fix(report): omit SARIF provenance for multiple repos

strix/report/state.py

@@ -438,15 +438,23 @@ class ReportState:
         targets = self.run_record.get("targets_info") or []
         if not isinstance(targets, list):
             return None
-        for target in targets:
+        repo_targets = [
-            if not isinstance(target, dict) or target.get("type") != "repository":
+            target
-                continue
+            for target in targets
+            if isinstance(target, dict) and target.get("type") == "repository"
+        ]
+        # Provenance binds the whole run to one repo; with multiple repo targets
+        # that's ambiguous, so omit it rather than mis-attributing later repos'
+        # findings to the first repo's URI/commit.
+        if len(repo_targets) != 1:
+            return None
+        target = repo_targets[0]
         details = target.get("details") or {}
         if not isinstance(details, dict):
-                continue
+            return None
         uri = details.get("target_repo")
         if not isinstance(uri, str) or not uri.strip():
-                continue
+            return None
 
         context: dict[str, Any] = {"repositoryUri": uri.strip()}
         full_name = _parse_repo_full_name(uri)
@@ -461,7 +469,6 @@ class ReportState:
                 context["branch"] = branch
                 context["ref"] = f"refs/heads/{branch}"
         return context
-        return None
 
     def _sync_llm_usage_record(self) -> None:
         self.run_record["llm_usage"] = self._build_llm_usage_record()

tests/test_state_repo_context.py

@@ -41,6 +41,15 @@ def test_repository_context_uri_only_without_clone() -> None:
     }
 
 
+def test_repository_context_none_for_multiple_repository_targets() -> None:
+    state = ReportState(run_name="t")
+    state.run_record["targets_info"] = [
+        {"type": "repository", "details": {"target_repo": "https://github.com/acme/widget"}},
+        {"type": "repository", "details": {"target_repo": "https://github.com/acme/api"}},
+    ]
+    assert state._sarif_repository_context() is None
+
+
 def test_repository_context_derives_commit_and_branch_from_clone(tmp_path: Path) -> None:
     repo = tmp_path / "widget"
     repo.mkdir()