lael-labs/executor

.changeset/mirror-readiness-removal.md+5−0

@@ -0,0 +1,5 @@
	1	---
	2	"@executor-js/cloud": patch
	3	---
	4
	5	`authorizeOrganization` now reads the local membership mirror unconditionally: the per-request readiness check (`MirrorReadiness`) and its live WorkOS `listUserMemberships` fallback are gone from the request path entirely. The backfill is complete and permanent, and an organization that predates the mirror is still covered by the existing on-demand scan (`ensureOrganizationBackfilled`). A stalled reconciler is now an operational alert instead of a per-request fallback: after each run, the cron checks the mirror's `drained_at` heartbeat and, if it has fallen behind the lag budget, logs a structured error and reports it to Sentry. The deploy gate (`scripts/ensure-workos-mirror-ready.ts`) is unchanged — it still refuses to ship while the mirror is unready — and `drained_at` keeps being written by every reconciler run.

.claude/skills/prod-telemetry/SKILL.md+22−11

   `execute`/`execute-action` calls `mcp.execute.code` (the script itself,
   capped at 10k chars — cloud-only content capture; local/self-host
   telemetry never records content).
-- `auth.authorize_organization` — every membership authorization.
+- `auth.authorize_organization` — every membership authorization. Reads the
-  `mirror.ready` (bool: the local membership mirror answered; `false` =
+  local membership mirror unconditionally; there is no per-request readiness
-  the request fell back to a live WorkOS read) and `mirror.readiness`
+  check and no WorkOS fallback, so this span carries no readiness attribute.
-  (why: `ready`, `backfill pending: …`, `reconciler stale: …`). The
+  The mirror's write spans are `workos_mirror.<op>`; the reconciler run is
-  mirror's write spans are `workos_mirror.<op>`; the reconciler run is
   `workos_events.sync`. `workos_sync.drained_at` in the prod DB is the
-  reconciler heartbeat.
+  reconciler heartbeat, and a stalled reconciler now raises its own error
+  from the cron (see below) rather than showing up as a fallback here.
-**Recipe — membership-mirror fallback rate (should be ~0 after cutover):**
+**Recipe — reconciler heartbeat (ticks should land roughly every minute; a
+gap wider than the 10-minute lag budget means the cron alert should already
+have fired — see `workos_events: reconciler stale` below):**
 ```apl
 ['executor-cloud']
-| where _time > ago(1h) and name == "auth.authorize_organization"
+| where _time > ago(1h) and name == "workos_events.sync"
-| extend ready = tobool(['attributes.custom']['mirror.ready'])
+| summarize n = count() by bin(_time, 1m)
-| extend why = tostring(['attributes.custom']['mirror.readiness'])
+| sort by _time desc
-| summarize n = count() by ready, why
+```
+**Recipe — stale-reconciler alerts (should be empty; each row is one paging
+event):**
+```apl
+['executor-cloud']
+| where _time > ago(1d) and ['status.message'] contains "workos_events: reconciler stale"
+| project _time, trace_id, msg = tostring(['status.message'])
+| sort by _time desc
 ```
 **Recipe — error signatures by class (the daily-digest query):**

apps/cloud/src/account/account-api.ts+5−8

 import { ApiKeyService } from "../auth/api-keys";
 import { UserStoreService } from "../auth/context";
-import { MirrorReadiness } from "../auth/mirror-readiness";
 import { WorkOsMirror } from "../auth/workos-mirror";
 import { sessionFromSealed, type Session } from "../auth/middleware";
 import { WorkOSClient } from "../auth/workos";
 // `UserStoreService` / `WorkOsMirror` / `MemberDirectory` are supplied by the
 // combined `rsLive` layer.
 // `ApiKeyService.WorkOS` is built here on top of the boot `WorkOSClient`.
-const AccountProviderMiddleware = HttpRouter.middleware<{ provides: AccountProvider }>()(
+const AccountProviderMiddleware = HttpRouter.middleware<{
+  provides: AccountProvider;
+}>()(
   Effect.gen(function* () {
     // Long-lived services only (built once at boot). `UserStoreService` and
     // `DbService` are NOT grabbed here — they come per request from the combined
  * (the seat-gate) stays a residual requirement, satisfied by the app `boot`.
  */
 export const workosAccountMiddleware = (
-  rsLive: Layer.Layer<
+  rsLive: Layer.Layer<DbService | UserStoreService | WorkOsMirror | MemberDirectory>,
-    DbService | UserStoreService | WorkOsMirror | MemberDirectory | MirrorReadiness
-  >,
 ) => AccountProviderMiddleware.combine(requestScopedMiddleware(rsLive)).layer;
 export const makeAccountApiLive = (
-  rsLive: Layer.Layer<
+  rsLive: Layer.Layer<DbService | UserStoreService | WorkOsMirror | MemberDirectory>,
-    DbService | UserStoreService | WorkOsMirror | MemberDirectory | MirrorReadiness
-  >,
 ) => {
   // Cloud builds the WorkOS `AccountProvider` INSIDE the request body (so it
   // closes over the per-request postgres socket), so it can't be a self-

apps/cloud/src/account/org-api-key-revoke.node.test.ts+0−8

 import { ApiKeyService, OrgApiKeyNotFound } from "../auth/api-keys";
 import { UserStoreService } from "../auth/context";
-import { MirrorReadiness, MirrorReadinessState } from "../auth/mirror-readiness";
 import { ORG_SELECTOR_HEADER } from "../auth/organization";
 import { WorkOSClient, type WorkOSClientService } from "../auth/workos";
 import { WorkOsMirror } from "../auth/workos-mirror";
 // The mirror as the directory reads it: both are active members of ORG, and
 // only ADMIN carries the `admin` role. Revoke reads the caller's membership
 // (the org check and the admin gate) and nothing else.
-// The mirror is READY in these tests (backfill complete, reconciler caught
-// up), so membership is read from the stubbed directory, never from WorkOS.
-const stubReadiness = Layer.succeed(MirrorReadiness)({
-  state: () => Effect.succeed(MirrorReadinessState.Ready()),
-});
 const stubDirectory = Layer.succeed(MemberDirectory)({
   membership: (accountId, organizationId) =>
     Effect.succeed(
             stubUsers,
             stubMirror,
             stubDirectory,
-            stubReadiness,
             stubApiKeys,
             stubAutumn,
             Layer.succeed(AccountCaller)({ session: session(accountId) }),

apps/cloud/src/account/workos-account-service.ts+1−8

 import { ApiKeyService } from "../auth/api-keys";
 import { UserStoreService } from "../auth/context";
 import type { Session } from "../auth/middleware";
-import { MirrorReadiness } from "../auth/mirror-readiness";
 import { WorkOSClient } from "../auth/workos";
 import { ensureOrganizationBackfilled, mirrorInvitedMember } from "../auth/mirror-feeders";
 import { WorkOsMirror, mirrorMembershipFromWorkOs } from "../auth/workos-mirror";
   | UserStoreService
   | WorkOsMirror
   | MemberDirectory
-  | MirrorReadiness
   | ApiKeyService
   | AutumnService
   | AccountCaller
     // erased to `R = never`, as the neutral AccountProvider shape requires.
     // Provided per method below.
     const ctx = yield* Effect.context<
-      | WorkOSClient
+      WorkOSClient | UserStoreService | AutumnService | MemberDirectory | WorkOsMirror
-      | UserStoreService
-      | AutumnService
-      | MemberDirectory
-      | MirrorReadiness
-      | WorkOsMirror
     >();
     // Unauthenticated (missing/invalid session) => AccountUnauthorized, exactly

