@anonympins/fingerprint 0.7.1 → 0.7.3

package/src/php/DirectFingerprint.php

@@ -34,17 +34,25 @@ class DirectFingerprint
     public function protect(): ?array
     {
         // 1. Build request context from PHP superglobals
+        // phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.NonceVerification.Recommended -- Direct WAF inspection firewall before WP core logic
         $body = $_POST ?: json_decode(file_get_contents('php://input'), true);
         $headers = function_exists('getallheaders') ? getallheaders() : [];
 
+        $remoteAddr = isset($_SERVER['REMOTE_ADDR']) ? sanitize_text_field(wp_unslash($_SERVER['REMOTE_ADDR'])) : '127.0.0.1';
+        $rawUri = isset($_SERVER['REQUEST_URI']) ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'])) : '/';
+        // phpcs:ignore WordPress.WP.AlternativeFunctions.parse_url_parse_url -- Uses wp_parse_url when available
+        $path = function_exists('wp_parse_url') ? (string)wp_parse_url($rawUri, PHP_URL_PATH) : (string)parse_url($rawUri, PHP_URL_PATH);
+        $serverProtocol = isset($_SERVER['SERVER_PROTOCOL']) ? sanitize_text_field(wp_unslash($_SERVER['SERVER_PROTOCOL'])) : '1.1';
+
         $context = new RequestContext(
-            $_SERVER['REMOTE_ADDR'] ?? '127.0.0.1',
-            parse_url($_SERVER['REQUEST_URI'] ?? '', PHP_URL_PATH) ?: '/',
+            $remoteAddr,
+            !empty($path) ? $path : '/',
             $headers,
+            // phpcs:ignore WordPress.Security.NonceVerification.Recommended
             $_GET,
             $body,
             $_COOKIE,
-            $_SERVER['SERVER_PROTOCOL'] ?? '1.1'
+            $serverProtocol
         );
 
         // 2. Process request with engine
@@ -62,9 +70,11 @@ class DirectFingerprint
                 http_response_code($decision['status'] ?? 403);
                 if (is_array($decision['body'])) {
                     header('Content-Type: application/json');
+                    // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- JSON API challenge payload
                     echo json_encode($decision['body']);
                 } else {
                     header('Content-Type: text/html; charset=utf-8');
+                    // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Proof-of-Work challenge HTML page
                     echo $decision['body'];
                 }
                 exit();
@@ -152,7 +162,8 @@ class DirectFingerprint
                 switch ($decision['action']) {
                     case 'block':
                         http_response_code($decision['status'] ?? 403);
-                        echo $decision['body'] ?? "Access denied.";
+                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+                        echo esc_html($decision['body'] ?? "Access denied.");
                         exit();
                     case 'redirect':
                         header('Location: ' . $decision['path'], true, $decision['status'] ?? 302);
@@ -176,6 +187,7 @@ class DirectFingerprint
 
         // 3. If authorized, stream metrics output
         header('Content-Type: text/plain; version=0.0.4; charset=utf-8');
+        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Prometheus exposition format output
         echo MetricsManager::getPrometheusMetrics();
         exit();
     }

package/src/php/FingerprintClient.php

@@ -87,7 +87,7 @@ class FingerprintClient
         $containerTags = ['div', 'span', 'p', 'section'];
         $tag = $containerTags[array_rand($containerTags)];
 
-        $nestingType = rand(0, 1);
+        $nestingType = function_exists('wp_rand') ? wp_rand(0, 1) : random_int(0, 1);
         if ($nestingType === 1) {
             return '<' . $tag . ' style="' . $styles . '" aria-hidden="true">'
                 . '<label for="' . htmlspecialchars($fieldName) . '">' . htmlspecialchars($fieldName) 
@@ -113,26 +113,24 @@ class FingerprintClient
         $nonceAttr = $this->nonce ? ' nonce="' . $this->nonce . '"' : '';
 
