SIS CLI

Content Disarm & Reconstruction (CDR) Guide

CDR produces a cleaned artefact safe to release, as opposed to a verdict about the original. Three surfaces cover the lifecycle: sis sanitize (single file), sis cdr-gateway (directory pipeline), and sis sanitize verify (evidence-report check). Supported families: PDF, OOXML, RTF, HTML, SVG, ZIP/archive (ISO/UDF not yet supported).

sis sanitize — single document

sis sanitize <file> --out clean.pdf

Key modes (in increasing assurance):

• plain — --out <path>: best-effort transform, writes the sanitised file.
• dry-run — sanitize plan: scans and prints the deterministic transform plan as JSON (what would be removed + residual forecast). Mutates nothing, writes nothing. --out not required.
• safe rebuild — --safe-rebuild: phase-2 rebuild validation and integrity checks.
• verify rescan — --verify-rescan: re-scans the output and reports residual five-axis risk (cdr_residual_risk).
• release path — sanitize release: runs the transform in an isolated worker, re-scans and decides in the trusted parent, and publishes --out only when releasable. Writes the authoritative evidence report to --report-json.

The sanitize release exit code encodes the decision:

Pick a profile with --cdr-profile: cdr-strict-gateway (default), cdr-business-docs, or cdr-ai-ingestion.

# preview what would be stripped, change nothing
sis sanitize sample.docx --cdr-plan | jq .

# gated release with full evidence; check the exit code
sis sanitize sample.docx --cdr --out clean.docx --report-json evidence.json \
  --cdr-profile cdr-business-docs
echo "decision exit: $?"

Scoped-drop plan (--asset-selector)

sis sanitize --asset-selector <selector> previews a scoped drop: it reports the asset-graph diff of removing the subtrees matching an asset-path selector — i.e. exactly which containment chains a drop would break — and mutates nothing. This is a plan, not a release: it never emits a sanitize release decision/exit code, and it is off the whole-document release path (--asset-selector conflicts with sanitize release/sanitize plan).

sis sanitize bundle.zip --asset-selector "**/[format=pe]" | jq .

The output (type: sanitize_asset_plan, mutated: false) carries an AssetGraphDiff — the removed subtree(s) with the findings that leave with them. Dropping zip:doc.docx reports both it and its …/rtf:… child under removed. Refuses on flat roots (no members to drop) and on a selector that matches the document root. The selector grammar is in sis docs asset-graph; the byte-level scoped rebuild is a follow-on — today this is a preview.

sis cdr-gateway — directory pipeline

Drains an intake directory through a bounded pool of isolated workers, routing each file to a release / quarantine / manual directory and writing an audit log.

sis cdr-gateway \
  --watch intake/ --release-dir released/ --quarantine-dir quarantine/ \
  --manual-dir manual/ --reports-dir reports/ --audit-log gateway.log \
  --profile cdr-strict-gateway --pool-size 4

Add --once to drain the current backlog and exit (instead of watching continuously). The gateway is unix-only (it relies on process isolation); it dedups duplicate work and the audit log records identities + decisions, never content.

sis sanitize verify — evidence-report check

Verifies a CDR evidence report’s internal consistency and that its artefacts match.

sis sanitize verify --report evidence.json
sis sanitize verify --report evidence.json --input original.docx --output clean.docx

Choosing a CDR surface

• One file, want it cleaned and gated → sis sanitize release
• Just want to see what would change → sis sanitize plan
• Preview dropping specific assets (which chain breaks) → sis sanitize --asset-selector (a plan)
• Continuous intake folder → sis cdr-gateway
• Auditing a produced evidence report → sis sanitize verify

Related guides

• sis docs assess (is the document safe to feed a model?)
• sis docs verdict (the malware-axis decision on the original)