@anonympins/fingerprint 0.6.3 → 0.6.5

package/src/js/redis-store.js

@@ -111,5 +111,18 @@ export function createRedisStore(redisClient) {
         triggerFallback();
       }
     },
+    async clear() {
+      localStore.clear();
+      for (const timeout of localTimeouts.values()) {
+        clearTimeout(timeout);
+      }
+      localTimeouts.clear();
+      if (isDown) return;
+      try {
+        await redisClient.flushdb();
+      } catch (e) {
+        triggerFallback();
+      }
+    }
   };
 }

package/src/js/sql-store.js

@@ -1,78 +1,81 @@
-/**
- * @file Creates a store adapter for Knex.js.
- * This adapter is compatible with various SQL databases like PostgreSQL, MySQL, and SQLite.
- * It handles serialization of complex objects and TTL for automatic data expiration.
- */
-
-/**
- * Creates a store adapter for a Knex.js client.
- *
- * **Note:** You must create the table yourself before using the store.
- * The table should have at least the following columns:
- * - `key` (string, primary key)
- * - `value` (text or json/jsonb)
- * - `expiresAt` (datetime or timestamp with time zone)
- *
- * Example schema for PostgreSQL:
- * ```sql
- * CREATE TABLE your_table_name (
- *   "key" VARCHAR(255) PRIMARY KEY,
- *   "value" TEXT NOT NULL,
- *   "expiresAt" TIMESTAMPTZ
- * );
- * ```
- *
- * @param {import('knex').Knex} knex - An instance of the Knex client.
- * @param {string} [tableName='fingerprint_store'] - The name of the table to use.
- * @returns {import('./fingerprint.js').IStore} An object that complies with the IStore interface.
- */
-export function createSqlStore(knex, tableName = 'fingerprint_store') {
-  // Custom replacer/reviver to handle Set serialization, similar to the Redis store.
-  const replacer = (k, v) => (v instanceof Set ? Array.from(v) : v);
-  const reviver = (k, v) => (k === 'ips' && Array.isArray(v) ? new Set(v) : v);
-
-  return {
-    async get(key) {
-      const row = await knex(tableName).where('key', key).first();
-      if (!row) return null;
-
-      // Manually check for expiration, as not all SQL databases have automatic TTL cleanup.
-      if (row.expiresAt && new Date(row.expiresAt) < new Date()) {
-        await this.delete(key); // Clean up expired key.
-        return null;
-      }
-
-      try {
-        return JSON.parse(row.value, reviver);
-      } catch (e) {
-        // In case of malformed JSON, treat it as a miss.
-        return null;
-      }
-    },
-
-    async set(key, value, ttl) {
-      const stringValue = JSON.stringify(value, replacer);
-      const expiresAt = ttl ? new Date(Date.now() + ttl * 1000) : null;
-
-      // Use native upsert capabilities of Knex for different SQL dialects.
-      await knex(tableName)
-        .insert({ key, value: stringValue, expiresAt })
-        .onConflict('key')
-        .merge();
-    },
-
-    async has(key) {
-      const row = await knex(tableName).where('key', key).first('key');
-      if (!row) return false;
-      // Also check for expiration here.
-      if (row.expiresAt && new Date(row.expiresAt) < new Date()) {
-        return false;
-      }
-      return true;
-    },
-
-    async delete(key) {
-      await knex(tableName).where('key', key).del();
-    },
-  };
+/**
+ * @file Creates a store adapter for Knex.js.
+ * This adapter is compatible with various SQL databases like PostgreSQL, MySQL, and SQLite.
+ * It handles serialization of complex objects and TTL for automatic data expiration.
+ */
+
+/**
+ * Creates a store adapter for a Knex.js client.
+ *
+ * **Note:** You must create the table yourself before using the store.
+ * The table should have at least the following columns:
+ * - `key` (string, primary key)
+ * - `value` (text or json/jsonb)
+ * - `expiresAt` (datetime or timestamp with time zone)
+ *
+ * Example schema for PostgreSQL:
+ * ```sql
+ * CREATE TABLE your_table_name (
+ *   "key" VARCHAR(255) PRIMARY KEY,
+ *   "value" TEXT NOT NULL,
+ *   "expiresAt" TIMESTAMPTZ
+ * );
+ * ```
+ *
+ * @param {import('knex').Knex} knex - An instance of the Knex client.
+ * @param {string} [tableName='fingerprint_store'] - The name of the table to use.
+ * @returns {import('./fingerprint.js').IStore} An object that complies with the IStore interface.
+ */
+export function createSqlStore(knex, tableName = 'fingerprint_store') {
+  // Custom replacer/reviver to handle Set serialization, similar to the Redis store.
+  const replacer = (k, v) => (v instanceof Set ? Array.from(v) : v);
+  const reviver = (k, v) => (k === 'ips' && Array.isArray(v) ? new Set(v) : v);
+
+  return {
+    async get(key) {
+      const row = await knex(tableName).where('key', key).first();
+      if (!row) return null;
+
+      // Manually check for expiration, as not all SQL databases have automatic TTL cleanup.
+      if (row.expiresAt && new Date(row.expiresAt) < new Date()) {
+        await this.delete(key); // Clean up expired key.
+        return null;
+      }
+
+      try {
+        return JSON.parse(row.value, reviver);
+      } catch (e) {
+        // In case of malformed JSON, treat it as a miss.
+        return null;
+      }
+    },
+
+    async set(key, value, ttl) {
+      const stringValue = JSON.stringify(value, replacer);
+      const expiresAt = ttl ? new Date(Date.now() + ttl * 1000) : null;
+
+      // Use native upsert capabilities of Knex for different SQL dialects.
+      await knex(tableName)
+        .insert({ key, value: stringValue, expiresAt })
+        .onConflict('key')
+        .merge();
+    },
+
+    async has(key) {
+      const row = await knex(tableName).where('key', key).first('key');
+      if (!row) return false;
+      // Also check for expiration here.
+      if (row.expiresAt && new Date(row.expiresAt) < new Date()) {
+        return false;
+      }
+      return true;
+    },
+
+    async delete(key) {
+      await knex(tableName).where('key', key).del();
+    },
+    async clear() {
+      await knex(tableName).del();
+    }
+  };
 }

