Retire the block importer and obsolete internal key fixtures (#22)

ddiff --git a/scripts/lib/db-ops.js b/scripts/lib/db-ops.js
iindex c5a93f9c..9d278f14 100644
---- a/scripts/lib/db-ops.js
++++ b/scripts/lib/db-ops.js
@@@ -2,7 +2,7 @@
  /**
   * Shared by the operator scripts: `parseArgs(argv, { flags, values })`, the `--flag` / `--key value`
   * parsing they all use. On PostgreSQL (plan T2, ADR-035) the scripts open the service database through
-- * DATABASE_URL themselves (scripts/secrets-out-of-db.js, scripts/import-blocks.js); the old
++ * DATABASE_URL themselves (for example, scripts/secrets-out-of-db.js); the old
   * better-sqlite3 helpers (dbPath, dropToOwnerOf, the sqlite online backup) are gone with the file.
   */
  const path = require('path');
ddiff --git a/scripts/rehearse-pg-cutover.js b/scripts/rehearse-pg-cutover.js
iindex 0d024b80..d6970ad2 100644
---- a/scripts/rehearse-pg-cutover.js
++++ b/scripts/rehearse-pg-cutover.js
@@@ -329,7 +329,7 @@ async function bootAndCheck(target, dir, { timeoutMs = 120000 } = {}) {
          PATH: process.env.PATH, HOME: dir, PORT: String(port), HOST: '127.0.0.1',
          NODE_ENV: target.store === 'pglite' ? 'test' : 'production',
          JWT_PRIVATE_KEY: path.join(dir, 'keys', 'private.pem'), JWT_PUBLIC_KEY: path.join(dir, 'keys', 'public.pem'),
--        AVATAR_PATH: path.join(dir, 'avatars'), INTERNAL_API_KEY: crypto.randomBytes(24).toString('hex'),
++        AVATAR_PATH: path.join(dir, 'avatars'),
          OV_NETWORK_INTERNAL_URL: `http://127.0.0.1:${port}`,
          OV_LIVE_INTERNAL_URL: 'http://127.0.0.1:9', OV_TOOLS_INTERNAL_URL: 'http://127.0.0.1:9', OV_GAMES_INTERNAL_URL: 'http://127.0.0.1:9',
          OV_MEDIA_INTERNAL_URL: 'http://127.0.0.1:9', OV_AI_INTERNAL_URL: 'http://127.0.0.1:9',
ddiff --git a/server/identity/modules.js b/server/identity/modules.js
iindex aacd8429..c3d863a0 100644
---- a/server/identity/modules.js
++++ b/server/identity/modules.js
@@@ -336,7 +336,7 @@ function userRouter(requireAuth) {
      return router;
  }
  
--/** Service routes; mounted under /internal (after requireInternalKey) with principal guards. */
++/** Service routes; mounted under /internal after the requireServiceToken gate, with principal guards. */
  function serviceRoutes(router, principals) {
      const nsOf = (req) => req.params.ns;
      const resolveSubject = async (db, s) => (/^usr_[0-9A-HJKMNP-TV-Z]{26}$/.test(s) && await db.prepare('SELECT 1 FROM users WHERE subject_id = ?').get(s) ? s : null);
ddiff --git a/server/notifications/stream-live.js b/server/notifications/stream-live.js
iindex 215d8a49..6f311e30 100644
---- a/server/notifications/stream-live.js
++++ b/server/notifications/stream-live.js
@@@ -5,7 +5,7 @@
   *   POST /internal/events/stream-live   Live's direct call (server/internal/routes.js), with the
   *                                       follower list in the body (follower_network_ids)
   *   live.stream.started via Events      server/notifications/events-consumer.js; the followers are
-- *                                       read from Network's active user_follows rows
++ *                                       read from Network's own active user_follows rows
   *
   * Both claim the same persisted per-streamer announcement window (stream_live_announcements, keyed
   * by the streamer's NETWORK user id), so while Live still makes the direct call and Network also
