Remove stale VM-agent binary artifact

[simple-agent-manager]

Summary

• Removes the stale tracked executable artifact packages/vm-agent/vm-agent from source control.
• Adds a targeted ignore rule for /packages/vm-agent/vm-agent and a CI quality guard, pnpm quality:tracked-artifacts, that fails if the exact stale root binary is tracked or present in the working tree.
• No runtime behavior change: no Go/runtime source was changed, and deployment paths build VM-agent artifacts from source into packages/vm-agent/bin/ / apps/api/container-artifacts/.

Deployment artifact evidence:

• .github/workflows/deploy-reusable.yml runs make -C packages/vm-agent prepare-container VERSION="$GITHUB_SHA" BUILD_DATE="$BUILD_DATE" before the raw container build.
• apps/api/Dockerfile.vm-agent-container copies apps/api/container-artifacts/vm-agent-linux-amd64 to /usr/local/bin/vm-agent.
• .github/workflows/deploy-reusable.yml runs make -C packages/vm-agent build-all VERSION="$GITHUB_SHA" BUILD_DATE="$BUILD_DATE" and uploads packages/vm-agent/bin/vm-agent-linux-amd64 and packages/vm-agent/bin/vm-agent-linux-arm64 to R2.
• packages/cloud-init/src/template.ts and scripts/vm/cloud-init.yaml download VM-agent from /api/agent/download into /usr/local/bin/vm-agent; they do not use packages/vm-agent/vm-agent.

Validation

• pnpm lint
• pnpm typecheck
• pnpm test
• Additional validation run (if applicable)
  • pnpm exec vitest run --config scripts/quality/vitest.config.ts scripts/quality/check-tracked-artifacts.test.ts — passed, 3 tests.
  • pnpm quality:tracked-artifacts — passed.
  • pnpm exec vitest run --config scripts/quality/vitest.config.ts — passed, 119 tests across 11 quality test files.
  • pnpm quality:source-contract-tests — passed.
  • pnpm quality:file-sizes — passed.
  • git ls-files packages/vm-agent/vm-agent returned no tracked file after deletion; test ! -e packages/vm-agent/vm-agent passed; exact-path grep found no non-guard/task references.
  • /tmp/sam-go-install/go/bin/go test -race ./... from packages/vm-agent was attempted with Go 1.25.0, but local execution could not complete because this workspace has no Docker (docker-dependent PTY/server tests failed with exec: "docker": executable file not found in $PATH). GitHub VM-agent CI jobs run on Ubuntu with Docker available.
• If this PR changes candidate selection for a sweep/cron/alarm loop (WHERE clause, status set, join, or equivalent), expected candidate volume and worst-case per-candidate cost are stated in the summary or validation notes (N/A: no sweep/cron/alarm candidate selection change)

Staging Verification (REQUIRED for all code changes — merge-blocking)

All checkboxes below are mandatory for any PR that changes runtime code (.ts, .tsx, .go, etc.). Write N/A: docs-only ONLY if the PR contains zero runtime code changes. See .claude/rules/13-staging-verification.md.

• Staging deployment green — N/A: no runtime behavior change; source-control artifact deletion plus CI quality guard only.
• Live app verified via Playwright — N/A: no app/runtime behavior change.
• Existing workflows confirmed working — N/A: no deployed application path changed.
• New feature/fix verified on staging — N/A: guard verified locally and will run in CI; deploy artifact paths verified from source.
• Infrastructure verification completed — N/A: no infrastructure behavior change; no cloud-init, VM-agent Go source, DNS, TLS, or deploy script behavior changed.
• Mobile and desktop verification notes added for UI changes — N/A: no UI changes.

Staging Verification Evidence

N/A: this PR deletes a stale tracked binary and adds a repository quality guard. It does not change runtime code or deployed behavior. Deployment artifact paths are verified in the Summary above.

UI Compliance Checklist (Required for UI changes)

• Mobile-first layout verified — N/A: no UI changes.
• Accessibility checks completed — N/A: no UI changes.
• Shared UI components used or exception documented — N/A: no UI changes.
• Playwright visual audit run locally — N/A: no UI changes.

End-to-End Verification (Required for multi-component changes)

• Data flow traced from user input to final outcome with code path citations (see .claude/rules/10-e2e-verification.md)
• Capability test exercises the complete happy path across system boundaries
• All spec/doc assumptions about existing behavior verified against code (not just "read the code")
• If any gap exists between automated test coverage and full E2E, manual verification steps documented below

Data Flow Trace

• Repository guard path: CI .github/workflows/ci.yml → Code Quality Checks → pnpm quality:tracked-artifacts → scripts/quality/check-tracked-artifacts.ts → git ls-files packages/vm-agent/vm-agent and filesystem presence check.
• Deployment path: .github/workflows/deploy-reusable.yml → make -C packages/vm-agent prepare-container / build-all → packages/vm-agent/Makefile writes bin/vm-agent-* and apps/api/container-artifacts/vm-agent-linux-amd64 → R2 upload or container Dockerfile copy. No path uses packages/vm-agent/vm-agent.

