Phase 5: enforce v1 sunset (deprecation header, traffic counter, CI rule)

[vilosource]

Background

Phase 4b SDK adoption is now complete on vafi main as of vafi 422350d (2026-05-10): the controller exclusively uses vtf-sdk-python AsyncVtfClient; the old hand-rolled vtf_client.py is deleted; the judge polls /v2/reviews/pending/ (closed #6).

That means vafi-dev is now a 100% v2/SDK consumer. The next step in the v2-api-sdk-DESIGN roadmap is Phase 5 — deprecate v1.

Scope

The design doc lists three Phase 5 deliverables. Filing this so we can land them incrementally:

• Deprecation header on all /v1/* responses — Deprecation: true + Sunset: <date> (RFC 8594). Pick a date (suggest 90 days out from when zero v1 traffic is confirmed).
• Prometheus counter vtf_v1_request_total{path,method,user_agent} — exposed on the existing /metrics endpoint. Drives the "is anyone still on v1?" decision.
• CI guard against new /v1/ URLs — a unit/lint rule that fails if any non-removal change adds a route or call site under /v1/. Prevents accidental regressions while v1 is being phased out.

Once the counter trends to ≈ 0 across all known consumers, remove v1 serializers, URL routes, and tests in a follow-up PR.

Known v1 consumers as of today

• vafi controller — migrated (vafi 422350d)
• vtf CLI / vtf python package — uses SDK
• web SPA — status TBD; check before flipping the deprecation switch
• ad-hoc curl from operators (this is what we're trying to surface with the counter)

Reference: docs/design/v2-api-sdk-DESIGN.md §Phase 5 (lines 1778–1786).