SIS CLI

Policy Bundle Reference (preview)

sis policy show/rules/lineage <kind> are preview commands: output shapes may change before 1.0. All three are read-only, no-scan introspection of the currently loaded detection policy bundle — not a particular file’s analysis. None take a file argument.

sis policy show — the active bundle’s identity

Prints which policy bundle is loaded: mode, generation, bundle path, version, hash, source, load status, and any deprecations.

sis policy show

Replaces the legacy sis query policy.active --from-report <report.json> spelling. Unlike that spelling, this is a live property of the running process, not something a saved report carries — there is no --from-report form here either way.

sis policy rules — the loaded bundle’s rules

Enumerates the loaded bundle’s verdict and chain-score rule manifests, the decision inventory (floors/triggers/scalars/contradictions), and the budget inventory (every production bound that can truncate analysis).

sis policy rules

Replaces the legacy sis query policy.rules spelling — live form only; unlike policy.active, policy.rules --from-report <report.json> was never actually supported (it refuses with UNSUPPORTED_IN_REPORT_MODE, a pre-existing inconsistency in the legacy spelling; this command does not drop a capability the legacy one had, since it never had it).

sis policy lineage <kind> — one finding kind’s rule lineage

Traces one finding kind’s rating, intent contributions, and contract metadata through the loaded policy bundle, joined by stable id.

sis policy lineage js:runtime_network_request_attempt

Replaces the legacy sis query policy.kind <kind> spelling — live form only; same inconsistency as policy.rules above, policy.kind --from-report <report.json> was never actually supported either. Exits 0 whether or not the kind is found — “found” is a field in the output (found: false names the kind back and notes why), not a process-level distinction, matching how a missing match is reported elsewhere in this reference.

Exit codes

All three: 0 printed; 1 a generic failure (an unreadable policy bundle, or any other error with no distinct code); 2 a usage/argument error rejected by clap itself (a missing <KIND> on lineage).