browser/openspec/changes/add-scum-game-player-intelligence/tasks.md

1. Domain and persistence

• 1.1 Add server-local game-player, alias, session, access-attempt, and security-signal domain/models, repositories, MySQL migration, memory/file stores, validation, and retention helpers.
• 1.2 Add idempotent SCUM login/logout and failed-access projection from accepted semantic log entries, including rename, duplicate, stale event, session boundary, isolated HMAC correlation, and review-only signal thresholds.
• 1.3 Add focused domain/service/repository tests for privacy, ordering, idempotency, access control, retention, aliases, sessions, and risk signals.

2. APIs and plugin contract

• 2.1 Add named request/response DTOs, authorized handlers/routes, safe projections, and API tests for player profiles, lists, aliases, sessions, attempts, and signals.
• 2.2 Extend the SCUM manifest semantic schemas/page contract for bounded player intelligence and add plugin validation fixtures/tests.

3. SCUM console

• 3.1 Add Platform Web API/client contracts and route resolution for the SCUM player intelligence work surface.
• 3.2 Render full-width shared-console player records, access trajectories, and manual-review signals with explicit text status and no raw network/log exposure.
• 3.3 Add frontend contract/component tests for safe rendering and status readability.

4. Verification

• 4.1 Run strict OpenSpec validation and focused backend, plugin, and frontend test suites.
• 4.2 Run scripts/check-structure.sh, stage only task files, commit on main, and push the configured remote.