headquarter/openspec/changes/config-secrets/tasks.md

1. Backend Enhancements

• 1.1 Update Config model with scope validation methods
• 1.2 Update Secret model with encryption verification
• 1.3 Enhance configs router with scope filtering and hierarchy resolution
• 1.4 Enhance secrets router with scope filtering and hierarchy resolution
• 1.5 Create apps/api/app/services/runtime_injection.py for config/secret resolution
• 1.6 Implement config file generation for container mounts
• 1.7 Implement secret env var generation for container injection
• 1.8 Add validation to fail spawn when referenced secrets are missing

2. Frontend - Config Management

• 2.1 Create ConfigList component at /projects/:id/configs
• 2.2 Implement ConfigForm for creating/updating configs
• 2.3 Add scope selector (project/instance/global) to config form
• 2.4 Implement config delete with confirmation
• 2.5 Add JSON formatting for config values

3. Frontend - Secret Management

• 3.1 Create SecretList component at /projects/:id/secrets
• 3.2 Implement SecretForm for creating/updating secrets
• 3.3 Add masked value display (never show decrypted)
• 3.4 Implement secret delete with confirmation
• 3.5 Add scope selector to secret form

4. Runtime Integration

• 4.1 Integrate runtime injection into tool instance spawn endpoint
• 4.2 Update Docker Compose generation to include config mounts
• 4.3 Update Docker Compose generation to include secret env vars
• 4.4 Test config/secret injection in local Docker environment

5. Testing & Verification

• 5.1 Write backend tests for config scope resolution
• 5.2 Write backend tests for secret encryption/decryption
• 5.3 Write backend tests for runtime injection
• 5.4 Write frontend tests for ConfigList and SecretList
• 5.5 Run full test suite: make test
• 5.6 Run linters: make lint

6. Documentation

• 6.1 Update docs/development.md with config/secrets workflow
• 6.2 Add config/secrets UI guide to docs/architecture.md
• 6.3 Document scope hierarchy and resolution rules