ddiff --git a/test/analytics-privacy.test.js b/test/analytics-privacy.test.js
iindex 6002f9a0..13716985 100644
---- a/test/analytics-privacy.test.js
++++ b/test/analytics-privacy.test.js
@@@ -69,7 +69,7 @@ async function dumpAnalytics(db) {
      const ISSUER = 'https://openvibe.network';
      const closed = 'http://127.0.0.1:9'; // remote dashboards: refused at once, never a local dev server
      const config = {
--        internalKey: 'k'.repeat(32), baseUrl: ISSUER, loginUrl: ISSUER, networkUrl: ISSUER,
++        baseUrl: ISSUER, loginUrl: ISSUER, networkUrl: ISSUER,
          jwt: { issuer: ISSUER, accessTokenExpiry: '1h', refreshTokenExpiry: '30d' },
          services: { live: { internalUrl: closed }, tools: { internalUrl: closed }, games: { internalUrl: closed }, media: { internalUrl: closed } },
      };
ddiff --git a/test/avatar.test.js b/test/avatar.test.js
iindex 43411ed2..ccc75d90 100644
---- a/test/avatar.test.js
++++ b/test/avatar.test.js
@@@ -28,7 +28,7 @@ for (const bad of ['http://openvibe.media/x.png', 'javascript:alert(1)', 'https:
      // Network's own service token for the push (plan T2): live.avatar.write, audience openvibe.live.
      const { privateKey, publicKey } = require('crypto').generateKeyPairSync('rsa', { modulusLength: 2048, publicKeyEncoding: { type: 'spki', format: 'pem' }, privateKeyEncoding: { type: 'pkcs8', format: 'pem' } });
      const selfToken = require('../server/identity/self-token').createSelfTokens({ privateKey, issuer: 'https://openvibe.network' });
--    const svc = createAvatarService({ db, config: { internalKey: 'k'.repeat(24), services: {} }, selfToken, requireAuth: (req, _res, next) => { req.user = { id: 1, username: 'Goosely' }; next(); } });
++    const svc = createAvatarService({ db, config: { services: {} }, selfToken, requireAuth: (req, _res, next) => { req.user = { id: 1, username: 'Goosely' }; next(); } });
      assert.equal((await svc.fromSite({ user_id: 1, avatar_url: `${M}/f/a.png`, origin: 'live' })).changed, true);
      assert.equal(pushes.length, 0, 'a change that came from Live is not echoed back to Live');
      await svc.apply(1, 'Goosely', `${M}/f/b.png`, 'network'); assert.equal(pushes.length, 1); assert.equal(pushes[0].avatar_url, `${M}/f/b.png`, 'a change made here is pushed to the sites');
ddiff --git a/test/blocks.test.js b/test/blocks.test.js
iindex 4be4f65d..95988eb5 100644
---- a/test/blocks.test.js
++++ b/test/blocks.test.js
@@@ -17,7 +17,6 @@ const { getDb } = require('../server/db/database');
  
  (async () => {
  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ov-blocks-'));
--const dbFile = path.join(dir, 'network.db');
  const log = console.log; console.log = () => {};
  const db = getDb();
  console.log = log;
@@@ -39,7 +38,7 @@ await db.prepare("INSERT INTO users (id, username, password_hash, is_anon) VALUE
  const GUEST_SUBJECT = (await db.prepare('SELECT subject_id FROM users WHERE id = 5').get()).subject_id;
  
  const keys = crypto.generateKeyPairSync('rsa', { modulusLength: 2048, publicKeyEncoding: { type: 'spki', format: 'pem' }, privateKeyEncoding: { type: 'pkcs8', format: 'pem' } });
--const config = { internalKey: 'legacy-key', jwt: { issuer: 'https://openvibe.network', accessTokenExpiry: '1h' } };
++const config = { jwt: { issuer: 'https://openvibe.network', accessTokenExpiry: '1h' } };
