- Add RuntimeInjectionService for scope-based config/secret resolution
- Mount configs as JSON files at /app/config/ with 0400 permissions
- Inject secrets as environment variables with uppercase keys
- Implement scope hierarchy: instance > project > user > global
- Create ConfigListPage and SecretListPage frontend components
- Mask secret values in API responses (never expose decrypted)
- Validate secrets exist before spawning containers
- Add comprehensive tests for runtime injection service
- Update documentation with config/secrets workflow
- Add OIDC authentication with PKCE flow
- Create dashboard shell with sidebar and header
- Implement project management UI (list, create, detail)
- Add tool spawn page with tool/project selection
- Create tool instance detail page with status and controls
- Set up React Router with route guards
- Add Zustand auth store and API client with types
- Add ToolManifest Pydantic models with validators for ports, mounts, health checks, and traefik config
- Implement in-memory ToolRegistry with YAML loading and built-in manifest scanning
- Add FastAPI CRUD routes for listing, retrieving, and creating tool manifests
- Include built-in manifests for runfusion and code-server
- Harden web Dockerfile with unprivileged nginx and port 8080
- Add tool manifest specification documentation and architecture updates
Fusion-Task-Id: FN-003
alex
Fusion