@@ -298,7 +298,6 @@ vgi-client --input data.parquet --function sum_all_columns --worker vgi-fixture-
 | `VGI_OAUTH_DEVICE_CODE_CLIENT_SECRET` | Client secret for device-code flow (optional, URL-safe chars only) |
 | `VGI_OAUTH_USE_ID_TOKEN` | When `1`/`true`/`yes`, clients use OIDC `id_token` as Bearer instead of `access_token` |
 | `VGI_INTROSPECT_PRINCIPALS` | Comma-separated principals permitted to call `vgi_rpc.Identity.v1`'s `introspect_token`. Required — no permissive default — whenever the worker implements `resolve_token()` (see below) |
-| `VGI_INTROSPECT_RATE_LIMIT` | Introspection requests allowed per caller per second (default 20) |
 | `VGI_WORKER_ACCESS_LOG_SAMPLE` | Fraction of *successful* calls to keep in the access log, `0.0`–`1.0`. Errors are always kept; the decision is per call, so every record of one stream shares a fate |
 | `VGI_WORKER_ACCESS_LOG_ASYNC` | When `1`/`true`/`yes`, emit access-log records from a listener thread. Bounded queue; full means drop, and a crash loses whatever is queued |
 | `VGI_WORKER_ACCESS_LOG_QUEUE_SIZE` | Bound on the async access-log queue (default 10000) |
@@ -461,8 +460,10 @@ Enabling it also requires an allowlist of principals permitted to ask, via
 default and a worker that overrides the hook without one **refuses to start**:
 authenticating and introspecting are different capabilities, and "any
 authenticated caller" lets any user resolve any other user's credential to its
-owner. `--introspect-rate-limit` (default 20/caller/second) bounds, rather than
-closes, the oracle an allowlisted-but-compromised caller still has.
+owner. Introspection is deliberately not rate limited (vgi-rpc removed the
+limiter): the allowlisted caller is a proxy asking on behalf of every client, so a
+per-caller limit was one budget for every user's login, drainable by junk
+credentials. Throttle untrusted traffic at the proxy, per client.
 
 Return `None` for "the store answered and this credential is unknown"; raise
 `AuthUnavailableError` for "the answer is not knowable". A caller that
 
@@ -551,19 +551,18 @@ class TestTokenIntrospection:
     *wiring*: a ``resolve_token`` override becomes an ``IdentityImpl`` carrying
     the configured allowlist, and nothing at all when the hook is absent. The
     guards themselves (allowlist enforcement, uniform rejection, JWS-shape
-    refusal, rate limiting) live in vgi-rpc and are tested there.
+    refusal) live in vgi-rpc and are tested there.
     """
 
     @staticmethod
     def _identity(worker_cls: type[Worker], **env: str) -> object | None:
         from vgi.serve import _build_identity
 
         with pytest.MonkeyPatch.context() as mp:
-            for key in ("VGI_INTROSPECT_PRINCIPALS", "VGI_INTROSPECT_RATE_LIMIT"):
-                mp.delenv(key, raising=False)
+            mp.delenv("VGI_INTROSPECT_PRINCIPALS", raising=False)
             for key, value in env.items():
                 mp.setenv(key, value)
-            return _build_identity(worker_cls, None, None)
+            return _build_identity(worker_cls, None)
 
     def test_identity_absent_without_hook(self) -> None:
         """Not "hosted and refusing" — absent.
@@ -641,14 +640,19 @@ def test_hook_without_allowlist_refuses_to_start(self) -> None:
                 create_app(_IntrospectingWorker, prefix="/vgi", describe=False)
         assert exc.value.code == 1
 
-    @pytest.mark.parametrize("bad", ["nonsense", "0", "-5"])
-    def test_bad_rate_limit_refuses_to_start(self, bad: str) -> None:
-        """A typo must not silently become "refuse everything" or "no bound"."""
-        with pytest.MonkeyPatch.context() as mp:
+    def test_the_retired_rate_limit_is_not_passed(self) -> None:
+        """Introspection is not rate limited, and this repo no longer asks for it.
+
+        vgi-rpc still accepts ``introspect_rate_limit=`` for one release as a
+        deprecated no-op, only because vgi-python 0.34.1 passes it. Building the
+        identity without a ``DeprecationWarning`` pins that this version does not.
+        """
+        import warnings
+
+        with pytest.MonkeyPatch.context() as mp, warnings.catch_warnings():
+            warnings.simplefilter("error", DeprecationWarning)
             mp.setenv("VGI_INTROSPECT_PRINCIPALS", "proxy-a")
-            mp.setenv("VGI_INTROSPECT_RATE_LIMIT", bad)
-            with pytest.raises(SystemExit):
-                create_app(_IntrospectingWorker, prefix="/vgi", describe=False)
+            create_app(_IntrospectingWorker, prefix="/vgi", describe=False)
 
 
 class TestAuthUnavailableReExport:
 