  const { signToken } = require('../server/auth/routes');
  const requireAuth = require('../server/auth/session').makeRequireAuth(() => ({ db, publicKey: keys.publicKey, config }), signToken);
  const blocks = require('../server/identity/blocks');
ddiff --git a/test/creator-analytics.test.js b/test/creator-analytics.test.js
iindex 0bca1ab2..2ec7a98b 100644
---- a/test/creator-analytics.test.js
++++ b/test/creator-analytics.test.js
@@@ -28,7 +28,7 @@ const CAROL = ids.newId('user'), DAVE = ids.newId('user');
  await db.prepare('INSERT INTO users (id, username, password_hash, subject_id, role) VALUES (20, ?, ?, ?, ?), (21, ?, ?, ?, ?)').run('carol', 'x', CAROL, 'streamer', 'dave', 'x', DAVE, 'user');
  
  const keys = crypto.generateKeyPairSync('rsa', { modulusLength: 2048, publicKeyEncoding: { type: 'spki', format: 'pem' }, privateKeyEncoding: { type: 'pkcs8', format: 'pem' } });
--const config = { internalKey: 'legacy-key', jwt: { issuer: 'https://openvibe.network', accessTokenExpiry: '1h' } };
++const config = { jwt: { issuer: 'https://openvibe.network', accessTokenExpiry: '1h' } };
  const { signToken } = require('../server/auth/routes');
  const SECRET = 's'.repeat(40);
  const consumer = await createEventsConsumer({ db, notifications: new NotificationService(db), secrets: SECRET, log: { log() {}, warn() {}, error() {} } });
ddiff --git a/test/developer-defaults.test.js b/test/developer-defaults.test.js
iindex 471d9d1f..2a396c6f 100644
---- a/test/developer-defaults.test.js
++++ b/test/developer-defaults.test.js
@@@ -34,7 +34,7 @@ app.use(express.json());
  app.use(express.urlencoded({ extended: true }));
  app.locals.db = db;
  // No developer settings at all: the code defaults apply (as with DEV_SANDBOX_* unset).
--app.locals.config = { baseUrl: ISSUER, loginUrl: ISSUER, internalKey: 'legacy-key', jwt: { issuer: ISSUER, accessTokenExpiry: '1h' } };
++app.locals.config = { baseUrl: ISSUER, loginUrl: ISSUER, jwt: { issuer: ISSUER, accessTokenExpiry: '1h' } };
  app.locals.privateKey = keys.privateKey;
  app.locals.publicKey = keys.publicKey;
  app.use('/oauth', require('../server/auth/oauth-routes'));
ddiff --git a/test/developer-export-tokens.test.js b/test/developer-export-tokens.test.js
iindex f9817c7a..398ba73c 100644
---- a/test/developer-export-tokens.test.js
++++ b/test/developer-export-tokens.test.js
@@@ -37,7 +37,7 @@ app.use(express.json());
  app.use(express.urlencoded({ extended: true }));
  app.locals.db = db;
  app.locals.config = {
--    baseUrl: ISSUER, loginUrl: ISSUER, internalKey: 'legacy-key',
++    baseUrl: ISSUER, loginUrl: ISSUER,
      jwt: { issuer: ISSUER, accessTokenExpiry: '1h' },
      developer: { credentialOverlapS: 60 },
  };
ddiff --git a/test/developer-projects.test.js b/test/developer-projects.test.js
iindex 32247d29..89e58a55 100644
---- a/test/developer-projects.test.js
++++ b/test/developer-projects.test.js
@@@ -35,7 +35,7 @@ app.use(express.json());
  app.use(express.urlencoded({ extended: true }));
  app.locals.db = db;
  app.locals.config = {
--    baseUrl: ISSUER, loginUrl: ISSUER, internalKey: 'legacy-key',
++    baseUrl: ISSUER, loginUrl: ISSUER,
      jwt: { issuer: ISSUER, accessTokenExpiry: '1h' },
      // No sandbox allowance here, so every grant goes through the staff-set allowance (the defaults
      // are covered by test/developer-defaults.test.js).
