## 1. Manifest Refinement

- [x] 1.1 Update apps/api/app/tools/manifests/code-server.yml with complete runtime config
- [x] 1.2 Add Docker image, ports, volumes, env vars to manifest
- [x] 1.3 Validate manifest against ToolManifest schema
- [x] 1.4 Test manifest loading at application startup

## 2. Spawn Service

- [x] 2.1 Create apps/api/app/services/spawn.py with SpawnService class
- [x] 2.2 Implement Docker Compose service generation from manifest
- [x] 2.3 Implement container start/stop via Docker Compose API
- [x] 2.4 Integrate Traefik label generation (FN-006)
- [x] 2.5 Integrate config/secrets runtime injection (FN-009)
- [x] 2.6 Implement workspace volume mounting
- [x] 2.7 Implement SSH key mounting for Git access
- [x] 2.8 Add container status polling

## 3. Backend API

- [x] 3.1 Enhance POST /api/v1/tool-instances with spawn logic
- [x] 3.2 Add DELETE /api/v1/tool-instances/:id/stop endpoint
- [x] 3.3 Add POST /api/v1/tool-instances/:id/start endpoint
- [x] 3.4 Add GET /api/v1/tool-instances/:id/status endpoint
- [x] 3.5 Add validation for project ownership and tool existence
- [x] 3.6 Prevent duplicate spawn of running instances

## 4. Frontend UI

- [x] 4.1 Create ToolSpawn page at /tools/spawn
- [x] 4.2 Implement tool selection dropdown from registry
- [x] 4.3 Implement project selection dropdown
- [x] 4.4 Add config override fields based on manifest
- [x] 4.5 Create ToolInstanceDetail page at /tools/:id
- [x] 4.6 Display instance status, subdomain URL, and controls (stop/start)
- [x] 4.7 Add "Open Tool" button that opens subdomain in new tab

## 5. Auth Integration

- [x] 5.1 Configure Traefik forwardAuth middleware for code-server
- [x] 5.2 Implement auth validation endpoint for Traefik
- [x] 5.3 Disable code-server built-in auth (PASSWORD: "")
- [x] 5.4 Test that unauthenticated requests are blocked

## 6. Testing & Verification

- [x] 6.1 Write backend tests for SpawnService
- [x] 6.2 Write backend tests for tool instance lifecycle endpoints
- [x] 6.3 Test container spawn in local Docker environment
- [x] 6.4 Verify Traefik routing to spawned container
- [x] 6.5 Run full test suite: `make test`
- [x] 6.6 Run linters: `make lint`

## 7. Documentation

- [x] 7.1 Update docs/development.md with spawn workflow
- [x] 7.2 Add code-server setup guide to docs/architecture.md
- [x] 7.3 Document auth proxy configuration