ARGUS WordPress Defence 7.23.0

Real changes since 1.0.0, all live-verified before this release:

- Firewall: rule corpus expanded 19 -> 43 rules, real OWASP-CRS-equivalent
  coverage (XXE, SSRF, session fixation, Log4Shell/JNDI, scanner-tool
  detection, deeper SQL injection/XSS/PHP-injection).
- Fixed a real bug: a quarantined file's severity badge and its content
  analysis score could disagree with no explanation (e.g. a benign file
  showing CRITICAL next to Score 0); both are now derived consistently
  and shown together.
- ARGUS now always keeps itself updated, and can optionally do the same
  for every other installed plugin and theme (Settings, on by default) --
  uses WordPress's own native update system, nothing custom.
- Global Threat Intelligence is now opt-in, not automatic -- a single
  click on its own page, with an honest, specific description of exactly
  what's shared (an IP address, a reason code, a confidence score, a
  country). Previously connected automatically on activation.
- New first-run Welcome screen after activation: confirms what's already
  protecting the site, and surfaces the few real optional choices in one
  place.
- Dashboard: running version now visible in the header; new "IPs
  Tracked" and "ANIS Protections" metrics.
- Full WordPress.org Plugin Directory readiness audit performed against
  this codebase. Two real compliance issues found and fixed (see above:
  Global Threat Intelligence's default, and the self-update mechanism,
  which is excluded from this build entirely -- WordPress.org prohibits
  a plugin from using any update channel other than its own, even an
  inert one). This release is still self-distributed, not a WordPress.org
  submission -- that remains a future step.

Verified before publishing: this exact ZIP was installed, activated (14
admin pages loaded clean, zero PHP errors/warnings), and uninstalled
(zero leftover database tables or options) in a fresh, disposable
WordPress + MySQL environment.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

includes/class-argus-plugin.php

@@ -19,6 +19,13 @@ class Argus_Plugin {
 		Argus_DB::maybe_upgrade();
 		Argus_MU_Installer::ensure_current();
 
+		// Premium-build-only (see includes/class-argus-license.php's own
+		// header) -- covers sites that were already active before this
+		// existed, same idempotent-ensure pattern as Argus_MU_Installer above.
+		if ( class_exists( 'Argus_License' ) ) {
+			Argus_License::ensure_trial_started();
+		}
+
 		add_filter( 'cron_schedules', array( __CLASS__, 'register_cron_schedules' ) ); // phpcs:ignore WordPress.WP.CronInterval
 
 		Argus_Login_Guard::init();
@@ -37,7 +44,16 @@ class Argus_Plugin {
 		add_action( 'argus_wpd_five_minutes', array( 'Argus_ANIS_Client', 'maybe_retry_sync' ) );
 		add_action( 'argus_wpd_five_minutes', array( 'Argus_Vuln_Intel', 'maybe_retry' ) );
 
-		add_action( 'argus_wpd_five_minutes', array( 'Argus_Update_Client', 'maybe_check' ) );
+		// Argus_Update_Client is deliberately excluded from the WordPress.org-
+		// distributed build (bin/build-release.sh) -- a plugin hosted on
+		// WordPress.org must rely solely on WordPress.org's own update
+		// channel, never a self-update-from-external-manifest mechanism, even
+		// an inert-by-default one. class_exists() guards it everywhere it's
+		// referenced so the rest of the plugin degrades cleanly when the file
+		// is absent, rather than the packaging step needing to also edit code.
+		if ( class_exists( 'Argus_Update_Client' ) ) {
+			add_action( 'argus_wpd_five_minutes', array( 'Argus_Update_Client', 'maybe_check' ) );
+		}
 
 		if ( class_exists( 'Argus_Integrity' ) ) {
 			add_action( 'upgrader_process_complete', array( 'Argus_Integrity', 'on_upgrader_complete' ), 10, 2 );