From d4ac56c15564dbe2a20a68429391e0be92c53325 Mon Sep 17 00:00:00 2001
From: Svilen Stefanov <svilen.ks@gmail.com>
Date: Thu, 24 Sep 2026 02:28:39 +0200
Subject: [PATCH] feat: retire license keys: drop license_key and llm: license

Plans follow the GitHub account a run is charged to, and license keys stop
validating at the key cutoff (design 10.5), so the action stops carrying
them: no license_key input, no licence file staged, no
`~codeboarding-license~` in the relay's or the preflight's bearer, and the
tiers are hosted and byok only.

A workflow still on `llm: license` is refused as `license_retired` with the
one-word fix instead of `unknown_llm`. The dogfood workflows move to
`llm: hosted`.

Shipped as feat:, not feat!:, for the reason AGENTS.md gives for the llm
change: v1 users must receive it on the moving tag.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/codeboarding-sync.yml |   3 +-
 .github/workflows/codeboarding.yml      |   7 +-
 README.md                               |  45 ++++------
 action.yml                              |   9 +-
 scripts/action/configure-auth.sh        |   5 +-
 scripts/action/credential_check.py      | 111 ++++++++----------------
 scripts/action/run_meter.py             |  13 +--
 scripts/action/verify-credentials.sh    |   7 --
 scripts/oidc_relay.py                   |  15 +---
 tests/test_action_auth.py               |  68 ++-------------
 tests/test_action_inputs.py             |   8 +-
 tests/test_llm_contract.py              |  74 +++++-----------
 tests/test_oidc_relay.py                |  12 +--
 tests/test_run_meter.py                 |  13 +--
 14 files changed, 98 insertions(+), 292 deletions(-)

diff --git a/.github/workflows/codeboarding-sync.yml b/.github/workflows/codeboarding-sync.yml
index 2660515..4f1a303 100644
--- a/.github/workflows/codeboarding-sync.yml
+++ b/.github/workflows/codeboarding-sync.yml
@@ -142,8 +142,7 @@ jobs:
         with:
           mode: sync
           # CodeBoarding's own repositories run on the CodeBoarding plan.
-          llm: license
-          license_key: ${{ secrets.CODEBOARDING_LICENSE }}
+          llm: hosted
           sync_strategy: ${{ inputs.sync_strategy || 'push' }}
           force_full: ${{ inputs.force_full || false }}
           # App token authenticates the baseline push so the commit is attributed
diff --git a/.github/workflows/codeboarding.yml b/.github/workflows/codeboarding.yml
index 3495800..38240f8 100644
--- a/.github/workflows/codeboarding.yml
+++ b/.github/workflows/codeboarding.yml
@@ -111,8 +111,7 @@ jobs:
       - uses: ./
         with:
           # Named, not inferred: the action refuses to guess where credentials come
-          # from, so every workflow says which of hosted / license / a provider it
-          # wants. CodeBoarding's own repositories run on the CodeBoarding plan.
-          llm: license
-          license_key: ${{ secrets.CODEBOARDING_LICENSE }}
+          # from, so every workflow says which of hosted / a provider it wants.
+          # CodeBoarding's own repositories run on the CodeBoarding plan.
+          llm: hosted
           github_token: ${{ steps.codeboarding-app-token-client.outputs.token || steps.codeboarding-app-token-app.outputs.token || github.token }}
diff --git a/README.md b/README.md
index f913867..838c669 100644
--- a/README.md
+++ b/README.md
@@ -52,7 +52,7 @@ jobs:
     steps:
       - uses: CodeBoarding/CodeBoarding-action@v1
         with:
-          llm: hosted   # or license, or a provider name -- see Authentication
+          llm: hosted   # or a provider name -- see Authentication
 ```
 
 Automatic runs review both draft and non-draft pull requests and update one sticky **CodeBoarding review** comment. Opening, reopening, or pushing a commit runs analysis; changing only the draft state does not. A trusted repository owner, member, or collaborator can comment `/codeboarding` to analyze the current PR head again, including on fork PRs; every command creates a new result comment.
@@ -107,16 +107,11 @@ Every review comment ends with a machine-readable HTML comment, `<!-- codeboardi
 ## Authentication and providers
 
 The `llm` input is required and says where analysis credentials come from. There are
-three answers, and the action never picks one for you:
+two answers, and the action never picks one for you:
 
 ```yaml
     with:
-      llm: hosted                                        # CodeBoarding's free tier
-```
-```yaml
-    with:
-      llm: license                                       # a CodeBoarding plan
-      license_key: ${{ secrets.CODEBOARDING_LICENSE }}
+      llm: hosted                                        # CodeBoarding's hosted tier, on your plan
 ```
 ```yaml
     with:
@@ -124,7 +119,7 @@ three answers, and the action never picks one for you:
       anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 ```
 
-`hosted` and `license` run through CodeBoarding's proxy and need `id-token: write`, which
+`hosted` runs through CodeBoarding's proxy and needs `id-token: write`, which
 mints short-lived credentials per request and stores no LLM secret in your repository. A
 provider key is used directly and needs no OIDC permission.
 
@@ -139,21 +134,17 @@ The same rule makes the combinations explicit rather than order-dependent:
 | Workflow says | Result |
 |---|---|
 | nothing | refused: `llm` is required |
-| `llm: hosted` | the free tier |
+| `llm: hosted` | CodeBoarding's hosted tier, on the plan of whoever the run is charged to |
 | `llm: hosted` + any provider key | refused: pick one |
-| `llm: hosted` + `license_key` | refused: use `llm: license` |
-| `llm: license` without `license_key` | refused: names the secret to add |
+| `llm: license` | refused: license keys are retired, use `llm: hosted` |
 | `llm: anthropic` + `anthropic_api_key` | Anthropic, directly |
 | `llm: anthropic`, key empty or absent | refused: names the input and the secret |
 | `llm: anthropic` + `openai_api_key` | refused: a second provider's key |
-| `llm: anthropic` + key + `license_key` | Anthropic, on a CodeBoarding plan |
 
-A licence alongside your own key is deliberately allowed: it says "my CodeBoarding plan,
-my own tokens". **Your key always wins.** A direct provider call never reaches
-CodeBoarding, so the licence is never spent on a model call. It only tells the run's
-check whose plan the run is on, and the run is counted like any own-key run (see
-[Plans and allowances](#plans-and-allowances)). The job summary says so on every run, rather than leaving you to
-infer it from the tier name.
+License keys are retired: plans follow the GitHub account a run is charged to (see
+[Plans and allowances](#plans-and-allowances)). A workflow that still says `llm: license` is refused with the
+one-word fix; drop its `license_key` line too, which GitHub otherwise reports as an
+unexpected input.
 
