SIS CLI

Scan Configuration Guide

This guide captures the configuration priorities for agents running corpus evaluation and deep triage with sis.

Goals

  • preserve hostile-input safety boundaries
  • keep runs reproducible
  • control runtime policy mode explicitly
  • make behavioural drift reviewable

Preferred invocation pattern

Use explicit config for repeatable runs:

sis scan <file> --config <config.toml> --json

Critical config areas

  1. Analysis depth and budgets
  • deep analysis mode
  • recursion limits
  • extraction/decode byte limits
  • per-file timeout and batch timeout controls
  1. Format controls
  • format disable flags should be explicit and justified
  • compare runs only when format surface matches
  1. Policy mode
  • embedded
  • external_prefer
  • external_strict
  1. Output mode
  • machine workflows should default to JSON/JSONL
  • human triage can use markdown report surfaces as needed
  • sis report is the preferred built-in human-facing report surface when a scan needs a durable operator hand-off

Runtime policy block

Example:

[scan.policy]
mode = "external_strict"
bundle_path = "/abs/path/to/policy/calibration-session"

Use external_strict during calibration to avoid silent fallback.

Reproducibility checklist

  • commit or archive config used for capture
  • record active policy mode and bundle digest
  • keep scan surface consistent between baseline and candidate runs
  • preserve input ordering for corpus comparisons
  • sis docs report
  • ../configuration.md