## 1. Domain and persistence

- [x] 1.1 Add server-local game-player, alias, session, access-attempt, and security-signal domain/models, repositories, MySQL migration, memory/file stores, validation, and retention helpers.
- [x] 1.2 Add idempotent SCUM login/logout and failed-access projection from accepted semantic log entries, including rename, duplicate, stale event, session boundary, isolated HMAC correlation, and review-only signal thresholds.
- [x] 1.3 Add focused domain/service/repository tests for privacy, ordering, idempotency, access control, retention, aliases, sessions, and risk signals.

## 2. APIs and plugin contract

- [x] 2.1 Add named request/response DTOs, authorized handlers/routes, safe projections, and API tests for player profiles, lists, aliases, sessions, attempts, and signals.
- [x] 2.2 Extend the SCUM manifest semantic schemas/page contract for bounded player intelligence and add plugin validation fixtures/tests.

## 3. SCUM console

- [x] 3.1 Add Platform Web API/client contracts and route resolution for the SCUM player intelligence work surface.
- [x] 3.2 Render full-width shared-console player records, access trajectories, and manual-review signals with explicit text status and no raw network/log exposure.
- [x] 3.3 Add frontend contract/component tests for safe rendering and status readability.

## 4. Verification

- [x] 4.1 Run strict OpenSpec validation and focused backend, plugin, and frontend test suites.
- [x] 4.2 Run `scripts/check-structure.sh`, stage only task files, commit on `main`, and push the configured remote.