apps/cloud/src/admin/admin-users-api.node.test.ts+6−16

 import { ApiKeyService } from "../auth/api-keys";
 import { UserStoreService } from "../auth/context";
-import { MirrorReadiness, MirrorReadinessState } from "../auth/mirror-readiness";
 import { ORG_SELECTOR_HEADER } from "../auth/organization";
 import { WorkOSClient, type WorkOSClientService } from "../auth/workos";
 import { WorkOsMirror, type WorkOsMirrorShape } from "../auth/workos-mirror";
   ["user_invited_admin", mirrored("user_invited_admin", { role: "admin", status: "pending" })],
 ]);
-// The mirror is READY in these tests (backfill complete, reconciler caught
-// up), so membership is read from the stubbed directory, never from WorkOS.
-const stubReadiness = Layer.succeed(MirrorReadiness)({
-  state: () => Effect.succeed(MirrorReadinessState.Ready()),
-});
 const stubDirectory = Layer.succeed(MemberDirectory)({
   membership: (accountId, organizationId) =>
     Effect.succeed(organizationId === ORG ? (memberships.get(accountId) ?? null) : null),
       get: (_target, prop) => {
         if (prop === "authenticateRequest") {
           return () =>
-            Effect.succeed({ userId, email: `${userId}@placeholder.test`, organizationId: null });
+            Effect.succeed({
+              userId,
+              email: `${userId}@placeholder.test`,
+              organizationId: null,
+            });
         }
         return () => Effect.die(`unexpected WorkOSClient.${String(prop)} call`);
       },
     }),
   ).pipe(
     Effect.provide(
-      Layer.mergeAll(
+      Layer.mergeAll(stubDirectory, stubApiKeys, stubUsers, stubWorkOS(userId), stubMirror),
-        stubDirectory,
-        stubApiKeys,
-        stubUsers,
-        stubWorkOS(userId),
-        stubMirror,
-        stubReadiness,
-      ),
     ),
   );

apps/cloud/src/admin/admin-users-api.ts+5−9

 import { ApiKeyService } from "../auth/api-keys";
 import { UserStoreService } from "../auth/context";
-import { MirrorReadiness } from "../auth/mirror-readiness";
 import { WorkOsMirror } from "../auth/workos-mirror";
 import { isPlatformAuth, resolveBearerAuth } from "../auth/workos-auth-provider";
 import { orgSelectorFromRequest, authorizeOrganizationSelector } from "../auth/organization";
 ): Effect.Effect<
   string,
   AdminUsersUnauthorized | AdminUsersForbidden,
-  WorkOSClient | ApiKeyService | UserStoreService | MemberDirectory | MirrorReadiness | WorkOsMirror
+  WorkOSClient | ApiKeyService | UserStoreService | MemberDirectory | WorkOsMirror
 > =>
   Effect.gen(function* () {
     // (1) The bearer path. `resolveBearerAuth` (not `resolveApiKeyPrincipal`,
   | ApiKeyService
   | UserStoreService
   | MemberDirectory
-  | MirrorReadiness
   | WorkOsMirror
   | DbProvider
   | PluginsProvider
   | ApiKeyService
   | UserStoreService
   | MemberDirectory
-  | MirrorReadiness
   | WorkOsMirror
   | DbProvider
   | PluginsProvider
       | ApiKeyService
       | UserStoreService
       | MemberDirectory
-      | MirrorReadiness
       | WorkOsMirror
       | DbProvider
       | PluginsProvider
 // per-request `DbService`/`UserStoreService`/`MemberDirectory` (and the
 // execution seams built over them) are supplied by the combined
 // `requestScopedMiddleware`.
-const AdminUsersProviderMiddleware = HttpRouter.middleware<{ provides: AdminUsersProvider }>()(
+const AdminUsersProviderMiddleware = HttpRouter.middleware<{
+  provides: AdminUsersProvider;
+}>()(
   Effect.gen(function* () {
     const longLived = yield* Effect.context<WorkOSClient | ApiKeyService>();
     return (httpEffect) =>
  * `/api` prefix as the rest of the cloud router.
  */
 export const makeCloudAdminUsersRoutes = (
-  rsLive: Layer.Layer<
+  rsLive: Layer.Layer<DbService | UserStoreService | MemberDirectory | WorkOsMirror>,
-    DbService | UserStoreService | MemberDirectory | MirrorReadiness | WorkOsMirror
-  >,
   options: Parameters<typeof makeAdminUsersApiLayer>[1] = {},
 ) =>
   makeAdminUsersApiLayer(

apps/cloud/src/api/layers.ts+7−19

 import { SessionAuthLive } from "../auth/middleware-live";
 import { UserStoreService } from "../auth/context";
 import { cloudMemberDirectoryLayer } from "../auth/member-directory";
-import { MirrorReadiness } from "../auth/mirror-readiness";
 import { WorkOsMirror } from "../auth/workos-mirror";
 import {
   CloudAuthPublicHandlers,
 // The shared `MemberDirectory` read seam over the membership mirror — the
 // same per-request socket the mirror writes through.
 const MemberDirectoryLive = cloudMemberDirectoryLayer.pipe(Layer.provide(DbLive));
-// Whether the mirror may authorize this request at all (backfill complete,
-// reconciler caught up) — read on the same socket before the membership row.
-const MirrorReadinessLive = MirrorReadiness.Live.pipe(Layer.provide(DbLive));
 // Per-request layer. Anything that opens an I/O object (postgres.js socket,
 // fetch stream readers, anything backed by a `Writable`) MUST live here —
 // `provideRequestScoped` rebuilds it per request so Cloudflare Workers'
 // I/O isolation is satisfied. See `api.request-scope.test.ts`.
 export const RequestScopedServicesLive: Layer.Layer<
-  DbService | UserStoreService | WorkOsMirror | MemberDirectory | MirrorReadiness
+  DbService | UserStoreService | WorkOsMirror | MemberDirectory
-> = Layer.mergeAll(
+> = Layer.mergeAll(DbLive, UserStoreLive, WorkOsMirrorLive, MemberDirectoryLive);
-  DbLive,
-  UserStoreLive,
-  WorkOsMirrorLive,
-  MemberDirectoryLive,
-  MirrorReadinessLive,
-);
 // Boot-scoped layer. Built once at worker boot, reused across requests.
 // Safe for config, in-memory caches, the global tracer provider, and
 // handler reads it for the free-organizations-per-user limit gate — one of the
 // few app-only billing touchpoints. (It is NOT on the neutral boot core.)
 export const makeNonProtectedApiLive = (
-  rsLive: Layer.Layer<
+  rsLive: Layer.Layer<DbService | UserStoreService | WorkOsMirror | MemberDirectory>,
-    DbService | UserStoreService | WorkOsMirror | MemberDirectory | MirrorReadiness
-  >,
 ) =>
   HttpApiBuilder.layer(NonProtectedApi).pipe(
     Layer.provide(Layer.mergeAll(CloudAuthPublicHandlers, CloudSessionAuthHandlers)),
 // gates on billing, so `AutumnService.Default` is provided here, not on the
 // neutral boot core.
 export const makeOrgApiLive = (
-  rsLive: Layer.Layer<
+  rsLive: Layer.Layer<DbService | UserStoreService | MemberDirectory | WorkOsMirror>,
-    DbService | UserStoreService | MemberDirectory | MirrorReadiness | WorkOsMirror
-  >,
 ) =>
   HttpApiBuilder.layer(OrgHttpApi).pipe(
     Layer.provide(OrgHandlers),
 // folded into `.layer` here; the rest of the router (`makeApiLive` in
 // `./router.ts`, `./protected.ts`, the test harness) re-provides the same
 // shared `RouterConfigLive` directly.
-const protectedApi = makeProtectedApiLayer(cloudPlugins, { errorCapture: ErrorCaptureLive });
+const protectedApi = makeProtectedApiLayer(cloudPlugins, {
+  errorCapture: ErrorCaptureLive,
+});
 export const ProtectedCloudApi = protectedApi.api;
 export const ProtectedCloudApiHandlers = protectedApi.handlers;