package/src/js/tests/fingerprint.engine.test.js

@@ -92,8 +92,7 @@ describe('FingerprintEngine Challenge Validation', () => {
 
         // The client solves the challenge
         // --- FIX: Simulate the client creating the baseBlock for the solver ---
-        const messageBase = `${nonce}:${challengeContext.clientSecret}:fingerprint-A:`;
-        const baseBlock = new TextEncoder().encode(messageBase);
+        const baseBlock = new Uint8Array(challengeContext.baseBlock);
 
         const cpuSolution = await solveCpuTargetInline(baseBlock, cpuTarget, null);
         // The memory challenge seed does not include the fingerprint.
@@ -153,7 +152,7 @@ describe('FingerprintEngine Challenge Validation', () => {
         // --- 2. Second request: Solution is submitted from "Machine B" ---
         // --- FIX: Simulate the client creating the baseBlock for the solver ---
         // The solver uses the fingerprint of the machine it's running on.
-        const messageBase = `${nonce}:${challengeContext.clientSecret}:fingerprint-B:`;
+        const messageBase = `${nonce}:${challengeContext.clientSecret}:fingerprint-B:127.0.0.1::`;
         const baseBlock = new TextEncoder().encode(messageBase);
 
         const cpuSolution = await solveCpuTargetInline(baseBlock, cpuTarget, null);

package/src/js/tests/fingerprint.test.js

@@ -739,7 +739,7 @@ describe('Fingerprint & PoW Security Suite', () => {
             const memDifficulty = parseInt(challengeBody.match(/const memDifficulty = (\d+)/)[1], 10);
 
             // The client constructs the base block and solves the challenge
-            const baseBlock = new TextEncoder().encode(`${nonce}:${clientSecret}:${solverFingerprint}:`);
+            const baseBlock = new TextEncoder().encode(`${nonce}:${clientSecret}:${solverFingerprint}:${ip}::`);
             const cpuSolution = await solveCpuTargetInline(baseBlock, cpuTargetHex, () => {});
             const memSolution = await solveMemory(`:${nonce}:${clientSecret}`, memDifficulty);
 
@@ -821,7 +821,7 @@ describe('Fingerprint & PoW Security Suite', () => {
             const memDifficulty = parseInt(challengeBody.match(/const memDifficulty = (\d+)/)[1], 10);
 
