## 1. Backend Enhancements

- [ ] 1.1 Update Config model with scope validation methods
- [ ] 1.2 Update Secret model with encryption verification
- [ ] 1.3 Enhance configs router with scope filtering and hierarchy resolution
- [ ] 1.4 Enhance secrets router with scope filtering and hierarchy resolution
- [ ] 1.5 Create apps/api/app/services/runtime_injection.py for config/secret resolution
- [ ] 1.6 Implement config file generation for container mounts
- [ ] 1.7 Implement secret env var generation for container injection
- [ ] 1.8 Add validation to fail spawn when referenced secrets are missing

## 2. Frontend - Config Management

- [ ] 2.1 Create ConfigList component at /projects/:id/configs
- [ ] 2.2 Implement ConfigForm for creating/updating configs
- [ ] 2.3 Add scope selector (project/instance/global) to config form
- [ ] 2.4 Implement config delete with confirmation
- [ ] 2.5 Add JSON formatting for config values

## 3. Frontend - Secret Management

- [ ] 3.1 Create SecretList component at /projects/:id/secrets
- [ ] 3.2 Implement SecretForm for creating/updating secrets
- [ ] 3.3 Add masked value display (never show decrypted)
- [ ] 3.4 Implement secret delete with confirmation
- [ ] 3.5 Add scope selector to secret form

## 4. Runtime Integration

- [ ] 4.1 Integrate runtime injection into tool instance spawn endpoint
- [ ] 4.2 Update Docker Compose generation to include config mounts
- [ ] 4.3 Update Docker Compose generation to include secret env vars
- [ ] 4.4 Test config/secret injection in local Docker environment

## 5. Testing & Verification

- [ ] 5.1 Write backend tests for config scope resolution
- [ ] 5.2 Write backend tests for secret encryption/decryption
- [ ] 5.3 Write backend tests for runtime injection
- [ ] 5.4 Write frontend tests for ConfigList and SecretList
- [ ] 5.5 Run full test suite: `make test`
- [ ] 5.6 Run linters: `make lint`

## 6. Documentation

- [ ] 6.1 Update docs/development.md with config/secrets workflow
- [ ] 6.2 Add config/secrets UI guide to docs/architecture.md
- [ ] 6.3 Document scope hierarchy and resolution rules