apps/cloud/src/api/protected-api-key-auth.node.test.ts+3−11

 import { ApiKeyService } from "../auth/api-keys";
 import { UserStoreService } from "../auth/context";
-import { MirrorReadiness, MirrorReadinessState } from "../auth/mirror-readiness";
 import { WorkOSClient, type WorkOSClientService } from "../auth/workos";
 import { WorkOsMirror, type WorkOsMirrorShape } from "../auth/workos-mirror";
 import { resolveProtectedPrincipal } from "./protected";
 );
 // The mirror as the directory reads it: user_123 holds an active membership in
-// org_123 and nothing else. Membership is never read from WorkOS.
+// org_123 and nothing else. Membership is always read from the mirror, never
-// The mirror is READY in these tests (backfill complete, reconciler caught
+// from WorkOS.
-// up), so membership is read from the stubbed directory, never from WorkOS.
-const stubReadiness = Layer.succeed(MirrorReadiness)({
-  state: () => Effect.succeed(MirrorReadinessState.Ready()),
-});
 const stubDirectory = Layer.succeed(MemberDirectory)({
   membership: (accountId, organizationId) =>
     Effect.succeed(
 const run = (request: Request) =>
   resolveProtectedPrincipal(request).pipe(
-    Effect.provide(
+    Effect.provide(Layer.mergeAll(stubApiKeys, stubWorkOS, stubUsers, stubDirectory, stubMirror)),
-      Layer.mergeAll(stubApiKeys, stubWorkOS, stubUsers, stubDirectory, stubMirror, stubReadiness),
-    ),
   );
 describe("protected API key auth", () => {

apps/cloud/src/api/protected-jwt-auth.node.test.ts+3−11

 import { ApiKeyService } from "../auth/api-keys";
 import { UserStoreService } from "../auth/context";
-import { MirrorReadiness, MirrorReadinessState } from "../auth/mirror-readiness";
 import type { JwtBearerConfig } from "../auth/workos-auth-provider";
 import { WorkOSClient, type WorkOSClientService } from "../auth/workos";
 import { WorkOsMirror, type WorkOsMirrorShape } from "../auth/workos-mirror";
 );
 // The mirror as the directory reads it: user_123 holds an active membership in
-// org_123 and nothing else. Membership is never read from WorkOS.
+// org_123 and nothing else. Membership is always read from the mirror, never
-// The mirror is READY in these tests (backfill complete, reconciler caught
+// from WorkOS.
-// up), so membership is read from the stubbed directory, never from WorkOS.
-const stubReadiness = Layer.succeed(MirrorReadiness)({
-  state: () => Effect.succeed(MirrorReadinessState.Ready()),
-});
 const stubDirectory = Layer.succeed(MemberDirectory)({
   membership: (accountId, organizationId) =>
     Effect.succeed(
 const run = (request: Request, jwt: JwtBearerConfig) =>
   resolveProtectedPrincipal(request, jwt).pipe(
-    Effect.provide(
+    Effect.provide(Layer.mergeAll(stubApiKeys, stubWorkOS, stubUsers, stubDirectory, stubMirror)),
-      Layer.mergeAll(stubApiKeys, stubWorkOS, stubUsers, stubDirectory, stubMirror, stubReadiness),
-    ),
   );
 const request = (token: string) =>

apps/cloud/src/api/protected.ts+1−4

 import { cloudPlugins, type CloudPlugins } from "../plugins";
 import { ApiKeyService } from "../auth/api-keys";
 import { UserStoreService } from "../auth/context";
-import { MirrorReadiness } from "../auth/mirror-readiness";
 import { WorkOsMirror } from "../auth/workos-mirror";
 import { cloudIdentityFailureStrategy, workosIdentityLayer } from "../auth/workos-auth-provider";
 import { AutumnService } from "../extensions/billing/service";
 // account seat-gate, and the createOrganization free-limit gate each provide it
 // where they run.)
 export const makeProtectedApiLive = (
-  rsLive: Layer.Layer<
+  rsLive: Layer.Layer<DbService | UserStoreService | MemberDirectory | WorkOsMirror>,
-    DbService | UserStoreService | MemberDirectory | MirrorReadiness | WorkOsMirror
-  >,
 ) => {
   // The neutral `IdentityProvider`, built per request: it reads `UserStoreService`
   // + `MemberDirectory` from `rsLive` and the WorkOS control plane (`WorkOSClient` + `ApiKeyService`,

apps/cloud/src/api/router.ts+1−4

 } from "@executor-js/api/server";
 import { UserStoreService } from "../auth/context";
-import { MirrorReadiness } from "../auth/mirror-readiness";
 import { WorkOsMirror } from "../auth/workos-mirror";
 import { DbService } from "../db/db";
 import { makeAccountApiLive } from "../account/account-api";
 // assert per-request semantics — see
 // `apps/cloud/src/api.request-scope.node.test.ts`.
 export const makeApiLive = (
-  requestScopedLive: Layer.Layer<
+  requestScopedLive: Layer.Layer<DbService | UserStoreService | WorkOsMirror | MemberDirectory>,
-    DbService | UserStoreService | WorkOsMirror | MemberDirectory | MirrorReadiness
-  >,
 ) => {
   const BillingRoutesLive = AutumnRoutesLive.pipe(
     Layer.provide(requestScopedMiddleware(requestScopedLive).layer),

apps/cloud/src/auth/doc-gate.ts+3−3

 import { parseCookie } from "./cookies";
 import { LAST_ORG_COOKIE } from "./last-org-cookie";
 import { makeMemberDirectoryLayer } from "./member-directory";
-import { makeMirrorReadinessLayer } from "./mirror-readiness";
 import { makeWorkOsMirrorLayer } from "./workos-mirror";
 import { sealedSessionDisplayName } from "./middleware";
 import { authorizeOrganizationSelector } from "./organization";
         Layer.mergeAll(
           makeUserStoreLayer(),
           makeMemberDirectoryLayer(),
-          makeMirrorReadinessLayer(),
           makeWorkOsMirrorLayer(),
         ).pipe(Layer.provide(dbLive)),
       ),
     // the client AuthGate makes mid-session, made here before the document
     // exists so the app shell is never painted for an org-less session.
     if (!session.organizationId && !ONBOARDING_PATHS.has(pathname)) {
-      return redirect("/create-org", { refreshedSession: session.refreshedSession });
+      return redirect("/create-org", {
+        refreshedSession: session.refreshedSession,
+      });
     }
     // A BARE console path (no org slug in the URL) canonicalizes onto the org

