The SecurityLens's granular counts (sec_tainted_injection, sec_db_hooks, sec_bitwise_ops, …) reach the audit JSON's equations but are not persisted to the scan DB's file_data, so the temporal-crucible program (gitgalaxy#2982) cannot correlate them with CVE ground truth the way it does the ~50 registry signals (which ARE columns). Adding them as columns (the risk_cols pattern, record_keeper.py:189) makes 25 years of security events queryable against the security lens itself — e.g. do injection-CWE files carry elevated sec_tainted_injection before the event. Additive schema change; existing DBs unaffected (new columns default).
The SecurityLens's granular counts (sec_tainted_injection, sec_db_hooks, sec_bitwise_ops, …) reach the audit JSON's equations but are not persisted to the scan DB's file_data, so the temporal-crucible program (gitgalaxy#2982) cannot correlate them with CVE ground truth the way it does the ~50 registry signals (which ARE columns). Adding them as columns (the risk_cols pattern, record_keeper.py:189) makes 25 years of security events queryable against the security lens itself — e.g. do injection-CWE files carry elevated sec_tainted_injection before the event. Additive schema change; existing DBs unaffected (new columns default).