 ### Plans and allowances
 
@@ -199,11 +190,6 @@ ahead and how deep it may go. A final step reports whether a map was produced.
   with the proxy, so their hosted calls fail once it enforces plans. `@v1` gets this
   release automatically; a workflow pinned to an older tag or SHA must update.
 
-`license_key` is deprecated: plans now follow your GitHub account. It keeps working until
-the license key cutoff and is ignored after it; each run that sets it says so. Link the key
-to your account on the [plan page](https://app.codeboarding.org/dashboard/plan), then
-remove it (and use `llm: hosted` instead of `llm: license`).
-
 ### Providers
 
 Each provider has its own inputs, so which key a workflow uses is readable from the file
@@ -240,8 +226,8 @@ to Core and silently stay unreachable here.
 
 Every run reports what it resolved, so the answer never has to be inferred from behaviour:
 
-- outputs `llm_tier` (`hosted`, `license`, `byok`, `byok+license`), `llm_provider` (empty
-  on the hosted tiers, where the upstream is ours rather than yours), and
+- outputs `llm_tier` (`hosted`, `byok`), `llm_provider` (empty on the hosted tier, where
+  the upstream is ours rather than yours), and
   `llm_config_error` (empty when configured);
 - a job-summary table naming the tier and provider;
 - on a configuration failure, an error annotation and — in review mode — a pull request
@@ -352,11 +338,10 @@ With the default `github.token`, the repository or organization must allow GitHu
 | Input | Mode | Default | Description |
 |---|---|---|---|
 | `mode` | both | `review` | `review` or `sync`. |
-| `llm` | both | **required** | `hosted`, `license`, or a provider name. No default. |
+| `llm` | both | **required** | `hosted` or a provider name. No default. |
 | `<provider>_api_key` | both | empty | That provider's key, e.g. `anthropic_api_key`. See [Providers](#providers). |
 | `<provider>_base_url` | both | empty | That provider's endpoint, where it has one. |
 | `aws_bedrock_region` | both | empty | Bedrock region. Core defaults to `us-east-1`. |
-| `license_key` | both | empty | Deprecated. CodeBoarding license, required by `llm: license`; ignored after the license key cutoff. |
 | `model` | both | empty | Default model for both analysis and parsing. |
 | `agent_model` | both | empty | Analysis-only override for `model`. |
 | `parsing_model` | both | empty | Parsing-only override for `model`. |
@@ -396,8 +381,8 @@ breaking CLI migration.
 
 | Output | Mode | Description |
 |---|---|---|
-| `llm_tier` | both | `hosted`, `license`, `byok`, or `byok+license`. |
-| `llm_provider` | both | Provider the run used. Empty on `hosted` and `license`: which upstream the proxy routes to is CodeBoarding's decision, not your configuration. |
+| `llm_tier` | both | `hosted` or `byok`. |
+| `llm_provider` | both | Provider the run used. Empty on `hosted`: which upstream the proxy routes to is CodeBoarding's decision, not your configuration. |
 | `llm_config_error` | both | Configuration failure code, empty when configured. |
 | `diagram_md` | review | Path to the rendered Mermaid block on the runner. |
 | `n_changed` | review | Number of changed components. |
diff --git a/action.yml b/action.yml
index 43358d4..2bc66c9 100644
--- a/action.yml
+++ b/action.yml
@@ -10,12 +10,8 @@ inputs:
     required: false
     default: 'review'
   llm:
-    description: 'Required. Where analysis credentials come from: hosted, license, or a provider name (anthropic, aws_bedrock, cerebras, deepseek, glm, google, kimi, litellm, ollama, openai, openrouter, orcarouter, vercel).'
+    description: 'Required. Where analysis credentials come from: hosted or a provider name (anthropic, aws_bedrock, cerebras, deepseek, glm, google, kimi, litellm, ollama, openai, openrouter, orcarouter, vercel).'
     required: true
-  license_key:
-    description: 'Deprecated: plans now follow your GitHub account. A CodeBoarding license key, required by llm: license and optional alongside a provider key; it keeps working until the license key cutoff and is ignored after it.'
-    required: false
-    default: ''
   # Anthropic - selected by llm: anthropic
   anthropic_api_key:
     description: 'Anthropic API key, used when llm is anthropic. Sets ANTHROPIC_API_KEY.'
@@ -151,7 +147,7 @@ inputs:
     default: '1'
 outputs:
   llm_tier:
-    description: 'Resolved credential tier: hosted, license, byok, or byok+license.'
+    description: 'Resolved credential tier: hosted or byok.'
     value: ${{ steps.llm.outputs.tier }}
   llm_provider:
     description: 'Provider this run used for analysis.'
@@ -258,7 +254,6 @@ runs:
       env:
         ACTION_PATH: ${{ github.action_path }}
         CB_IN_LLM: ${{ inputs.llm }}
-        CB_IN_LICENSE_KEY: ${{ inputs.license_key }}
         CB_IN_ANTHROPIC_API_KEY: ${{ inputs.anthropic_api_key }}
         CB_IN_AWS_BEDROCK_API_KEY: ${{ inputs.aws_bedrock_api_key }}
         CB_IN_AWS_BEDROCK_REGION: ${{ inputs.aws_bedrock_region }}
diff --git a/scripts/action/configure-auth.sh b/scripts/action/configure-auth.sh
index 0008dcc..208a88e 100755
--- a/scripts/action/configure-auth.sh
+++ b/scripts/action/configure-auth.sh
@@ -19,7 +19,7 @@ fi
 TIER="$(cat "$AUTH_DIR/tier")"
 
 case "$TIER" in
-  hosted|license) ;;
+  hosted) ;;
   *) echo "Using direct $(cat "$AUTH_DIR/provider-name") credentials."; exit 0 ;;
 esac
 
@@ -28,9 +28,6 @@ PID="$AUTH_DIR/relay.pid"
 LOG="$AUTH_DIR/relay.log"
 
