refactor(e2e): align suite layout with testing strategy

Move behavioral suites under e2e/suites and extract shared Rust tooling into e2e/support/rust. Organize conformance tests into one Cargo target per area with story modules containing the tests and assertions. Remove the separate scenario crate and registry, and split lifecycle coverage into independent stop/start and stopped-deletion stories.

Reuse shared helpers from the existing Rust harness, preserve artifact packaging and focused test selection, and include tooling and pure assertion tests in test:rust and branch checks. Update authoring guidance for required behavior and retained failures with explicit waivers.

Closes #4119

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

.github/workflows/branch-checks.yml

@@ -141,6 +141,8 @@ jobs:
         shell: nix develop -c bash -euo pipefail {0}
         run: |
           cargo fmt --all -- --check
+          cargo fmt --manifest-path e2e/support/rust/Cargo.toml --all -- --check
+          cargo fmt --manifest-path e2e/suites/conformance/Cargo.toml --all -- --check
           cargo fmt --manifest-path e2e/rust/Cargo.toml --all -- --check
           cargo fmt --manifest-path examples/governance-interceptor/Cargo.toml --all -- --check
           cargo fmt --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --all -- --check
@@ -196,6 +198,8 @@ jobs:
         shell: nix develop -c bash -euo pipefail {0}
         run: |
           cargo clippy --locked --workspace --all-targets -- -D warnings
+          cargo clippy --locked --manifest-path e2e/support/rust/Cargo.toml --workspace --all-targets -- -D warnings
+          cargo clippy --locked --manifest-path e2e/suites/conformance/Cargo.toml --workspace --all-targets -- -D warnings
           cargo clippy --locked --manifest-path e2e/rust/Cargo.toml --all-targets -- -D warnings
           cargo clippy --locked --manifest-path examples/governance-interceptor/Cargo.toml --all-targets -- -D warnings
           cargo clippy --locked --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --all-targets -- -D warnings
@@ -235,6 +239,8 @@ jobs:
           OPENSHELL_TELEMETRY_ENABLED: "false"
         run: |
           cargo nextest run --locked --profile ci --workspace --features openshell-server/test-support
+          cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path e2e/support/rust/Cargo.toml
+          cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path e2e/suites/conformance/Cargo.toml --package openshell-test-conformance-cli -E 'binary(policy_advisor) & test(draft_assertion::tests::)'
           cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml
 
   rust-build-modes:

AGENTS.md

@@ -22,7 +22,6 @@ Do not rely on this file for a full inventory. The detailed public and contribut
 | Path | Components | Purpose |
 |------|-----------|---------|
 | `crates/openshell-cli/` | CLI binary | User-facing command-line interface |
-| `crates/openshell-conformance/` | CLI conformance library | Reusable driver-agnostic scenarios and command runner |
 | `crates/openshell-server/` | Gateway server | Control-plane API, sandbox lifecycle, auth boundary |
 | `crates/openshell-sandbox/` | Sandbox runtime | Capability-free workload launcher, process identity, and seccomp-mediated I/O |
 | `crates/openshell-supervisor/` | Supervisor runtime | Gateway session, policy evaluation, credentials, and upstream networking |
@@ -61,6 +60,9 @@ Do not rely on this file for a full inventory. The detailed public and contribut
 | `python/openshell/` | Python SDK | Python bindings and CLI packaging |
 | `sdk/typescript/` | TypeScript SDK | Native Connect client, curated sandbox API, and generated protobuf types |
 | `proto/` | Protobuf definitions | gRPC service contracts |
+| `e2e/suites/` | Behavioral E2E suites | Conformance scenarios, feature tests, and driver tests |
+| `e2e/support/rust/` | Shared Rust test tooling | CLI runner, binary resolution, output parsing, and port utilities |
+| `tests/` | Test provisioning | Target configuration, artifact construction, and Ansible setup |
 | `deploy/` | Docker, Helm, K8s | Dockerfiles, Helm chart, manifests |
 | `docs/` | Published docs | MDX pages, navigation, and content assets |
 | `fern/` | Docs site config | Fern site config, components, and theme assets |

CI.md

@@ -522,6 +522,14 @@ merge.
 Do not add the informational Actionlint, Zizmor, Dependency Review, or CodeQL
 jobs to the required status list while they remain in observation mode.
 
