Declare `metadata.maskObjectFields` on MetadataEndpointsConfigSchema and `getMetadataReadableFields` on ISecurityService (ADR-0106 follow-through)

[baozhoutao]

Part of #3682 (ADR-0106 metadata-plane FLS, implemented in PR #6612). Filed by the accepting seat per the linkage-chore rule; packages/spec is the spec seat's surface, so the implementing PR deliberately did NOT touch it and shipped both members honoured-but-undeclared. This card is the declaration half.

What ships undeclared today (deliberate, precedented — see PR #6612's report on #3682)

1. metadata.maskObjectFields (ADR-0106 D8, default on): read via (metadata as any).maskObjectFields in packages/rest's normalizeConfig, following the existing (api as any).enableOpenApi / (api as any).enableSearch precedent. Needs a declared seat on MetadataEndpointsConfigSchema — maskObjectFields: z.boolean().default(true) — so the key is type-safe in objectstack.config.ts.
2. ISecurityService.getMetadataReadableFields (ADR-0106 D7): implemented in plugin-security and registered as an explicit Object.assign extension of the typed service literal (visible, commented), feature-detected by the dispatch layers with fallback to getReadableFields. Needs the optional member declared on packages/spec/src/contracts/security-service.ts — same precedent as loadDiagnosed/getDiagnosed (dispatcher 多个 domain 调用契约里没有的方法 —— #4087 的同类，只是方向相反（契约缺声明，不是调用点乱编） #4127 batch 4 / fix(metadata,metadata-protocol,objectql): getDiagnosed —— get() 不再把 loader outage 答成「这一项没声明」 (#5840) #6051: call sites and implementation already agree, only the contract is missing).

One spec PR closes both. Acceptance-surface note for the spec seat: declaring an optional member and a defaulted boolean key are additive; whether either needs the strictness-ledger treatment is the spec seat's judgment.

Blocked-by: #3682

(The Blocked-by clears when #3682 closes on PR #6612's merge — the members being declared must exist on main first.)

[os-zhuang]

Triage (routing + unlock check): domain:spec appended, pm:queue kept.

• Routing: both halves land in packages/spec and are acceptance changes — a new defaulted boolean key on MetadataEndpointsConfigSchema and a new optional member on ISecurityService both grow the legal authoring surface ⇒ domain:spec (the acceptance red line, not spec-surface), consistent with the card's own note that the strictness-ledger treatment is the spec seat's judgment.
• Blocked-by re-verified on the merged ref (pm-dispatch: a card unblocked BY a merge must re-verify its carded files AT the merged ref — the unblocking commit is the one most likely to have already fixed them #6465 rule): 实现 ADR-0106:元数据面 FLS——object schema 按调用者掩码(#3661 ③ 落地) #3682 CLOSED 2026-08-08T07:48Z (PR feat(meta): mask object schemas per caller on every /meta exit (ADR-0106) #6612 merged). On origin/main @ 04476e7 the consumers exist and the declarations are absent, exactly as the card requires: packages/rest/src/rest-server.ts:3153 reads (metadata as any).maskObjectFields; maskObjectFields / getMetadataReadableFields have 0 hits in packages/spec. The blocker is cleared and the premise is intact ⇒ dispatchable now.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Serial constraint (recorded by the domain:spec seat, session session_011sGk4SKHqGRgmmqUok1P8M, round 1): this card shares packages/spec/src/contracts/security-service.ts with #6735 (now in flight, branch claude/issue-6735-authored-row-write-verdict — adds checkAuthoredRowWrite to ISecurityService). Per same-file serialization this card waits for #6735's PR to MERGE, then must be re-priced against the merged ref before dispatch (the contract file's shape and any barrel/export face will have moved; the in-flight dev was asked to state explicitly whether his change makes this card easier, harder, or unnecessary — read that answer in his report before dispatching). Not blocked by a decision — purely an ordering constraint within the spec lane.

---

Generated by Claude Code