 RELAY_ARGS=(--upstream-base-url "$HOSTED_PROXY_URL" --ready-file "$READY")
-if [ -s "$AUTH_DIR/license.txt" ]; then
-  RELAY_ARGS+=(--license-file "$AUTH_DIR/license.txt")
-fi
 # Written by the preflight when the proxy gave this run an id; read per request.
 RELAY_ARGS+=(--run-id-file "$AUTH_DIR/run-id")
 # Outside the auth directory, which goes with the analysis step: the wall outlives it.
diff --git a/scripts/action/credential_check.py b/scripts/action/credential_check.py
index 92372b3..1a917de 100755
--- a/scripts/action/credential_check.py
+++ b/scripts/action/credential_check.py
@@ -37,18 +37,16 @@
 #: Declared rather than left implicit in the raise sites, for two reasons. These codes are
 #: an interface: the action emits them as `llm_config_error` and the webview keys on them,
 #: so adding one silently is a contract change nobody reviewed. And a code with no test is
-#: invisible -- `license_with_provider_key` shipped untested precisely because nothing
-#: enumerated the set. `test_llm_contract.py` asserts every entry here is exercised.
+#: invisible -- one shipped untested precisely because nothing enumerated the set.
+#: `test_llm_contract.py` asserts every entry here is exercised.
 ERROR_CODES = frozenset(
     {
         "missing_llm",
         "unknown_llm",
         "missing_provider_key",
-        "missing_license_key",
         "missing_id_token",
         "hosted_with_provider_key",
-        "hosted_with_license",
-        "license_with_provider_key",
+        "license_retired",
         "foreign_provider_key",
     }
 )
@@ -160,16 +158,16 @@ def _provider_list(table: dict) -> str:
     return ", ".join(sorted(table["providers"]))
 
 
-def _reject_provider_inputs(table: dict, given: dict[str, str], llm: str, tier: str) -> None:
-    """`llm: hosted`/`license` run on CodeBoarding's credentials; a provider key means the
-    workflow is asking for two different things at once."""
+def _reject_provider_inputs(table: dict, given: dict[str, str]) -> None:
+    """`llm: hosted` runs on CodeBoarding's credentials; a provider key means the workflow
+    is asking for two different things at once."""
     if not given:
         return
     input_name = sorted(given)[0]
     provider = owner_of(table, input_name)
     raise ConfigError(
-        f"{tier}_with_provider_key",
-        f"`llm: {llm}` runs on CodeBoarding's hosted tier, but `{input_name}` is set. "
+        "hosted_with_provider_key",
+        f"`llm: hosted` runs on CodeBoarding's hosted tier, but `{input_name}` is set. "
         f"Remove it, or set `llm: {provider}` to run on that key instead.",
     )
 
@@ -246,69 +244,51 @@ def _resolve_byok(table: dict, name: str, given: dict[str, str], environ: dict[s
 def resolve(table: dict, environ: dict[str, str]) -> dict:
     """The whole contract. Returns a plan; raises ConfigError with the reason otherwise."""
     llm = environ.get("CB_IN_LLM", "").strip().lower()
-    license_key = environ.get("CB_IN_LICENSE_KEY", "").strip()
     given = read_inputs(table, environ)
 
     if not llm:
         raise ConfigError(
             "missing_llm",
             "The `llm` input is required and has no default. Set it to `hosted` "
-            "(CodeBoarding's free tier), `license` (a CodeBoarding plan), or one of: "
+            "(CodeBoarding's hosted tier, on your CodeBoarding plan) or one of: "
             f"{_provider_list(table)}. See {DOCS}.",
         )
 
     if llm == "hosted":
-        _reject_provider_inputs(table, given, llm, "hosted")
-        if license_key:
-            raise ConfigError(
-                "hosted_with_license",
-                "`llm: hosted` is the free tier and never spends a licence. Set `llm: license` "
-                "to run your CodeBoarding plan, or remove `license_key`.",
-            )
+        _reject_provider_inputs(table, given)
         _require_id_token(llm, environ)
         return {"tier": "hosted", "provider": table["hosted_provider"], "env": {}}
 
+    # Keys were retired completely, so the answer that ran on one is refused by name rather
+    # than as an unknown value: the fix is one word, and the plan it paid for now follows
+    # the GitHub account that `hosted` already runs on.
     if llm == "license":
-        _reject_provider_inputs(table, given, llm, "license")
-        if not license_key:
-            raise ConfigError(
-                "missing_license_key",
-                "`llm: license` needs `license_key`, which is empty. Add the "
-                f"CODEBOARDING_LICENSE repository secret ({SETTINGS_HINT}) and wire it.",
-                "\n\n".join(
-                    [
-                        "`llm: license` needs `license_key`, which is empty.",
-                        "**1.** " + _add_secret(environ, "CODEBOARDING_LICENSE", "your CodeBoarding licence key"),
-                        "**2.** " + _wire_it(environ, "license", ["license_key: ${{ secrets.CODEBOARDING_LICENSE }}"]),
-                    ]
-                ),
-            )
-        _require_id_token(llm, environ)
-        return {
-            "tier": "license",
-            "provider": table["hosted_provider"],
-            "license": license_key,
-            "env": {},
-        }
+        raise ConfigError(
+            "license_retired",
+            "`llm: license` was retired with CodeBoarding license keys: plans now follow your "
+            "GitHub account. Set `llm: hosted` and remove `license_key`.",
+            "\n\n".join(
+                [
+                    "`llm: license` was retired with CodeBoarding license keys: plans now follow "
+                    "your GitHub account, so `llm: hosted` runs on the plan the key paid for.",
+                    f"In `{workflow_path(environ)}`, the CodeBoarding step's `with:` block needs "
+                    "`llm: hosted` in place of `llm: license`, and no `license_key` line:"
+                    "\n\n```yaml\n        with:\n          llm: hosted\n```",
+                ]
+            ),
+        )
 
     name = llm
     if name not in table["providers"]:
         raise ConfigError(
             "unknown_llm",
             f"`llm: {environ.get('CB_IN_LLM', '').strip()}` is not a value this action "
-            f"understands. Use `hosted`, `license`, or one of: {_provider_list(table)}. "
+            f"understands. Use `hosted` or one of: {_provider_list(table)}. "
             f"See {DOCS}.",
         )
 
