fix: calibrate vulnerability severity to demonstrated impact

[bearsyankees]

Summary

• require reporting agents to tie every non-None CVSS impact metric to demonstrated evidence
• distinguish restricted-data disclosure from reconnaissance-only metadata
• recalibrate information-disclosure guidance for source maps, internal identifiers, versions, and public client data
• map zero-impact CVSS results to info
• reject CVSS calculation failures instead of fabricating a 7.5/High result

Why

Network reachability, lack of authentication, and reconnaissance value can inflate otherwise low-value observations to Medium when they are incorrectly treated as confidentiality impact. CVSS impact metrics should describe the direct, reasonable consequence demonstrated by the proof of concept, not a hypothetical downstream chain.

This change applies a general evidence-based reporting gate rather than special-casing particular domains or findings.

Validation

• uv run ruff check strix/tools/reporting/tool.py tests/test_reporting_tool.py
• uv run mypy strix/tools/reporting/tool.py
• uv run pytest -q tests/test_reporting_tool.py — 2 passed

The full suite passed before rebasing onto the latest upstream main (99 passed). On the post-rebase run, an unrelated long-running test did not complete promptly and was stopped; no failure was reported.

[greptile-apps]

Greptile Summary

The PR recalibrates vulnerability reporting around demonstrated impact and makes CVSS calculation failures reject reports rather than fabricate a High score.

• Adds evidence-based impact guidance to the agent prompt, information-disclosure skill, and reporting tool.
• Maps zero-impact CVSS vectors to informational severity.
• Adds focused tests for zero-impact scoring and calculation failure.

Confidence Score: 4/5

The contradictory CVSS instructions should be reconciled before merging because they can preserve the reconnaissance-driven severity inflation this PR intends to eliminate.

The reporting tool simultaneously requires C:N for reconnaissance-only evidence and instructs agents to assign C:L to account, domain, or version enumeration, which can produce persisted Medium findings without restricted-data disclosure.

Files Needing Attention: strix/tools/reporting/tool.py

Important Files Changed

Filename	Overview
strix/tools/reporting/tool.py	Adds stricter CVSS calculation and evidence guidance, but leaves a contradictory enumeration-as-C:L instruction in the same tool description.
strix/agents/prompts/system_prompt.jinja	Adds prompt-level requirements tying impact metrics and scope changes to demonstrated evidence.
strix/skills/vulnerabilities/information_disclosure.md	Recalibrates information-disclosure triage toward restricted-data access and validated consequences.
tests/test_reporting_tool.py	Covers zero-impact informational scoring and rejection when CVSS calculation raises.

Prompt To Fix All With AI

### Issue 1
strix/tools/reporting/tool.py:465-468
**Conflicting enumeration impact guidance**

When a reporting agent evaluates account, domain, or software-version enumeration, the later instruction classifies it as `C:L` despite the new requirement that reconnaissance without restricted-data access use `C:N`, causing the observation to be persisted as a Medium finding instead of informational.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix: calibrate vulnerability severity to..." | Re-trigger Greptile}