Master: deferred work — future functionality and long-horizon efforts #160

What this is

Every open issue asking for functionality that does not exist yet and is not a defect. Deliberately deferred: none of it blocks a release, and several depend on hardware access nobody has today.

Defects in current functionality are tracked in the companion master issue. Work already done was closed with evidence rather than parked here.

Restoring the removed backends

Seven backends were removed because none had ever been shown to run a job end to end. SUPPORTED_CLUSTER_TYPES is now exactly ('local', 'ssh', 'slurm', 'huggingface'), and config.py:283 maps each removed name to its issue so a user with an older config gets an explanation rather than a difflib guess.

The gate for each is the same and is not negotiable: a real job, on real hardware of that kind, whose result comes back and is checked in as evidence. That is the gate the surviving four passed. Restoring the code is the easy half and does not close any of these.

Capability work

• Make Clustrix a data mover: stage declared inputs and outputs (reverses the "not a data mover" limitation) #151 — data staging. The inputs half is built and verified against real HuggingFace. The outputs half named in the title was never built. This should be re-scoped: close the inputs work, split outputs into its own issue.
• Streaming: fetch only the parts of a dataset an analysis actually touches (split from #151) #155 — streaming. Fetch only the parts of a dataset an analysis touches. Deferred by the owner with reasoning recorded on the issue; needs a design decision before any code.
• Enhanced Authentication Methods for Cluster Access #66 — authentication. The password/env/GUI chain exists. Kerberos and GSSAPI do not: grep -rni "gssapi|kerberos|kinit" clustrix/ returns one hit, and it is a keyword in a string.

Test and quality efforts

• Epic: Achieve 90% Test Coverage #98 — 90% coverage epic. Needs rescoping before it means anything. Its "74%" baseline does not reproduce; the real figure is 70.91%, against a package 17,809 lines smaller than when the epic was written. Its children targeted files that have since been split, renamed or deleted.
• Utils Module Testing #100 — utils.py testing. Real figure 1,052 statements at 63%, not the "215 lines at 70%" claimed. Multi-day.
• Error Handling & Edge Cases #105 — error handling and edge cases. Depends on Replace silent-failure handling, fix resource leaks and import-time side effects #123 landing first.
• Replace assertion-free mock tests with tests that actually execute (2,513 mock occurrences) #117 — replace mock tests with real execution. The claimed 2,513 occurrences are actually 575 across 36 files. Three named offenders are fixed and four files deleted; the remainder is real but large.
• Performance & Quality Optimization #101 — performance and quality. Suite runs 334s against a 5-minute target; parallel execution not wired.
• Red-team campaign: trust boundary, script injection, serialization fuzzing, cost safety #126 — red-team campaign. No hypothesis, bandit or pip-audit anywhere. Groundwork exists in the injection, authentication and billable-safety test modules.
• Extract the salvageable pieces from the closed test-coverage epic (PR #128) #131 — salvage PR Issue #112: Surface the test-coverage epic work for review (do not merge as-is) #128. None of the six items landed. Item 6 is moot; its subject was deleted.

The one item here that is nearly ready

#127 — release v0.2.0. All four version strings read 0.2.0, the backends table is honest, NotImplementedError appears nowhere in clustrix/, and CHANGELOG.md carries the entry. What remains is small: cut the tag and release (git tag still shows only v0.1.1), and delete setup.py. It sits here rather than in the defect master because it is not a bug — but it is the shortest path to something shippable and should probably jump the queue.

Highest-value item, and it is not on any of these lists

Measured coverage is 70.91%, and that number conceals where the hole is. The live credential path is effectively untested: auth_manager 11%, auth_methods 25%, cli_credentials 9%, validation 11% — all imported by modern_notebook_widget.py and cli.py, all on the SSH backend, which is one of the four clustrix has actually verified.

Chasing a global percentage would not surface that. A successor to #98 should be scoped by which paths users actually take rather than by a headline number.

Definition of done

This issue closes when every child is closed, re-scoped, or explicitly declined — not when the work is finished.