feat: retire license keys: drop license_key and llm: license

[Svilen-Stefanov]

Update 24 Sep: the vendored tests/contracts/ are refreshed from licensing-aws paywall/7-harness at 55c2403 (identical to paywall/remove-legacy at e49053e). licensing-aws dropped the license email match on Svilen's decision: holders are linked by an admin backfill (scripts/licensing_admin.py link-license --license-key <key> --github-username <login> [--dry-run]), so /me has no offers.legacy_link and /legacy/link takes only {license_key}. Nothing in the Action read the removed fields.

Head 36360db. python -m unittest discover -s tests in python:3.12-slim (git, jq, unzip, jsonschema): 202 tests OK, 7 skipped.

Merge only after licensing-aws is in enforce and the key cutoff has passed.

The last PR of the paywall stack for the Action (design section 14: the flag's last PR removes the legacy path). Stacked on #135 (paywall/3-action-comment-pr), which sits on #133 (paywall/3-action-wall). Before the cutoff a license key still validates at the proxy, so merging this early would drop the plan of every workflow still on llm: license.

What goes

License keys are retired completely (design 10.5, decided 23 Sep), so the Action stops carrying them:

• the license_key input and its CB_IN_LICENSE_KEY wiring in action.yml;
• the llm: license answer, and with it the license and byok+license tiers: llm_tier is now hosted or byok;
• the licence file staged in the auth directory (license.txt), its masking and the deprecation warning in verify-credentials.sh;
• --license-file and the ~codeboarding-license~ packing in scripts/oidc_relay.py, used by the relay and by the preflight and finish in scripts/action/run_meter.py; the bearer is now <oidc> or <oidc>~codeboarding-run~<run_id>;
• the refusals missing_license_key, hosted_with_license and license_with_provider_key;
• the README's licence rows, the license_key input row and the deprecation paragraph;
• the dogfood workflows' llm: license / CODEBOARDING_LICENSE: both now say llm: hosted (both jobs already have id-token: write).

What replaces llm: license

A workflow still on llm: license is refused with a new code, license_retired, whose message and PR-comment details give the one-word fix (llm: hosted, drop license_key), rather than the generic unknown_llm. It fails red like every other refusal: the Action never picks a credential for you, and llm: hosted already runs on the plan the key paid for, since that plan now follows the GitHub account. A leftover license_key: line under llm: hosted only earns GitHub's "Unexpected input" warning; the README says so. Nothing in the webview keys on the removed codes (checked with a search of CodeBoarding-webview/src), and the webview's own removal PR shows llm: license workflows as needing an update.

The hosted tier's wording changes from "CodeBoarding's hosted free tier" to "CodeBoarding's hosted tier, on your CodeBoarding plan", since hosted now means what license used to mean.

Why feat: and not feat!:

Removing an input and an llm value is a breaking change. It ships as feat: for the same reason AGENTS.md records for the explicit-credentials change: a major bump moves adopters to v2 and freezes v1, so v1 workflows would keep sending a key the proxy no longer honours. On the moving v1 tag they get the named refusal and the fix instead.

Kept

• tests/contracts/, the vendored copy of licensing-aws's contracts, is unchanged (it still carries legacy-link.* and mode); the Action does not read those schemas.
• The protected tests are untouched and pass: tests/test_merge_base_contract.py and test_action_auth.py::test_a_named_provider_never_falls_back_to_codeboarding_credentials.
• CHANGELOG.md is release-please's; the removal reaches it from this commit's message.

Tests

• python -m unittest discover -s tests in python:3.12-slim (git, jq, unzip, jsonschema installed): 204 tests OK, 7 skipped (the engine-pinned drift tests, as on main). feat: name the pull request of a /codeboarding comment run in the run check #135 has 209: six licence tests are removed (licence beside a provider key, llm: license with a provider key, hosted with a licence, llm: license without a key, licensed BYOK not starting the relay, the staged licence in the preflight bearer) and one added, test_license_is_refused_as_retired_with_the_hosted_line_to_use; test_license_key_is_deprecated_but_still_wired became test_license_key_is_retired.
• rhysd/actionlint:1.7.7: clean. shellcheck scripts/run_local.sh scripts/action/*.sh: clean. black==25.1.0 --check .: clean (the pre-commit hook passed too).

No design section 15 decision is made here beyond the key cutoff (30 days after release, proposed), which gates the merge.

🤖 Generated with Claude Code

[codeboarding-review]

CodeBoarding review

Status: 1 changed component

See the full change in CodeBoarding.

graph LR
    n_action_scripts["action_scripts"]
    classDef added fill:#1f883d,stroke:#0b5d23,color:#ffffff;
    classDef modified fill:#bf8700,stroke:#7d4e00,color:#ffffff;
    classDef deleted fill:#cf222e,stroke:#82071e,color:#ffffff,stroke-dasharray:5 3;
    class n_action_scripts modified;

Loading

_{download artifacts · run 36055368123}