ddiff --git a/test/follows-go-live.test.js b/test/follows-go-live.test.js
iindex 94720d28..d7db832e 100644
---- a/test/follows-go-live.test.js
++++ b/test/follows-go-live.test.js
@@@ -1,4 +1,5 @@
  'use strict';
++process.env.FOLLOWS_AUTHORITY = 'live';
  // ADR-030 step 4, plan T2 "Follows": products write follows through /internal/follows (network.follows.write,
  // service token only), and go-live notifications take the followers from Network's own graph only (no call to
  // Live, whatever the environment says); a channel with no Network account announces nothing.
@@@ -28,7 +29,7 @@ await db.prepare('INSERT INTO users (id, username, password_hash, subject_id, ro
      .run('carol', 'x', CAROL, 'streamer', 'dave', 'x', DAVE, 'user', 'erin', 'x', ERIN, 'user');
  
  const keys = crypto.generateKeyPairSync('rsa', { modulusLength: 2048, publicKeyEncoding: { type: 'spki', format: 'pem' }, privateKeyEncoding: { type: 'pkcs8', format: 'pem' } });
--const config = { internalKey: 'legacy-key', jwt: { issuer: 'https://openvibe.network', accessTokenExpiry: '1h' } };
++const config = { jwt: { issuer: 'https://openvibe.network', accessTokenExpiry: '1h' } };
  const { signToken } = require('../server/auth/routes');
  const requireAuth = require('../server/auth/session').makeRequireAuth(() => ({ db, publicKey: keys.publicKey, config }), signToken);
  const follows = require('../server/identity/follows');
@@@ -74,7 +75,6 @@ const server = http.createServer(app);
          assert.deepStrictEqual(evs.map((e) => e.event_type), ['network.follow.created', 'network.follow.created', 'network.follow.deleted', 'network.follow.created']);
  
          // ── Go-live: Network's followers, no Live call (even with Live's old switch set) ──
--        process.env.FOLLOWS_AUTHORITY = 'live';
          const started = {
              event_id: ids.newId('event'), event_type: 'live.stream.started', version: 1, source: 'live',
              actor: { type: 'user', id: CAROL }, subject: { type: 'stream', id: '801', revision: 1 }, visibility: 'public', priority: 'important',
ddiff --git a/test/follows.test.js b/test/follows.test.js
iindex 225d1943..076f9eb5 100644
---- a/test/follows.test.js
++++ b/test/follows.test.js
@@@ -31,7 +31,7 @@ await db.prepare(`INSERT INTO users (id, username, display_name, password_hash,
  await db.prepare("INSERT INTO users (id, username, password_hash, is_anon) VALUES (5, 'anon1234', 'x', 1)").run();
  
  const keys = crypto.generateKeyPairSync('rsa', { modulusLength: 2048, publicKeyEncoding: { type: 'spki', format: 'pem' }, privateKeyEncoding: { type: 'pkcs8', format: 'pem' } });
--const config = { internalKey: 'legacy-key', jwt: { issuer: 'https://openvibe.network', accessTokenExpiry: '1h' } };
++const config = { jwt: { issuer: 'https://openvibe.network', accessTokenExpiry: '1h' } };
  const { signToken } = require('../server/auth/routes');
  const requireAuth = require('../server/auth/session').makeRequireAuth(() => ({ db, publicKey: keys.publicKey, config }), signToken);
  const follows = require('../server/identity/follows');
ddiff --git a/test/frame.test.js b/test/frame.test.js
iindex ef5bde85..29db9ec2 100644
---- a/test/frame.test.js
++++ b/test/frame.test.js
@@@ -8,7 +8,7 @@ const { siteForHost } = require('../server/frame/sites');
  
  (async () => {
  const db = getDb();
--const svc = await createFrameService(db, { internalKey: 'change-me-in-production', services: {} }, null);