apps/cloud/src/auth/mirror-feeders.node.test.ts+50−43

 import { cloudMemberDirectoryLayer } from "./member-directory";
 import { SessionAuthLive } from "./middleware-live";
 import { mirrorSignIn } from "./mirror-feeders";
-import { MirrorReadiness, MirrorReadinessState } from "./mirror-readiness";
 import {
   ORG_SELECTOR_HEADER,
   authorizeOrganization,
     ),
   );
-// The mirror is READY throughout (backfill complete, reconciler caught up):
-// every membership read below is against the mirror, never WorkOS. The
-// readiness rule itself is pinned in workos-mirror.node.test.ts and the
-// fallback in org-selector-auth.node.test.ts.
-const readyMirror = Layer.succeed(MirrorReadiness)({
-  state: () => Effect.succeed(MirrorReadinessState.Ready()),
-});
 const stubAutumn = Layer.succeed(AutumnService)({
   use: () => Effect.die("feeders do not read billing"),
   ensureCustomer: () => Effect.void,
         const rejoinedAt = "2026-01-03T00:00:00.000Z";
         yield* mirrorSignIn(
           workosUser(userId),
-          [workosMembership(userId, org, { id: `om_${userId}_${org}_2`, updatedAt: rejoinedAt })],
+          [
+            workosMembership(userId, org, {
+              id: `om_${userId}_${org}_2`,
+              updatedAt: rejoinedAt,
+            }),
+          ],
           new Date(rejoinedAt),
         );
         return { membership, rejoined: yield* readMembership(userId, org) };
         DbService | UserStoreService | WorkOsMirror | MemberDirectory
       >;
       readonly autumn?: Layer.Layer<AutumnService>;
-      /** The mirror's readiness for this request; ready unless a test says otherwise. */
-      readonly readiness?: Layer.Layer<MirrorReadiness>;
     } = {},
   ) =>
     HttpRouter.toWebHandler(
       HttpApiBuilder.layer(NonProtectedApi).pipe(
         Layer.provide(Layer.mergeAll(CloudAuthPublicHandlers, CloudSessionAuthHandlers)),
         Layer.provide(
-          requestScopedMiddleware(
+          requestScopedMiddleware(Layer.mergeAll(options.services ?? RequestScopedServicesLive))
-            Layer.mergeAll(
+            .layer,
-              options.services ?? RequestScopedServicesLive,
-              options.readiness ?? readyMirror,
-            ),
-          ).layer,
         ),
         Layer.provideMerge(SessionAuthLive),
         Layer.provideMerge(options.autumn ?? stubAutumn),
     );
   /**
-   * `authorizeOrganization` over the live stores and a READY mirror, as every
+   * `authorizeOrganization` over the live stores, as every protected request
-   * protected request runs it; `workos` serves whatever the check may read
+   * runs it: membership is read from the mirror unconditionally; `workos`
-   * from WorkOS (nothing, by default: any read dies).
+   * serves whatever the check may read from WorkOS (nothing, by default: any
+   * read dies).
    */
   const authorize = (
     userId: string,
     Effect.runPromise(
       authorizeOrganization(userId, org).pipe(
         Effect.provide(
-          Layer.mergeAll(
+          Layer.mergeAll(UserStoreService.Live, WorkOsMirror.Live, cloudMemberDirectoryLayer).pipe(
-            UserStoreService.Live,
+            Layer.provideMerge(DbService.Live),
-            WorkOsMirror.Live,
+          ),
-            cloudMemberDirectoryLayer,
-            readyMirror,
-          ).pipe(Layer.provideMerge(DbService.Live)),
         ),
         Effect.provide(workos),
         Effect.scoped,
                   purges.push(op);
                 }).pipe(
                   Effect.flatMap(() =>
-                    Effect.fail(new UserStoreError({ operation: op, reason: "connection_closed" })),
+                    Effect.fail(
+                      new UserStoreError({
+                        operation: op,
+                        reason: "connection_closed",
+                      }),
+                    ),
                   ),
                 )
               : live.use(op, fn),
     expect(await authorized(admin, org)).toBe(false);
   });
-  it("finishes on a retry while the mirror is not ready, after WorkOS already deleted the org", async () => {
+  it("finishes on a retry after WorkOS already deleted the org", async () => {
     const admin = freshId("user");
     const member = freshId("user");
     const org = freshId("org");
     expect(first.status).toBe(500);
     expect(purges).toEqual(["deleteOrganizationCascade"]);
-    // The reconciler stalls before the retry. WorkOS no longer lists the org
+    // WorkOS no longer has the org to delete a second time. The admin's own
-    // or the admin's membership in it — and the fallback must not ask it:
+    // mirror row, which the failed purge left behind, is what admits the
-    // the stub dies on `listUserMemberships`. The admin's own mirror row,
+    // retry — membership is read from the mirror unconditionally.
-    // which the failed purge left behind, is what admits the retry.
     const retry = sessionHandler(admin, {
       autumn: deletingAutumn,
-      readiness: Layer.succeed(MirrorReadiness)({
+      workos: {
-        state: () => Effect.succeed(MirrorReadinessState.ReconcilerStale({ drainedAt: null })),
+        deleteOrganization: () => Effect.fail(new WorkOSError({ status: 404 })),
-      }),
+      },
-      workos: { deleteOrganization: () => Effect.fail(new WorkOSError({ status: 404 })) },
     });
     const second = await retry(deleteOrganizationRequest(org));
-    expect(second.status, "the retry is admitted from the mirror, not WorkOS").toBe(200);
+    expect(second.status, "the retry is admitted from the mirror").toBe(200);
     expect(await second.json()).toEqual({ success: true });
     expect(await readMembers(org), "and the purge ran").toEqual([]);
     expect((await readOrganization(org))?.deletedAt).not.toBeNull();
         calls.push(`getUserOrgMembership:${userId}`);
         return Effect.succeed(
           userId === memberId
-            ? (workosMembership(userId, organizationId, { role: { slug: "admin" } }) as never)
+            ? (workosMembership(userId, organizationId, {
+                role: { slug: "admin" },
+              }) as never)
             : null,
         );
       },
     );
     expect(response.status).toBe(200);
-    const body = (await response.json()) as { organizations: { id: string; slug: string }[] };
+    const body = (await response.json()) as {
+      organizations: { id: string; slug: string }[];
+    };
     expect(body.organizations.map((o) => [o.id, o.slug])).toEqual([[live, liveSlug]]);
   });
 });
       UserStoreService.Live,
       WorkOsMirror.Live,
       cloudMemberDirectoryLayer,
-      readyMirror,
     );
     return workosAccountProvider.pipe(
       Layer.provide(
     );
     const counts = await runBackfill(
-      new Map([[org, [workosMembership(paused, org, { status: "inactive", updatedAt: T2 })]]]),
+      new Map([
+        [
+          org,
+          [
+            workosMembership(paused, org, {
+              status: "inactive",
+              updatedAt: T2,
+            }),
+          ],
+        ],
+      ]),
       false,
     );
     expect(counts, "the deactivated membership is written, not tombstoned").toMatchObject({
       [orgB, [workosMembership(staying, orgB)]],
     ]);
     const retried = await runBackfill(attemptB, false);
-    expect(retried).toMatchObject({ organizations: 2, membershipsTombstoned: 1 });
+    expect(retried).toMatchObject({
+      organizations: 2,
+      membershipsTombstoned: 1,
+    });
     expect(
       await syncState(),
       "the retry keeps the first attempt's boundary instead of taking a later one",

