{
  "task": "HRMS_FEISHU_READONLY_TOKEN_CACHE_REFRESH_PREP_PACK_Z5B",
  "generated_at": "2026-06-03T16:50:27+08:00",
  "token_refresh_safety_plan_ready": true,
  "allowed_next_apply_scope": [
    "refresh token cache metadata through existing provider path only",
    "output only metadata: expires_at, ttl_seconds, scope names, provider_usable",
    "no Feishu employee/department list calls",
    "no snapshot refresh",
    "no snapshot row writes"
  ],
  "forbidden": [
    "do not output token/app_secret/credential/env value",
    "do not write master data",
    "do not import employees",
    "do not create permission_subject",
    "do not call Feishu write APIs",
    "do not restart backend service"
  ],
  "pre_apply_checks": [
    "readonly scope declared",
    "write scope absent",
    "provider refresh path exists",
    "env key names known, values never printed",
    "snapshot and master table row counts unchanged"
  ],
  "post_apply_checks": [
    "token_cache_status usable",
    "provider_usable true",
    "ttl_seconds positive",
    "readiness endpoint ok",
    "contract endpoint ok",
    "no snapshot rows written",
    "no token/secret output"
  ]
}