Authorize org membership from the local mirror

[RhysSullivan]

Layer 5 of 5. Cloud only. Takes WorkOS off the per-request path.

• authorizeOrganization reads MemberDirectory.membership instead of calling WorkOS. Active status required; role mapping unchanged. Admin gates on the account, admin, and org planes use the role the authorize step resolved. The membership ownership check on remove and role change is one point read. The org switcher and free-org limit read membershipsOf.
• The mirror is trusted only while it is ready: the backfill has completed and the reconciler has drained within the last ten minutes. Until then the check falls back to WorkOS exactly as before, so nobody is locked out and nobody revoked during an outage is let in. An org the mirror has never seen is resolved from WorkOS on demand for a caller WorkOS confirms as a member.
• Org deletion order is now mark deleted locally, cancel billing, delete in WorkOS, purge. A retry after a partial deletion is admitted from the mirror.
• Deploy gate: deploy.yml runs scripts/ensure-workos-mirror-ready.ts after migrations. It runs the backfill if needed, drains the events stream itself, and fails the deploy if the mirror is still not ready.
• Every membership authorization runs under an auth.authorize_organization span stamped with mirror.ready and mirror.readiness, so the WorkOS fallback rate is one Axiom query (recipe added to the prod-telemetry skill).
• Unused WorkOS wrapper methods removed.

Ops step (cloud): add WORKOS_API_KEY to the production GitHub environment so the deploy gate can run the backfill. Removal in the WorkOS dashboard now takes effect when the event lands, normally seconds and at most about a minute. Removal through Executor stays immediate.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	59d4c4c	Sep 16 2026, 06:25 PM

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@2026

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@2026

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@2026

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@2026

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@2026

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@2026

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@2026

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@2026

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@2026

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@2026

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@2026

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@2026

executor

npm i https://pkg.pr.new/executor@2026

commit: 59d4c4c

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	59d4c4c	Commit Preview URL Branch Preview URL	Sep 16 2026, 06:24 PM