MaskingContractValidator

Checks masking policies against the declared type contract of their resource, so a policy that would emit schema-invalid output is caught up front rather than at serialization time.

This is the reporting half of the guarantee: it returns the violations and never throws, leaving the enforcement decision (the starter fails the application context; ADR 0005) to the caller. Capabilities are computed with the supplied ObjectMapper's introspection, so the verdict matches exactly what IhawuBeanSerializerModifier will do at serialization time — including @JsonProperty renames and any configured naming strategy.

Two failure modes are reported:

• a policy that cannot produce contract-valid output (REDACT on a non-nullable non-String, or HIDE on a non-nullable field);

• a policy whose field is not a serialized property of the resource, which masks nothing and so silently leaves a sensitive field exposed (the under-masking failure mode of ADR 0004).