Untested Gaps

• Local Go -race suite could not complete without Docker in this workspace; GitHub CI VM-agent jobs provide Docker and are the authoritative check for those docker-dependent tests.

Post-Mortem (Required for bug fix PRs)

What broke

A historical VM-agent binary artifact was committed at packages/vm-agent/vm-agent, increasing repository size and creating a stale executable artifact in source control.

Root cause

Historical build output was tracked at the package root even though maintained build/deploy paths produce artifacts under packages/vm-agent/bin/ and apps/api/container-artifacts/.

Class of bug

Tracked generated artifact / source-control hygiene issue.

Why it wasn't caught

Existing ignore rules covered packages/vm-agent/bin/ and container artifacts, but not the exact stale root binary path, and CI had no guard for this artifact.

Process fix included in this PR

• .gitignore: ignores /packages/vm-agent/vm-agent.
• scripts/quality/check-tracked-artifacts.ts: deterministic guard for the exact stale artifact path.
• scripts/quality/check-tracked-artifacts.test.ts: tests tracked and untracked reintroduction cases.
• .github/workflows/ci.yml: runs the guard in Code Quality Checks.

Post-mortem file

tasks/active/2026-08-01-remove-stale-vm-agent-binary.md

Specialist Review Evidence (Required for agent-authored PRs)

If local subagents were used during Phase 5, list every reviewer below. Do NOT merge until every row shows PASS or ADDRESSED. If any reviewer could not complete (timeout, workspace killed, error), you MUST add the needs-human-review label and stop — do not self-merge. See .claude/rules/25-review-merge-gate.md.

• All local reviewers completed and findings addressed before merge
• If any reviewer did NOT complete: needs-human-review label added and merge deferred to human

Reviewer	Status	Outcome
local task-completion/test-quality reviewer (Linnaeus)	FAILED	Timed out after repeated waits; no findings returned.
local quick guard/test reviewer (Parfit)	FAILED	Timed out after repeated waits; no findings returned.
main-session task-completion-validator + test-engineer pass	PASS	Manual application of validator/test-quality checks found no code/test blockers: research findings map to checklist and diff; acceptance criteria are covered by guard tests/manual exact-path verification; no UI/backend or multi-resource path applies.

Exceptions (If any)

• Scope: Staging and live Playwright verification skipped.
• Rationale: This PR has no runtime behavior changes; it removes a stale generated artifact and adds a repository/CI guard. Deploy artifact source paths were verified directly in workflow/Makefile/Dockerfile/cloud-init code.
• Expiration: This PR only.

Agent Preflight (Required)

• Preflight completed before code changes

Classification

• external-api-change
• cross-component-change
• business-logic-change
• public-surface-change
• docs-sync-change
• security-sensitive-change
• ui-change
• infra-change

External References

N/A: no external API/library behavior change.

Codebase Impact Analysis

Affected files:

• packages/vm-agent/vm-agent: removed stale tracked binary.
• .gitignore: targeted ignore for the stale root VM-agent artifact.
• scripts/quality/check-tracked-artifacts.ts and .test.ts: new quality guard and tests.
• package.json and .github/workflows/ci.yml: CI wiring for the guard.

Documentation & Specs

N/A: no public behavior or user-facing documentation change. Task tracking file added under tasks/active/.

Constitution & Risk Check

Checked Principle XI / hardcoded values: the only blocked artifact path is intentionally hardcoded as the exact stale artifact path named in the task. Risk is limited to local developers who create packages/vm-agent/vm-agent; the guard will ask them to remove that obsolete root binary while preserving supported packages/vm-agent/bin/ outputs.

[codspeed-hq]

Merging this PR will not alter performance

✅ 6 untouched benchmarks

---

_{Comparing sam/execute-task-using-skill-qnvr4a (35d7e2a) with main (ccc9dff)}

[sonarqubecloud]

Quality Gate failed

Failed conditions
B Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[simple-agent-manager]

Closing as duplicate of #1712 (same stale tracked vm-agent binary removal + CI guard). #1712 is smaller, has green checks, and is being completed and merged tonight per Raphaël's backlog-cleanup authorization (SAM task 01KZ9YVKD8FD6JT15FCWRD7TY4).