Authorize from the mirror unconditionally; alert on a stale reconciler

[RhysSullivan]

Follow-up to the member-directory stack (#2003 through #2026).

The per-request MirrorReadiness check and its live WorkOS fallback are removed from authorizeOrganization. Every membership authorization now reads the mirror unconditionally. The backfill is complete and permanent, and an organization that predates the mirror is still covered by the existing on-demand scan.

A stalled reconciler is an operational alert instead of a per-request fallback. After each cron run that does not end drained, the runner reads the drained_at heartbeat and, if it is older than the ten-minute lag budget, logs workos_events: reconciler stale and reports a WorkOsReconcilerStale error to Sentry.

• Deletes the request-scoped MirrorReadiness service and removes it from every layer it was threaded through.
• The deploy gate (scripts/ensure-workos-mirror-ready.ts) is unchanged and still refuses to ship while the mirror is unready.
• The drained_at heartbeat is still written by every reconciler run.
• Removes the mirror.ready span attributes and the fallback recipe from the prod-telemetry skill, adds the heartbeat and alert recipes.
• Rewrites the mcp-workos-blip-session-survival e2e scenario for the new contract: a WorkOS outage is invisible to a live session (the request never asks WorkOS), and a membership revoked through the product fails closed on the member's next request and condemns their session.

Expected effect: about 13 ms off every authorization, which was measured at 40 ms median after the cutover.

Verified: repo typecheck, lint, and format check pass; the full cloud vitest suite passes; the org-delete, mcp-session-cold-init, and mcp-workos-blip-session-survival cloud e2e scenarios pass locally.

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@2031

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@2031

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@2031

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@2031

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@2031

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@2031

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@2031

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@2031

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@2031

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@2031

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@2031

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@2031

executor

npm i https://pkg.pr.new/executor@2031

commit: e871001

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	e871001	Sep 16 2026, 08:51 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	e871001	Commit Preview URL Branch Preview URL	Sep 16 2026, 08:49 PM