Two independent, disagreeing implementations of the same risk-scoring logic

[squid-protocol]

File: security_lens.py vs signal_processor.py
Labels: bug, tech-debt, priority:high
SecurityLens.evaluate_risk() — with its own policy thresholds and network-centrality multipliers — is fully implemented but never called anywhere in the codebase (verified via grep across all 21 files). The actual risk scoring for the same five categories (logic_bomb, injection_surface, memory_corruption, secrets_risk, malware density) is separately implemented in signal_processor.py's calc* methods, with different math.
Impact: whichever of these two implementations is "correct" is ambiguous, and the dead one will silently drift out of sync with schema/policy changes made to the live one.
Fix: delete evaluate_risk() or make it the actual source of truth; don't maintain both.

[squid-protocol]

Resolved by #302, #303, #304

Root cause (refined from the original report): SecurityLens.evaluate_risk() was not dead code — it was live, called from supply_chain_firewall.py's run_firewall_audit() (Phase 10 of the pipeline), independently of SignalProcessor's _calc_logic_bomb / _calc_injection_surface / _calc_memory_corruption / _calc_secrets_risk / _calc_obscured_payload (used everywhere else — main risk vector, SARIF export, CI/CD policy gate). So this was two live, disagreeing implementations of the same five categories, not one dead copy and one live one. Worth flagging for anyone who trusted the original "verified via grep across all 21 files" — that grep missed supply_chain_firewall.py.

Also surfaced in the process: the firewall's network-centrality multiplier had silently been a no-op in production the whole time. It read file_node.get("dependency_network", {}), a key nothing in the codebase ever wrote. Real network metrics live at telemetry.network_metrics.

Fix, landed across three PRs:

#302 — Wires supply_chain_firewall.py to read SignalProcessor's already-computed risk_vector (via RISK_SCHEMA index lookup) instead of recomputing its own score from raw hit counts. SignalProcessor is now the single source of truth for all five categories, everywhere in the pipeline.
#303 — Removes the now-dead evaluate_risk(), SecurityLens.policy, and the ThreatPolicy paranoid/baseline plumbing that existed solely to feed it — it duplicated SignalProcessor.is_paranoid, which is driven by the same PARANOID_MODE config flag.
#304 — Properly implements network-centrality weighting (fixing the dead-key bug above), shipped as opt-in rather than silently reviving previously-inert behavior as a side effect of the refactor.