             // The server stores the challenge context. We need to ensure the `baseBlock` is present for verification.
-            const baseBlock = new TextEncoder().encode(`${nonce}:${clientSecret}:${solverFingerprint}:`);
+            const baseBlock = new TextEncoder().encode(`${nonce}:${clientSecret}:${solverFingerprint}:${ip}::`);
             await inMemoryStore.set(`secret:${nonce}`, {
                 clientSecret: clientSecret,
                 cpuTarget: cpuTargetHex,

package/src/js/tests/gpu_pow.test.js

@@ -27,7 +27,7 @@ describe('GpuPowSolver - Chaotic Logistic Map PoW', () => {
         const solutions = [];
 
         for (let idx = 0; idx < 64; idx++) {
-            let x = Math.fround(numericSeed + idx * 0.015);
+            let x = Math.fround((numericSeed + idx * 0.015) % 1); // Ensure x starts in [0, 1)
             for (let i = 0; i < iterations; i++) {
                 x = Math.fround(rFloat * x * Math.fround(1.0 - x));
             }
@@ -53,19 +53,21 @@ describe('GpuPowSolver - Chaotic Logistic Map PoW', () => {
         const solutions = [];
 
         for (let idx = 0; idx < 64; idx++) {
-            let x = Math.fround(numericSeed + idx * 0.015);
+            let x = Math.fround((numericSeed + idx * 0.015) % 1); // Ensure x starts in [0, 1)
             for (let i = 0; i < iterations; i++) {
                 x = Math.fround(rFloat * x * Math.fround(1.0 - x));
             }
             solutions.push(x.toFixed(6));
         }
 
-        // Tamper with the 12th channel (one of the default sample indices [0, 12, 35, 57])
+        // Tamper with one of the dynamically derived sample indices
+        const sampleIndices = GpuPowSolver.deriveSampleIndices('127.0.0.1', 'gpu-pow-salt');
+        const tamperedIndex = sampleIndices[0];
         const tamperedSolutions = [...solutions];
-        const originalVal = parseFloat(tamperedSolutions[12]);
-        tamperedSolutions[12] = (originalVal + 0.0002).toFixed(6); // exceeding 1e-4 tolerance
-
-        expect(GpuPowSolver.verify(seed, iterations, tamperedSolutions.join(','))).toBe(false);
+        const originalVal = parseFloat(tamperedSolutions[tamperedIndex]);
+        tamperedSolutions[tamperedIndex] = (originalVal + 0.1).toFixed(6); // exceeding tolerance
+        const verificationResult = GpuPowSolver.verify(seed, iterations, tamperedSolutions.join(','), '127.0.0.1', 'gpu-pow-salt');
+        expect(verificationResult).toBe(false);
     });
 