         // Inline initialization script embedded in HTML
-        $initScript = <<<JS
-document.addEventListener('DOMContentLoaded', function() {
-    const config = {$configJson};
-    if (window.ClientLibrary) {
-        if (config.wasmPath) {
-            const wasmScript = document.createElement('script');
-            wasmScript.src = config.wasmPath;
-            wasmScript.async = true;
-            wasmScript.nonce = '{$this->nonce}';
-            document.head.appendChild(wasmScript);
-        }
-
-        window.ClientLibrary.initializeClient(config);
-    } else {
-        console.error('Fingerprint client library not loaded.');
-    }
-});
-JS;
+        $initScript = "document.addEventListener('DOMContentLoaded', function() {\n"
+            . "    const config = " . $configJson . ";\n"
+            . "    if (window.ClientLibrary) {\n"
+            . "        if (config.wasmPath) {\n"
+            . "            const wasmScript = document.createElement('script');\n"
+            . "            wasmScript.src = config.wasmPath;\n"
+            . "            wasmScript.async = true;\n"
+            . "            wasmScript.nonce = '" . addslashes((string)$this->nonce) . "';\n"
+            . "            document.head.appendChild(wasmScript);\n"
+            . "        }\n"
+            . "        window.ClientLibrary.initializeClient(config);\n"
+            . "    } else {\n"
+            . "        console.error('Fingerprint client library not loaded.');\n"
+            . "    }\n"
+            . "});";
 
         // Combine library loader script and inline initialization
+        // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript -- Polymorphic dynamic client script tag generation
         return '<script src="' . htmlspecialchars($this->clientScriptPath) . '"' . $nonceAttr . '></script>'
             . '<script' . $nonceAttr . '>' . $initScript . '</script>';
     }

package/src/php/FingerprintEngine.php

@@ -127,41 +127,27 @@
          $useAsymmetric = ($securityConfig['useAsymmetricTickets'] ?? false) === true || ($securityConfig['ed25519'] ?? '') === 'auto';
          $envPrivate = Env::get('ED25519_PRIVATE_KEY');
          if ($useAsymmetric && ($envPrivate === null || $envPrivate === '')) {
-             $configDir = dirname(__DIR__, 1) . '/config';
-             $persistentKeyPath = $configDir . '/ed25519_key.json';
-
-             if (file_exists($persistentKeyPath)) {
-                 try {
-                     $keys = json_decode(file_get_contents($persistentKeyPath), true);
-                     if (isset($keys['privateKey'], $keys['publicKey'])) {
-                         Env::set('ED25519_PRIVATE_KEY', $keys['privateKey']);
-                         Env::set('ED25519_PUBLIC_KEY', $keys['publicKey']);
+             if (function_exists('get_option') && function_exists('update_option')) {
+                 // In WordPress, persist cryptographic keys in the database options table
+                 $storedKeys = get_option('fingerprint_ed25519_keys');
+                 if (is_array($storedKeys) && isset($storedKeys['privateKey'], $storedKeys['publicKey'])) {
+                     Env::set('ED25519_PRIVATE_KEY', $storedKeys['privateKey']);
+                     Env::set('ED25519_PUBLIC_KEY', $storedKeys['publicKey']);
+                 } elseif (defined('OPENSSL_KEYTYPE_ED25519')) {
+                     $pkey = openssl_pkey_new(["private_key_type" => OPENSSL_KEYTYPE_ED25519]);
+                     if ($pkey && openssl_pkey_export($pkey, $privateKeyPem)) {
+                         $details = openssl_pkey_get_details($pkey); // @phpstan-ignore-line
+                         $publicKeyPem = $details['key'] ?? ''; // @phpstan-ignore-line
+                         Env::set('ED25519_PRIVATE_KEY', $privateKeyPem);
+                         Env::set('ED25519_PUBLIC_KEY', $publicKeyPem);
+                         update_option('fingerprint_ed25519_keys', [
+                             'privateKey' => $privateKeyPem,
+                             'publicKey'  => $publicKeyPem,
+                         ], false);
                      }
-                 } catch (\Throwable $e) {
-                     error_log('[Fingerprint] Failed to load persistent Ed25519 keys: ' . $e->getMessage());
                  }
              } else {
-                 try {
-                     if (defined('OPENSSL_KEYTYPE_ED25519')) {
-                         $pkey = openssl_pkey_new(["private_key_type" => OPENSSL_KEYTYPE_ED25519]);
-                         if ($pkey && openssl_pkey_export($pkey, $privateKeyPem)) {
-                             $details = openssl_pkey_get_details($pkey); // @phpstan-ignore-line
-                             $publicKeyPem = $details['key']; // @phpstan-ignore-line
-                             Env::set('ED25519_PRIVATE_KEY', $privateKeyPem);
-                             Env::set('ED25519_PUBLIC_KEY', $publicKeyPem);
-                             // Also update $_ENV and $_SERVER for consistency
-                             if (!is_dir($configDir)) {
-                                 mkdir($configDir, 0777, true);
-                             }
-                             file_put_contents($persistentKeyPath, json_encode([
-                                 'privateKey' => $privateKeyPem,
-                                 'publicKey' => $publicKeyPem
-                             ], JSON_PRETTY_PRINT));
-                         }
-                     }
-                 } catch (\Throwable $e) {
-                     error_log('[Fingerprint] Native Ed25519 key generation failed: ' . $e->getMessage());
-                 }
+                 self::initStandaloneEd25519Keys();
              }
          }
 