apps/cloud/src/auth/mirror-readiness-store.ts+17−20

 // ---------------------------------------------------------------------------
-// Mirror READINESS: whether the local membership mirror may be trusted as
+// Mirror READINESS: whether the local membership mirror has ever been fit to
-// the membership authority for a request, or WorkOS must still be asked.
+// authorize from, per the ORIGINAL cutover rule. The request path
+// (`organization.ts`) no longer consults this — it authorizes from the
+// mirror unconditionally, because the one-off backfill is complete and
+// permanent and a pre-mirror organization is covered by the on-demand scan
+// (`ensureOrganizationBackfilled`). What remains is the deploy gate
+// (`scripts/ensure-workos-mirror-ready.ts`), which still refuses to ship a
+// build that trusts the mirror while it is unready, and the reconciler's own
+// staleness alert (`workos-events-runner.ts`), which reads `drainedAt` after
+// each run and raises a Sentry error when the drain has fallen behind the lag
+// budget below — a stalled reconciler is now an operational page, not a
+// per-request fallback.
 //
-// The mirror is fed by login, write-through, and the Events API reconciler
+// Readiness is BOTH: the backfill's completion mark
-// (`workos-mirror.ts`), and is complete only once the one-off backfill has
-// written every organization and the reconciler has caught up to the
-// present. Before that, two things go wrong if it is trusted anyway:
-//   - a member who has not signed in since the mirror shipped has no row
-//     yet, and every protected request of theirs is refused — the backfill
-//     is what writes them;
-//   - a member revoked in the WorkOS dashboard while the reconciler was not
-//     running still holds an active row, and keeps their access until the
-//     stream is replayed — the reconciler is what tombstones them.
-// So readiness is BOTH: the backfill's completion mark
 // (`workos_sync.backfill_completed_at`, written once by a run that covered
 // every live organization) AND a recent drain of the events stream
 // (`workos_sync.drained_at`, moved forward by every reconciler run that read
 // the stream to its end). The lag budget bounds how far behind the reconciler
 // may be: it runs every minute, so a mark older than the budget means it has
 // stalled (WorkOS unreachable, the cron not deployed, a backlog draining over
-// many runs) and the mirror may be missing revocations. While either half is
+// many runs) and the mirror may be missing revocations.
-// missing the authorization path reads membership from WorkOS instead
-// (`organization.ts`), exactly as it did before the cutover; nothing is
-// denied or granted on the mirror's word.
 //
 // The rule and the row read live here, free of `cloudflare:workers`, so the
-// deploy gate (`scripts/ensure-workos-mirror-ready.ts`) applies the SAME rule
+// deploy gate applies the SAME rule over a plain postgres.js connection under
-// over a plain postgres.js connection under bun before the build that trusts
+// bun before a build goes live, and the reconciler's alert applies the SAME
-// the mirror goes live. The request-scoped service is `mirror-readiness.ts`.
+// `drainedAt` age check the gate does.
 // ---------------------------------------------------------------------------
 import { eq } from "drizzle-orm";

apps/cloud/src/auth/mirror-readiness.ts+0−69

@@ -1,69 +0,0 @@
1	// ---------------------------------------------------------------------------
2	// MirrorReadiness — the request-scoped service that answers whether the
3	// membership mirror may authorize this request (see
4	// `mirror-readiness-store.ts` for the rule and why it exists).
5	//
6	// Per-request layer shape, like `UserStoreService` and `WorkOsMirror`: it
7	// reads the request's postgres socket, so it is rebuilt per request
8	// (`RequestScopedServicesLive`) and never shared across Workers requests. One
9	// indexed point read per authorization, on the same socket the membership
10	// read uses next.
11	// ---------------------------------------------------------------------------
12
13	import { Clock, Context, Effect, Layer } from "effect";
14
15	import { DbService, type DrizzleDb } from "../db/db";
16	import {
17	WorkOsMirrorError,
18	tryPromiseService,
19	userStoreReasonFromCause,
20	withServiceLogging,
21	} from "./errors";
22	import { readMirrorReadiness, type MirrorReadinessState } from "./mirror-readiness-store";
23
24	export {
25	MIRROR_RECONCILER_LAG_BUDGET,
26	MirrorReadinessState,
27	describeMirrorReadiness,
28	mirrorReadinessFrom,
29	type MirrorReadinessRow,
30	} from "./mirror-readiness-store";
31
32	export interface MirrorReadinessShape {
33	/**
34	* The mirror's readiness as of now. Fails with `WorkOsMirrorError` when the
35	* row cannot be read — the caller must not treat that as either ready or
36	* not; it is the same infra failure as any other mirror read.
37	*/
38	readonly state: () => Effect.Effect<MirrorReadinessState, WorkOsMirrorError>;
39	}
40
41	const makeService = (db: DrizzleDb): MirrorReadinessShape => ({
42	state: () =>
43	Effect.flatMap(Clock.currentTimeMillis, (millis) =>
44	withServiceLogging(
45	"workos_mirror.readiness",
46	(failure) =>
47	new WorkOsMirrorError({
48	operation: "readiness",
49	reason: userStoreReasonFromCause(failure),
50	}),
51	tryPromiseService(() => readMirrorReadiness(db, new Date(millis))),
52	),
53	),
54	});
55
56	export class MirrorReadiness extends Context.Service<MirrorReadiness, MirrorReadinessShape>()(
57	"@executor-js/cloud/MirrorReadiness",
58	) {
59	static Live = Layer.effect(this)(Effect.map(DbService.asEffect(), ({ db }) => makeService(db)));
60	}
61
62	/**
63	* A FRESH `MirrorReadiness` layer (new layer value per call), for a service
64	* built once but invoked across many Workers requests — the MCP
65	* org-authorization seam and the document gate — for the same reason
66	* `makeUserStoreLayer` exists. See [[makeDbLayer]].
67	*/
68	export const makeMirrorReadinessLayer = (): Layer.Layer<MirrorReadiness, never, DbService> =>
69	Layer.effect(MirrorReadiness)(Effect.map(DbService.asEffect(), ({ db }) => makeService(db)));

apps/cloud/src/auth/org-api-key-auth.node.test.ts+5−32

 import { ApiKeyService } from "./api-keys";
 import { UserStoreService } from "./context";
-import { MirrorReadiness, MirrorReadinessState } from "./mirror-readiness";
 import { WorkOSClient, type WorkOSClientService } from "./workos";
 import { WorkOsMirror, type WorkOsMirrorShape } from "./workos-mirror";
 import { isPlatformAuth, resolveApiKeyPrincipal, resolveBearerAuth } from "./workos-auth-provider";
 );
 // The mirror as the directory reads it: user_123 holds an active membership in
-// org_123 and nothing else. Membership is never read from WorkOS.
+// org_123 and nothing else. Membership is always read from the mirror, never
-// The mirror is READY in these tests (backfill complete, reconciler caught
+// from WorkOS.
-// up), so membership is read from the stubbed directory, never from WorkOS.
-const stubReadiness = Layer.succeed(MirrorReadiness)({
-  state: () => Effect.succeed(MirrorReadinessState.Ready()),
-});
 const stubDirectory = Layer.succeed(MemberDirectory)({
   membership: (accountId, organizationId) =>
     Effect.succeed(
   }),
 );
-const layers = Layer.mergeAll(
+const layers = Layer.mergeAll(stubApiKeys, stubWorkOS, stubUsers, stubDirectory, stubMirror);
-  stubApiKeys,
-  stubWorkOS,
-  stubUsers,
-  stubDirectory,
-  stubMirror,
-  stubReadiness,
-);
 const bearer = (token: string) =>
   new Request("https://executor.test/api/tools", {
       const exit = yield* Effect.exit(
         resolveBearerAuth(bearer("valid_org_key")).pipe(
           Effect.provide(
-            Layer.mergeAll(
+            Layer.mergeAll(stubApiKeys, stubWorkOS, deletedOrgUsers, stubDirectory, stubMirror),
-              stubApiKeys,
-              stubWorkOS,
-              deletedOrgUsers,
-              stubDirectory,
-              stubMirror,
-              stubReadiness,
-            ),
           ),
         ),
       );
       });
       const auth = yield* resolveBearerAuth(bearer("valid_org_key")).pipe(
         Effect.provide(
-          Layer.mergeAll(
+          Layer.mergeAll(stubApiKeys, stubWorkOS, stubUsers, noMembershipReads, stubMirror),
-            stubApiKeys,
-            stubWorkOS,
-            stubUsers,
-            noMembershipReads,
-            stubMirror,
-            stubReadiness,
-          ),
         ),
       );