     env = _resolve_byok(table, name, given, environ)
-    # A licence alongside a provider key is deliberately allowed, not an error: it says
-    # "my CodeBoarding plan, my own tokens". Direct provider calls never reach our proxy, so
-    # it is never spent on a model call; it is staged only for the run's preflight, which
-    # tells the proxy whose plan this run is on.
-    plan = {"tier": "byok+license" if license_key else "byok", "provider": name, "env": env}
-    if license_key:
-        plan["license"] = license_key
-    return plan
+    return {"tier": "byok", "provider": name, "env": env}
 
 
 def _is_endpoint(var: str) -> bool:
@@ -347,9 +327,7 @@ def _pays(table: dict, plan: dict) -> str:
     """
     tier, provider = plan["tier"], plan["provider"]
     if tier == "hosted":
-        return "CodeBoarding's hosted free tier"
-    if tier == "license":
-        return "CodeBoarding's hosted tier, on your plan"
+        return "CodeBoarding's hosted tier, on your CodeBoarding plan"
     entry = table["providers"].get(provider, {})
     label = entry.get("label", provider)
     key_envs = {var for i, var in entry.get("inputs", {}).items() if i.endswith("_api_key")}
@@ -359,9 +337,9 @@ def _pays(table: dict, plan: dict) -> str:
 
 
 def reported_provider(plan: dict) -> str:
-    """The provider to tell the user about, which is none on the hosted tiers.
+    """The provider to tell the user about, which is none on the hosted tier.
 
-    Hosted and licensed runs go through CodeBoarding's proxy, and which upstream sits
+    Hosted runs go through CodeBoarding's proxy, and which upstream sits
     behind it is our routing decision, not the user's configuration. Naming it invites
     "why does my CodeBoarding plan say openrouter?", and worse, implies a commitment we
     have not made: we can change what the proxy routes to without telling anyone.
@@ -369,38 +347,25 @@ def reported_provider(plan: dict) -> str:
     It stays in the plan, because the analysis still has to be pointed somewhere and the
     reusable-analysis identity has to separate the tiers. Only the reporting is withheld.
     """
-    return "" if plan["tier"] in ("hosted", "license") else plan["provider"]
+    return "" if plan["tier"] == "hosted" else plan["provider"]
 
 
 def plan_headline(table: dict, plan: dict) -> str:
     """The one line the log opens with. Same source as the summary, so they cannot drift."""
-    sentence = f"CodeBoarding is running on {_pays(table, plan)}."
-    if plan["tier"] == "byok+license":
-        return sentence + " The wired CodeBoarding plan is not spent on a direct call."
-    return sentence
+    return f"CodeBoarding is running on {_pays(table, plan)}."
 
 
 def plan_summary(table: dict, plan: dict) -> list[tuple[str, str]]:
     """What this run is actually about to do, for the job summary.
 
-    "Tier: byok+license" names the configuration without answering the question someone
-    reads a summary to answer, which is *which credential pays*. A direct provider call
-    never reaches CodeBoarding, so a licence wired beside your own key is recorded and
-    not spent; saying only "byok+license" leaves that ambiguous, so it is spelled out.
+    "Tier: byok" names the configuration without answering the question someone reads a
+    summary to answer, which is *which credential pays*, so that is spelled out.
     """
-    tier = plan["tier"]
-    rows = [("Tier", f"`{tier}`")]
+    rows = [("Tier", f"`{plan['tier']}`")]
     shown = reported_provider(plan)
     if shown:
         rows.append(("Provider", f"`{shown}`"))
     rows.append(("Credentials", _pays(table, plan)))
-    if tier == "byok+license":
-        rows.append(
-            (
-                "Licence",
-                "wired, and not spent: a direct provider call never reaches CodeBoarding",
-            )
-        )
     # Only where the run was pointed somewhere other than the default, since that is the
     # setting most likely to be wrong and least likely to be noticed.
     for var, value in sorted(plan["env"].items()):
@@ -418,8 +383,6 @@ def write_auth_dir(table: dict, plan: dict, auth_dir: Path) -> None:
     (auth_dir / "provider-name").write_text(plan["provider"], encoding="utf-8")
     for var, value in plan["env"].items():
         (env_dir / var).write_text(value, encoding="utf-8")
-    if plan.get("license"):
-        (auth_dir / "license.txt").write_text(plan["license"], encoding="utf-8")
     # Every variable core knows about, minus the ones this run actually resolved, so
     # with-auth.sh can strip the rest without carrying its own copy of the list to fall
     # behind on.
diff --git a/scripts/action/run_meter.py b/scripts/action/run_meter.py
index 3556944..d498210 100755
--- a/scripts/action/run_meter.py
+++ b/scripts/action/run_meter.py
@@ -41,12 +41,11 @@ def proxy_url(environ: dict[str, str]) -> str:
     return environ.get("CODEBOARDING_PROXY_URL") or (Path(__file__).parent / "hosted-proxy-url").read_text().strip()
 
 
-def post(environ: dict[str, str], path: str, body: dict, license_file: Path | None = None) -> dict:
+def post(environ: dict[str, str], path: str, body: dict) -> dict:
     config = RelayConfig(
         proxy_url(environ),
         environ["ACTIONS_ID_TOKEN_REQUEST_URL"],
         environ["ACTIONS_ID_TOKEN_REQUEST_TOKEN"],
-        license_file,
     )
     request = Request(
         proxy_url(environ).rstrip("/") + path,
@@ -73,7 +72,7 @@ def start_request(environ: dict[str, str], depth: int, tier: str) -> dict:
     manifest = json.loads((ACTION_ROOT / ".release-please-manifest.json").read_text(encoding="utf-8"))
     body = {
         "depth": depth,
-        "credential": "hosted" if tier in ("hosted", "license") else "own_key",
+        "credential": "hosted" if tier == "hosted" else "own_key",
         "baseline_depth": baseline_depth(Path(environ.get("CHECKOUT_DIR", ""))),
         "client": {"surface": "action", "version": manifest["."]},
     }
@@ -116,14 +115,8 @@ def start(environ: dict[str, str]) -> tuple[dict[str, str], int]:
         return outputs, 0
 
