browser/openspec/changes/move-scum-feature-ownership-to-plugin/proposal.md

Why

SCUM plugin behavior must survive server updates without treating a game, UE4SS, database, build, or revision string as a feature kill switch. The prior plan also incorrectly treated plugin-generated SQL and management-command text as a direct-access surface. Generating text is distinct from possessing a DSN, RCON credential, host path, socket, or shell capability.

What Changes

• Move all SCUM feature authority to the plugin and its Companion, with generic platform authorization, isolation, approval, audit, expiry, queue, protected storage, and Run channels.
• Replace build/version/revision gates with runtime schema and capability probes.
• Let plugins declare and generate bounded SQL, RCON, or program-management request text for a logical, server-bound protected transport. Platform stores, authorizes, approves, audits, expires, and forwards that opaque payload; Run alone resolves the bound transport and executes the authorized request.
• Keep platform transport-agnostic: it validates declarations, scope, limits, lifecycle, and redaction but does not parse SCUM SQL, RCON, or program syntax.
• Let Run provide bounded SCUM process stdout/stderr console records through the platform log channel for plugin parsing. These are not file execution logs.
• Require bounded succeeded/failed/unknown result classifications and safe diagnostics. Unknown text, command formats, and fields affect only the one request and never disable unrelated features.

Non-Goals

No plugin, page, AI request, or result projection receives a DSN, database path, raw connection, RCON credential, host path, direct socket, or shell. Protected program-management requests are not host OS shell requests. No OCR, screenshot, keyboard/mouse injection, desktop automation, Run source, SCUM import, or game.scum branch is added to platform_web.