++const svc = await createFrameService(db, { services: {} }, null);
  
  assert.equal(siteForHost('yt.openvibe.tools').id, 'tools');
  assert.equal(siteForHost('evil.example'), null);
@@@ -49,7 +49,7 @@ for (let i = 0; i < 6; i++) await ins.run(1, 'tools', 'dns');
      });
      await Promise.all([live, ai].map(s => new Promise(r => s.listen(0, '127.0.0.1', r))));
      const { privateKey } = crypto.generateKeyPairSync('rsa', { modulusLength: 2048, privateKeyEncoding: { type: 'pkcs8', format: 'pem' }, publicKeyEncoding: { type: 'spki', format: 'pem' } });
--    const cfg = { internalKey: 'a-real-internal-key', services: { live: { internalUrl: `http://127.0.0.1:${live.address().port}` } } };
++    const cfg = { services: { live: { internalUrl: `http://127.0.0.1:${live.address().port}` } } };
      const aiUrl = `http://127.0.0.1:${ai.address().port}`;
      const db2 = db;   // the process's database (test/helpers/pg-preload.mjs); the copy cache lives here
      const copySvc = async (d) => await createFrameService(d, cfg, null, { privateKey, issuer: 'https://openvibe.network', aiUrl });
ddiff --git a/test/github-integration.test.js b/test/github-integration.test.js
iindex 93c0b689..982683ad 100644
---- a/test/github-integration.test.js
++++ b/test/github-integration.test.js
@@@ -36,7 +36,7 @@ const keys = crypto.generateKeyPairSync('rsa', { modulusLength: 2048, publicKeyE
  const app = express();
  app.use(express.urlencoded({ extended: true }));
  app.locals.db = db;
--app.locals.config = { internalKey: 'legacy-key', jwt: { issuer: 'https://openvibe.network', accessTokenExpiry: '1h' } };
++app.locals.config = { jwt: { issuer: 'https://openvibe.network', accessTokenExpiry: '1h' } };
  app.locals.privateKey = keys.privateKey;
  app.locals.publicKey = keys.publicKey;
  app.use('/oauth', require('../server/auth/oauth-routes'));
ddiff --git a/test/helpers/boot-server.js b/test/helpers/boot-server.js
iindex 3ddbce32..cb469b06 100644
---- a/test/helpers/boot-server.js
++++ b/test/helpers/boot-server.js
@@@ -32,7 +32,7 @@ async function bootServer({ env = {}, child = false, timeoutMs = 60000 } = {}) {
          NODE_ENV: 'test', PORT: String(port), HOST: '127.0.0.1', PGLITE_DIR: path.join(dir, 'pglite'),
          AVATAR_PATH: path.join(dir, 'avatars'),
          JWT_PRIVATE_KEY: path.join(dir, 'none.pem'), JWT_PUBLIC_KEY: path.join(dir, 'none.pub.pem'),
--        BOOTSTRAP_PROFILE: 'local-dev', INTERNAL_API_KEY: 'k'.repeat(40),
++        BOOTSTRAP_PROFILE: 'local-dev',
          OV_NETWORK_INTERNAL_URL: `http://127.0.0.1:${port}`,
          OV_LIVE_INTERNAL_URL: 'http://127.0.0.1:9', OV_TOOLS_INTERNAL_URL: 'http://127.0.0.1:9',
          OV_GAMES_INTERNAL_URL: 'http://127.0.0.1:9', OV_MEDIA_INTERNAL_URL: 'http://127.0.0.1:9',
ddiff --git a/test/node-principals-me.test.js b/test/node-principals-me.test.js
iindex a136a429..b2ad761e 100644
---- a/test/node-principals-me.test.js
++++ b/test/node-principals-me.test.js
@@@ -29,7 +29,7 @@ await db.prepare("INSERT INTO users (id, username, password_hash, is_anon) VALUE
  const clock = { offset: 0 };
  const now = () => Date.now() + clock.offset;
  const keys = crypto.generateKeyPairSync('rsa', { modulusLength: 2048, publicKeyEncoding: { type: 'spki', format: 'pem' }, privateKeyEncoding: { type: 'pkcs8', format: 'pem' } });
--const config = { internalKey: 'legacy-key', jwt: { issuer: 'https://openvibe.network', accessTokenExpiry: '1h' } };
