Adopt the shared vm-lab and drop KeyPath's copy

[malpern]

The lab began in this repository and was coupled to this project in five places, so a second application could not use it. It now lives in vm-lab and serves KeyPath as one tenant among others, reached as vm-lab keypath <command>.

3,490 deletions, 90 insertions.

What moved, and why those files

Four helpers turned out to be lab code wearing this project's name. peekaboo-ui and desktop-bootstrap referenced no product at all. nameplate-instrumentation named KeyPath only in an on-screen window label, and permission-drag only in a temp directory and three environment variable prefixes.

The test that decided each case: if a file names the product, it belongs to the tenant. Applied mechanically, it moved two files my initial eyeball classification had put on the wrong side.

KeyPath now declares itself

.vm-lab.tsv at the repository root states the artifact its installer must contain, the command that admits a lane, and the managed-policy generator and verifier. The lab knows nothing about KeyPath beyond that file, so changing lab behaviour for KeyPath means changing that file.

Verified before deleting anything

• A real lease taken through the new CLI, installing KeyPath's declared artifact — proven by deliberately pairing KeyPath's descriptor with a different installer and watching it fail looking for KeyPath.app rather than anything hardcoded.
• A second tenant taking its own lease and installing its own application from a two-line descriptor, with no KeyPath.app present and no admission command invented for it.

Two staying scripts needed repointing

scenarios/installer-scenario reads the guest staging directory, renamed .vm-lab. macos-26-selector-driver resolves peekaboo-ui, now from the lab checkout, keeping its existing KEYPATH_SELECTOR_PEEKABOO override.

What deliberately stays

Scenarios, MDM policy, and the dashboards are KeyPath's. So is host-disk-reserve — it is generic, but CI calls it directly on the runner in three workflows, and making CI depend on the lab being installed there is a worse trade than duplicating twenty-six lines. Flagging that as a considered exception rather than an oversight.

Note on #1258

That PR modified the remote.sh this deletes. Its work — credential-safe dialog input on the Parallels macOS 26/27 lanes, verified live against macOS 27 — was ported to vm-lab first, along with its tests, and the postcondition was re-verified to fail when defeated. #1258 is superseded and can be closed; merging it after this would resurrect a deleted file.

One honest gap

Docs that told a reader to run peekaboo-ui inside a guest relied on it riding along in this repo's archive. It no longer does. Those docs now say so and point at the peekaboo the desktop base provides at /usr/local/bin. Shipping the lab's guest-side helpers into leases is a real follow-up, not something this PR solves.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[claude]

Review findings

1. Likely-missing .vm-lab.tsv (high confidence, blocks the new workflow). AGENTS.md now says: "KeyPath declares itself to the lab in .vm-lab.tsv at the repository root: the artifact its installer must contain, the command that admits a lane, and the managed-policy generator and verifier. The lab knows nothing about KeyPath beyond that file." But the diff's changed-file list has no new .vm-lab.tsv at the repo root — only AGENTS.md, the Scripts/lab/* deletions, macos-26-selector-driver, scenarios/installer-scenario, and the docs files are touched. If .vm-lab.tsv doesn't already exist elsewhere in the tree, vm-lab keypath list/create/... has nothing to read for this repo and the whole workflow this PR points agents to is broken on first use. Please confirm the file exists (in this PR or a prior one) or add it here.

2. Hardcoded personal-machine fallback path (minor). In Scripts/lab/macos-26-selector-driver, the new default for PEEKABOO is:

   pathlib.Path(os.environ.get("VM_LAB_HOME", pathlib.Path.home() / "local-code" / "vm-lab")) / "lib" / "peekaboo-ui"

   This bakes in an assumption that every runner has vm-lab checked out at ~/local-code/vm-lab. On any host/CI runner where that layout doesn't hold and VM_LAB_HOME isn't set, this silently resolves to a nonexistent path rather than failing with a clear "set VM_LAB_HOME" error. Worth an explicit existence check or a louder failure mode.

Note: the diff was truncated after ~60000 bytes (mid-way through the Scripts/lab/remote.sh deletion), so I could not review the rest of remote.sh's deletion, Scripts/lab/scenarios/installer-scenario, Scripts/lab/tests/peekaboo-ui-tests.sh, or the doc file changes (docs/testing/remote-installer-lab.md, docs/testing/managed-vm-lanes.md, installer-gui-automation-capabilities.md) for stale references to the deleted scripts.