ARGUS WordPress Defence 7.23.0

Real changes since 1.0.0, all live-verified before this release:

- Firewall: rule corpus expanded 19 -> 43 rules, real OWASP-CRS-equivalent
  coverage (XXE, SSRF, session fixation, Log4Shell/JNDI, scanner-tool
  detection, deeper SQL injection/XSS/PHP-injection).
- Fixed a real bug: a quarantined file's severity badge and its content
  analysis score could disagree with no explanation (e.g. a benign file
  showing CRITICAL next to Score 0); both are now derived consistently
  and shown together.
- ARGUS now always keeps itself updated, and can optionally do the same
  for every other installed plugin and theme (Settings, on by default) --
  uses WordPress's own native update system, nothing custom.
- Global Threat Intelligence is now opt-in, not automatic -- a single
  click on its own page, with an honest, specific description of exactly
  what's shared (an IP address, a reason code, a confidence score, a
  country). Previously connected automatically on activation.
- New first-run Welcome screen after activation: confirms what's already
  protecting the site, and surfaces the few real optional choices in one
  place.
- Dashboard: running version now visible in the header; new "IPs
  Tracked" and "ANIS Protections" metrics.
- Full WordPress.org Plugin Directory readiness audit performed against
  this codebase. Two real compliance issues found and fixed (see above:
  Global Threat Intelligence's default, and the self-update mechanism,
  which is excluded from this build entirely -- WordPress.org prohibits
  a plugin from using any update channel other than its own, even an
  inert one). This release is still self-distributed, not a WordPress.org
  submission -- that remains a future step.

Verified before publishing: this exact ZIP was installed, activated (14
admin pages loaded clean, zero PHP errors/warnings), and uninstalled
(zero leftover database tables or options) in a fresh, disposable
WordPress + MySQL environment.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

includes/class-argus-quarantine.php

@@ -88,6 +88,15 @@ class Argus_Quarantine {
 
 		$now = current_time( 'mysql', true );
 
+		// Detection engines that already ran a content-based heuristic score
+		// (e.g. Argus_Malware_Scanner::score_content()) can pass it through here
+		// so the quarantine row never sits with a severity label and no
+		// supporting analysis data behind it -- 'severity' is the rule's
+		// verdict, 'content_score'/'matched_rules' are the raw evidence for it,
+		// and they must always be inserted together, not one now and one later
+		// via a separate manual Analyse click.
+		$has_content_score = isset( $detection['content_score'] );
+
 		$wpdb->insert(
 			Argus_DB::table( 'quarantine' ),
 			array(
@@ -102,10 +111,13 @@ class Argus_Quarantine {
 				'detection_rule'      => $detection['rule'] ?? null,
 				'detection_type'      => $detection['type'],
 				'severity'            => $detection['severity'],
+				'confidence_score'    => $has_content_score ? (int) $detection['content_score'] : null,
+				'matched_rules'       => ! empty( $detection['matched_rules'] ) ? wp_json_encode( $detection['matched_rules'] ) : null,
+				'analysed_at'         => $has_content_score ? $now : null,
 				'status'              => self::STATUS_QUARANTINED,
 				'quarantined_at'      => $now,
 			),
-			array( '%s', '%s', '%s', '%d', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s' )
+			array( '%s', '%s', '%s', '%d', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%d', '%s', '%s', '%s', '%s' )
 		);
 
 		$id = (int) $wpdb->insert_id;