suaveplan/openspec/changes/enterprise-gaming-api-plugin-anticheat/tasks.md

Tasks: enterprise-gaming-api-plugin-anticheat

0. Pre-flight (non-negotiable)

• 0.1 Confirm clean working tree (git status reports nothing) and no in-flight worktrees with uncommitted work (git worktree list then git status in each)
• 0.2 If any worktrees exist under .claude/worktrees/, account for each one: still-active agent, work-pending-merge, or stale-and-prune. Stale worktrees MUST be removed (git worktree remove) before opening a new one — code that has been lost twice on main is the failure mode this guards against.
• 0.3 Confirm the package set in MANIFEST.md matches find packages -maxdepth 3 -name package.json count. Drift here means a prior change archived without regenerating the manifest.

Phase 1 — Scaffold

• Create gaming/server/api-plugin-anticheat/ (@suaveplan/api-plugin-anticheat, 0.1.0, sideEffects: false)
• tsconfig.json, vitest.config.ts

Phase 2 — Error codes + types

• src/error-codes.ts + src/types/common.ts + common.md

Phase 3 — Violation tracker

• src/core/violation-tracker/violation-tracker.ts — check/addViolation/getTrustScore/isBanned/tick/reset, OTel counters
• Tests (decay, ban threshold, per-type thresholds)
• Docs

Phase 4 — Routes

• src/routes/anticheat.ts — all HTTP endpoints
• src/routes/anticheat.md

Phase 5 — Plugin factory

• src/plugin.ts — antiCheatPlugin() factory
• src/plugin.md

Phase 6 — Integration tests

• tests/integration.test.ts — POST /check → trust score → ban event

Phase 7 — Pre-publish gate

• bunx turbo lint typecheck test --filter=@suaveplan/api-plugin-anticheat green
• 100% coverage
• Publish: bun scripts/publish.ts --package @suaveplan/api-plugin-anticheat