chore(vulture): exclude build artifacts and prune stale whitelist entries (#1151)

Vulture recursed into the gitignored packages/testing/build/ tree, which
duplicates the real source, so every package symbol was reported twice.
Exclude build directories from the scan to remove those false positives at
the root.

Whitelist the Validators index-position model_validator, a real validator
that runs on every construction but is invisible to static analysis.

Drop two stale whitelist entries whose symbols no longer exist anywhere in
the codebase: the fork-upgrade method and the route access-tier flag. Their
code was already removed; only the whitelist lines lingered.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: tcoratger

pyproject.toml

@@ -146,6 +146,9 @@ fail_under = 90
 # The whitelist names the indirectly-used symbols vulture cannot see; listing
 # them explicitly keeps the ignores tight instead of relying on wide globs.
 paths = ["src", "packages", "tests", "vulture_whitelist.py"]
+# Skip build artifacts under packages, which duplicate the real source and would
+# otherwise report every package symbol twice.
+exclude = ["*/build/*"]
 # Show the largest unused blocks first; they are the highest-value removals.
 sort_by_size = true
 

vulture_whitelist.py

@@ -54,6 +54,7 @@
 _._accept_hex_string
 _._validate_byte_list_data
 _._validate_decomposition
+_._require_index_matches_position
 _.validate_state_length
 _.validate_target
 _.validate_rejection_is_declared
@@ -68,10 +69,6 @@
 _._serialize_data
 _._serialize_as_hex
 
-# Fork-upgrade protocol method, invoked polymorphically on a fork transition.
-# A single-fork tree has no transition yet, so there is no call site.
-_.upgrade_state
-
 # Signature parameters mandated by external protocols we cannot rename.
 # The pydantic core-schema hook, the pytest session-finish hook, and the
 # prometheus metric stub interface.
@@ -170,10 +167,6 @@
 slot_number
 _.slot_number
 
-# Access tier recorded on every route entry to document the route, not yet
-# read back by the registration path.
-is_admin
-
 # Attribute assignment in slotted-class tests that proves new attributes are
 # rejected; the assignment is the action under test, never read back.
 _.extra_field