@@ -175,10 +161,16 @@
                          $securityConfig = SecurityProfiles::deepMerge($securityConfig, $savedConfig);
                      }
                  } catch (\Throwable $e) {
-                     error_log("[FingerprintEngine] Failed to auto-load optimized config from {$savePath}: " . $e->getMessage());
+                     self::logError("[FingerprintEngine] Failed to auto-load optimized config from {$savePath}: " . $e->getMessage());
                  }
              }
          }
+
+         // Si aucune liste blanche n'est explicitement fournie, appliquer la liste par défaut.
+         if (!isset($securityConfig['whitelist'])) {
+             $securityConfig['whitelist'] = self::default_whitelist();
+         }
+
          $this->securityConfig = $securityConfig;
          $this->verbose = $securityConfig['verbose'] ?? false;
          $this->allowlist = $this->buildAllowlist();
@@ -190,6 +182,49 @@
          }
      }
 
+     /**
+      * Initialise et persiste les cles Ed25519 pour les environnements PHP hors WordPress.
+      */
+     private static function initStandaloneEd25519Keys(): void
+     {
+         $configDir = dirname(__DIR__, 1) . '/config';
+         $persistentKeyPath = $configDir . '/ed25519_key.json';
+
+         if (file_exists($persistentKeyPath)) {
+             try {
+                 $keys = json_decode((string)file_get_contents($persistentKeyPath), true);
+                 if (isset($keys['privateKey'], $keys['publicKey'])) {
+                     Env::set('ED25519_PRIVATE_KEY', $keys['privateKey']);
+                     Env::set('ED25519_PUBLIC_KEY', $keys['publicKey']);
+                 }
+             } catch (\Throwable $e) {
+                 self::logError('[Fingerprint] Failed to load persistent Ed25519 keys: ' . $e->getMessage());
+             }
+         } else {
+             try {
+                 if (defined('OPENSSL_KEYTYPE_ED25519')) {
+                     $pkey = openssl_pkey_new(["private_key_type" => OPENSSL_KEYTYPE_ED25519]);
+                     if ($pkey && openssl_pkey_export($pkey, $privateKeyPem)) {
+                         $details = openssl_pkey_get_details($pkey); // @phpstan-ignore-line
+                         $publicKeyPem = $details['key'] ?? ''; // @phpstan-ignore-line
+                         Env::set('ED25519_PRIVATE_KEY', $privateKeyPem);
+                         Env::set('ED25519_PUBLIC_KEY', $publicKeyPem);
+                         if (!is_dir($configDir)) {
+                             mkdir($configDir, 0777, true);
+                         }
+                         // phpcs:ignore PluginCheck.CodeAnalysis.WriteFile.PluginDirectoryWrite -- Non-WordPress standalone environment fallback
+                         file_put_contents($persistentKeyPath, json_encode([
+                             'privateKey' => $privateKeyPem,
+                             'publicKey' => $publicKeyPem
+                         ], JSON_PRETTY_PRINT));
+                     }
+                 }