++const config = { jwt: { issuer: 'https://openvibe.network', accessTokenExpiry: '1h' } };
  const requireAuth = require('../server/auth/session').makeRequireAuth(() => ({ db, publicKey: keys.publicKey, config }), signToken);
  
  const app = express();
ddiff --git a/test/nodes.test.js b/test/nodes.test.js
iindex 4cf06fc0..d978a26c 100644
---- a/test/nodes.test.js
++++ b/test/nodes.test.js
@@@ -27,7 +27,7 @@ const keys = crypto.generateKeyPairSync('rsa', { modulusLength: 2048, publicKeyE
  const app = express();
  app.use(express.urlencoded({ extended: true }));
  app.locals.db = db;
--app.locals.config = { internalKey: 'legacy-key', jwt: { issuer: 'https://openvibe.network', accessTokenExpiry: '1h' } };
++app.locals.config = { jwt: { issuer: 'https://openvibe.network', accessTokenExpiry: '1h' } };
  app.locals.privateKey = keys.privateKey;
  app.locals.publicKey = keys.publicKey;
  app.use('/oauth', require('../server/auth/oauth-routes'));
ddiff --git a/test/observability.test.js b/test/observability.test.js
iindex e2f758d9..8d397ec8 100644
---- a/test/observability.test.js
++++ b/test/observability.test.js
@@@ -28,7 +28,7 @@ metrics.instrument(app, { service: 'network', release: 'abc123def456', registry:
  app.use(express.json());
  app.use(express.urlencoded({ extended: true }));
  app.locals.db = db;
--app.locals.config = { internalKey: 'legacy-key', jwt: { issuer: ISSUER, accessTokenExpiry: '1h' } };
++app.locals.config = { jwt: { issuer: ISSUER, accessTokenExpiry: '1h' } };
  app.locals.privateKey = keys.privateKey;
  app.locals.publicKey = keys.publicKey;
  app.use('/oauth/token', observability.tokenEndpointMetrics);
ddiff --git a/test/project-placement.test.js b/test/project-placement.test.js
iindex a4556d9e..4d22c041 100644
---- a/test/project-placement.test.js
++++ b/test/project-placement.test.js
@@@ -23,7 +23,7 @@ const app = express();
  app.use(express.json());
  app.locals.db = db;
  app.locals.config = {
--    baseUrl: ISSUER, loginUrl: ISSUER, internalKey: 'legacy-key',
++    baseUrl: ISSUER, loginUrl: ISSUER,
      jwt: { issuer: ISSUER, accessTokenExpiry: '1h' },
      developer: { sandboxAudiences: 'openvibe.media', sandboxAllowance: '', credentialOverlapS: 60 },
  };
ddiff --git a/test/resource-registry.test.js b/test/resource-registry.test.js
iindex 4e67ff99..4360e33f 100644
---- a/test/resource-registry.test.js
++++ b/test/resource-registry.test.js
@@@ -29,7 +29,7 @@ const keys = crypto.generateKeyPairSync('rsa', { modulusLength: 2048, publicKeyE
  const app = express();
  app.use(express.urlencoded({ extended: true }));
  app.locals.db = db;
--app.locals.config = { internalKey: 'legacy-key', jwt: { issuer: 'https://openvibe.network', accessTokenExpiry: '1h' } };
++app.locals.config = { jwt: { issuer: 'https://openvibe.network', accessTokenExpiry: '1h' } };
  app.locals.privateKey = keys.privateKey;
  app.locals.publicKey = keys.publicKey;
  app.use('/oauth', require('../server/auth/oauth-routes'));
ddiff --git a/test/security-private.test.js b/test/security-private.test.js
iindex 11c4bc16..585d03fa 100644
---- a/test/security-private.test.js
++++ b/test/security-private.test.js
@@@ -121,7 +121,7 @@ const out = (...a) => process.stdout.write(a.join(' ') + '\n');
          }
          assert.deepStrictEqual(bad, [], `private reads answered:\n${bad.join('\n')}`);
          // A service principal reaches only the /internal routes its capabilities name.
