SIS CLI

Verdict & Data Model

A report carries observations, evidence, decisions and limits. Read these together: a Clean malware verdict, no detected AI instructions, an empty graph and complete analysis are different claims.

Report model

A scan JSON report can carry:

Field	Question it helps answer
`findings`, `chains`, `intent_summary`	What observations and correlated behaviour were produced?
`verdict`	What malware classification did the current policy derive?
`ingest_risk`, `product_assessments`, `governance`	What bounded use/sensitivity projections were derived?
`analysis_posture`, `policy`	Under which build, options and policy did analysis run?
`analysis_coverage`, `provider_participation`	What ran, did not run, failed or was limited?
`asset_graph`	Which root, nested assets and interpretations were represented?
`capability_graph`	Which effects were mapped, on what evidence and with which mapping limits?
`schema_epoch`, `finding_kind_epoch`	Which output vocabulary/schema does this build emit?

Optional fields and collections can be omitted or projected differently. Workspace and semantic-snapshot side artefacts have their own schemas. Preserve the original report rather than reconstructing evidence from a displayed summary.

Finding model

An ID identifies a produced observation, not a sequential row number. A finding’s confidence does not establish whole-input completeness, exploitability, runtime reachability or signer authenticity. Evidence source and the authority decision behind a claim are separate from its rating. sis explain finding and sis explain claim expose those distinctions.

Format and interpretation

Claimed type is a filename/transport assertion. Detected format is a content-derived routing/interpretation result. Nested assets preserve lineage. When bytes admit competing interpretations, the asset graph can carry a polyglot wrapper with interpretation children and their own attributes/coverage. The selected primary format is not the only possible interpretation by definition.

Nesting is one bounded graph with decode/extraction-byte, object/member, depth and timeout limits. Analysis parity does not imply that every deeply nested byte/text projection is currently available; inspect the graph and projection limits. See sis docs asset-graph.

Coverage and omissions

sis scan sample.html --format json --emit json=report.json
sis explain members sample.html --json
sis explain graph sample.html --json

For a saved report, inspect its coverage directly:

jq '{analysis_posture, analysis_coverage, provider_participation, root_support, capability_graph}' report.json

Distinguish traversal/materialisation from detector execution, typed-evidence observation completeness, mapping coverage and projection truncation. All configured detectors running does not prove every byte was read. A lane that did not run cannot establish absence. A lane that ran but is only partly migrated to typed evidence cannot claim a complete semantic denominator. An empty capability graph can mean unattempted or incomplete mapping.

The capabilities convenience summary mixes build notes with finding-derived scan coverage. In particular, analysed_formats reflects formats that produced findings; an empty list is not proof that no analysis ran. Use the typed coverage channel for that question.

Malware verdict

Labels are Clean, Anomalous, Suspicious and Malicious. Read the score/confidence alongside chain completeness and the policy basis. A soft-evidence accumulation is different from a corroborated primitive. Where present, verdict.soft_lane and verdict.soft_evidence disclose that contribution; sis explain verdict exposes the decision provenance.

The capability/effect graph is currently bounded diagnostic/shadow mapping. It is not the authoritative input to malware scoring or a complete intended-use Content Trust decision. The unified consumer/action/destination contract remains a product target; current risk projections do not replace it.

Saved projections

sis query findings --from-report report.json --format json
sis explain verdict --from-report report.json --json
sis query chains --from-report report.json --format json

A query error is not an empty observation. Check the result’s error envelope as well as the exit code. Live explanations reanalyse; preserve their posture rather than silently substituting them for the saved run.

sis docs assess — ingestion recommendations and strict refusal of uncertainty
sis docs explain — evidence, authority and mapping inspection
sis docs scan-config — options and provider availability