reporting: surface contextual CVSS in the markdown report; require reasoning only for surviving metrics

strix/report/writer.py

@@ -215,6 +215,14 @@ def render_vulnerability_md(report: dict[str, Any]) -> str:  # noqa: PLR0912, PL
     cvss = report.get("cvss")
     if cvss is not None:
         metadata.append(("CVSS", cvss))
+    contextual_metrics = dep_meta.get("contextual_cvss_metrics")
+    if isinstance(contextual_metrics, dict) and contextual_metrics:
+        metadata.append(
+            (
+                "Contextual CVSS Metrics",
+                "/".join(f"{metric}:{value}" for metric, value in contextual_metrics.items()),
+            )
+        )
     if report.get("fix_effort"):
         metadata.append(("Fix Effort", str(report["fix_effort"]).title()))
     for label, value in metadata:
@@ -241,6 +249,11 @@ def render_vulnerability_md(report: dict[str, Any]) -> str:  # noqa: PLR0912, PL
         lines.append(str(report["technical_analysis"]))
         lines.append("")
 
+    if dep_meta.get("contextual_cvss_reasoning"):
+        lines.append("## Contextual CVSS\n")
+        lines.append(str(dep_meta["contextual_cvss_reasoning"]))
+        lines.append("")
+
     if report.get("poc_description") or report.get("poc_script_code"):
         lines.append("## Proof of Concept\n")
         if report.get("poc_description"):

strix/tools/reporting/tool.py

@@ -948,7 +948,9 @@ async def _do_create_dependency(  # noqa: PLR0912
             "govulncheck call path). Never claim a reachability level without evidence."
         )
 
-    if contextual_cvss_metrics and not (contextual_cvss_reasoning or "").strip():
+    if _clean_contextual_cvss_metrics(contextual_cvss_metrics) and not (
+        contextual_cvss_reasoning or ""
+    ).strip():
         errors.append(
             "contextual_cvss_reasoning is required when contextual_cvss_metrics is set: "
             "state in one or two sentences what you observed in this codebase that "