fix(cleanup): never delete resources matched by .vapi-ignore

[scott-lowe-vapi]

Value

V.A.L.U.E. tier: small — a behavior change in a destructive command (npm run cleanup). Not micro: it changes what the command deletes.

• Problem: npm run cleanup -- <org> --force --confirm <org> deletes every platform resource that isn't in .vapi-state.<org>.json. That included resources matched by resources/<org>/.vapi-ignore, which is how users tell this repo "don't manage these". push already respected the ignore file; cleanup didn't. So the file you write to protect a resource was the one way to get it deleted (improvements.md refactor(push): extract reconcileStateKeyForResource — fold two ensure-fns into one generic helper #36).
• Who it affects: anyone who runs cleanup in an org that also holds resources managed outside this repo (dashboard-owned assistants, legacy tools, another team's squad).
• What changes:
  • Cleanup loads .vapi-ignore and checks each orphan against it, using the file IDs pull would give it (<slug>-<uuid8>, and the bare slug), so a pattern written against your files matches the platform resource too.
  • Matched resources are listed as 🚫 <name> retained (matched .vapi-ignore: <pattern>) and never deleted, in dry runs and destructive runs. The summary counts them.
  • AGENTS.md, the workflows guide and .vapi-ignore.example say that neither push nor cleanup touches ignored resources. improvements.md refactor(push): extract reconcileStateKeyForResource — fold two ensure-fns into one generic helper #36 is marked resolved.

Evidence of value

New tests/cleanup-ignore.test.ts runs the real src/cleanup.ts against a stub API holding a tracked assistant, an ignored assistant (assistants/legacy-*), an ignored tool (tools/legacy-*) and one genuine orphan.

Run	Before this PR	After
Destructive cleanup: DELETE requests	3 — the orphan plus the ignored assistant and tool	1 — the orphan only
Dry run output	Lists the ignored resources as "would delete"	Lists them as retained, naming the matching pattern

The test was run against the old cleanup.ts first and failed on the extra deletes, then passed with the fix.

Testing plan

• npm test and npx tsc --noEmit pass.
• Not tested: a live cleanup against a real org. The stub mirrors the list and delete endpoints cleanup calls; no live run was needed to show the bug or the fix.

Refs TEST-141

🤖 Generated with Claude Code

[scott-lowe-vapi]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• feat: identify every gitops API request with a User-Agent #78
• feat(validate): catch broken references and show findings on the PR #77
• ci: validate every org's resources on every pull request #76
• ci: lint workflows and test the PR check's key-sharing decision #75
• test(docs): check that doc links, commands and flags exist #74
• fix(cleanup): never delete resources matched by .vapi-ignore #73 👈 (View in Graphite)
• docs(agents): one compact guide for Claude, Codex and Cursor #72
• docs: edit the guides for new readers and fix inaccuracies #71
• docs: restructure the README into a short landing page and topic guides #70
• docs: prepare for public release: scrub internal names, fix examples, add community files #69
• feat(promotion): gate promotion out of an org on a passing check #66
• fix(promotion): commit the files of transitions that applied when a later one fails #65
• test(promotion): pin the exact files promoting an assistant writes to the target #68
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.