     tier = (auth_dir / "tier").read_text(encoding="utf-8").strip()
-    license_file = auth_dir / "license.txt"
     try:
-        answer = post(
-            environ,
-            "/run/start",
-            start_request(environ, depth, tier),
-            license_file if license_file.is_file() else None,
-        )
+        answer = post(environ, "/run/start", start_request(environ, depth, tier))
         allowed, cap = answer["allowed"], answer["depth_cap"]
         if not isinstance(allowed, bool) or not isinstance(cap, int) or cap < 1:
             raise ValueError("unexpected /run/start answer")
diff --git a/scripts/action/verify-credentials.sh b/scripts/action/verify-credentials.sh
index 9779edf..9a7eddc 100755
--- a/scripts/action/verify-credentials.sh
+++ b/scripts/action/verify-credentials.sh
@@ -16,12 +16,6 @@ rm -rf "$AUTH_DIR"
 while IFS= read -r var; do
   [ -z "${!var:-}" ] || echo "::add-mask::${!var}"
 done < <(compgen -v | grep -E '^CB_IN_.*_API_KEY$' || true)
-[ -z "${CB_IN_LICENSE_KEY:-}" ] || echo "::add-mask::${CB_IN_LICENSE_KEY}"
-
-# Still honoured: the proxy decides what a key is worth, and after the cutoff it is ignored there.
-if [ -n "${CB_IN_LICENSE_KEY:-}" ]; then
-  echo "::warning title=CodeBoarding license_key is deprecated::License keys stop working after the key cutoff. Plans now follow your GitHub account: link this key at https://app.codeboarding.org/dashboard/plan, then remove license_key (and replace llm: license with llm: hosted)."
-fi
 
 set +e
 plan="$(python3 "${ACTION_PATH}/scripts/action/credential_check.py" --auth-dir "$AUTH_DIR")"
@@ -81,7 +75,6 @@ if [ -d "$AUTH_DIR/env" ]; then
     echo "::add-mask::$(cat "$file")"
   done
 fi
-[ ! -s "$AUTH_DIR/license.txt" ] || echo "::add-mask::$(cat "$AUTH_DIR/license.txt")"
 
 # Written by the check, not restated here. The same phrase feeds the summary, so the log
 # and the summary cannot end up claiming different things -- which they did: this said
diff --git a/scripts/oidc_relay.py b/scripts/oidc_relay.py
index f2dbace..f5169ad 100644
--- a/scripts/oidc_relay.py
+++ b/scripts/oidc_relay.py
@@ -47,7 +47,6 @@ class RelayConfig:
     upstream_base_url: str
     id_token_request_url: str
     id_token_request_token: str
-    license_file: Path | None = None
     run_id_file: Path | None = None
     wall_file: Path | None = None
 
@@ -80,15 +79,6 @@ def _mint_oidc_token(config: RelayConfig) -> str:
 
 def authorization(config: RelayConfig) -> str:
     token = _mint_oidc_token(config)
-    if config.license_file is not None:
-        try:
-            license_key = config.license_file.read_text(encoding="utf-8").strip()
-        except OSError as exc:
-            raise RuntimeError("could not read CodeBoarding license") from exc
-        if not license_key:
-            raise RuntimeError("CodeBoarding license is empty")
-        token = f"{token}~codeboarding-license~{license_key}"
-    # Last, because the proxy splits it off from the right before it looks for a licence.
     # Absent when the preflight failed open: the proxy then decides what an unheld call gets.
     if config.run_id_file is not None and config.run_id_file.is_file():
         run_id = config.run_id_file.read_text(encoding="utf-8").strip()
@@ -189,7 +179,6 @@ def main(argv: list[str] | None = None) -> int:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--upstream-base-url", required=True)
     parser.add_argument("--ready-file", required=True, type=Path)
-    parser.add_argument("--license-file", type=Path)
     parser.add_argument("--run-id-file", type=Path)
     parser.add_argument("--wall-file", type=Path)
     args = parser.parse_args(argv)
@@ -201,9 +190,7 @@ def main(argv: list[str] | None = None) -> int:
         return 2
 
     server = RelayServer(
-        RelayConfig(
-            args.upstream_base_url, request_url, request_token, args.license_file, args.run_id_file, args.wall_file
-        )
+        RelayConfig(args.upstream_base_url, request_url, request_token, args.run_id_file, args.wall_file)
     )
     args.ready_file.write_text(str(server.server_port), encoding="utf-8")
     try:
diff --git a/tests/test_action_auth.py b/tests/test_action_auth.py
index dc0f9d8..3ccafc6 100644
--- a/tests/test_action_auth.py
+++ b/tests/test_action_auth.py
@@ -244,13 +244,11 @@ def test_a_refusal_with_one_exact_fix_carries_it_into_the_summary(self) -> None:
 
     def test_successful_run_reports_its_tier_and_provider(self) -> None:
         """The webview reads this to show what a repository is actually running on."""
-        result, _, outputs = self._preflight(
-            CB_IN_LLM="anthropic", CB_IN_ANTHROPIC_API_KEY="k", CB_IN_LICENSE_KEY="lic"
-        )
+        result, _, outputs = self._preflight(CB_IN_LLM="anthropic", CB_IN_ANTHROPIC_API_KEY="k")
         self.assertEqual(result.returncode, 0, result.stderr or result.stdout)
-        self.assertEqual(outputs["tier"], "byok+license")
+        self.assertEqual(outputs["tier"], "byok")
         summary = (Path(self.temp_dir.name) / "summary.md").read_text(encoding="utf-8")
-        self.assertIn("byok+license", summary)
+        self.assertIn("`byok`", summary)
         self.assertIn("anthropic", summary)
 
     # -- hosted tiers ------------------------------------------------------
@@ -277,15 +275,12 @@ def test_hosted_auth_relays_to_the_codeboarding_proxy(self) -> None:
         fake_python.chmod(0o755)
 
         result, auth_dir, outputs = self._preflight(
-            CB_IN_LLM="license",
-            CB_IN_LICENSE_KEY="a-license",
+            CB_IN_LLM="hosted",
             ACTIONS_ID_TOKEN_REQUEST_URL="https://oidc.example/token",
             ACTIONS_ID_TOKEN_REQUEST_TOKEN="request-token",
         )
         self.assertEqual(result.returncode, 0, result.stderr or result.stdout)
-        self.assertEqual(outputs["tier"], "license")
-        self.assertIn("::add-mask::a-license", result.stdout)
-        self.assertIn("license_key is deprecated", result.stdout, "still honoured, but said to be going")
+        self.assertEqual(outputs["tier"], "hosted")
 