apps/cloud/src/auth/org-selector-auth.node.test.ts+31−166

@@ -6,7 +6,6 @@ import { MemberDirectory, type DirectoryMember } from "@executor-js/api/server"; · 5 unmodified lines
6		6
7	import { ApiKeyService } from "./api-keys";	7	import { ApiKeyService } from "./api-keys";
8	import { UserStoreService } from "./context";	8	import { UserStoreService } from "./context";
9	import { MirrorReadiness, MirrorReadinessState } from "./mirror-readiness";
10	import { AUTHORIZE_ORGANIZATION_SPAN } from "./organization";	9	import { AUTHORIZE_ORGANIZATION_SPAN } from "./organization";
11	import { resolveSessionPrincipal } from "./workos-auth-provider";	10	import { resolveSessionPrincipal } from "./workos-auth-provider";
12	import { WorkOSClient, type WorkOSClientService } from "./workos";	11	import { WorkOSClient, type WorkOSClientService } from "./workos";
@@ -68,12 +67,6 @@ const memberships = new Map<string, DirectoryMember>([ · 55 unmodified lines
68	[PENDING_ORG, mirrored(PENDING_ORG, { status: "pending" })],	67	[PENDING_ORG, mirrored(PENDING_ORG, { status: "pending" })],
69	]);	68	]);
70		69
71	// The mirror is READY in these tests (backfill complete, reconciler caught
72	// up), so membership is read from the stubbed directory, never from WorkOS.
73	const stubReadiness = Layer.succeed(MirrorReadiness)({
74	state: () => Effect.succeed(MirrorReadinessState.Ready()),
75	});
76
77	const stubDirectory = Layer.succeed(MemberDirectory)({	70	const stubDirectory = Layer.succeed(MemberDirectory)({
78	membership: (accountId, organizationId) =>	71	membership: (accountId, organizationId) =>
79	Effect.succeed(accountId === MEMBER ? (memberships.get(organizationId) ?? null) : null),	72	Effect.succeed(accountId === MEMBER ? (memberships.get(organizationId) ?? null) : null),
@@ -167,85 +160,28 @@ const stubMirror = Layer.succeed( · 87 unmodified lines
167	}),	160	}),
168	);	161	);
169		162
170	const run = (	163	const run = (headers: Record<string, string>) =>
171	headers: Record<string, string>,
172	readiness: Layer.Layer<MirrorReadiness> = stubReadiness,
173	) =>
174	resolveSessionPrincipal(new Request("https://executor.test/api/tools", { headers })).pipe(	164	resolveSessionPrincipal(new Request("https://executor.test/api/tools", { headers })).pipe(
175	Effect.provide(	165	Effect.provide(Layer.mergeAll(stubApiKeys, stubWorkOS, stubUsers, stubDirectory, stubMirror)),
176	Layer.mergeAll(stubApiKeys, stubWorkOS, stubUsers, stubDirectory, stubMirror, readiness),
177	),
178	);	166	);
179		167
180	// The mirror before the cutover has landed: the backfill has not covered
181	// every organization, or the reconciler has not drained recently.
182	const unreadyMirror = (state: MirrorReadinessState) =>
183	Layer.succeed(MirrorReadiness)({ state: () => Effect.succeed(state) });
184
185	/**	168	/**
186	* A WorkOS that answers the pre-cutover membership list for MEMBER — active	169	* A tracer that keeps every span's attributes, so the authorization span
187	* in SESSION_ORG only, as a member — and records the calls, so the fallback	170	* itself — {@link AUTHORIZE_ORGANIZATION_SPAN} — is assertable.
188	* is assertable: with the mirror unready the list is read from WorkOS and
189	* the directory (which says MEMBER is active in URL_ORG too) is never asked.
190	*/
191	const workosMemberships = (calls: string[]) =>
192	Layer.succeed(
193	WorkOSClient,
194	new Proxy({} as WorkOSClientService, {
195	get: (_t, prop) => {
196	if (prop === "authenticateRequest") {
197	return () =>
198	Effect.succeed({
199	userId: MEMBER,
200	email: "u@e2e.test",
201	organizationId: SESSION_ORG,
202	});
203	}
204	if (prop === "listUserMemberships") {
205	return (userId: string) =>
206	Effect.sync(() => {
207	calls.push(`listUserMemberships:${userId}`);
208	return {
209	object: "list" as const,
210	data: [
211	{
212	id: `om_${MEMBER}_${SESSION_ORG}`,
213	userId: MEMBER,
214	organizationId: SESSION_ORG,
215	status: "active",
216	role: { slug: "member" },
217	},
218	] as never[],
219	listMetadata: { before: null, after: null },
220	};
221	});
222	}
223	return () => Effect.die(`unexpected WorkOSClient.${String(prop)} call`);
224	},
225	}),
226	);
227
228	const unreadDirectory = Layer.succeed(MemberDirectory)({
229	membership: () => Effect.die("an unready mirror must not be asked for membership"),
230	membershipById: () => Effect.die("an unready mirror must not be asked for membership"),
231	membershipsOf: () => Effect.die("an unready mirror must not be asked for membership"),
232	members: () => Effect.die("an unready mirror must not be asked for membership"),
233	membersById: () => Effect.die("an unready mirror must not be asked for membership"),
234	findByEmail: () => Effect.die("an unready mirror must not be asked for membership"),
235	});
236
237	/**
238	* A tracer that keeps every span's attributes, so the readiness decision the
239	* authorization stamps on its span (`mirror.ready`, `mirror.readiness`) is
240	* assertable: that attribute is what production counts the fallback by.
241	*/	171	*/
242	const makeRecordingTracer = () => {	172	const makeRecordingTracer = () => {
243	const spans: { readonly name: string; readonly attributes: Map<string, unknown> }[] = [];	173	const spans: {
		174	readonly name: string;
		175	readonly attributes: Map<string, unknown>;
		176	}[] = [];
244	const tracer: Tracer.Tracer = {	177	const tracer: Tracer.Tracer = {
245	span: (options) => {	178	span: (options) => {
246	const attributes = new Map<string, unknown>();	179	const attributes = new Map<string, unknown>();
247	spans.push({ name: options.name, attributes });	180	spans.push({ name: options.name, attributes });
248	let status: Tracer.SpanStatus = { _tag: "Started", startTime: options.startTime };	181	let status: Tracer.SpanStatus = {
		182	_tag: "Started",
		183	startTime: options.startTime,
		184	};
249	return {	185	return {
250	_tag: "Span",	186	_tag: "Span",
251	name: options.name,	187	name: options.name,
@@ -261,7 +197,12 @@ const makeRecordingTracer = () => { · 9 unmodified lines
261	sampled: options.sampled,	197	sampled: options.sampled,