+             } catch (\Throwable $e) {
+                 self::logError('[Fingerprint] Native Ed25519 key generation failed: ' . $e->getMessage());
+             }
+         }
+     }
+
     /**
      * Applique à chaud une nouvelle configuration de sécurité (poids, seuils, etc.)
      * sans nécessiter de redémarrage.
@@ -260,7 +295,7 @@
                      }
                  }
              } catch (\Throwable $e) {
-                 error_log("[Fingerprint] Error loading whitelist file {$filename}: " . $e->getMessage());
+                 self::logError("[Fingerprint] Error loading whitelist file {$filename}: " . $e->getMessage());
              }
          }
          return $fallbackEntries;
@@ -352,7 +387,7 @@
              } else {
                  $logMessage = "[FingerprintEngine] {$message}";
                  if (!empty($data)) $logMessage .= ' ' . json_encode($data);
-                 error_log($logMessage);
+                 self::logError($logMessage);
              }
          }
      }
@@ -551,10 +586,8 @@
 
              $deviceId = bin2hex(random_bytes(16)); // UUID-like
 
-             $isHttps = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ||
-                 (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == 443) ||
-                 ($context->getHeader('x-forwarded-proto') === 'https');
-             $secureOption = $isHttps || $this->isProduction;
+             $isHttps = !empty($context->isHttps);
+             $secureOption = $isHttps;
 
              // Préparer le cookie à envoyer
              $newCookie = [
@@ -985,13 +1018,36 @@
                      // Le fingerprint est cohérent, on peut valider la solution
                      if ($powType === 'cpu_target' || $powType === 'cpu_mem') {
                          $cpuSolution = $context->query['pow_solution_cpu'] ?? $context->query['pow_solution'] ?? null;
-                         if ($cpuSolution) {
-                             $ticket = ChallengeUtils::verifyCpuTargetPoWAndGenerateTicket($context->clientIp, 3600000, $powNonce, $cpuSolution, $challengeContext);
+                         if ($cpuSolution !== null && $cpuSolution !== '') {
+                             $identity = $this->resolveRequestIdentity($context, $suspicionVector);
+                             $deviceId = (string)($identity['deviceId'] ?? '');
+                             $currentDeviceHash = (string)($identity['currentDeviceHash'] ?? RequestUtils::getCompositeDeviceHash($context));
+
+                             $ticket = ChallengeUtils::verifyCpuTargetPoWAndGenerateTicket(
+                                 $context->clientIp,
+                                 3600000,
+                                 $powNonce,
+                                 (string)$cpuSolution,
+                                 $challengeContext,
+                                 $deviceId,
+                                 $currentDeviceHash
+                             );
                              $isValid = $ticket !== null;
  