         configured = subprocess.run(
             [str(CONFIGURE_AUTH)],
@@ -305,7 +300,6 @@ def test_hosted_auth_relays_to_the_codeboarding_proxy(self) -> None:
         args = captured_args.read_text(encoding="utf-8").splitlines()
         upstream = args[args.index("--upstream-base-url") + 1]
         self.assertEqual(upstream, "https://auduihjmm4b735zci7vyabuikq0hppqn.lambda-url.us-east-1.on.aws")
-        self.assertIn("--license-file", args)
         self.assertEqual(args[args.index("--run-id-file") + 1], str(auth_dir / "run-id"))
         self.assertEqual(
             args[args.index("--wall-file") + 1], str(temp_dir / "runner" / "codeboarding-wall" / "wall.json")
@@ -313,61 +307,11 @@ def test_hosted_auth_relays_to_the_codeboarding_proxy(self) -> None:
         self.assertEqual((auth_dir / "env" / "OPENROUTER_API_KEY").read_text(), "github-actions-oidc-relay")
         self.assertEqual((auth_dir / "env" / "OPENROUTER_BASE_URL").read_text(), "http://127.0.0.1:12345")
 
-    def test_your_own_key_wins_outright_when_a_licence_is_wired_beside_it(self) -> None:
-        """`byok+license` runs on YOUR key. The licence is recorded and never spent.
-
-        A direct provider call does not go through CodeBoarding, so there is nothing for a
-        licence to pay for. The tier label alone leaves that ambiguous, so the guarantee is
-        pinned here: the provider key is exported, no licence is staged for the relay, and
-        the relay is never started.
-        """
-        temp_dir = Path(self.temp_dir.name)
-        fake_bin = temp_dir / "bin"
-        fake_bin.mkdir()
-        marker = temp_dir / "relay-started"
-        (fake_bin / "python3").write_text(f'#!/usr/bin/env bash\ntouch "{marker}"\n', encoding="utf-8")
-        (fake_bin / "python3").chmod(0o755)
-
-        result, auth_dir, outputs = self._preflight(
-            CB_IN_LLM="anthropic",
-            CB_IN_ANTHROPIC_API_KEY="my-own-key",
-            CB_IN_LICENSE_KEY="a-licence",
-            ACTIONS_ID_TOKEN_REQUEST_URL="https://oidc.example/token",
-            ACTIONS_ID_TOKEN_REQUEST_TOKEN="request-token",
-        )
-        self.assertEqual(result.returncode, 0, result.stderr or result.stdout)
-        self.assertEqual(outputs["tier"], "byok+license")
-        self.assertEqual((auth_dir / "env" / "ANTHROPIC_API_KEY").read_text(), "my-own-key")
-        # Staged for the preflight, which tells the proxy whose plan the run is on; the relay
-        # that would spend it on a model call is never started (asserted below).
-        self.assertEqual((auth_dir / "license.txt").read_text(), "a-licence")
-        self.assertNotIn("a-licence", (auth_dir / "env" / "ANTHROPIC_API_KEY").read_text())
-
-        configured = subprocess.run(
-            [str(CONFIGURE_AUTH)],
-            env={
-                "PATH": f"{fake_bin}:{os.environ['PATH']}",
-                "ACTION_PATH": str(ROOT),
-                "RUNNER_TEMP": str(temp_dir / "runner"),
-                "ACTIONS_ID_TOKEN_REQUEST_URL": "https://oidc.example/token",
-                "ACTIONS_ID_TOKEN_REQUEST_TOKEN": "request-token",
-            },
-            capture_output=True,
-            text=True,
-            check=False,
-        )
-        self.assertEqual(configured.returncode, 0, configured.stderr or configured.stdout)
-        self.assertFalse(marker.exists(), "a licensed BYOK run must not contact the relay")
-
-        scoped = self._with_auth('test "$ANTHROPIC_API_KEY" = "my-own-key" && test -z "${OPENROUTER_API_KEY:-}"')
-        self.assertEqual(scoped.returncode, 0, scoped.stderr or scoped.stdout)
-
     def test_the_summary_says_which_credential_actually_pays(self) -> None:
         """A tier name is not an answer to "whose key is this run spending?"."""
-        self._preflight(CB_IN_LLM="anthropic", CB_IN_ANTHROPIC_API_KEY="k", CB_IN_LICENSE_KEY="lic")
+        self._preflight(CB_IN_LLM="anthropic", CB_IN_ANTHROPIC_API_KEY="k")
         summary = (Path(self.temp_dir.name) / "summary.md").read_text(encoding="utf-8")
         self.assertIn("your own Anthropic key, called directly", summary)
-        self.assertIn("not spent", summary, "the licence's status must be stated, not implied")
 
     def test_the_summary_names_a_non_default_endpoint(self) -> None:
         """The setting most likely to be wrong and least likely to be noticed."""
diff --git a/tests/test_action_inputs.py b/tests/test_action_inputs.py
index 992930b..c1a239b 100644
--- a/tests/test_action_inputs.py
+++ b/tests/test_action_inputs.py
@@ -55,7 +55,7 @@ def test_every_provider_input_is_wired_to_the_resolver(self) -> None:
     def test_no_declared_provider_input_is_absent_from_the_table(self) -> None:
         """An input the table does not own can never be read, so it would mislead."""
         suffixes = ("_api_key", "_base_url", "_region")
-        declared = {n for n in self.inputs if n.endswith(suffixes) and n not in {"license_key", "github_token"}}
+        declared = {n for n in self.inputs if n.endswith(suffixes) and n != "github_token"}
         self.assertEqual(sorted(declared - table_inputs()), [])
 
     def test_llm_is_required_and_has_no_default(self) -> None:
@@ -143,9 +143,9 @@ def test_the_wall_is_a_neutral_comment_an_artifact_and_never_a_red_check(self) -
         self.assertEqual(block.count("continue-on-error: true"), 3, "no wall step can fail the job")
         self.assertNotIn("exit 1", block)
 
-    def test_license_key_is_deprecated_but_still_wired(self) -> None:
-        self.assertIn("Deprecated", self.inputs["license_key"])
-        self.assertIn("CB_IN_LICENSE_KEY: ${{ inputs.license_key }}", ACTION)
+    def test_license_key_is_retired(self) -> None:
+        self.assertNotIn("license_key", self.inputs)
+        self.assertNotIn("CB_IN_LICENSE_KEY", ACTION)
 
     def test_default_workflow_reviews_drafts_on_open_and_new_commits(self) -> None:
         self.assertNotIn("github.event.pull_request.draft", DOGFOOD)
diff --git a/tests/test_llm_contract.py b/tests/test_llm_contract.py
index 71d5e9a..dfb6e2a 100644
--- a/tests/test_llm_contract.py
+++ b/tests/test_llm_contract.py
@@ -54,21 +54,11 @@ def test_every_provider_resolves_from_its_own_inputs(self) -> None:
                     f"{name} resolved without a variable core selects it by",
                 )
 