--        assert.strictEqual(st['service GET /internal/integrations/github-token'], 403, 'github-token needs the legacy key or its own capability');
++        assert.strictEqual(st['service GET /internal/integrations/github-token'], 403, 'github-token needs its own capability');
          // Deleted with the X-Internal-Key retirement (plan T2, no caller left): no longer routes at all.
          for (const p of ['/internal/stats', `/internal/users/${users.alice.id}`, `/internal/users/${users.alice.id}/linked-accounts`, '/internal/anon-list', `/internal/notifications/unread/${users.alice.id}`]) {
              assert.strictEqual(st[`service GET ${p}`], undefined, `${p} is gone`);
ddiff --git a/test/security-secrets.test.js b/test/security-secrets.test.js
iindex 56af26d1..8e5669f2 100644
---- a/test/security-secrets.test.js
++++ b/test/security-secrets.test.js
@@@ -63,7 +63,7 @@ const out = (...a) => process.stdout.write(a.join(' ') + '\n');
              '/oauth/client-info?client_id=live', `/oauth/client-info?client_id=${dev.PA.app}`, '/api/auth/anon-identities', '/sso/check', '/fedcm/accounts'];
          const paths = crawler.pathsFor(w.routes, values, { method: 'get', query: 'limit=5&all=1&debug=1&include=secret', extra });
          const tokenOf = (h) => String((h && h.authorization) || '').replace(/^Bearer /, '');
--        const people = { ...w.callers, key: { 'x-internal-key': w.sentinels.INTERNAL_API_KEY } };
++        const people = { ...w.callers, key: { 'x-internal-key': 'retired-key' } };
          // What each caller must never see: every secret, plus every other caller's credential. Staff
          // admins and the owner list verification keys (they make them to hand out); nobody else sees one.
          const needlesFor = (who) => {
@@@ -137,7 +137,7 @@ const out = (...a) => process.stdout.write(a.join(' ') + '\n');
          }
          // Wrong credentials of every kind on the paths that take them.
          const wrong = {
--            'retired internal key': { 'x-internal-key': w.sentinels.INTERNAL_API_KEY },
++            'retired internal key': { 'x-internal-key': 'retired-key' },
              'forged bearer': { authorization: `Bearer ${jwt.sign({ sub: users.owner.id, id: users.owner.id }, 'guess', { issuer: w.issuer })}` },
              'none alg bearer': { authorization: `Bearer ${jwt.sign({ sub: users.owner.id, id: users.owner.id }, null, { algorithm: 'none' })}` },
              'setup token guess': { 'x-setup-token': 'x', authorization: 'Bearer x' },
ddiff --git a/test/security-world.js b/test/security-world.js
iindex 6930aee5..78fdb567 100644
---- a/test/security-world.js
++++ b/test/security-world.js
@@@ -26,7 +26,6 @@ const S = (name) => `sentinel-not-a-secret-${name}`;
  /** Every secret-typed environment variable Network (or a module it loads) reads, with its sentinel. */
  function sentinelEnv() {
      return {
--        INTERNAL_API_KEY: S('internal-api-key'),
          SETUP_TOKEN: S('setup-token'),
          NETWORK_EVENTS_SECRET: S('network-events-secret'),
          OV_LIVE_WEBHOOK_SECRET: S('live-webhook-secret'),
@@@ -136,7 +135,7 @@ async function buildWorld({ label = 'sec', env: extraEnv = {} } = {}) {
      const shownOnce = [];   // responses that legitimately carry a secret once (checked for no-store by the suites)
      const once = (what, r) => { shownOnce.push({ what, status: r.status, cache: r.headers.get('cache-control') || '' }); return r; };
  
--    // Service principal tokens (client_credentials) and the legacy key.
