From 9eb3199d10a780543bb4e5dfe5e766d2b4b0e995 Mon Sep 17 00:00:00 2001 From: Alex Schapiro Date: Fri, 4 Sep 2026 20:24:25 +0000 Subject: [PATCH] fix(reporting): reject unpersisted findings --- strix/report/state.py | 6 +++--- tests/test_reporting_fields.py | 18 ++++++++++++++++++ 2 files changed, 21 insertions(+), 3 deletions(-) diff --git a/strix/report/state.py b/strix/report/state.py index 8452c602..2885a74d 100644 --- a/strix/report/state.py +++ b/strix/report/state.py @@ -407,14 +407,14 @@ class ReportState: if agent_name: report["agent_name"] = agent_name + if self.vulnerability_found_callback: + self.vulnerability_found_callback(report) + self.vulnerability_reports.append(report) logger.info(f"Added vulnerability report: {report_id} - {title}") posthog.finding(severity, cwe=cwe, is_cve=bool(cve)) scarf.finding(severity, cwe=cwe, is_cve=bool(cve)) - if self.vulnerability_found_callback: - self.vulnerability_found_callback(report) - self.save_run_data() return report_id diff --git a/tests/test_reporting_fields.py b/tests/test_reporting_fields.py index 3ac27262..872bdc0e 100644 --- a/tests/test_reporting_fields.py +++ b/tests/test_reporting_fields.py @@ -131,6 +131,24 @@ async def test_create_report_persists_new_fields(report_state: ReportState) -> N assert report["http_exchange_ids"] == ["1042", "1088"] +def test_create_report_does_not_commit_when_callback_fails( + report_state: ReportState, +) -> None: + def fail_persistence(_report: dict[str, Any]) -> None: + raise RuntimeError("persistence failed") + + report_state.vulnerability_found_callback = fail_persistence + + with pytest.raises(RuntimeError, match="persistence failed"): + report_state.add_vulnerability_report( + title="Unstored finding", + severity="high", + http_exchange_ids=["1042"], + ) + + assert report_state.vulnerability_reports == [] + + async def test_create_report_requires_evidence_and_assumptions( report_state: ReportState, ) -> None: