Tracker: production-readiness of openshellctl (review of caa5117)

[clcollins]

Ordered checklist linking issues 1–25 (from the production-readiness review at commit caa5117) in implementation sequence:

Phase 0 — unblock CI

• [Critical] Unit tests fail on a clean checkout: -f conflict validation runs after gateway dial, CLI tests read the real $HOME #4 hermetic CLI tests + -f validation ordering

Phase 1 — security posture

• [Critical] Sandbox policy is never applied: --policy, OPENSHELL_SANDBOX_POLICY and manifest spec.policy/policyFile are silently dropped #6 policy actually applied
• [Critical][Security] sandbox download tar extraction follows symlinks: arbitrary file write on the host from a malicious sandbox #8 tar symlink traversal
• [High][Security] mTLS/CA material is loaded relative to the process CWD because Resolved.Dir is never populated #11 TLS material from config dir, not CWD
• [High] policyyaml loader accepts shapes the upstream loader rejects; port+ports silently drops port; ToSDK can never fail #19 policyyaml loader strictness

Phase 2 — data loss / hangs / leaks

• [High] -f commands ignore metadata.workspace (can delete the wrong sandbox); manifest approvalMode always overridden by flag default #13 manifest workspace + approvalMode
• [Medium] Flag parity is not enforced: parity_test never reads hack/parity JSON, flag conflicts not derived from it, get --policy-only missing #2 parity enforcement + conflict mechanism (prerequisite of [High] sandbox create: enforce documented flag conflicts, clean up on every --no-keep path, fix --forward lifecycle and partial-failure handling #16)
• [High] sandbox create: enforce documented flag conflicts, clean up on every --no-keep path, fix --forward lifecycle and partial-failure handling #16 create conflicts / no-keep cleanup / forward
• [High] sandbox exec: concurrent Send on one gRPC bidi stream, positional NAME dropped before --, auto-detected TTY never enters interactive mode #18 exec stream + positional + TTY
• [High] Timeouts that never fire: provisioning idle deadline, SSH handshake, connect after stdout EOF #21 dead timeouts
• [High] SSH keepalive cannot detect a dead peer (blocking SendRequest); no gRPC client keepalive configured #3 SSH/gRPC keepalive
• [High] sandbox download reports success when remote tar fails; partial files left in dest #5 download success-on-failure

Phase 3 — auth & transport hardening

• [High][Security] Transport hardening: --gateway-insecure is silent, client secret is exchanged before the plaintext refusal, oidc-config is fetched over an untrusted client #9 insecure flag / secret ordering / oidc-config
• [Medium][Security] Token write-back path derived from unvalidated metadata.json name; -g + --gateway-endpoint sends a gateway's token anywhere #12 write-back path / token binding / last_sandbox / writer fsync
• [Medium] Refresh-token grant is dead code; login writes oidc_token.json unconditionally; write-back errors swallowed #15 refresh-token path / login write
• [Medium] Stream RPCs never receive the Unauthenticated auth retry (exec/watch/logs --tail cannot refresh an expired token) #22 stream RPC auth retry

Phase 4 — contracts

• [Medium] Terminal/signal handling: SIGWINCH teardown race panics without restoring raw mode; Ctrl-C exits 1 with "Error: Canceled"; two duplicate raw-mode stacks #23 terminal/signals
• [Medium] sandbox delete: last_sandbox never cleared, --all silently capped at 1000 with no confirmation, -f appended to positionals #24 delete semantics + waitForDeletion
• [Medium] Exit-code and output contract gaps: unmapped typed errors, list -o json is not an array, unknown -o silently renders table #26 exit codes / output
• [Medium] policyyaml: lint gives false confidence, load→serialize→load is lossy, multi-document YAML silently truncated, no size limit, no glob validation #25 policyyaml lint / serialize / loading

Phase 5 — infrastructure

• Add a hermetic Go integration test package (in-process gateway + SSH sandbox) to replace hack/integration-test.sh #7 hermetic integration test package
• CI/build hardening: -race in CI, real statement-coverage gate, gosec, Go 1.25/1.26 drift, unpinned ubi-micro, goreleaser env, integration tier #10 CI/build hardening
• Test-suite cleanup: remove padding/vacuous tests, fix environment-dependent tests, add the missing security-relevant tests #14 test-suite cleanup

Phase 6 — docs & cleanup

• [documentation] Docs/plan reconciliation: no-op flags, ssh-config ProxyCommand, undocumented login/whoami, stale divergence notes, untrue auth claims #17 docs/plan reconciliation
• Validation gaps, dead code and duplication: name ≤19 TODO, ParseLabels, IPv6 forward, unreachable helpers, two upload FS resolvers, gitignore over-exclusion #20 validation gaps / dead code

Sources for all issues: repository openshift-online/openshellctl at caa5117; github.com/NVIDIA/OpenShell/sdk/go@v0.0.0-20260828082717-d1155aa70042 (openshell/v1/fake, ssh_client.go, tcp_client.go, internal/grpc/conn.go, oidc/discovery.go, proto/openshellv1); golang.org/x/crypto/ssh v0.55.0 (client.go, mux.go); github.com/sabhiram/go-gitignore; grpc-go stream/keepalive docs; Go os.Root docs; docs/plans/0002-openshell-go-client-plan.md; README.md.

---

Generated by Claude Code