feat: retire license keys: drop license_key and llm: license

.github/workflows/codeboarding-sync.yml

@@ -142,8 +142,7 @@ jobs:
         with:
           mode: sync
           # CodeBoarding's own repositories run on the CodeBoarding plan.
-          llm: license
-          license_key: ${{ secrets.CODEBOARDING_LICENSE }}
+          llm: hosted
           sync_strategy: ${{ inputs.sync_strategy || 'push' }}
           force_full: ${{ inputs.force_full || false }}
           # App token authenticates the baseline push so the commit is attributed

.github/workflows/codeboarding.yml

@@ -111,8 +111,7 @@ jobs:
       - uses: ./
         with:
           # Named, not inferred: the action refuses to guess where credentials come
-          # from, so every workflow says which of hosted / license / a provider it
-          # wants. CodeBoarding's own repositories run on the CodeBoarding plan.
-          llm: license
-          license_key: ${{ secrets.CODEBOARDING_LICENSE }}
+          # from, so every workflow says which of hosted / a provider it wants.
+          # CodeBoarding's own repositories run on the CodeBoarding plan.
+          llm: hosted
           github_token: ${{ steps.codeboarding-app-token-client.outputs.token || steps.codeboarding-app-token-app.outputs.token || github.token }}

README.md

@@ -52,7 +52,7 @@ jobs:
     steps:
       - uses: CodeBoarding/CodeBoarding-action@v1
         with:
-          llm: hosted   # or license, or a provider name -- see Authentication
+          llm: hosted   # or a provider name -- see Authentication
 ```
 
 Automatic runs review both draft and non-draft pull requests and update one sticky **CodeBoarding review** comment. Opening, reopening, or pushing a commit runs analysis; changing only the draft state does not. A trusted repository owner, member, or collaborator can comment `/codeboarding` to analyze the current PR head again, including on fork PRs; every command creates a new result comment.
@@ -107,24 +107,19 @@ Every review comment ends with a machine-readable HTML comment, `<!-- codeboardi
 ## Authentication and providers
 
 The `llm` input is required and says where analysis credentials come from. There are
-three answers, and the action never picks one for you:
+two answers, and the action never picks one for you:
 
 ```yaml
     with:
-      llm: hosted                                        # CodeBoarding's free tier
-```
-```yaml
-    with:
-      llm: license                                       # a CodeBoarding plan
-      license_key: ${{ secrets.CODEBOARDING_LICENSE }}
+      llm: hosted                                        # CodeBoarding's hosted tier, on your plan
 ```
 ```yaml
     with:
       llm: anthropic                                     # your own provider key
       anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 ```
 
-`hosted` and `license` run through CodeBoarding's proxy and need `id-token: write`, which
+`hosted` runs through CodeBoarding's proxy and needs `id-token: write`, which
 mints short-lived credentials per request and stores no LLM secret in your repository. A
 provider key is used directly and needs no OIDC permission.
 
@@ -139,21 +134,17 @@ The same rule makes the combinations explicit rather than order-dependent:
 | Workflow says | Result |
 |---|---|
 | nothing | refused: `llm` is required |
-| `llm: hosted` | the free tier |
+| `llm: hosted` | CodeBoarding's hosted tier, on the plan of whoever the run is charged to |
 | `llm: hosted` + any provider key | refused: pick one |
-| `llm: hosted` + `license_key` | refused: use `llm: license` |
-| `llm: license` without `license_key` | refused: names the secret to add |
+| `llm: license` | refused: license keys are retired, use `llm: hosted` |
 | `llm: anthropic` + `anthropic_api_key` | Anthropic, directly |
 | `llm: anthropic`, key empty or absent | refused: names the input and the secret |
 | `llm: anthropic` + `openai_api_key` | refused: a second provider's key |
-| `llm: anthropic` + key + `license_key` | Anthropic, on a CodeBoarding plan |
 
-A licence alongside your own key is deliberately allowed: it says "my CodeBoarding plan,
-my own tokens". **Your key always wins.** A direct provider call never reaches
-CodeBoarding, so the licence is never spent on a model call. It only tells the run's
-check whose plan the run is on, and the run is counted like any own-key run (see
-[Plans and allowances](#plans-and-allowances)). The job summary says so on every run, rather than leaving you to
-infer it from the tier name.
+License keys are retired: plans follow the GitHub account a run is charged to (see
+[Plans and allowances](#plans-and-allowances)). A workflow that still says `llm: license` is refused with the
+one-word fix; drop its `license_key` line too, which GitHub otherwise reports as an
+unexpected input.
 
 ### Plans and allowances
 
@@ -199,11 +190,6 @@ ahead and how deep it may go. A final step reports whether a map was produced.
   with the proxy, so their hosted calls fail once it enforces plans. `@v1` gets this
   release automatically; a workflow pinned to an older tag or SHA must update.
 
-`license_key` is deprecated: plans now follow your GitHub account. It keeps working until
-the license key cutoff and is ignored after it; each run that sets it says so. Link the key
-to your account on the [plan page](https://app.codeboarding.org/dashboard/plan), then
-remove it (and use `llm: hosted` instead of `llm: license`).
-
 ### Providers
 
 Each provider has its own inputs, so which key a workflow uses is readable from the file
@@ -240,8 +226,8 @@ to Core and silently stay unreachable here.
 
