Remove pkg/compliance's report generator and wrapper validators (#811)

[scttfrdmn]

Sixth of #811's staged items, and the one this issue specified most precisely — "the validator is live; the 807-line report generator has test callers only. Keep the first, delete the second." That holds up. Refs #811.

1,852 lines removed (746 non-test, 1,106 test); the package goes from 3,782 to 1,930. There is no spawn compliance command and never was.

What goes

• report.go + report_test.go. All seven exported functions — GenerateComplianceReport, GenerateInstanceReport, GenerateSummaryReport, FormatReportJSON, FormatReportText, CompareBaselinesReport, CompareFedRAMPReport — have zero callers outside the file and its own test.
• Thirteen standalone wrappers across nist80053.go, nist80171.go, fedramp.go: the Validate*Compliance, Enforce*Compliance, Validate*Instance, Get*Description and Compare* functions, plus the eleven test functions that covered only them.

What stays, and why that's the whole point

cmd/ uses exactly compliance.NewValidator and compliance.ValidationResult. The live method set is four:

method	caller
ValidateLaunchConfig	cmd/launch_single.go
EnforceLaunchConfig	cmd/launch_single.go
IsStrictMode	cmd/launch_single.go
ValidateInstances	cmd/validate.go

Those, the three *ControlSet constructors they dispatch to, controls.go, and every test of them are untouched. ControlViolation.Error is deliberately left alone — #811 is right that it's what makes the type satisfy error.

These were not a second implementation

The distinction that matters, given the pkg/regions finding earlier in this chain. Each removed wrapper was two lines over the live path:

func ValidateNIST80053Compliance(cfg *aws.LaunchConfig, baseline Baseline) (*ValidationResult, error) {
	controlSet := NIST80053ControlSet(baseline)
	result := controlSet.ValidateLaunchConfig(cfg)
	return result, nil
}

No logic, and an error return that is always nil. The live path is also the better-covered one — 10 test references to ValidateLaunchConfig against 1 for the wrapper — so unlike pkg/regions nothing unique was lost. I checked this before deleting precisely because the regions case an hour earlier came out the opposite way.

Deletion cascades, and the second pass caught a wrong deletion of mine

Removing the thirteen wrappers orphaned four more functions that had only ever been reachable through them. Three were then removed. The fourth I deleted and restored:

GetBaselineControlCount has no production caller — its only one was GetBaselineDescription, which this change removes. But TestFedRAMPControlSet, a test of the live FedRAMPControlSet path, uses it to assert that a FedRAMP control set holds the same number of controls as the NIST baseline it maps to. Deleting it would have forced that assertion to be weakened or the count reimplemented in the test — so it is restored with the reason recorded at the function.

"Dead outside tests" is not the same as "safe to delete" when a live test needs the symbol to express what it means. My reachability pass excluded _test.go, which is right for "is this dead in production" and wrong as a deletion criterion. Worth knowing for the remaining item.

Two methods are also retained while unreachable, said out loud rather than decided quietly: GetComplianceSummary and GetControlList are the validator's introspection surface, unused because the command that would call them doesn't exist. That's the same finish-or-withdraw question as #864, not evidence they're wrong — and deleting every unused exported method in turn eventually removes the component's usable surface while each step looks locally justified.

No gate, deliberately

I don't have a mechanism to gate here. The property is "a report generator exists with no command to invoke it", and every offline check I sketched either needed an allowlist of the symbols I'm deliberately keeping — rule 6's tell — or reduced to "exported things must be called", which this PR intentionally violates twice with reasons. A weak gate counted as coverage is the single most common defect this audit has found, so I'd rather say there isn't one than add one that can't fail.

make check, make check-docs and semgrep scan --config=auto --error . clean; make api-snapshot shows no public-surface drift, confirming pkg/compliance was never part of it.

Remaining in #811

pkg/security only, kept last on purpose: the reaper's unquoted su — fixed earlier in this audit by giving lambda/ttl-reaper the security.ValidateUsername it didn't import at all — is evidence that at least one of those helpers was wanted on a live path. That makes it a wiring question, not a deletion.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!