docs(config): document app config & secrets in the /v1 OpenAPI spec + changelog

Adds the four /v1/apps/{id}/config routes (and ConfigItem/CreateConfigRequest/
PatchConfigRequest schemas) to docs/openapi.yaml so the console<->sandboxd
contract test stays green after merging #33. Bumps the spec to 0.3.0 and adds
an Unreleased changelog entry for the v0.3.0 integration.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: tastyeffectco

CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to sandboxd are documented here. The format is based on
 [Semantic Versioning](https://semver.org/) (pre-1.0: a minor bump adds features,
 a patch is fixes only).
 
+## [Unreleased] — v0.3.0 (integration: `console`)
+
+Backend and console landing together as one incremental release. Tracked on
+the `console` integration branch; `main` stays at 0.2.0 until v0.3.0 is cut.
+
+### Added
+- **App-scoped config & secrets.** Per-app key/value config under
+  `/v1/apps/{id}/config` (`POST` / `GET`) and `/v1/apps/{id}/config/{key}`
+  (`PATCH` / `DELETE`). Sensitive values are AES-256-GCM-encrypted at rest and
+  write-only over the API (a `GET` returns metadata and `value_set`, never the
+  plaintext); non-sensitive values are returned. An `access_policy`
+  (`control_plane_only` default) records who may later read a value through the
+  broker. Documented in `docs/openapi.yaml`. (#33)
+- **Web console + `/v1` OpenAPI spec.** An optional Vite/React console (served
+  through Traefik at `console.<domain>`) over the public `/v1` API, plus
+  `docs/openapi.yaml` and a contract test that keeps the spec and the routes in
+  sync. The app detail screen now includes a **Config & Secrets** panel. (#32)
+
+### Note
+- The secrets **broker** (Slice 2 — delivering values to agents/runtimes per
+  `access_policy`) is intentionally deferred and tracked separately; it does not
+  block this release.
+
 ## [0.2.0] — 2026-06-22
 
 Reliability fixes across the core, and durable "apps" as first-class entities

docs/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: sandboxd /v1 API
-  version: "0.2.0"
+  version: "0.3.0"
   description: >
     The public, tenant-scoped API for sandboxd. This is the only surface a
     console or external integration should use — the internal /sandbox and
@@ -115,6 +115,89 @@ paths:
             application/json:
               schema: { $ref: "#/components/schemas/Error" }
 
+  /v1/apps/{id}/config:
+    parameters:
+      - $ref: "#/components/parameters/Id"
+    get:
+      tags: [apps]
+      summary: List an app's config entries (metadata; secret values redacted)
+      description: >
+        Returns every config key for the app. Sensitive entries never
+        include their value (only value_set=true); non-sensitive entries
+        include the plaintext value.
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  config:
+                    type: array
+                    items: { $ref: "#/components/schemas/ConfigItem" }
+        "404": { $ref: "#/components/responses/Error" }
+    post:
+      tags: [apps]
+      summary: Create a config entry (set sensitive=true to encrypt at rest)
+      description: >
+        Sensitive values are AES-256-GCM-encrypted at rest and are
+        write-only — they are never returned by any GET. access_policy
+        governs who may later read the value through the broker; the
+        default control_plane_only never leaves sandboxd.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: "#/components/schemas/CreateConfigRequest" }
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/ConfigItem" }
+        "400": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409":
+          description: A config entry with this key already exists; PATCH to update.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/Error" }
+
+  /v1/apps/{id}/config/{key}:
+    parameters:
+      - $ref: "#/components/parameters/Id"
+      - in: path
+        name: key
+        required: true
+        schema: { type: string }
+    patch:
+      tags: [apps]
+      summary: Update a config entry (value, sensitivity, or access policy)
+      description: >
+        Omit value to keep the stored value untouched (a policy-only
+        change preserves an existing secret). Toggling sensitive
+        re-encodes the stored value.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: "#/components/schemas/PatchConfigRequest" }
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/ConfigItem" }
+        "400": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+    delete:
+      tags: [apps]
+      summary: Delete a config entry
+      responses:
+        "204": { description: Deleted }
+        "404": { $ref: "#/components/responses/Error" }
+
   /v1/sandboxes:
     post:
       tags: [sandboxes]
@@ -429,6 +512,39 @@ components:
         name: { type: string }
         description: { type: string }
         tags: { type: array, items: { type: string } }
+    ConfigItem:
+      type: object
+      properties:
+        key: { type: string }
+        sensitive: { type: boolean }
+        access_policy:
+          type: string
+          enum: [control_plane_only, agent_access, runtime_access, both]
+        value_set: { type: boolean, description: "True when a value is stored." }
+        value:
+          type: string
+          description: "Present only for non-sensitive entries; sensitive values are never returned."
+        created_at: { type: string, format: date-time }
+        updated_at: { type: string, format: date-time }
+    CreateConfigRequest:
+      type: object
+      required: [key]
+      properties:
+        key: { type: string }
+        value: { type: string }
+        sensitive: { type: boolean, default: false }
+        access_policy:
+          type: string
+          enum: [control_plane_only, agent_access, runtime_access, both]
+          default: control_plane_only
+    PatchConfigRequest:
+      type: object
+      properties:
+        value: { type: string, description: "Omit to keep the stored value unchanged." }
+        sensitive: { type: boolean }
+        access_policy:
+          type: string
+          enum: [control_plane_only, agent_access, runtime_access, both]
     Sandbox:
       type: object
       properties: