1 ;;
  20) echo 'Original refused; derivative and removal review required.'; exit 1 ;;
  *) echo 'Refuse ingestion; inspect the assessment or command error.' >&2; exit 1 ;;
esac

This deliberately leaves uncertainty pending for operator/policy acceptance. Never send content downstream merely because the output says allow_logged.

Derivatives and configuration

sis assess sample.html --config config.toml --safe-text safe-text --json
sis extract sample.html --profile ai-ingest-safe --format json

--safe-text removes spans of hidden or transformed carriers only; visible directive-like text is passed through. Assessment reads an explicit --config; it does not automatically use scan’s default config lookup. --safe-text-min-confidence is the minimum confidence of a removal, not a minimum assurance of the remaining text. Raising it can retain spans flagged with lower confidence. sis docs extract explains removal records and limitations.

Default exit numbers overlap other command families: 20 and 30 have different meanings for CDR release. The generic mode above is an assessment option; it is not a global flag or an option accepted by every transformation command. Usage errors normally exit 2; execution/input failures can use other nonzero codes. Check both output validity and the command result.