I wonder if this would be easy to make a map by channel name, e.g.:

fix-channels:
  apply: none
  channels:
    eus:
      apply: auto
      version: > 9

Where this configuration is more-or-less what gets sent to the matchers, e.g.:

type FixChannels struct {
  Apply FixChannelEnabled
  Channels map[string]FixChannel
}

... in some future state where a matcher does something like:

for channel in select_applicable_channels() {
  if fixChannels.enabled(channel) {
    // select some things from the special channel records
  }
}

... or should the initial configuration not even have redhat, only a global apply option?

I think we agreed that each Result should reference a single Vulnerability to avoid cases where there are different match details that get merged together, is that right?

we did agree, but the main bug was to ensure that the merge function correctly reasoned about these details (which was fixed). I held off incorporating the data shape changes for a few of reasons:

1. this has been tested to show it's working as we'd expect
2. further changes to the Result struct should probably be guided by what we want to do with match details and if we want criteria to take their place in the result struct
3. I though you suggested to hold off on incorporating changes to the Result object based on your prototyping (maybe I misunderstood?)