                              if ($powType === 'cpu_mem') {
-                                 $memSolution = $context->query['pow_solution_mem'] ?? null;
-                                 $isMemValid = $memSolution ? ChallengeUtils::verifyMemoryPoW($powNonce, $memSolution, $challengeContext['memDifficulty'] ?? 0, $challengeContext['clientSecret'] ?? '') : false;
+                                 if (!empty($challengeContext['isHttp'])) {
+                                     $isMemValid = true;
+                                 } else {
+                                     $memSolution = $context->query['pow_solution_mem'] ?? null;
+                                     $isMemValid = ($memSolution !== null && $memSolution !== '')
+                                         ? ChallengeUtils::verifyMemoryPoW(
+                                             $powNonce,
+                                             (string)$memSolution,
+                                             $challengeContext['memDifficulty'] ?? 0,
+                                             $challengeContext['clientSecret'] ?? ''
+                                         )
+                                         : false;
+                                 }
                                  $isValid = $isValid && $isMemValid;
                              }
                          }
@@ -1073,10 +1129,8 @@
                      MetricsManager::incrementCounter('challenges_solved_total');
                      $this->log('Challenge solution valid - issuing ticket', ['ticketMaxAge' => $ticketTtl]);
 
-                     $isHttps = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ||
-                         (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == 443) ||
-                         ($context->getHeader('x-forwarded-proto') === 'https');
-                     $secureOption = $isHttps || $this->isProduction;
+                     $isHttps = !empty($context->isHttps);
+                     $secureOption = $isHttps;
 
                      return [
                          'action' => 'redirect',
@@ -1529,7 +1583,7 @@
                      $isAsymmetric = true;
                  }
              } catch (\Throwable $e) {
-                 error_log('[Fingerprint] Asymmetric broadcast signing failed: ' . $e->getMessage());
+                 self::logError('[Fingerprint] Asymmetric broadcast signing failed: ' . $e->getMessage());
              }
          }
 
@@ -1550,7 +1604,8 @@
 
      private function asyncPost(string $url, array $params): void
      {
-         $parts = parse_url($url);
+         // phpcs:ignore WordPress.WP.AlternativeFunctions.parse_url_parse_url -- wp_parse_url used if available
+         $parts = function_exists('wp_parse_url') ? wp_parse_url($url) : parse_url($url);
          if ($parts === false) return;
 
          $host = $parts['host'];
@@ -1580,7 +1635,9 @@
              $out .= "Connection: Close\r\n\r\n";
              $out .= $postData;
 
+             // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fwrite -- Socket stream write
              @fwrite($fp, $out);
+             // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- Socket stream close
              @fclose($fp);
          }
      }
@@ -1707,7 +1764,7 @@
                 $b3 = ord($str[$offset++]); $b4 = ord($str[$offset++]);
                 return ($b1 << 24) | ($b2 << 16) | ($b3 << 8) | $b4;
             }
-            throw new \Exception("Unsupported integer size: " . $val);
+            throw new \Exception("Unsupported integer size: " . (int)$val);
         };
 
         if ($major === 0) {
@@ -1829,8 +1886,14 @@
                 return openssl_verify($verifyBuffer, base64_decode($anchor['signature']), $publicKey, OPENSSL_ALGO_SHA256) === 1;
             }
         } catch (\Throwable $e) {
-            error_log('[WebAuthn-Server] PHP verification failed: ' . $e->getMessage());
+            self::logError('[WebAuthn-Server] PHP verification failed: ' . $e->getMessage());
         }
         return false;
     }
+
+    private static function logError(string $message): void
+    {
+        // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- Engine diagnostic error log
+        error_log($message);
+    }
  }