 Every run reports what it resolved, so the answer never has to be inferred from behaviour:
 
-- outputs `llm_tier` (`hosted`, `license`, `byok`, `byok+license`), `llm_provider` (empty
-  on the hosted tiers, where the upstream is ours rather than yours), and
+- outputs `llm_tier` (`hosted`, `byok`), `llm_provider` (empty on the hosted tier, where
+  the upstream is ours rather than yours), and
   `llm_config_error` (empty when configured);
 - a job-summary table naming the tier and provider;
 - on a configuration failure, an error annotation and — in review mode — a pull request
@@ -352,11 +338,10 @@ With the default `github.token`, the repository or organization must allow GitHu
 | Input | Mode | Default | Description |
 |---|---|---|---|
 | `mode` | both | `review` | `review` or `sync`. |
-| `llm` | both | **required** | `hosted`, `license`, or a provider name. No default. |
+| `llm` | both | **required** | `hosted` or a provider name. No default. |
 | `<provider>_api_key` | both | empty | That provider's key, e.g. `anthropic_api_key`. See [Providers](#providers). |
 | `<provider>_base_url` | both | empty | That provider's endpoint, where it has one. |
 | `aws_bedrock_region` | both | empty | Bedrock region. Core defaults to `us-east-1`. |
-| `license_key` | both | empty | Deprecated. CodeBoarding license, required by `llm: license`; ignored after the license key cutoff. |
 | `model` | both | empty | Default model for both analysis and parsing. |
 | `agent_model` | both | empty | Analysis-only override for `model`. |
 | `parsing_model` | both | empty | Parsing-only override for `model`. |
@@ -396,8 +381,8 @@ breaking CLI migration.
 
 | Output | Mode | Description |
 |---|---|---|
-| `llm_tier` | both | `hosted`, `license`, `byok`, or `byok+license`. |
-| `llm_provider` | both | Provider the run used. Empty on `hosted` and `license`: which upstream the proxy routes to is CodeBoarding's decision, not your configuration. |
+| `llm_tier` | both | `hosted` or `byok`. |
+| `llm_provider` | both | Provider the run used. Empty on `hosted`: which upstream the proxy routes to is CodeBoarding's decision, not your configuration. |
 | `llm_config_error` | both | Configuration failure code, empty when configured. |
 | `diagram_md` | review | Path to the rendered Mermaid block on the runner. |
 | `n_changed` | review | Number of changed components. |

action.yml

@@ -10,12 +10,8 @@ inputs:
     required: false
     default: 'review'
   llm:
-    description: 'Required. Where analysis credentials come from: hosted, license, or a provider name (anthropic, aws_bedrock, cerebras, deepseek, glm, google, kimi, litellm, ollama, openai, openrouter, orcarouter, vercel).'
+    description: 'Required. Where analysis credentials come from: hosted or a provider name (anthropic, aws_bedrock, cerebras, deepseek, glm, google, kimi, litellm, ollama, openai, openrouter, orcarouter, vercel).'
     required: true
-  license_key:
-    description: 'Deprecated: plans now follow your GitHub account. A CodeBoarding license key, required by llm: license and optional alongside a provider key; it keeps working until the license key cutoff and is ignored after it.'
-    required: false
-    default: ''
   # Anthropic - selected by llm: anthropic
   anthropic_api_key:
     description: 'Anthropic API key, used when llm is anthropic. Sets ANTHROPIC_API_KEY.'
@@ -151,7 +147,7 @@ inputs:
     default: '1'
 outputs:
   llm_tier:
-    description: 'Resolved credential tier: hosted, license, byok, or byok+license.'
+    description: 'Resolved credential tier: hosted or byok.'
     value: ${{ steps.llm.outputs.tier }}
   llm_provider:
     description: 'Provider this run used for analysis.'
@@ -258,7 +254,6 @@ runs:
       env:
         ACTION_PATH: ${{ github.action_path }}
         CB_IN_LLM: ${{ inputs.llm }}
-        CB_IN_LICENSE_KEY: ${{ inputs.license_key }}
         CB_IN_ANTHROPIC_API_KEY: ${{ inputs.anthropic_api_key }}
         CB_IN_AWS_BEDROCK_API_KEY: ${{ inputs.aws_bedrock_api_key }}
         CB_IN_AWS_BEDROCK_REGION: ${{ inputs.aws_bedrock_region }}

scripts/action/configure-auth.sh

@@ -19,7 +19,7 @@ fi
 TIER="$(cat "$AUTH_DIR/tier")"
 
 case "$TIER" in
-  hosted|license) ;;
+  hosted) ;;
   *) echo "Using direct $(cat "$AUTH_DIR/provider-name") credentials."; exit 0 ;;
 esac
 
@@ -28,9 +28,6 @@ PID="$AUTH_DIR/relay.pid"
 LOG="$AUTH_DIR/relay.log"
 
 RELAY_ARGS=(--upstream-base-url "$HOSTED_PROXY_URL" --ready-file "$READY")
-if [ -s "$AUTH_DIR/license.txt" ]; then
-  RELAY_ARGS+=(--license-file "$AUTH_DIR/license.txt")
-fi
 # Written by the preflight when the proxy gave this run an id; read per request.
 RELAY_ARGS+=(--run-id-file "$AUTH_DIR/run-id")
 # Outside the auth directory, which goes with the analysis step: the wall outlives it.