@@ -217,7 +217,6 @@ def create_app(
     max_stream_response_bytes: int | None = None,
     max_externalized_response_bytes: int | None = None,
     introspect_principals: Iterable[str] | None = None,
-    introspect_rate_limit: int | None = None,
     iroh_bridge_issuer: str | None = None,
     iroh_trusted_proxy_addresses: Iterable[str] = (),
     iroh_authenticate: bool = True,
@@ -279,9 +278,6 @@ def create_app(
             ``vgi_rpc.Identity.v1``'s ``introspect_token``.  Only consulted
             when the worker class overrides ``resolve_token``.  ``None`` reads
             ``VGI_INTROSPECT_PRINCIPALS``.
-        introspect_rate_limit: Introspection requests allowed per caller per
-            second.  ``None`` reads ``VGI_INTROSPECT_RATE_LIMIT``, defaulting
-            to 20.
         iroh_bridge_issuer: Operator-controlled identity namespace for an
             ``iroh-http/2`` bridge. ``None`` disables Iroh header trust.
         iroh_trusted_proxy_addresses: Exact immediate bridge addresses.
@@ -327,7 +323,7 @@ def create_app(
         worker,
         enable_describe=describe,
         server_version=_get_vgi_version(),
-        identity=_build_identity(worker_cls, introspect_principals, introspect_rate_limit),
+        identity=_build_identity(worker_cls, introspect_principals),
     )
 
     effective_peer_identity_providers = tuple(peer_identity_providers)
@@ -499,15 +495,6 @@ def serve(
                 "that case, with no permissive default. Env: VGI_INTROSPECT_PRINCIPALS."
             ),
         ),
-        introspect_rate_limit: int | None = typer.Option(  # noqa: B008
-            None,
-            "--introspect-rate-limit",
-            help=(
-                "Introspection requests allowed per caller per second (default 20). "
-                "Bounds, rather than closes, the oracle an allowlisted-but-compromised "
-                "caller has. Env: VGI_INTROSPECT_RATE_LIMIT."
-            ),
-        ),
         access_log_sample: float | None = typer.Option(  # noqa: B008
             None,
             "--access-log-sample",
@@ -591,7 +578,6 @@ def serve(
                 max_stream_response_bytes=max_stream_response_bytes,
                 max_externalized_response_bytes=max_externalized_response_bytes,
                 introspect_principals=introspect_principals,
-                introspect_rate_limit=introspect_rate_limit,
                 server=server,
                 worker_ref=worker_ref,
                 http_workers=http_workers,
@@ -802,7 +788,6 @@ def _resolve_authenticate() -> Callable[..., Any] | None:
 def _build_identity(
     worker_cls: type[Worker],
     introspect_principals: Iterable[str] | None,
-    introspect_rate_limit: int | None,
 ) -> IdentityImpl | None:
     """Build the ``vgi_rpc.Identity.v1`` implementation, or ``None``.
 
@@ -823,8 +808,6 @@ def _build_identity(
             override.
         introspect_principals: Principals permitted to introspect, or ``None``
             to read the environment.
-        introspect_rate_limit: Per-caller, per-second ceiling, or ``None`` to
-            read the environment.
 
     Returns:
         The implementation, or ``None`` when this worker does not resolve
@@ -842,7 +825,6 @@ def _build_identity(
     return IdentityImpl(
         resolve_token=resolver,
         introspect_principals=_resolve_introspect_principals(introspect_principals),
-        introspect_rate_limit=_resolve_introspect_rate_limit(introspect_rate_limit),
     )
 
 
@@ -891,42 +873,6 @@ def _resolve_introspect_principals(explicit: Iterable[str] | None) -> list[str]:
     return principals
 
 
-def _resolve_introspect_rate_limit(explicit: int | None) -> int:
-    """Resolve introspection requests allowed per caller per second.
-
-    Env var: ``VGI_INTROSPECT_RATE_LIMIT``; defaults to 20.
-
-    Args:
-        explicit: Value passed to :func:`create_app`, or None to read the
-            environment.
-
-    Returns:
-        A positive per-caller, per-second request ceiling.
-
-    Raises:
-        SystemExit: When the environment value is not a positive integer. A
-            typo that silently became 0 would refuse every introspection with
-            no diagnostic; one that became huge would remove the bound on an
-            allowlisted-but-compromised caller's guessing rate.
-
-    """
-    if explicit is not None:
-        value = explicit
-    else:
-        raw = os.environ.get("VGI_INTROSPECT_RATE_LIMIT")
-        if not raw:
-            return 20
-        try:
-            value = int(raw)
-        except ValueError:
-            sys.stderr.write(f"Error: VGI_INTROSPECT_RATE_LIMIT must be an integer, got {raw!r}\n")
-            sys.exit(1)
-    if value <= 0:
-        sys.stderr.write(f"Error: introspection rate limit must be positive, got {value}\n")
-        sys.exit(1)
-    return value
-
-
 def _resolve_proxy_proof_gate() -> Any | None:
     """Build a proxy-proof gate from ``VGI_PROXY_PROOF_*`` environment variables.
 
@@ -1506,7 +1452,6 @@ def _serve_http(
     max_stream_response_bytes: int | None = None,
     max_externalized_response_bytes: int | None = None,
     introspect_principals: str | None = None,
-    introspect_rate_limit: int | None = None,
     server: str = "waitress",
     worker_ref: str | None = None,
     http_workers: int | None = None,
@@ -1524,8 +1469,6 @@ def _serve_http(
     # export_serve_config for why the environment is the channel.
     if introspect_principals is not None:
         os.environ["VGI_INTROSPECT_PRINCIPALS"] = introspect_principals
-    if introspect_rate_limit is not None:
-        os.environ["VGI_INTROSPECT_RATE_LIMIT"] = str(introspect_rate_limit)
 
     if server == "granian":
         _serve_http_granian(