     it('should fallback to WebGL2 if WebGPU is not supported', async () => {

package/src/php/AutoTuner.php

@@ -53,6 +53,47 @@ class AutoTuner
         $this->onCleanup = $options['onCleanup'] ?? null;
         $this->savePath = $options['savePath'] ?? null;
         $this->validationTolerance = $options['validationTolerance'] ?? 0.15;
+
+        if (isset($this->securityConfig['logger']) && is_callable($this->securityConfig['logger']) && !isset($this->securityConfig['logger_wrapped'])) {
+            $originalLogger = $this->securityConfig['logger'];
+            $maxPercentage = $this->securityConfig['autotuning']['maxDensityPercentage'] ?? 0.02;
+
+            $this->securityConfig['logger'] = function (array $log) use ($originalLogger, $maxPercentage) {
+                $ip = $log['clientIp'] ?? $log['ip'] ?? null;
+                $subnet = $ip ? RequestUtils::getIpSubnet($ip, 24, 48) : null;
+                $fp = $log['deviceHash'] ?? $log['fingerprint'] ?? $log['deviceFingerprint'] ?? null;
+                $stableFp = $fp ? RequestUtils::extractStablePart($fp) : null;
+
+                if (count($this->trafficData) > 0) {
+                    $total = count($this->trafficData);
+                    $ipMatchCount = 0;
+                    $fpMatchCount = 0;
+                    $matchedKey = null;
+
+                    foreach ($this->trafficData as $key => $existingLog) {
+                        $logIp = $existingLog['clientIp'] ?? $existingLog['ip'] ?? null;
+                        $logSubnet = $logIp ? RequestUtils::getIpSubnet($logIp, 24, 48) : null;
+                        $logFp = $existingLog['deviceHash'] ?? $existingLog['fingerprint'] ?? $existingLog['deviceFingerprint'] ?? null;
+                        $logStableFp = $logFp ? RequestUtils::extractStablePart($logFp) : null;
+
+                        $isIpMatch = $subnet && $logSubnet === $subnet;
+                        $isFpMatch = $stableFp && $logStableFp === $stableFp;
+                        if ($isIpMatch) $ipMatchCount++;
+                        if ($isFpMatch) $fpMatchCount++;
+                        if ($isIpMatch || $isFpMatch) $matchedKey = $key;
+                    }
+                    if (($subnet && ($ipMatchCount / $total) > $maxPercentage) || ($stableFp && ($fpMatchCount / $total) > $maxPercentage)) {
+                        if ($matchedKey !== null) {
+                            $this->trafficData[$matchedKey]['instancesCount'] = ($this->trafficData[$matchedKey]['instancesCount'] ?? 1) + 1;
+                            $this->trafficData[$matchedKey]['weight'] = ($this->trafficData[$matchedKey]['weight'] ?? 1.0) + 1.0;
+                        }
+                        return;
+                    }
+                }
+                $originalLogger($log);
+            };
+            $this->securityConfig['logger_wrapped'] = true;
+        }
     }
 
     /**

package/src/php/Challenge/ChallengeUtils.php

@@ -32,12 +32,33 @@ class ChallengeUtils
         return abs($hash % 1000000) / 1000000;
     }
 
-    public static function verifyGpuPow(string $seed, int $iterations, string $solution, array $sampleIndices = [0, 12, 35, 57]): bool
+    public static function deriveSampleIndices(string $clientIp, string $secret): array
+    {
+        $timeWindow = (int)floor(time() / (60 * 5));
+        $message = "{$clientIp}:{$timeWindow}";
+        $hmacHex = hash_hmac('sha256', $message, $secret ?: 'gpu-pow-salt');
+        $hmacBytes = array_values(unpack('C*', hex2bin($hmacHex)));
+
+        $indices = [];
+        for ($i = 0; $i < 4; $i++) {
+            $offset = ($i * 2) % count($hmacBytes);
+            $value = ($hmacBytes[$offset] << 8) | $hmacBytes[($offset + 1) % count($hmacBytes)];
+            $idx = $value % 64;
+            while (in_array($idx, $indices, true)) {
+                $idx = ($idx + 1) % 64;
+            }
+            $indices[] = $idx;
+        }
+        return $indices;
+    }
+
+    public static function verifyGpuPow(string $seed, int $iterations, string $solution, string $clientIp = '127.0.0.1', string $secret = 'gpu-pow-salt'): bool
     {
         $values = explode(',', $solution);
         if (count($values) !== 64) {
             return false;
         }
+        $sampleIndices = self::deriveSampleIndices($clientIp, $secret);
         $numericSeed = self::hashSeedToFloat($seed);
         $r = 3.9999;
         foreach ($sampleIndices as $idx) {
@@ -203,9 +224,22 @@ class ChallengeUtils
                 return ['error' => 'Missing signature'];
             }
 
-            // Ban the ZKP public key for 30 days
-            $store->set("banned-zkp-y:{$zkpY}", true, 86400 * 30);
-            return ['status' => 'synchronized'];
+            $peersKey = "fed-peers:{$zkpY}";
+            $reportedPeers = $store->get($peersKey) ?: [];
+            if (!is_array($reportedPeers)) {
+                $reportedPeers = [];
+            }
+            if (!in_array($clientIp, $reportedPeers, true)) {
+                $reportedPeers[] = $clientIp;
+                $store->set($peersKey, $reportedPeers, 86400 * 30);
+            }
+
+            $threshold = $config['federationConsensusThreshold'] ?? 3;
+            if (count($reportedPeers) >= $threshold) {
+                $store->set("banned-zkp-y:{$zkpY}", true, 86400 * 30);
+                return ['status' => 'synchronized', 'banned' => true];
+            }
+            return ['status' => 'synchronized', 'banned' => false, 'reportsCount' => count($reportedPeers)];
         }
 