262	kind: options.kind,	198	kind: options.kind,
263	end: (endTime, exit) => {	199	end: (endTime, exit) => {
264	status = { _tag: "Ended", startTime: options.startTime, endTime, exit };	200	status = {
		201	_tag: "Ended",
		202	startTime: options.startTime,
		203	endTime,
		204	exit,
		205	};
265	},	206	},
266	attribute: (key, value) => {	207	attribute: (key, value) => {
267	attributes.set(key, value);	208	attributes.set(key, value);
@@ -275,24 +216,6 @@ const makeRecordingTracer = () => { · 7 unmodified lines
275	return { tracer, attributesOf };	216	return { tracer, attributesOf };
276	};	217	};
277		218
278	const runAgainstWorkOs = (headers: Record<string, string>, state: MirrorReadinessState) => {
279	const calls: string[] = [];
280	return resolveSessionPrincipal(new Request("https://executor.test/api/tools", { headers }))
281	.pipe(
282	Effect.provide(
283	Layer.mergeAll(
284	stubApiKeys,
285	workosMemberships(calls),
286	stubUsers,
287	unreadDirectory,
288	stubMirror,
289	unreadyMirror(state),
290	),
291	),
292	)
293	.pipe(Effect.map((principal) => ({ principal, calls })));
294	};
295
296	describe("resolveSessionPrincipal · URL org selector", () => {	219	describe("resolveSessionPrincipal · URL org selector", () => {
297	it.effect("fails closed when no selector header is sent", () =>	220	it.effect("fails closed when no selector header is sent", () =>
298	Effect.gen(function* () {	221	Effect.gen(function* () {
@@ -358,79 +281,21 @@ describe("resolveSessionPrincipal · URL org selector", () => { · 59 unmodified lines
358	);	281	);
359	});	282	});
360		283
361	// The mirror authorizes only while it is READY (`mirror-readiness.ts`):	284	// Membership is read from the local mirror unconditionally — there is no
362	// the backfill has written every organization and the reconciler has drained	285	// readiness gate and no per-request WorkOS fallback (`auth/organization.ts`).
363	// the stream within its lag budget. Until then the membership check reads	286	// The span every authorization runs under is still pinned here; a stalled
364	// WorkOS, as it did before the cutover — so a member the backfill has not	287	// reconciler is now an operational alert (`workos-events-runner.ts`), not a
365	// written yet is not locked out, and a stale mirror row cannot grant access	288	// request-path branch, so it has no span attribute left to assert on.
366	// WorkOS has revoked.	289	describe("resolveSessionPrincipal · authorization span", () => {
367	describe("resolveSessionPrincipal · mirror readiness", () => {	290	it.effect("runs the authorization under its span", () =>
368	const unready: readonly [string, MirrorReadinessState][] = [
369	["the backfill has not completed", MirrorReadinessState.BackfillPending()],
370	["the reconciler has never drained", MirrorReadinessState.ReconcilerStale({ drainedAt: null })],
371	[
372	"the reconciler's last drain is older than the budget",
373	MirrorReadinessState.ReconcilerStale({ drainedAt: createdAt }),
374	],
375	];
376
377	for (const [why, state] of unready) {
378	it.effect(`reads membership from WorkOS, not the mirror, while ${why}`, () =>
379	Effect.gen(function* () {
380	// WorkOS says MEMBER is active in SESSION_ORG: authorized there...
381	const granted = yield* runAgainstWorkOs(
382	{ cookie: "wos-session=x", "x-executor-organization": SESSION_ORG },
383	state,
384	);
385	expect(granted.principal.organizationId).toBe(SESSION_ORG);
386	expect(granted.principal.orgRole, "the role comes from WorkOS's list too").toBe("member");
387	expect(granted.calls).toEqual([`listUserMemberships:${MEMBER}`]);
388
389	// ...and NOT in URL_ORG, even though the (unready) mirror holds an
390	// active admin membership there: the mirror's word is not taken.
391	const refused = yield* Effect.flip(
392	runAgainstWorkOs({ cookie: "wos-session=x", "x-executor-organization": URL_SLUG }, state),
393	);
394	expect(refused).toMatchObject({ _tag: "NoOrganization" });
395	}),
396	);
397	}
398
399	it.effect("reads the mirror once it is ready, without any WorkOS membership call", () =>
400	Effect.gen(function* () {	291	Effect.gen(function* () {
401	// `stubWorkOS` dies on any call past session authentication, so a	292	const recorder = makeRecordingTracer();
402	// resolved principal here proves the list was never requested.	293	const principal = yield* run({
403	const principal = yield* run(	294	cookie: "wos-session=x",
404	{ cookie: "wos-session=x", "x-executor-organization": URL_SLUG },	295	"x-executor-organization": URL_SLUG,
405	stubReadiness,	296	}).pipe(Effect.withTracer(recorder.tracer));
406	);
407	expect(principal.organizationId).toBe(URL_ORG);	297	expect(principal.organizationId).toBe(URL_ORG);
408	expect(principal.orgRole).toBe("admin");	298	expect(recorder.attributesOf(AUTHORIZE_ORGANIZATION_SPAN)).toBeDefined();
409	}),
410	);
411
412	it.effect("stamps which source answered on the authorization span", () =>
413	Effect.gen(function* () {
414	// The fallback is counted in production by this attribute, not by
415	// grepping the warning it logs beside it — so both branches must set it.
416	const ready = makeRecordingTracer();
417	yield* run({ cookie: "wos-session=x", "x-executor-organization": URL_SLUG }).pipe(
418	Effect.withTracer(ready.tracer),
419	);
420	const readyAttrs = ready.attributesOf(AUTHORIZE_ORGANIZATION_SPAN);
421	expect(readyAttrs?.get("mirror.ready"), "the mirror answered").toBe(true);
422	expect(readyAttrs?.get("mirror.readiness")).toBe("ready");
423
424	const stale = makeRecordingTracer();
425	yield* runAgainstWorkOs(
426	{ cookie: "wos-session=x", "x-executor-organization": SESSION_ORG },
427	MirrorReadinessState.ReconcilerStale({ drainedAt: null }),
428	).pipe(Effect.withTracer(stale.tracer));
429	const staleAttrs = stale.attributesOf(AUTHORIZE_ORGANIZATION_SPAN);
430	expect(staleAttrs?.get("mirror.ready"), "WorkOS answered").toBe(false);
431	expect(String(staleAttrs?.get("mirror.readiness")), "and the span says why").toContain(
432	"reconciler",
433	);
434	}),	299	}),
435	);	300	);
436	});	301	});