package/src/php/Ja3AnomalyDetector.php

@@ -212,10 +212,12 @@ class Ja3AnomalyDetector
 
     /**
      * Correlates low-level TCP RTT with application layer latency to detect residential proxy hops.
+     * Evaluates continuous physical transit discrepancies rather than arbitrary step numbers.
+     * 
      * @param RequestContext $context
-     * @return int Suspicion score
+     * @return float Suspicion score between 0.0 and 95.0
      */
-    public static function getRttProxyScore(RequestContext $context): int
+    public static function getRttProxyScore(RequestContext $context): float
     {
         $tcpRttHeader = $context->headers['x-tcp-rtt'] ?? $context->headers['x-real-rtt'] ?? null;
         $tcpRtt = $tcpRttHeader !== null ? (int)$tcpRttHeader : null;
@@ -223,22 +225,28 @@ class Ja3AnomalyDetector
         $behaviorHeader = $context->headers['x-behavior-metrics'] ?? null;
         if ($behaviorHeader) {
             $metrics = json_decode($behaviorHeader, true);
-            if (json_last_error() === JSON_ERROR_NONE && isset($metrics['clientTimestamp'])) {
+            if (json_last_error() === JSON_ERROR_NONE && isset($metrics['clientTimestamp']) && is_numeric($metrics['clientTimestamp'])) {
                 $clientTimestamp = (int)$metrics['clientTimestamp'];
                 $appLatency = $context->requestTimestamp - $clientTimestamp;
-                if ($tcpRtt !== null && $tcpRtt > 0) {
-                    $clientToProxyDelta = $appLatency - $tcpRtt;
-                    if ($tcpRtt < 35 && $clientToProxyDelta > 150) {
-                        return 85;
-                    }
-                } else {
-                    if ($appLatency > 350) {
-                        return 40;
+
+                if ($tcpRtt !== null && $tcpRtt > 0 && $appLatency > 0) {
+                    // Marge de tolérance défensive contre le jitter réseau et le scheduling JS / Garbage Collection
+                    $jitterAllowance = 60.0;
+                    $effectiveRtt = max((float)$tcpRtt, 5.0);
+                    $tunnelDelta = $appLatency - ($tcpRtt + $jitterAllowance);
+                    $divergenceRatio = $appLatency / $effectiveRtt;
+
+                    // Condition de disjonction : liaison edge ultra-proche (< 40ms) + transit applicatif au moins 3x supérieur
+                    if ($tcpRtt <= 40 && $divergenceRatio >= 3.0 && $tunnelDelta > 0) {
+                        $scaling = 120.0;
+                        $ratioWeight = min(1.0, ($divergenceRatio - 3.0) / 5.0);
+                        $proxyScore = min(95.0, 40.0 + 55.0 * tanh($tunnelDelta / $scaling) * $ratioWeight);
+                        return round($proxyScore, 1);
                     }
                 }
             }
         }
-        return 0;
+        return 0.0;
     }
 }
 

package/src/php/Optimization/Optimization.php

@@ -17,7 +17,11 @@ class Optimization
         try {
             return random_int(0, PHP_INT_MAX - 1) / PHP_INT_MAX;
         } catch (\Exception $e) {
-            return (float)mt_rand() / (float)mt_getrandmax(); // Fallback
+            if (function_exists('wp_rand')) {
+                return (float)wp_rand(0, 1000000) / 1000000.0;
+            }
+            // phpcs:ignore WordPress.WP.AlternativeFunctions.rand_mt_rand -- Standalone fallback
+            return (float)mt_rand() / (float)mt_getrandmax();
         }
     }
 

package/src/php/Optimization/OptimizationOperators.php

@@ -44,7 +44,11 @@ class OptimizationOperators
         try {
             return random_int(0, PHP_INT_MAX - 1) / PHP_INT_MAX;
         } catch (\Exception $e) {
-            return (float)mt_rand() / (float)mt_getrandmax(); // Fallback
+            if (function_exists('wp_rand')) {
+                return (float)wp_rand(0, 1000000) / 1000000.0;
+            }
+            // phpcs:ignore WordPress.WP.AlternativeFunctions.rand_mt_rand -- Standalone fallback
+            return (float)mt_rand() / (float)mt_getrandmax();
         }
     }
 

package/src/php/Optimization/ProblemInitializers.php

@@ -12,6 +12,18 @@ class ProblemInitializers
     /** @var array<string, callable> */
     private static array $initializers = [];
 
