Master: deferred work — future functionality and long-horizon efforts

## What this is

Every open issue asking for functionality that **does not exist yet and is not a defect**. Deliberately deferred: none of it blocks a release, and several depend on hardware access nobody has today.

Defects in current functionality are tracked in the companion master issue. Work already done was closed with evidence rather than parked here.

## Restoring the removed backends

Seven backends were removed because none had ever been shown to run a job end to end. `SUPPORTED_CLUSTER_TYPES` is now exactly `('local', 'ssh', 'slurm', 'huggingface')`, and `config.py:283` maps each removed name to its issue so a user with an older config gets an explanation rather than a `difflib` guess.

| Issue | Backend |
|-|-|
| #140 | PBS/Torque |
| #141 | SGE |
| #142 | Kubernetes execution and provisioning |
| #143 | AWS |
| #144 | GCP |
| #145 | Azure |
| #146 | Lambda Cloud |

**The gate for each is the same and is not negotiable**: a real job, on real hardware of that kind, whose result comes back and is checked in as evidence. That is the gate the surviving four passed. Restoring the code is the easy half and does not close any of these.

## Capability work

- **#151 — data staging.** The *inputs* half is built and verified against real HuggingFace. The **outputs** half named in the title was never built. This should be re-scoped: close the inputs work, split outputs into its own issue.
- **#155 — streaming.** Fetch only the parts of a dataset an analysis touches. Deferred by the owner with reasoning recorded on the issue; needs a design decision before any code.
- **#66 — authentication.** The password/env/GUI chain exists. Kerberos and GSSAPI do not: `grep -rni "gssapi|kerberos|kinit" clustrix/` returns one hit, and it is a keyword in a string.

## Test and quality efforts

- **#98 — 90% coverage epic.** Needs rescoping before it means anything. Its "74%" baseline does not reproduce; the real figure is 70.91%, against a package **17,809 lines smaller** than when the epic was written. Its children targeted files that have since been split, renamed or deleted.
- **#100 — utils.py testing.** Real figure 1,052 statements at 63%, not the "215 lines at 70%" claimed. Multi-day.
- **#105 — error handling and edge cases.** Depends on #123 landing first.
- **#117 — replace mock tests with real execution.** The claimed 2,513 occurrences are actually 575 across 36 files. Three named offenders are fixed and four files deleted; the remainder is real but large.
- **#101 — performance and quality.** Suite runs 334s against a 5-minute target; parallel execution not wired.
- **#126 — red-team campaign.** No hypothesis, bandit or pip-audit anywhere. Groundwork exists in the injection, authentication and billable-safety test modules.
- **#131 — salvage PR #128.** None of the six items landed. Item 6 is moot; its subject was deleted.

## The one item here that is nearly ready

**#127 — release v0.2.0.** All four version strings read 0.2.0, the backends table is honest, `NotImplementedError` appears nowhere in `clustrix/`, and `CHANGELOG.md` carries the entry. What remains is small: cut the tag and release (`git tag` still shows only v0.1.1), and delete `setup.py`. It sits here rather than in the defect master because it is not a bug — but it is the shortest path to something shippable and should probably jump the queue.

## Highest-value item, and it is not on any of these lists

Measured coverage is 70.91%, and that number conceals where the hole is. The live credential path is effectively untested: `auth_manager` 11%, `auth_methods` 25%, `cli_credentials` 9%, `validation` 11% — all imported by `modern_notebook_widget.py` and `cli.py`, all on the SSH backend, which is one of the four clustrix has actually verified.

Chasing a global percentage would not surface that. A successor to #98 should be scoped by *which paths users actually take* rather than by a headline number.

## Definition of done

This issue closes when every child is closed, re-scoped, or explicitly declined — not when the work is finished.

Start by reading the child issues referenced here, then inspect config.py:283, CHANGELOG.md, setup.py, and the current git tags to separate actionable work from deferred design and hardware-dependent efforts. This master issue is done only when every child is closed, re-scoped, or explicitly declined; it is not a single implementation task.

Written by the indexing model from the issue text.