Contracts 0.127.0: ai.openvibe.network and events.openvibe.network retired; service-auth drops the X-Internal-Key hook (#78)

OP OpenVibers committed 10 Oct 2026 · tag v0.127 · 0 files, +0 −0

Contracts 0.127.0, retiring the old addresses (plan T6 "the ai.openvibe.network redirect removed once nothing calls it", T7 "events.openvibe.network is deleted after the move") and finishing T2's X-Internal-Key retirement in the library.

**Evidence that nothing calls them** (nginx access logs on the host, all rotations):
- `events.openvibe.network`: the last service call (a `node` client polling `/api/v1/events`) was 2026-09-30 18:25.
- `ai.openvibe.network`: the last service call (a `/release.json` poller from the host) was 2026-10-02 00:13.

Since then, only crawlers and the release UX check (until 09-30) have reached either address.

**Changes:**
- `ai.openvibe.network` / `events.openvibe.network` leave the `ai` and `events` service and repository manifests, and the `ai.openvibe.network` "moved" product manifest is deleted. The Sites-domains test snapshot drops it too (34 domains).
- Descriptions name only `ai.openvibe.services` and `openvibe.events`.
- The AI repository manifest no longer lists a domain the network doesn't hold. The AI service manifest no longer describes SQLite (AI is on PostgreSQL).
- `lib/service-auth.js`: `requireCapability` drops the `legacy` option (the X-Internal-Key hook). No consumer passes it; the test now asserts an X-Internal-Key alone opens nothing.

Generated files regenerated. `npm test`: 18,057 checks, compat vs v0.126.0 has no breaking changes. The old vhosts come out of the Events and AI repos and production in follow-up PRs.

This commit has no diff to show.