docs(spec): ADR-0056 D8 — mark unenforced compliance/encryption/masking/RLS-config EXPERIMENTAL

Honesty pass per ADR-0049/ADR-0056 D8: the security-adjacent schemas with no runtime
consumer get an explicit `⚠️ EXPERIMENTAL — NOT ENFORCED` header (GDPR/HIPAA/PCI,
encryption, masking, security-context governance, global RLSConfig + RLSAuditEvent).
The ENFORCED RowLevelSecurityPolicySchema is deliberately left unmarked. Comment-only;
spec builds; liveness gate green (these aren't governed types — the markers are
documentation honesty, not a gate change).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XVdnfUAx85amkerym26vdx

Author: claude

.changeset/adr-0056-d8-experimental-markers.md

@@ -0,0 +1,14 @@
+---
+"@objectstack/spec": patch
+---
+
+docs(spec): mark unenforced compliance/encryption/masking/RLS-config surface EXPERIMENTAL (ADR-0056 D8)
+
+Per ADR-0049's enforce-or-remove gate (and ADR-0056 D8), the security-adjacent
+schemas that are parsed but have **no runtime consumer** now carry an explicit
+`⚠️ EXPERIMENTAL — NOT ENFORCED` header so the no-op is visible to authors and the
+reference docs: GDPR/HIPAA/PCI compliance configs, field-level encryption, data
+masking, the unified security-context governance, and the global `RLSConfig` /
+`RLSAuditEvent` (distinct from the ENFORCED `RowLevelSecurityPolicySchema`, which is
+left untouched). No behaviour change — these were already inert; the marker makes
+the inertness honest rather than silent.

packages/spec/src/security/rls.zod.ts

@@ -422,6 +422,8 @@ export const RowLevelSecurityPolicySchema = lazySchema(() => z.object({
  * 
  * Records a single RLS policy evaluation event for compliance and debugging.
  */
+// ⚠️ EXPERIMENTAL — NOT ENFORCED (ADR-0056). RLS audit events are not emitted by the
+// runtime RLS path — no consumer writes these. Authoring does NOT change behaviour (per ADR-0049).
 export const RLSAuditEventSchema = lazySchema(() => z.object({
   /** ISO 8601 timestamp of the evaluation */
   timestamp: z.string()
@@ -518,6 +520,8 @@ export type RLSAuditConfig = z.infer<typeof RLSAuditConfigSchema>;
  * Global configuration for the Row-Level Security system.
  * Defines how RLS is enforced across the entire platform.
  */
+// ⚠️ EXPERIMENTAL — NOT ENFORCED (ADR-0056). Global RLSConfig (defaultPolicy / bypassRoles /
+// caching / audit) is not read by the SecurityPlugin RLS path. Authoring does NOT change behaviour (per ADR-0049).
 export const RLSConfigSchema = lazySchema(() => z.object({
   /**
    * Global RLS enable/disable flag.

packages/spec/src/system/compliance.zod.ts

@@ -1,6 +1,12 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
 import { z } from 'zod';
+
+// ⚠️ EXPERIMENTAL — NOT ENFORCED (ADR-0056). The GDPR/HIPAA/PCI-DSS schemas below
+// are parsed but have NO runtime consumer — no data-subject-rights engine,
+// retention enforcer, BAA gate, or tokenizer reads them. Authoring them does NOT
+// change behaviour; recorded as roadmap intent (M2+). Do not rely on them for
+// compliance until a consumer lands (per ADR-0049 enforce-or-remove).
 import { ComplianceFrameworkSchema } from './security-context.zod';
 
 /**

packages/spec/src/system/encryption.zod.ts

@@ -2,6 +2,10 @@
 
 import { z } from 'zod';
 
+// ⚠️ EXPERIMENTAL — NOT ENFORCED (ADR-0056). Field-level encryption is declared but
+// no runtime crypto provider reads this config to encrypt/decrypt at rest.
+// Authoring it does NOT change behaviour (roadmap M2+; per ADR-0049).
+
 /**
  * Field-level encryption protocol
  * GDPR/HIPAA/PCI-DSS compliant

packages/spec/src/system/masking.zod.ts

@@ -2,6 +2,11 @@
 
 import { z } from 'zod';
 
+// ⚠️ EXPERIMENTAL — NOT ENFORCED (ADR-0056). Data-masking rules are declared but no
+// redaction layer applies them — Field-Level Security (PermissionSet.fields) is the
+// enforced field-visibility mechanism today. Authoring masking does NOT change
+// behaviour (roadmap M2+; per ADR-0049).
+
 /**
  * Data masking protocol for PII protection
  */

packages/spec/src/system/security-context.zod.ts

@@ -2,6 +2,10 @@
 
 import { z } from 'zod';
 
+// ⚠️ EXPERIMENTAL — NOT ENFORCED (ADR-0056). The unified security-context governance
+// (audit/encryption/masking/compliance correlation) is declared but has no runtime
+// consumer. Authoring it does NOT change behaviour (roadmap M2+; per ADR-0049).
+
 /**
  * Unified Security Context Protocol
  *