Attacker gains five denormalized cache fields (ipv6_leak_count, last_ipv6_leak_at, last_ipv6_link_local, last_ipv6_iid_kind, last_ipv6_mac_oui) mirroring the rotation_count/last_rotation_at pattern. AttackerIdentity gains ipv6_link_local_iids (JSON list[dict]) for EUI-64-derived MAC cluster signals that survive VPN/IP rotation. No ALTER TABLE helpers — direct SQLModel column additions per pre-v1 policy.
7.0 KiB
7.0 KiB