test(e2e): add portable CLI conformance baseline

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

TESTING.md

@@ -148,14 +148,16 @@ lifecycle management, output parsing, and cleanup.
 Suites:
 
 - Common suite (`--features e2e`) - driver-neutral CLI behavior, sandbox lifecycle, sync, port forwarding, policy, and provider tests.
-- Docker suite (`--features e2e-docker`) - common suite plus Docker-only coverage such as Dockerfile image builds, Docker preflight checks, and managed Docker gateway start.
+- CLI conformance (`--features e2e-cli-conformance`) - the portable deployment
+  smoke scenario plus focused tests for its reusable command runner.
+- Driver suites (`--features e2e-docker`, `e2e-podman`, `e2e-kubernetes`, or
+  `e2e-vm`) - CLI conformance plus the common and driver-specific coverage for
+  the selected deployment.
+- Docker suite (`--features e2e-docker`) - includes Docker-only coverage such as Dockerfile image builds, Docker preflight checks, and managed Docker gateway start.
 - Docker GPU suite (`--features e2e-docker-gpu`) - Docker suite plus GPU sandbox smoke coverage.
 - VM suite (`--features e2e-vm`) - runs e2e tests on a VM.
 - Kubernetes credential-driver suite (`--features e2e-kubernetes-credential-drivers`) - targeted Kubernetes Secrets and Vault provider credential storage coverage.
 
-VM overlay and TLS-key permission assertions run only in the VM suite; the
-driver-neutral smoke test does not include them.
-
 GPU device-selection tests compare OpenShell sandboxes against a plain Docker or
 Podman container that requests `--device nvidia.com/gpu=all`. The probe image
 defaults to the image used by the `gateway` stage in
@@ -172,6 +174,42 @@ Run the Docker-backed Rust CLI e2e suite:
 mise run e2e:rust
 ```
 
+Run the minimal portable CLI conformance profile against the gateway selected
+in your OpenShell CLI configuration:
+
+```shell
+mise run e2e:cli-conformance
+```
+
+The gateway must already be installed, reachable, and selected before the task
+starts. The task does not provision a gateway or select a compute driver. Set
+`OPENSHELL_BIN` to test a prebuilt CLI; otherwise, the task builds the CLI from
+the current checkout.
+
+The phase-1 scenario verifies the complete CLI-to-gateway-to-driver path without
+depending on how the gateway was installed or which driver is configured. It
+requires machine-readable gRPC status, creates a uniquely named detached
+sandbox with `--from base`, verifies the sandbox is `Ready` by finding its
+unique name in paginated JSON list output, executes `echo` with a run-specific
+marker, deletes the sandbox, and verifies that its name no longer appears.
+Driver suites enable the same profile
+instead of maintaining a separate smoke implementation. Sandbox lifecycle,
+label matrices, VM overlay, and TLS-key permission assertions remain regular
+E2E coverage.
+
+Each invocation prints a ten-character run ID before creating resources.
+Conformance sandboxes use names such as `ct-<run-id>-01`. The runner tracks the
+exact name and uses it for cleanup; phase 1 does not add ownership labels.
+
+The runner deletes owned resources after both success and failure. If the test
+process is interrupted before cleanup, locate leftovers without touching
+unrelated gateway state:
+
+```shell
+openshell sandbox list --output json
+openshell sandbox delete <sandbox-name>
+```
+
 Run the Podman-backed Rust CLI e2e suite:
 
 ```shell

e2e/rust/Cargo.toml

@@ -16,7 +16,10 @@ license = "Apache-2.0"
 publish = false
 
 [features]
-e2e = []
+# Selects the minimal portable CLI conformance profile.
+e2e-cli-conformance = []
+# Selects the common E2E suite, including the CLI conformance baseline.
+e2e = ["e2e-cli-conformance"]
 # Selects tests that rely on `host.openshell.internal` (the sandbox's stable
 # alias to the host running test fixtures). docker, podman, and vm wire the
 # alias unconditionally; the kube driver only does so when the chart's
@@ -41,6 +44,11 @@ name = "oidc_pkce"
 path = "tests/oidc_pkce.rs"
 required-features = ["e2e-oidc-pkce"]
 
+[[test]]
+name = "smoke"
+path = "tests/smoke.rs"
+required-features = ["e2e-cli-conformance"]
+
 [[test]]
 name = "vm_overlay"
 path = "tests/vm_overlay.rs"

e2e/rust/e2e-docker.sh

@@ -10,7 +10,7 @@ set -euo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 E2E_TEST="${OPENSHELL_E2E_DOCKER_TEST:-smoke}"
-E2E_FEATURES="${OPENSHELL_E2E_DOCKER_FEATURES:-e2e,e2e-docker}"
+E2E_FEATURES="${OPENSHELL_E2E_DOCKER_FEATURES:-e2e-docker}"
 DEFAULT_WORKLOAD_MANIFEST="${ROOT}/e2e/gpu/images/.build/workloads.yaml"
 
 if [ "${E2E_TEST}" = "gpu" ] && [ -z "${OPENSHELL_E2E_WORKLOAD_MANIFEST:-}" ] && [ ! -f "${DEFAULT_WORKLOAD_MANIFEST}" ]; then

e2e/rust/e2e-kubernetes.sh

@@ -26,6 +26,7 @@ E2E_FEATURES="${OPENSHELL_E2E_KUBERNETES_FEATURES:-e2e,e2e-host-gateway,e2e-kube
 # local CLI needs to be built when CI has not supplied a prebuilt one.
 if [ -z "${OPENSHELL_BIN:-}" ]; then
   cargo build -p openshell-cli
+  export OPENSHELL_BIN="${ROOT}/target/debug/openshell"
 fi
 
 test_filter=()