Remove unreachable exported functions from pkg/

Dead-code audit batch 1: five functions with zero references from main,
tests, or pulse-enterprise (deadcode -test, grep-verified per symbol,
enterprise compile-checked). Also renames the tlsutil test that
exercised the deleted compat alias's target to name the Unverified
function it actually calls.

Skipped from the audit list after re-verification: IsNilAlertPayload
(live pulse-enterprise consumer in internal/aialertanalysis).

pkg/auth/policy_evaluator.go

@@ -148,13 +148,6 @@ func (e *PolicyEvaluator) substituteVariables(value, username string, attributes
 	return value
 }
 
-// SetAdminUser implements AdminConfigurable.
-// The admin user always has full access regardless of roles.
-func (e *PolicyEvaluator) SetAdminUser(username string) {
-	// Store admin user for bypass - not implemented in this basic version
-	// The FileManager handles this separately
-}
-
 // RBACAuthorizer wraps PolicyEvaluator to implement Authorizer for the RBAC system.
 type RBACAuthorizer struct {
 	evaluator *PolicyEvaluator
@@ -180,18 +173,6 @@ func (a *RBACAuthorizer) Authorize(ctx context.Context, action string, resource
 	return a.evaluator.Authorize(ctx, action, resource)
 }
 
-// AuthorizeWithAttributes checks authorization with ABAC attributes.
-func (a *RBACAuthorizer) AuthorizeWithAttributes(ctx context.Context, action string, resource string, attributes map[string]string) (bool, error) {
-	username := GetUser(ctx)
-
-	// Admin user bypass
-	if a.adminUser != "" && username == a.adminUser {
-		return true, nil
-	}
-
-	return a.evaluator.AuthorizeWithAttributes(ctx, action, resource, attributes)
-}
-
 // SetAdminUser sets the admin user who has full access.
 func (a *RBACAuthorizer) SetAdminUser(username string) {
 	a.adminUser = username

pkg/licensing/entitlement_payload.go

@@ -322,20 +322,6 @@ func BuildEntitlementPayload(status *LicenseStatus, subscriptionState string) En
 	return BuildEntitlementPayloadWithUsage(status, subscriptionState, EntitlementUsageSnapshot{}, nil)
 }
 
-// BuildCommercialPosturePayload constructs the canonical non-billing
-// commercial posture payload from LicenseStatus.
-func BuildCommercialPosturePayload(
-	status *LicenseStatus,
-	subscriptionState string,
-) CommercialPosturePayload {
-	return BuildCommercialPosturePayloadWithUsage(
-		status,
-		subscriptionState,
-		EntitlementUsageSnapshot{},
-		nil,
-	)
-}
-
 // BuildRuntimeCapabilitiesPayload constructs the canonical non-commercial
 // runtime capability payload from LicenseStatus.
 func BuildRuntimeCapabilitiesPayload(

pkg/licensing/legacy_v5_monitored_system_limit_aliases.go

@@ -1,7 +1,5 @@
 package licensing
 
-import "strings"
-
 const legacyV5AgentLimitKey = "max_agents"
 const legacyV5NodeLimitKey = "max_nodes"
 
@@ -9,12 +7,3 @@ var legacyV5MonitoredSystemLimitAliasKeys = [...]string{
 	legacyV5AgentLimitKey,
 	legacyV5NodeLimitKey,
 }
-
-func canonicalizeLegacyV5MonitoredSystemLimitKey(key string) (string, bool) {
-	switch strings.TrimSpace(key) {
-	case legacyV5AgentLimitKey, legacyV5NodeLimitKey:
-		return MaxMonitoredSystemsLicenseGateKey, true
-	default:
-		return "", false
-	}
-}

pkg/pulsecli/root.go

@@ -58,24 +58,6 @@ func NewRootCommand(command CommandSpec, runtime RuntimeSpec, deps CommandDeps)
 	return cmd
 }
 
-func ResetFlags(config *ConfigDeps) {
-	if config == nil {
-		return
-	}
-	if config.ExportFile != nil {
-		*config.ExportFile = ""
-	}
-	if config.ImportFile != nil {
-		*config.ImportFile = ""
-	}
-	if config.Passphrase != nil {
-		*config.Passphrase = ""
-	}
-	if config.ForceImport != nil {
-		*config.ForceImport = false
-	}
-}
-
 func newVersionCmd(command CommandSpec) *cobra.Command {
 	return &cobra.Command{
 		Use:   "version",

pkg/tlsutil/fingerprint.go

@@ -40,12 +40,6 @@ func UnverifiedPeerCertificateCaptureTLSConfig() *tls.Config {
 	}
 }
 
-// PeerCertificateCaptureTLSConfig is retained for source compatibility. New
-// callers should use the explicitly named unverified capture boundary.
-func PeerCertificateCaptureTLSConfig() *tls.Config {
-	return UnverifiedPeerCertificateCaptureTLSConfig()
-}
-
 // FetchFingerprint connects to a host and returns the SHA256 fingerprint of its TLS certificate.
 // This is used for TOFU (Trust On First Use) when discovering cluster peers.
 // The host should be in the format "hostname:port" or "https://hostname:port".

pkg/tlsutil/tlsutil_test.go

@@ -43,16 +43,16 @@ func TestFingerprintVerifier_NormalizesFingerprint(t *testing.T) {
 	}
 }
 
-func TestPeerCertificateCaptureTLSConfigRequiresPeerCertificate(t *testing.T) {
+func TestUnverifiedPeerCertificateCaptureTLSConfigRequiresPeerCertificate(t *testing.T) {
 	config := UnverifiedPeerCertificateCaptureTLSConfig()
 	if !config.InsecureSkipVerify {
-		t.Fatal("PeerCertificateCaptureTLSConfig should enable custom verification mode")
+		t.Fatal("UnverifiedPeerCertificateCaptureTLSConfig should enable custom verification mode")
 	}
 	if config.VerifyPeerCertificate == nil {
-		t.Fatal("PeerCertificateCaptureTLSConfig should install a peer-certificate verifier")
+		t.Fatal("UnverifiedPeerCertificateCaptureTLSConfig should install a peer-certificate verifier")
 	}
 	if config.MinVersion != minimumTLSVersion {
-		t.Fatalf("PeerCertificateCaptureTLSConfig MinVersion = %v, want %v", config.MinVersion, minimumTLSVersion)
+		t.Fatalf("UnverifiedPeerCertificateCaptureTLSConfig MinVersion = %v, want %v", config.MinVersion, minimumTLSVersion)
 	}
 
 	err := config.VerifyPeerCertificate(nil, nil)