         $nodeId = $params['node_id'] ?? '';
@@ -633,14 +667,14 @@ class ChallengeUtils
     /**
      * Crée le bloc de données de base pour le challenge CPU.
      */
-    public static function createCpuChallengeBaseBlock(string $nonce, string $clientSecret, string $fingerprint): string
+    public static function createCpuChallengeBaseBlock(string $nonce, string $clientSecret, string $fingerprint, string $clientIp = '', string $tlsSessionId = ''): string
     {
         $parts = explode('|', $fingerprint);
         $filteredParts = array_filter($parts);
         sort($filteredParts);
         $sortedFingerprint = implode('|', $filteredParts);
         
-        return "{$nonce}:{$clientSecret}:{$sortedFingerprint}:";
+        return "{$nonce}:{$clientSecret}:{$sortedFingerprint}:{$clientIp}:{$tlsSessionId}:";
     }
 
     /**

package/src/php/Config/SecurityProfiles.php

@@ -58,6 +58,7 @@ class SecurityProfiles
                 'decayFactor' => 0.9,
                 'inactivityReset' => 5000,
             ],
+        'filterWhitelist' => 85.0, // Stratégie d'inspection modérée pour les IP/chemins en liste blanche
         'wasm' => true,
         ],
 
@@ -108,6 +109,7 @@ class SecurityProfiles
             ],
             'challengeNewDevices' => true, // Challenge all new devices
         'wasm' => true,
+        'filterWhitelist' => true, // Tout comportement d'attaque certain bypass immédiatement la liste blanche
         ],
 
         /**
@@ -155,6 +157,7 @@ class SecurityProfiles
             ],
             // This would be a callable in PHP, but for now, we represent its intent.
             'isApiRequest' => 'req.path.startsWith("/api/") || req.headers.accept?.includes("application/json")',
+        'filterWhitelist' => 75.0, // Seuil bas pour parer au vol de clés/tokens API légitimes
         'wasm' => true,
         ],
 
@@ -204,6 +207,7 @@ class SecurityProfiles
                 'decayFactor' => 0.92,
                 'inactivityReset' => 10000,
             ],
+        'filterWhitelist' => 90.0, // Très tolérant, n'inspecte que si le score est presque au blocage
         'wasm' => true,
         ],
 
@@ -257,6 +261,7 @@ class SecurityProfiles
             // This would be a callable in PHP, but for now, we represent its intent.
             'isApiRequest' => 'req.path.startsWith("/api/cart") || req.path.startsWith("/api/stock") || req.path.startsWith("/api/checkout")',
         'wasm' => true,
+        'filterWhitelist' => true, // Tolérance zéro pour le scraping / scalping distribué
         ],
     ];
 

package/src/php/FingerprintEngine.php

@@ -237,6 +237,9 @@
          $this->logger = isset($securityConfig['logger']) && is_callable($securityConfig['logger']) ? new Logger($securityConfig['logger']) : null;
          $this->dryRun = $securityConfig['dryRun'] ?? false;
          $this->validateConfig($securityConfig);
+         if ($this->securityConfig['reset'] ?? false) {
+             $this->resetStore();
+         }
      }
 
     /**
@@ -252,6 +255,18 @@
         $this->log('Configuration mise à jour à chaud (Hot-Reloaded)', $this->securityConfig);
     }
 
+    /**
+     * Réinitialise le store de persistance actif.
+     */
+    public function resetStore(): void
+    {
+        $store = StoreManager::getStore();
+        if (method_exists($store, 'clear')) {
+            $store->clear();
+        }
+        $this->log('Store has been reset/cleared.');
+    }
+
      private function validateConfig(array $config): void
      {
          if (empty($config)) {
@@ -266,7 +281,7 @@
              'autotuning', 'enableUsefulWork', 'usefulWorkConfigPath', 'challengeNewDevices', 'graphql_operation_allowlist', 'dryRun',
              'similarityThreshold', 'summary', 'description',
              'ed25519_private_key', 'ed25519_public_key',
-             'wasm', 'enableProofOfSpace', 'pospace', 'federatedPeers', 'federationSecret'
+             'wasm', 'enableProofOfSpace', 'pospace', 'federatedPeers', 'federationSecret', 'reset'
          ];
 
