# test623 — Feishu token scrub + prior-ready health gate

Date: 2026-08-09
Issue: #618
Source commit: 4c7a64dbabf12ec3af9cbf0607698c6bfac86311
Docker tag: anet-test623:dev
Docker image: sha256:a85afb2252be93b619880d24a65daa6827a8d269168a28f68d159b929b6c0d81
Embedded source: TEST623_SOURCE_COMMIT=4c7a64dbabf12ec3af9cbf0607698c6bfac86311
Runner artifact SHA256: 421059ca361c88cec5f8626a948c5dd62327c654df7d67af77eb79e2216db36e

## Result

- TypeScript `tsc --noEmit`: PASS.
- Feishu lifecycle tests: 10 pass / 0 fail / 30 assertions.
- Production CLI, node-server, and Feishu worker bundle: PASS.
- Sanitized inbound audit evidence contained only
  `inbound [redacted] Bearer [redacted]`.
- Remove arbitrary `a-`/`t-`/`u-` token scrub: witnessed RED (`rc=1`).
- Remove bare JWT scrub: witnessed RED (`rc=1`).
- Bypass scrub in the inbound dispatcher catch: witnessed RED (`rc=1`).
- Remove the prior-ready reconnect gate: witnessed RED (`rc=1`).
- Restored lifecycle suite: 10 pass / 0 fail / 30 assertions.

```text
L3 witnessed-red: arbitrary access-token scrub is load-bearing
MUTATION_RED: access-token-scrub rc=1
L4 witnessed-red: bare JWT scrub is load-bearing
MUTATION_RED: jwt-token-scrub rc=1
L5 witnessed-red: inbound errors must not bypass scrub
MUTATION_RED: inbound-error-scrub rc=1
L6 witnessed-red: reconnect cannot become ready before onReady
MUTATION_RED: reconnect-prior-ready rc=1
L7 restored green
10 pass
0 fail
30 expect() calls
RESULT: PASS
```

All credentials in the fixture are synthetic test strings. No production
channel, Hub, token, package installation, or deployment was touched.