+## Conformance source checks
+
+Branch Rust checks format and lint the separate
+`e2e/suites/conformance` workspace and shared tooling in `e2e/support/rust`.
+The Rust test jobs run the shared tooling and select the pure policy assertion
+tests in the conformance CLI package with the CI nextest profile, without a gateway. Gateway-backed CLI tests retain their driver E2E and installed-artifact
+integration lanes; source unit-test jobs do not execute those entry points.
+
 ## Nix download recovery
 
 Jobs that enter the development shell enable `prepare-shell: "true"` on

Cargo.lock

@@ -8,14 +8,32 @@ mise run e2e           # End-to-end tests (starts a Docker-backed gateway)
 mise run ci            # Everything: lint, compile checks, and tests
 ```
 
+## Test Families
+
+- Lint checks formatting, style, and static rules.
+- Unit tests verify a component in isolation.
+- Integration tests verify interactions between components.
+- End-to-end tests exercise a configured OpenShell target through a client.
+- Benchmarks measure performance or scale separately from behavioral correctness.
+
+End-to-end suites under `e2e/suites/` are grouped by intent: conformance verifies
+required public behavior, feature suites need a named external service or special
+gateway configuration, and driver suites verify driver or host integration.
+The [conformance guide](e2e/suites/conformance/README.md) owns conformance
+requirements, authoring, and execution guidance. Existing mixed suites remain
+under `e2e/rust/` while their behavior is migrated. `tests/` supplies provisioning
+and artifact construction independently of the suite layout.
+
 ## Test Layout
 
 ```text
 crates/*/src/          # Inline #[cfg(test)] modules
 crates/*/tests/        # Rust integration tests
 python/openshell/      # Python unit tests (*_test.py suffix)
 e2e/python/            # Python E2E tests (test_*.py prefix)
-e2e/rust/              # Rust CLI E2E tests
+e2e/rust/              # Legacy Rust CLI E2E tests awaiting migration
+e2e/suites/            # Conformance, feature, and driver E2E suites
+tests/                 # Target provisioning and artifact construction
 ```
 
 ## Rust Tests
@@ -210,10 +228,15 @@ When more than one test needs this behavior, put the transport in the shared
 Rust e2e harness and require callers to use it instead of duplicating DNS,
 HTTP `Host`, TLS SNI, and mTLS handling.
 
+Shared Rust test tooling lives under `e2e/support/rust`, including the CLI runner,
+binary resolution, output parsing, and port utilities. Conformance scenarios live
+under `e2e/suites/conformance/cli/tests`. `mise run test:rust` includes the tooling
+and scenario unit tests without requiring a gateway.
+
 Suites:
 
 - Common suite (`--features e2e`) - driver-neutral CLI behavior, sandbox lifecycle, sync, port forwarding, policy, and provider tests.
-- CLI conformance (`tests/suites/conformance`) - portable Cargo tests for
+- CLI conformance (`e2e/suites/conformance`) - portable Cargo tests for
   lifecycle, mechanistic drafts, file transfer, and the sandbox-local API,
   including agent-authored permission requests. Driver E2E runs the complete
   Cargo test package. The installed-artifact conformance suite runs the same
@@ -251,7 +274,7 @@ cargo build --package openshell-cli
 OPENSHELL_BIN="$PWD/target/debug/openshell" \
   cargo test \
     --locked \
-    --manifest-path tests/suites/conformance/Cargo.toml \
+    --manifest-path e2e/suites/conformance/Cargo.toml \
     --package openshell-test-conformance-cli \
     --no-fail-fast \
     -- \