+    private static function randomFloat(): float
+    {
+        try {
+            return (float)random_int(0, PHP_INT_MAX - 1) / (float)PHP_INT_MAX;
+        } catch (\Throwable $e) {
+            if (function_exists('wp_rand')) {
+                return (float)wp_rand(0, 1000000) / 1000000.0;
+            }
+            return 0.5;
+        }
+    }
+
     private static function initialize(): void
     {
         if (empty(self::$initializers)) {
@@ -22,8 +34,8 @@ class ProblemInitializers
                 $points = [];
                 for ($i = 0; $i < $count; $i++) {
                     $points[] = [
-                        'x' => mt_rand() / mt_getrandmax() * $bounds['x'],
-                        'y' => mt_rand() / mt_getrandmax() * $bounds['y']
+                        'x' => self::randomFloat() * $bounds['x'],
+                        'y' => self::randomFloat() * $bounds['y']
                     ];
                 }
                 return $points;
@@ -36,8 +48,8 @@ class ProblemInitializers
                 for ($i = 0; $i < $count; $i++) {
                     $assets[] = [
                         'name' => 'Asset ' . ($i + 1),
-                        'expectedReturn' => mt_rand() / mt_getrandmax() * 0.2,
-                        'volatility' => 0.1 + mt_rand() / mt_getrandmax() * 0.3
+                        'expectedReturn' => self::randomFloat() * 0.2,
+                        'volatility' => 0.1 + self::randomFloat() * 0.3
                     ];
                 }
                 return $assets;

package/src/php/ProblemManager.php

@@ -59,17 +59,17 @@ class ProblemManager
     private function loadProblems(): void
     {
         if (!file_exists($this->configPath)) {
-            error_log("[ProblemManager] Problem config file not found: {$this->configPath}");
+            self::logError("[ProblemManager] Problem config file not found: {$this->configPath}");
             return;
         }
         $data = file_get_contents($this->configPath);
         if ($data === false) {
-            error_log("[ProblemManager] Failed to read problem config file: {$this->configPath}");
+            self::logError("[ProblemManager] Failed to read problem config file: {$this->configPath}");
             return;
         }
         $problemsFromFile = json_decode($data, true);
         if (json_last_error() !== JSON_ERROR_NONE) {
-            error_log("[ProblemManager] Failed to parse problem config JSON: " . json_last_error_msg());
+            self::logError("[ProblemManager] Failed to parse problem config JSON: " . json_last_error_msg());
             return;
         }
 
@@ -88,7 +88,7 @@ class ProblemManager
                 $problem['workUnit']['scoreFunction'] = FunctionRegistry::get($problem['workUnit']['scoreFunction']);
                 if ($problem['workUnit']['scoreFunction'] === null) {
                     // @codeCoverageIgnoreStart
-                    error_log("[ProblemManager] Warning: scoreFunction '{$problem['workUnit']['scoreFunction']}' not found in registry for problem '{$problem['id']}'.");
+                    self::logError("[ProblemManager] Warning: scoreFunction '{$problem['workUnit']['scoreFunction']}' not found in registry for problem '{$problem['id']}'.");
                     // @codeCoverageIgnoreEnd
                 }
             }
@@ -167,7 +167,7 @@ class ProblemManager
                 $task['solverName'] = $problem['workUnit']['solverName'];
                 break;
             default:
-                error_log("[ProblemManager] Unknown useful work type: {$problem['workUnit']['type']}");
+                self::logError("[ProblemManager] Unknown useful work type: {$problem['workUnit']['type']}");
                 return null;
         }
 
