alex
78aaddb2b5
- Add frontend-foundation change (FN-005) with 46 tasks - Add deployment-config change (FN-006) with 27 tasks - Add runfusion-poc/opencode-poc change (FN-008) with 25 tasks - Add config-secrets change (FN-009) with 31 tasks - Add codeserver-spawn change (FN-010) with 38 tasks - Include project specsheet and configuration - Archive completed deployment-config change
41 lines
1.6 KiB
Markdown
41 lines
1.6 KiB
Markdown
## ADDED Requirements
|
|
|
|
### Requirement: Configs are mounted into tool containers
|
|
The system SHALL mount configuration values as files into spawned tool containers.
|
|
|
|
#### Scenario: Config file mount
|
|
- **WHEN** a tool instance is spawned
|
|
- **THEN** all applicable configs are written to /app/config/
|
|
- **AND** each config is a separate JSON file named by key
|
|
- **AND** files have restrictive permissions (0400)
|
|
|
|
#### Scenario: Config scope resolution
|
|
- **WHEN** configs are resolved for a tool instance
|
|
- **THEN** the system collects configs from all applicable scopes
|
|
- **AND** instance scope overrides project scope
|
|
- **AND** project scope overrides user scope
|
|
- **AND** user scope overrides global scope
|
|
|
|
### Requirement: Secrets are injected as environment variables
|
|
The system SHALL inject secret values as environment variables into tool containers.
|
|
|
|
#### Scenario: Secret env var injection
|
|
- **WHEN** a tool instance is spawned
|
|
- **THEN** all applicable secrets are decrypted
|
|
- **AND** injected as environment variables with uppercase keys
|
|
- **AND** the container process can access them
|
|
|
|
#### Scenario: Secret scope resolution
|
|
- **WHEN** secrets are resolved for a tool instance
|
|
- **THEN** the same scope hierarchy applies as configs
|
|
- **AND** closest scope wins on key collision
|
|
|
|
### Requirement: Missing secrets fail spawn
|
|
The system SHALL prevent spawning if referenced secrets are missing.
|
|
|
|
#### Scenario: Validate secrets before spawn
|
|
- **WHEN** a spawn request references a secret by key
|
|
- **AND** the secret does not exist in any applicable scope
|
|
- **THEN** the spawn fails with a clear error message
|
|
- **AND** no container is created
|