the tcsh login-shell problem -- ideas?

Folks, as intimated in my earlier msg today, if a person has
tcsh as their login shell (you know, in /etc/passwd), the
ARK stuff won't work for them, assuming they've set

   <ark-sysadmin-group-must-be> sliadmin </ark-sysadmin-group-must-be>

in their team.xml.  (Idea: in a multi-sysadmin env, you want
to *guarantee* that all ARK work is done as a particular
group.)  This is a bummer.

If ARK cannot be sure that your group will end up right on
the far side (here called 'norbert'), it invokes something like

  /usr/local/bin/ssh norbert /usr/bin/newgrp vladmin

and then shoves 'exec /bin/sh' and then the script you want
into stdin.  As long as the shell on the far side is
/bin/csh (the old one) or any Bourne-ish shell, it works;
if it's tcsh, it fails.

newgrp is a terrible uncontrollable thing.  The only
alternative is to always become root on the far side, and
set the effective user and group thereafter.  (Sadly, you
can't change a process's group, even if it's a group you're
allowed to be in.)

Anyone with any better ideas?

Will