fix(report): keep baseline findings out of active listings

strix/report/state.py

@@ -528,6 +528,9 @@ class ReportState:
         return report
 
     def get_existing_vulnerabilities(self) -> list[dict[str, Any]]:
+        return list(self.vulnerability_reports)
+
+    def get_dedupe_vulnerabilities(self) -> list[dict[str, Any]]:
         return [*self.baseline_vulnerability_reports, *self.vulnerability_reports]
 
     def record_sdk_usage(

strix/tools/reporting/tool.py

@@ -674,7 +674,7 @@ async def _do_create(
 
         from strix.report.dedupe import check_duplicate
 
-        existing = report_state.get_existing_vulnerabilities()
+        existing = report_state.get_dedupe_vulnerabilities()
         candidate = {
             "title": title,
             "description": description,
@@ -1705,7 +1705,7 @@ async def _do_create_dependency(  # noqa: PLR0912
 
         from strix.report.dedupe import check_duplicate
 
-        existing = report_state.get_existing_vulnerabilities()
+        existing = report_state.get_dedupe_vulnerabilities()
         candidate = {
             "title": title,
             "description": description,

tests/test_list_reports.py

@@ -20,6 +20,15 @@ if TYPE_CHECKING:
     from pathlib import Path
 
 
+BASELINE_RUN_NAME = "baseline-run"
+BASELINE_REPORT_ID = "vuln-0042"
+BASELINE_REPORT_TITLE = "Baseline SQL injection"
+BASELINE_REPORT_SEVERITY = "critical"
+BASELINE_REPORT_TIMESTAMP = "2026-07-27 00:00:00 UTC"
+BASELINE_REPORT_TARGET = "https://baseline.example.com"
+CURRENT_REPORT_TITLE = "Reflected XSS in search"
+
+
 @pytest.fixture
 def report_state(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> ReportState:
     monkeypatch.chdir(tmp_path)
@@ -174,6 +183,40 @@ def test_list_reports_metadata_first_and_sorted(report_state: ReportState) -> No
     assert "evidence" not in first
 
 
+def test_list_reports_and_get_report_exclude_baseline_findings(
+    report_state: ReportState,
+) -> None:
+    baseline_report = {
+        "id": BASELINE_REPORT_ID,
+        "title": BASELINE_REPORT_TITLE,
+        "severity": BASELINE_REPORT_SEVERITY,
+        "timestamp": BASELINE_REPORT_TIMESTAMP,
+        "target": BASELINE_REPORT_TARGET,
+    }
+    report_state.load_baseline_vulnerabilities(BASELINE_RUN_NAME, [baseline_report])
+    report_state.add_vulnerability_report(
+        title=CURRENT_REPORT_TITLE,
+        severity="medium",
+        description="q reflects unencoded input.",
+        target="https://app.example.com",
+    )
+
+    listed = _do_list_reports(
+        severity=None,
+        finding_class=None,
+        target=None,
+        search=None,
+        include_details=False,
+    )
+    baseline_lookup = _do_get_report(BASELINE_REPORT_ID)
+
+    assert listed["total_count"] == 1
+    assert listed["severity_counts"] == {"medium": 1}
+    assert [report["title"] for report in listed["reports"]] == [CURRENT_REPORT_TITLE]
+    assert baseline_lookup["success"] is False
+    assert baseline_lookup["report"] is None
+
+
 def test_list_reports_filter_severity(report_state: ReportState) -> None:
     _seed(report_state)
     result = _do_list_reports(