@@ -198,17 +198,17 @@ class ProblemManager
                 if (isset($solutionData['solution']) && isset($solutionData['energy'])) {
                     $scoreFunction = $problem['workUnit']['scoreFunction'] ?? null;
                     if (!$scoreFunction) {
-                        error_log("[ProblemManager] No score function defined for {$problemId}.");
+                        self::logError("[ProblemManager] No score function defined for {$problemId}.");
                         return;
                     }
                 // DoS mitigation: validate solution size and structure
                 if (is_array($solutionData['solution']) && count($solutionData['solution']) > 500) {
-                    error_log("[ProblemManager] Solution array too large for {$problemId} verification.");
+                    self::logError("[ProblemManager] Solution array too large for {$problemId} verification.");
                     return;
                 }
                 $serializedSolution = json_encode($solutionData['solution']);
                 if ($serializedSolution !== false && strlen($serializedSolution) > 65536) {
-                    error_log("[ProblemManager] Solution payload size exceeds safe limit for {$problemId}.");
+                    self::logError("[ProblemManager] Solution payload size exceeds safe limit for {$problemId}.");
                     return;
                 }
                     // 1. Never trust client-reported score. Recalculate server-side.
@@ -222,19 +222,19 @@ class ProblemManager
                         $problem['state']['bestEnergy'] = $recalculatedEnergy; // 3. Store verified score
                         $problem['state']['lastUpdate'] = (new \DateTime())->format(\DateTime::ATOM);
                         $stateChanged = true;
-                        error_log("[ProblemManager] New best solution for {$problemId}: {$recalculatedEnergy}"); // @phpstan-ignore-line
+                        self::logError("[ProblemManager] New best solution for {$problemId}: {$recalculatedEnergy}"); // @phpstan-ignore-line
                     }
                 }
                 break;
             case 'genetic_algorithm_generations':
                 if (isset($solutionData['population']) && is_array($solutionData['population'])) {
                 if (count($solutionData['population']) > 150) {
-                    error_log("[ProblemManager] Population size exceeds safe limit for {$problemId}.");
+                    self::logError("[ProblemManager] Population size exceeds safe limit for {$problemId}.");
                     return;
                 }
                 foreach ($solutionData['population'] as $ind) {
                     if (isset($ind['chromosome']) && is_array($ind['chromosome']) && count($ind['chromosome']) > 100) {
-                        error_log("[ProblemManager] Chromosome size too large for {$problemId}.");
+                        self::logError("[ProblemManager] Chromosome size too large for {$problemId}.");
                         return;
                     }
                 }
@@ -251,7 +251,7 @@ class ProblemManager
                                 $recalculated = $fitnessFunction($individual['chromosome'], $problem['payload'] ?? []);
                                 if (isset($individual['fitness']) && $individual['fitness'] !== -1) {
                                     if (abs($individual['fitness'] - $recalculated) > 1e-4) {
-                                        error_log("[ProblemManager] Cheating detected for {$problemId}! Reported: {$individual['fitness']}, recalculated: {$recalculated}");
+                                        self::logError("[ProblemManager] Cheating detected for {$problemId}! Reported: {$individual['fitness']}, recalculated: {$recalculated}");
                                         return; // Reject inconsistent population
                                     }
                                 }
@@ -272,7 +272,7 @@ class ProblemManager
                 }
                 break;
             default:
-                error_log("[ProblemManager] Integration not implemented for useful work type: {$problem['workUnit']['type']}");
+                self::logError("[ProblemManager] Integration not implemented for useful work type: {$problem['workUnit']['type']}");
                 break;
         }
         // Persist updated state to datastore
@@ -294,7 +294,7 @@ class ProblemManager
         if (!empty($newFront) && json_encode($newFront) !== json_encode($currentFront)) {
             $problem['state']['paretoFront'] = $newFront;
             $problem['state']['lastUpdate'] = (new \DateTime())->format(\DateTime::ATOM);
-            error_log("[ProblemManager] New Pareto front for {$problem['id']} with " . count($newFront) . " solutions."); // @phpstan-ignore-line
+            self::logError("[ProblemManager] New Pareto front for {$problem['id']} with " . count($newFront) . " solutions."); // @phpstan-ignore-line
             return true;
         }
         return false;
@@ -407,4 +407,10 @@ class ProblemManager
     {
         return $this->problems;
     }
+
+    private static function logError(string $message): void
+    {
+        // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- ProblemManager logging
+        error_log($message);
+    }
 }