NVIDIA · elezar · Aug 25, 2026 · Aug 25, 2026
@@ -148,7 +148,12 @@ lifecycle management, output parsing, and cleanup.
 Suites:
 
 - Common suite (`--features e2e`) - driver-neutral CLI behavior, sandbox lifecycle, sync, port forwarding, policy, and provider tests.
-- Docker suite (`--features e2e-docker`) - common suite plus Docker-only coverage such as Dockerfile image builds, Docker preflight checks, and managed Docker gateway start.
+- CLI conformance (`--features e2e-cli-conformance`) - the portable deployment
+  smoke scenario plus focused tests for its reusable command runner.
+- Driver suites (`--features e2e-docker`, `e2e-podman`, `e2e-kubernetes`, or
+  `e2e-vm`) - CLI conformance plus the common and driver-specific coverage for
+  the selected deployment.
+- Docker suite (`--features e2e-docker`) - includes Docker-only coverage such as Dockerfile image builds, Docker preflight checks, and managed Docker gateway start.
 - Docker GPU suite (`--features e2e-docker-gpu`) - Docker suite plus GPU sandbox smoke coverage.
 - VM suite (`--features e2e-vm`) - runs e2e tests on a VM.
 - Kubernetes credential-driver suite (`--features e2e-kubernetes-credential-drivers`) - targeted Kubernetes Secrets and Vault provider credential storage coverage.
@@ -169,6 +174,42 @@ Run the Docker-backed Rust CLI e2e suite:
 mise run e2e:rust
 ```
 
+Run the minimal portable CLI conformance profile against the gateway selected
+in your OpenShell CLI configuration:
+
+```shell
+mise run e2e:cli-conformance
+```
+
+The gateway must already be installed, reachable, and selected before the task
+starts. The task does not provision a gateway or select a compute driver. Set
+`OPENSHELL_BIN` to test a prebuilt CLI; otherwise, the task builds the CLI from
+the current checkout.
+
+The phase-1 scenario verifies the complete CLI-to-gateway-to-driver path without
+depending on how the gateway was installed or which driver is configured. It
+requires machine-readable gRPC status, creates a uniquely named detached
+sandbox with `--from base`, verifies the sandbox is `Ready` by finding its
+unique name in paginated JSON list output, executes `echo` with a run-specific
+marker, deletes the sandbox, and verifies that its name no longer appears.
+Driver suites enable the same profile
+instead of maintaining a separate smoke implementation. Sandbox lifecycle,
+label matrices, VM overlay, and TLS-key permission assertions remain regular
+E2E coverage.
+
+Each invocation prints a ten-character run ID before creating resources.
+Conformance sandboxes use names such as `ct-<run-id>-01`. The runner tracks the
+exact name and uses it for cleanup; phase 1 does not add ownership labels.
+
+The runner deletes owned resources after both success and failure. If the test
+process is interrupted before cleanup, locate leftovers without touching
+unrelated gateway state:
+
+```shell
+openshell sandbox list --output json
+openshell sandbox delete <sandbox-name>
+```
+
 Run the Podman-backed Rust CLI e2e suite:
 
 ```shell

@@ -16,7 +16,10 @@ license = "Apache-2.0"
 publish = false
 
 [features]
-e2e = []
+# Selects the minimal portable CLI conformance profile.
+e2e-cli-conformance = []
+# Selects the common E2E suite, including the CLI conformance baseline.
+e2e = ["e2e-cli-conformance"]
 # Selects tests that rely on `host.openshell.internal` (the sandbox's stable
 # alias to the host running test fixtures). docker, podman, and vm wire the
 # alias unconditionally; the kube driver only does so when the chart's
@@ -41,6 +44,16 @@ name = "oidc_pkce"
 path = "tests/oidc_pkce.rs"
 required-features = ["e2e-oidc-pkce"]
 
+[[test]]
+name = "smoke"
+path = "tests/smoke.rs"
+required-features = ["e2e-cli-conformance"]
+
+[[test]]
+name = "vm_overlay"
+path = "tests/vm_overlay.rs"
+required-features = ["e2e-vm"]
+
 [[test]]
 name = "custom_image"
 path = "tests/custom_image.rs"

@@ -10,7 +10,7 @@ set -euo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 E2E_TEST="${OPENSHELL_E2E_DOCKER_TEST:-smoke}"
-E2E_FEATURES="${OPENSHELL_E2E_DOCKER_FEATURES:-e2e,e2e-docker}"
+E2E_FEATURES="${OPENSHELL_E2E_DOCKER_FEATURES:-e2e-docker}"
 DEFAULT_WORKLOAD_MANIFEST="${ROOT}/e2e/gpu/images/.build/workloads.yaml"
 
 if [ "${E2E_TEST}" = "gpu" ] && [ -z "${OPENSHELL_E2E_WORKLOAD_MANIFEST:-}" ] && [ ! -f "${DEFAULT_WORKLOAD_MANIFEST}" ]; then

@@ -26,6 +26,7 @@ E2E_FEATURES="${OPENSHELL_E2E_KUBERNETES_FEATURES:-e2e,e2e-host-gateway,e2e-kube
 # local CLI needs to be built when CI has not supplied a prebuilt one.
 if [ -z "${OPENSHELL_BIN:-}" ]; then
   cargo build -p openshell-cli
+  export OPENSHELL_BIN="${ROOT}/target/debug/openshell"
 fi
 
 test_filter=()

@@ -371,7 +371,6 @@ fi
 # The CLI uses the raw endpoint but still resolves matching metadata so it
 # can find the mTLS client bundle.
 
-export OPENSHELL_E2E_EXPECT_VM_OVERLAY=1
 export OPENSHELL_E2E_DRIVER="vm"
 export OPENSHELL_E2E_VM_STATE_DIR="${RUN_STATE_DIR}"
 e2e_export_gateway_restart_metadata \
@@ -405,5 +404,6 @@ if [ -n "${E2E_TEST_OVERRIDE}" ]; then
 else
   run_e2e_test smoke
   run_e2e_test host_gateway_alias
+  run_e2e_test vm_overlay
   run_e2e_test vm_gateway_start
 fi