++    // Service principal tokens (client_credentials).
      async function serviceToken(clientId, audience = 'openvibe.network') {
          const r = once(`service token ${clientId}`, await call(null, 'POST', '/oauth/token', new URLSearchParams({ grant_type: 'client_credentials', client_id: clientId, client_secret: clientSecrets[clientId], audience })));
          if (r.status !== 200) throw new Error(`service token for ${clientId}: ${r.status} ${r.text}`);
ddiff --git a/test/status-incidents.test.js b/test/status-incidents.test.js
iindex 08ce6537..2f2d0fc1 100644
---- a/test/status-incidents.test.js
++++ b/test/status-incidents.test.js
@@@ -23,7 +23,7 @@ for (const c of ['host', 'live']) await db.prepare('UPDATE oauth_clients SET cli
  await db.prepare("INSERT INTO users (id, username, password_hash, subject_id, role) VALUES (1, 'boss', 'x', 'usr_01JAB2C3D4E5F6G7H8J9K0MNPA', 'admin'), (2, 'pat', 'x', 'usr_01JAB2C3D4E5F6G7H8J9K0MNPB', 'user')").run();
  
  const keys = crypto.generateKeyPairSync('rsa', { modulusLength: 2048, publicKeyEncoding: { type: 'spki', format: 'pem' }, privateKeyEncoding: { type: 'pkcs8', format: 'pem' } });
--const config = { internalKey: 'legacy-key', jwt: { issuer: 'https://openvibe.network', accessTokenExpiry: '1h' } };
++const config = { jwt: { issuer: 'https://openvibe.network', accessTokenExpiry: '1h' } };
  const { signToken } = require('../server/auth/routes');
  const requireAuth = require('../server/auth/session').makeRequireAuth(() => ({ db, publicKey: keys.publicKey, config }), signToken);
  const app = express();
ddiff --git a/test/themes-review.test.js b/test/themes-review.test.js
iindex d8ec37d2..52dc601b 100644
---- a/test/themes-review.test.js
++++ b/test/themes-review.test.js
@@@ -20,7 +20,7 @@ const db = getDb();
  console.log = log;
  await db.prepare("INSERT INTO users (id, username, password_hash, role) VALUES (1, 'ann', 'x', 'user'), (2, 'bob', 'x', 'user'), (3, 'boss', 'x', 'admin')").run();
  const keys = crypto.generateKeyPairSync('rsa', { modulusLength: 2048, publicKeyEncoding: { type: 'spki', format: 'pem' }, privateKeyEncoding: { type: 'pkcs8', format: 'pem' } });
--const config = { internalKey: 'legacy-key', jwt: { issuer: 'https://openvibe.network', accessTokenExpiry: '1h' } };
++const config = { jwt: { issuer: 'https://openvibe.network', accessTokenExpiry: '1h' } };
  const { signToken } = require('../server/auth/routes');
  const requireAuth = require('../server/auth/session').makeRequireAuth(() => ({ db, publicKey: keys.publicKey, config }), signToken);
  const requireAdmin = (req, res, next) => (req.user && req.user.role === 'admin' ? next() : res.status(403).json({ error: 'admin only' }));