-    def test_hosted_and_license_are_named_not_inferred(self) -> None:
+    def test_hosted_is_named_not_inferred(self) -> None:
         hosted = self.resolve(CB_IN_LLM="hosted", **OIDC)
         self.assertEqual(hosted["tier"], "hosted")
         self.assertEqual(hosted["env"], {})
 
-        licensed = self.resolve(CB_IN_LLM="license", CB_IN_LICENSE_KEY="lic", **OIDC)
-        self.assertEqual(licensed["tier"], "license")
-        self.assertEqual(licensed["license"], "lic")
-
-    def test_licence_alongside_a_provider_key_is_recorded_not_refused(self) -> None:
-        """A CodeBoarding plan and your own tokens are two different questions."""
-        plan = self.resolve(CB_IN_LLM="anthropic", CB_IN_ANTHROPIC_API_KEY="k", CB_IN_LICENSE_KEY="lic")
-        self.assertEqual(plan["tier"], "byok+license")
-        self.assertEqual(plan["provider"], "anthropic")
-
     def test_one_spelling_per_provider_and_nothing_else(self) -> None:
         """Casing and surrounding space are forgiven; a second spelling is not.
 
@@ -137,23 +127,14 @@ def test_hosted_refuses_to_share_a_workflow_with_a_provider_key(self) -> None:
         self.assertEqual(error.code, "hosted_with_provider_key")
         self.assertIn("llm: anthropic", error.message)
 
-    def test_license_refuses_to_share_a_workflow_with_a_provider_key(self) -> None:
-        """The mirror of the hosted case, and it shipped untested: `llm: license` runs on
-        CodeBoarding's credentials, so a provider key beside it asks for two things at once."""
-        error = self.refuse(CB_IN_LLM="license", CB_IN_LICENSE_KEY="lic", CB_IN_ANTHROPIC_API_KEY="k", **OIDC)
-        self.assertEqual(error.code, "license_with_provider_key")
-        self.assertIn("anthropic_api_key", error.message)
-        self.assertIn("llm: anthropic", error.message)
-
-    def test_hosted_refuses_a_licence_it_would_not_spend(self) -> None:
-        error = self.refuse(CB_IN_LLM="hosted", CB_IN_LICENSE_KEY="lic", **OIDC)
-        self.assertEqual(error.code, "hosted_with_license")
-        self.assertIn("llm: license", error.message)
-
-    def test_license_without_a_licence_key_is_refused(self) -> None:
+    def test_license_is_refused_as_retired_with_the_hosted_line_to_use(self) -> None:
+        """Keys are retired, so a workflow still on `llm: license` is told the one-word fix
+        rather than that its value is unknown."""
         error = self.refuse(CB_IN_LLM="license", **OIDC)
-        self.assertEqual(error.code, "missing_license_key")
-        self.assertIn("CODEBOARDING_LICENSE", error.message)
+        self.assertEqual(error.code, "license_retired")
+        self.assertIn("llm: hosted", error.message)
+        self.assertIn("license_key", error.message)
+        self.assertIn("```yaml\n        with:\n          llm: hosted\n```", error.details)
 
     def test_hosted_tiers_require_both_oidc_variables(self) -> None:
         """The relay refuses to start without either, and a runner can expose one alone.
@@ -220,18 +201,13 @@ def test_a_hosted_run_does_not_name_the_upstream_it_is_routed_to(self) -> None:
         it, because the analysis still has to be pointed somewhere; only the reporting
         withholds it.
         """
-        for environ in (
-            {"CB_IN_LLM": "hosted", **OIDC},
-            {"CB_IN_LLM": "license", "CB_IN_LICENSE_KEY": "lic", **OIDC},
-        ):
-            plan = self.resolve(**environ)
-            with self.subTest(tier=plan["tier"]):
-                self.assertEqual(credential_check.reported_provider(plan), "")
-                rendered = dict(credential_check.plan_summary(self.table, plan))
-                self.assertNotIn("Provider", rendered)
-                self.assertNotIn("openrouter", credential_check.plan_headline(self.table, plan))
-                # Still resolved internally: the run has to be pointed somewhere.
-                self.assertEqual(plan["provider"], "openrouter")
+        plan = self.resolve(CB_IN_LLM="hosted", **OIDC)
+        self.assertEqual(credential_check.reported_provider(plan), "")
+        rendered = dict(credential_check.plan_summary(self.table, plan))
+        self.assertNotIn("Provider", rendered)
+        self.assertNotIn("openrouter", credential_check.plan_headline(self.table, plan))
+        # Still resolved internally: the run has to be pointed somewhere.
+        self.assertEqual(plan["provider"], "openrouter")
 
     def test_your_own_provider_is_always_named(self) -> None:
         """It is your configuration, and it is the thing you would check first."""
@@ -256,12 +232,10 @@ def test_the_headline_and_the_summary_cannot_disagree(self) -> None:
         rows = dict(credential_check.plan_summary(self.table, plan))
         self.assertIn(rows["Credentials"], credential_check.plan_headline(self.table, plan))
 
-    def test_hosted_tiers_require_the_oidc_permission(self) -> None:
-        for value, extra in (("hosted", {}), ("license", {"CB_IN_LICENSE_KEY": "lic"})):
-            with self.subTest(llm=value):
-                error = self.refuse(CB_IN_LLM=value, **extra)
-                self.assertEqual(error.code, "missing_id_token")
-                self.assertIn("id-token: write", error.message)
+    def test_hosted_requires_the_oidc_permission(self) -> None:
+        error = self.refuse(CB_IN_LLM="hosted")
+        self.assertEqual(error.code, "missing_id_token")
+        self.assertIn("id-token: write", error.message)
 
     def test_an_unknown_provider_lists_the_ones_that_exist(self) -> None:
         error = self.refuse(CB_IN_LLM="claude")
@@ -293,11 +267,7 @@ def test_a_remedy_degrades_to_prose_off_a_runner(self) -> None:
         self.assertIn("Add a repository secret", error.details)
         self.assertIn("your CodeBoarding workflow", error.details)
 