          if (empty($config['weights'])) {
@@ -497,28 +512,50 @@
       */
      private function checkAllowlists(RequestContext $context): bool
      {
+         $whitelisted = false;
+         $type = '';
+
          if ($this->isIpInAllowlist($context->clientIp)) {
-             $this->log('IP in allowlist - allowing request', ['clientIp' => $context->clientIp]);
-             return true;
-         }
-         if ($this->isPathInAllowlist($context->path)) {
-             $this->log('Path in allowlist - allowing request', ['path' => $context->path]);
-             return true;
-         }
-         if ($this->isHostPathInAllowlist($context->getHeader('host'), $context->path)) {
-             $this->log('Host and path in allowlist - allowing request', ['host' => $context->getHeader('host'), 'path' => $context->path]);
-             return true;
-         }
-         // NOUVEAU: Vérifier la liste blanche GraphQL
-         if ($context->graphqlOperation && $this->isGraphqlOperationInAllowlist($context->graphqlOperation['type'], $context->graphqlOperation['name'])) {
-             $this->log('GraphQL operation in allowlist - allowing request', ['operation' => "{$context->graphqlOperation['type']}:{$context->graphqlOperation['name']}"]);
-             return true;
-         }
-         if ($this->verifyWhitelistedBot($context)) {
-             $this->log('Whitelisted bot verified - allowing request', ['clientIp' => $context->clientIp]);
+             $whitelisted = true;
+             $type = 'allowlist';
+         } elseif ($this->isPathInAllowlist($context->path)) {
+             $whitelisted = true;
+             $type = 'path_allowlist';
+         } elseif ($this->isHostPathInAllowlist($context->getHeader('host'), $context->path)) {
+             $whitelisted = true;
+             $type = 'host_path_allowlist';
+         } elseif ($context->graphqlOperation && $this->isGraphqlOperationInAllowlist($context->graphqlOperation['type'], $context->graphqlOperation['name'])) {
+             $whitelisted = true;
+             $type = 'graphql_operation_allowlist';
+         } elseif ($this->verifyWhitelistedBot($context)) {
+             $whitelisted = true;
+             $type = 'bot';
+         }
+
+         if ($whitelisted) {
+             $filterWhitelist = $this->securityConfig['filterWhitelist'] ?? false;
+             $bypassWhitelist = false;
+             if ($filterWhitelist === true) {
+                 $bypassWhitelist = $this->hasCertainAttack($context);
+             } elseif (is_numeric($filterWhitelist)) {
+                 if ($context->preCalculatedScore === null) {
+                     $suspicionVector = [];
+                     $context->preCalculatedVector = $this->getSuspicionVector($context, $suspicionVector);
+                     $context->preCalculatedScore = $this->calculateFinalScore($context->preCalculatedVector);
+                 }
+                 if ($context->preCalculatedScore > $filterWhitelist) {
+                     $bypassWhitelist = true;
+                 }
+             }
+
+             if ($bypassWhitelist) {
+                 $this->log('Whitelisted request exceeds filter threshold - bypassing whitelist bypass', ['clientIp' => $context->clientIp, 'path' => $context->path]);
+                 return false;
+             }
+             $this->log("IP/Path in allowlist ({$type}) - allowing request", ['clientIp' => $context->clientIp, 'path' => $context->path]);
              return true;
          }
- 
+
          return false;
      }
 
