[P0][security] PolicySchema is 100% dead — enforce or remove

[os-zhuang]

Part of the metadata liveness audit umbrella #1878 (P0 security cluster).

Problem

PolicySchema is 100% dead: password complexity, session idle/absolute timeout, forceMfa, IP allow-list (trustedRanges/vpnRequired), and audit retention/redaction are all parsed but enforced by nothing. It is not even registered as a metadata type. better-auth runs hardcoded defaults instead (auth-manager.ts:458), producing a false sense of compliance — an admin can author a strict policy and the system silently ignores it.

Decision required (enforce or remove)

• Enforce: register policy as a metadata type, wire each group into its enforcement point (better-auth config for password/session/MFA, request middleware for IP allow-list, audit pipeline for retention/redaction).
• Remove: delete PolicySchema from the spec so authors aren't misled, and document the actual (hardcoded) behavior.

Shipping it parsed-but-unenforced is a compliance/security liability and is not an acceptable end state.

Evidence

• docs/audits/2026-06-security-identity-property-liveness.md
• auth-manager.ts:458 (hardcoded defaults)

[os-zhuang]

Experimental marking landed in #1902 (ADR-0049): this property is now flagged [EXPERIMENTAL — not enforced] in the spec so authors aren't misled. This issue stays open to track the actual enforcement (or removal with the feature) at M2 — the marking only neutralised the false promise, it did not implement the behaviour.

[os-zhuang]

Triage (2026-06-27, for 11.0 epic #2364): confirmed STILL-DEAD. PolicySchema (packages/spec/src/security/policy.zod.ts) has no runtime consumer (plugin-auth hardcodes session/password), no liveness ledger entry, not in METADATA_FORM_REGISTRY. 11.0 action: remove (breaking — deprecation note + migration) or commit to enforcing.

[os-zhuang]

11.0 resolution: REMOVE (owner decision) — part of the breaking-change batch (#2364, ADR-0049).

PolicySchema is unenforced at runtime, so it's removed in 11.0 rather than implemented.

Cascade (not a one-liner — it's a real stack field + used by examples):

• Delete packages/spec/src/security/policy.zod.ts (PolicySchema + Password/Network/Session/Audit sub-schemas + definePolicy)
• Remove the policies field + import from packages/spec/src/stack.zod.ts
• Remove barrel exports: security/index.ts, spec/index.ts (definePolicy)
• Migrate examples: examples/app-crm/objectstack.config.ts (policies:), examples/app-crm/src/security/crm-policy.ts (definePolicy), examples/app-showcase/objectstack.config.ts (policies: allPolicies) + the allPolicies source
• Remove downstream-contract DcPolicy fixture + contract.test.ts case
• Delete policy.test.ts
• pnpm --filter @objectstack/spec gen:api-surface + commit snapshot; major changeset

Risk: medium (mechanical, but examples must be migrated together).