-    def test_the_licence_and_permission_remedies_are_copyable_too(self) -> None:
-        licence = self.refuse(CB_IN_LLM="license", GITHUB_REPOSITORY="acme/widgets", **OIDC)
-        self.assertIn("secrets/actions/new", licence.details)
-        self.assertIn("license_key: ${{ secrets.CODEBOARDING_LICENSE }}", licence.details)
-
+    def test_the_permission_remedy_is_copyable_too(self) -> None:
         oidc = self.refuse(CB_IN_LLM="hosted")
         self.assertIn("permissions:", oidc.details)
         self.assertIn("id-token: write", oidc.details)
@@ -326,8 +296,6 @@ def test_every_declared_refusal_is_exercised_by_this_file(self) -> None:
             {"CB_IN_LLM": "license", **OIDC},
             {"CB_IN_LLM": "hosted"},
             {"CB_IN_LLM": "hosted", "CB_IN_ANTHROPIC_API_KEY": "k", **OIDC},
-            {"CB_IN_LLM": "hosted", "CB_IN_LICENSE_KEY": "lic", **OIDC},
-            {"CB_IN_LLM": "license", "CB_IN_LICENSE_KEY": "lic", "CB_IN_ANTHROPIC_API_KEY": "k", **OIDC},
             {"CB_IN_LLM": "anthropic", "CB_IN_ANTHROPIC_API_KEY": "k", "CB_IN_OPENAI_API_KEY": "o"},
         ]
         seen = {self.refuse(**case).code for case in cases}
@@ -338,7 +306,7 @@ def test_every_refusal_carries_a_code_and_an_actionable_message(self) -> None:
             {},
             {"CB_IN_LLM": "nope"},
             {"CB_IN_LLM": "anthropic"},
-            {"CB_IN_LLM": "hosted", "CB_IN_LICENSE_KEY": "l", **OIDC},
+            {"CB_IN_LLM": "hosted", "CB_IN_ANTHROPIC_API_KEY": "k", **OIDC},
             {"CB_IN_LLM": "license", **OIDC},
             {"CB_IN_LLM": "hosted"},
         ]
diff --git a/tests/test_oidc_relay.py b/tests/test_oidc_relay.py
index cca74d6..c20a152 100644
--- a/tests/test_oidc_relay.py
+++ b/tests/test_oidc_relay.py
@@ -103,8 +103,8 @@ def log_message(self, *_args):
         self.assertEqual([auth for _, auth, _ in received], ["Bearer jwt-1", "Bearer jwt-2"])
         self.assertEqual([path for path, _, _ in received], ["/api/v1/chat/completions?model=test"] * 2)
 
-    def test_the_run_id_rides_last_in_the_bearer_with_or_without_a_licence(self):
-        """The proxy splits `~codeboarding-run~` off from the right, then the licence."""
+    def test_the_run_id_rides_in_the_bearer_once_the_preflight_wrote_it(self):
+        """The proxy splits `~codeboarding-run~` off from the right."""
 
         class OidcIssuer(BaseHTTPRequestHandler):
             def do_GET(self):
@@ -121,8 +121,7 @@ def log_message(self, *_args):
         issuer.start()
         self.addCleanup(issuer.close)
         with tempfile.TemporaryDirectory() as temp:
-            license_file, run_id_file = Path(temp) / "license.txt", Path(temp) / "run-id"
-            license_file.write_text("LIC\n")
+            run_id_file = Path(temp) / "run-id"
 
             def bearer(**files):
                 config = oidc_relay.RelayConfig(
@@ -133,11 +132,6 @@ def bearer(**files):
             self.assertEqual(bearer(run_id_file=run_id_file), "Bearer jwt", "no run id until the preflight wrote one")
             run_id_file.write_text("github:o/r#42\n")
             self.assertEqual(bearer(run_id_file=run_id_file), "Bearer jwt~codeboarding-run~github:o/r#42")
-            self.assertEqual(
-                bearer(license_file=license_file, run_id_file=run_id_file),
-                "Bearer jwt~codeboarding-license~LIC~codeboarding-run~github:o/r#42",
-            )
-            self.assertEqual(bearer(license_file=license_file), "Bearer jwt~codeboarding-license~LIC")
 
     def test_a_402_wall_is_kept_for_the_action_and_still_relayed(self):
         answers = [
diff --git a/tests/test_run_meter.py b/tests/test_run_meter.py
index 140d0ce..489b3f7 100644
--- a/tests/test_run_meter.py
+++ b/tests/test_run_meter.py
@@ -128,7 +128,7 @@ def _start(self, answer: dict | None, tier: str = "hosted", **extra: str):
     @NEEDS_JSONSCHEMA
     def test_the_preflight_request_matches_the_contract_in_every_credential_mode(self) -> None:
         (self.checkout / ".codeboarding" / "analysis.json").write_text('{"metadata": {"depth_cap": 2}}')
-        for tier, credential in (("hosted", "hosted"), ("license", "hosted"), ("byok", "own_key")):
+        for tier, credential in (("hosted", "hosted"), ("byok", "own_key")):
             with self.subTest(tier=tier):
                 _, requests, _ = self._start(example("run-start.allowed.json"), tier)
                 path, _, body = requests[0]
@@ -158,17 +158,6 @@ def test_a_pull_request_run_leaves_its_number_to_the_token(self) -> None:
         )
         self.assertNotIn("pull_request", requests[0][2])
 
-    def test_a_staged_licence_rides_in_the_bearer_on_the_license_and_own_key_tiers(self) -> None:
-        """Otherwise a licence holder on their own key reads as Free at the proxy."""
-        _, bare, _ = self._start(example("run-start.allowed.json"), "byok")
-        (self.auth_dir / "license.txt").write_text("LIC-123", encoding="utf-8")
-        for tier, credential in (("license", "hosted"), ("byok+license", "own_key")):
-            with self.subTest(tier=tier):
-                _, requests, _ = self._start(example("run-start.allowed.json"), tier)
-                self.assertEqual(requests[0][1], "Bearer oidc-jwt~codeboarding-license~LIC-123")
-                self.assertEqual(requests[0][2]["credential"], credential)
-        self.assertEqual(bare[0][1], "Bearer oidc-jwt")
-
     # -- the answer --------------------------------------------------------
 
     @NEEDS_JSONSCHEMA