@@ -908,6 +945,23 @@
          }
      }
 
+     /**
+      * Évalue si la requête présente des caractéristiques d'attaque flagrantes ou a déclenché un honeypot.
+      */
+     private function hasCertainAttack(RequestContext $context): bool
+     {
+         $honeypotConfig = $this->securityConfig['honeypot'] ?? [];
+         $honeypot = RequestUtils::getHoneypotScore($context, $honeypotConfig);
+         if (($honeypot['honeypotScore'] ?? 0.0) >= 100.0) {
+             return true;
+         }
+         $bot = RequestUtils::getBotScore($context);
+         if (($bot['botScore'] ?? 0.0) >= 100.0) {
+             return true;
+         }
+         return false;
+     }
+
      /**
       * Traite une requête entrante et retourne une décision.
       * @param RequestContext $context Le contexte de la requête.
@@ -1032,6 +1086,28 @@
                                 $problemManager = \Anonympins\Fingerprint\ProblemManager::getInstance($configPath, $store);
                                  // FIX: La solution est directement le $workResult, pas une sous-propriété.
                                  $problemManager->integrateSolution($problemId, $workResult);
+
+                             // Si le problème résolu est l'auto-tuning de sécurité et que l'auto-tuning est activé,
+                             // on applique directement la meilleure solution calculée au moteur en direct.
+                             if ($problemId === 'security_auto_tuning' && ($this->securityConfig['autotuning']['enabled'] ?? false)) {
+                                 $paretoFront = $workResult['paretoFront'] ?? null;
+                                 if (is_array($paretoFront) && !empty($paretoFront)) {
+                                     $bestSolution = $paretoFront[0];
+                                     $minDistance = sqrt(pow((float)$bestSolution['objectives'][0], 2) + pow((float)$bestSolution['objectives'][1], 2));
+                                     for ($i = 1; $i < count($paretoFront); $i++) {
+                                         $distance = sqrt(pow((float)$paretoFront[$i]['objectives'][0], 2) + pow((float)$paretoFront[$i]['objectives'][1], 2));
+                                         if ($distance < $minDistance) {
+                                             $minDistance = $distance;
+                                             $bestSolution = $paretoFront[$i];
+                                         }
+                                     }
+                                     if (isset($bestSolution['solution'])) {
+                                         $this->updateConfig($bestSolution['solution']);
+                                         $this->log('Useful Work auto-tuning applied successfully to live config.');
+                                     }
+                                 }
+                             }
+
                                  $isValid = true;
                                  // FIX: Générer un vrai ticket pour uPoW, comme pour un PoW normal.
                                  $ticketTtl = $this->securityConfig['ticketMaxAge'] ?? 3600000; // 1 heure par défaut
@@ -1113,8 +1189,8 @@
              return $decision;
          }
 
-         $suspicionVector = $this->getSuspicionVector($context, $suspicionVector);
-         $finalScore = $this->calculateFinalScore($suspicionVector);
+         $suspicionVector = $context->preCalculatedVector ?? $this->getSuspicionVector($context, $suspicionVector);
+         $finalScore = $context->preCalculatedScore ?? $this->calculateFinalScore($suspicionVector);
          $this->log('Suspicion vector and final score calculated', [
              'finalScore' => round($finalScore, 2),
              'vector' => $suspicionVector
@@ -1173,10 +1249,21 @@
                  // 1. Valider cryptographiquement la preuve avant de bannir/diffuser
                  if (ChallengeUtils::verifyZkpProof($zkpY, $zkpT, $zkpS)) {
                      // 2. Dédoublonner : Ne diffuser que si la clé n'est pas déjà bannie
-                     if (!$store->has("banned-zkp-y:{$zkpY}")) {
+                     $peersKey = "fed-peers:{$zkpY}";
+                     $reportedPeers = $store->get($peersKey) ?: [];
+                     if (!is_array($reportedPeers)) {
+                         $reportedPeers = [];
+                     }
+                     if (!in_array('local', $reportedPeers, true)) {
+                         $reportedPeers[] = 'local';
+                         $store->set($peersKey, $reportedPeers, 86400 * 30);
+                     }
+
+                     $threshold = $this->securityConfig['federationConsensusThreshold'] ?? 3;
+                     if (count($reportedPeers) >= $threshold) {
                          $store->set("banned-zkp-y:{$zkpY}", true, 86400 * 30);
-                         $this->broadcastBannedZkp($zkpY);
                      }
+                     $this->broadcastBannedZkp($zkpY);
                  }
              }
 
@@ -1354,7 +1441,8 @@
                  $memDifficulty = (int)round($memActivationFactor * 48); // 0 à 48MB
 
                  $originalFingerprint = RequestUtils::getCompositeDeviceHash($context);
-                 $baseBlock = ChallengeUtils::createCpuChallengeBaseBlock($nonce, $clientSecret, $originalFingerprint);
+                 $tlsSessionId = $context->tlsSessionId ?? '';
+                 $baseBlock = ChallengeUtils::createCpuChallengeBaseBlock($nonce, $clientSecret, $originalFingerprint, $context->clientIp, $tlsSessionId);
 
                  $challengeContext = [
                      'clientSecret' => $clientSecret,