apps/cloud/src/auth/organization.ts+41−99

 import { UserStoreService } from "./context";
 import { ensureOrganizationBackfilled } from "./mirror-feeders";
-import { MirrorReadiness, MirrorReadinessState, describeMirrorReadiness } from "./mirror-readiness";
 import type { Organization } from "./user-store";
 import { WorkOSClient } from "./workos";
 // until their access token naturally expired (~10 min) if the session were
 // trusted on its own.
 //
-// To close that gap, membership is verified on every protected request — but
+// To close that gap, membership is verified on every protected request
 // against the LOCAL mirror of WorkOS memberships (`memberships` join
-// `accounts`, read through the shared `MemberDirectory`), never against WorkOS
+// `accounts`, read through the shared `MemberDirectory`) — never against
-// itself. This used to be one `listUserMemberships` call per request (2026-07:
+// WorkOS itself, and unconditionally: there is no readiness gate and no
-// deliberately NOT cached, because a positive TTL cache is exactly what would
+// per-request WorkOS fallback. The mirror is not a cache with a TTL; it is a
-// re-open the revocation gap). The mirror is not a cache with a TTL; it is a
 // replica whose freshness is defined by its feeders:
 //   - login (`auth/handlers.ts` callback): the user and every membership WorkOS
 //     lists for them, from the list the callback already fetches;
 // not finish refuses every session at once — its membership rows are still
 // there, live, until the purge removes them, and must not authorize anyone.
 //
-// The mirror is trusted only while it is READY (`mirror-readiness.ts`): the
+// The one-off backfill is complete and permanent, and an organization that
-// one-off backfill has written every organization, and the events reconciler
+// predates it is covered on demand (below), so there is nothing left for a
-// has drained the stream within its lag budget. Until both hold, membership is
+// per-request readiness check to gate. What can still go wrong is the events
-// read from WorkOS (`listUserMemberships`, one call per request) exactly as
+// reconciler falling behind — a member revoked in the WorkOS dashboard would
-// before the cutover — a member the backfill has not written yet must not be
+// keep a stale active row until it catches up. That is now an OPERATIONAL
-// locked out, and a member revoked in the dashboard while the reconciler was
+// concern, not a request-path fallback: the reconciler itself
-// down must not be let in on a stale row. The readiness row is one indexed
+// (`workos-events-runner.ts`) checks its own drain lag after every run and
-// point read on the same socket; the deploy gate
+// raises a Sentry error when it has stalled, so it is fixed by paging someone,
-// (`scripts/ensure-workos-mirror-ready.ts`) applies the same rule before this
+// not by asking WorkOS on every request. The deploy gate
-// build goes live, so in steady state the fallback is never taken. A
+// (`scripts/ensure-workos-mirror-ready.ts`) separately refuses to ship a build
-// readiness or mirror read failure fails the request (500), never a silent
+// that trusts the mirror while it is unready, using the same rule
-// fallback in either direction. The one org the fallback never asks WorkOS
+// (`mirror-readiness-store.ts`).
-// about is one the mirror holds as DELETED: WorkOS no longer has it (or is
-// about to not), so its answer is "no member" for everyone — including the
-// admin whose deletion failed part-way and must retry it (below). That
-// membership is read from the mirror, whose rows are exactly what the purge
-// has not removed yet, ready or not; a refused caller gets null either way.
 //
-// Readiness is database-wide; completeness is PER ORGANIZATION. An
+// Completeness is PER ORGANIZATION. An organization whose row was minted
-// organization whose row was minted after the backfill ran — lazily by a
+// after the backfill ran — lazily by a request (`resolveOrganization`), or by
-// request (`resolveOrganization`), or by a first login — carries no
+// a first login — carries no `backfilled_at`, and the mirror holds only the
-// `backfilled_at`, and the mirror holds only the memberships login and
+// memberships login and write-through happened to record for it: a member
-// write-through happened to record for it: a member who has not signed in
+// who has not signed in since would be refused on a row that was never
-// since would be refused on a row that was never written. So the org row is
+// written. So the org row is read FIRST, and an unmarked live organization is
-// read FIRST, and an unmarked live organization is scanned from WorkOS
+// scanned from WorkOS (`ensureOrganizationBackfilled`: one membership listing
-// (`ensureOrganizationBackfilled`: one membership listing plus one `getUser`
+// plus one `getUser` per member, then the mark) BEFORE its mirror is read —
-// per member, then the mark) BEFORE its mirror is read — the same on-demand
+// the same on-demand scan the seat gates run. One-time per organization: the
-// scan the seat gates run. One-time per organization: the scan marks the
+// scan marks the row, and this branch is never taken for it again. An
-// row, and this branch is never taken for it again. An organization the
+// organization the mirror does not hold at all — one that predates the
-// mirror does not hold at all — one that predates the mirror and that nobody
+// mirror and that nobody has signed in to since (a CLI or MCP token names it,
-// has signed in to since (a CLI or MCP token names it, and the JWT path has
+// and the JWT path has no login feeder), or one created in the WorkOS
-// no login feeder), or one created in the WorkOS dashboard — is reachable by
+// dashboard — is reachable by neither the backfill (which lists the mirror's
-// neither the backfill (which lists the mirror's organizations) nor the
+// organizations) nor the reconciler (which starts at the replay boundary), so
-// reconciler (which starts at the replay boundary), so it is resolved on
+// it is resolved on demand HERE: WorkOS is asked for the caller's own
-// demand HERE: WorkOS is asked for the caller's own membership in it first
+// membership in it first (`getUserOrgMembership`, a read scoped to this
-// (`getUserOrgMembership`, a read scoped to this caller — never a listing
+// caller — never a listing of the org), and only a member's answer mints the
-// of the org), and only a member's answer mints the row
+// row (`resolveOrganization`) and scans it as above. A non-member mints
-// (`resolveOrganization`) and scans it as above. A non-member mints nothing:
+// nothing: a signed-in caller cannot create the row of an arbitrary WorkOS
-// a signed-in caller cannot create the row of an arbitrary WorkOS
 // organization by naming its id. An organization marked deleted is never
 // scanned: WorkOS no longer has it, and its rows are the purge's to remove,
 // not a listing's to refresh.
     return active;
   });
-// The pre-cutover read, kept for the window in which the mirror is not yet
-// ready: WorkOS's own membership list for the user, one call per request.
-const activeMembershipFromWorkOs = (userId: string, organizationId: string) =>
-  Effect.gen(function* () {
-    const workos = yield* WorkOSClient;
-    const memberships = yield* workos.listUserMemberships(userId);
-    const membership = memberships.data.find(
-      (m) => m.organizationId === organizationId && m.status === "active",
-    );
-    if (!membership) return null;
-    const active: ActiveMembership = { role: membership.role.slug };
-    return active;
-  });
 // The authorized organization, or null for one marked deleted (unless the
 // caller is the deletion flow). The membership already names the caller's
 // role — surfaced normalized so identity resolution can bind the executor's
     return yield* resolveOrganization(organizationId);
   });
-/**
+/** The span every membership authorization runs under. */
- * The span every membership authorization runs under, with the readiness
- * decision stamped on it so the fallback can be counted rather than grepped:
- * `mirror.ready` (boolean, which source answered) and `mirror.readiness` (the
- * state's description, why). Query Axiom for `name == "auth.authorize_organization"`
- * and `mirror.ready == false` to see how many requests are on the WorkOS
- * fallback and for which reason.
- */
 export const AUTHORIZE_ORGANIZATION_SPAN = "auth.authorize_organization";
 export const authorizeOrganization = (
   options: AuthorizeOrganizationOptions = {},
 ) =>
   Effect.gen(function* () {
-    const readiness = yield* MirrorReadiness;
-    const state = yield* readiness.state();
-    const ready = MirrorReadinessState.$is("Ready")(state);
-    yield* Effect.annotateCurrentSpan({
-      "mirror.ready": ready,
-      "mirror.readiness": describeMirrorReadiness(state),
-    });
-    if (!ready) {
-      yield* Effect.logWarning(
-        "authorizeOrganization: membership mirror not ready; membership read from WorkOS",
-        { readiness: describeMirrorReadiness(state) },
-      );
-      // A marked organization is the mirror's to answer for (see above):
-      // WorkOS lists no member of it, and the deletion retry must still
-      // get in.
-      const users = yield* UserStoreService;
-      const held = yield* users.use("getOrganization", (s) => s.getOrganization(organizationId));
-      if (held?.deletedAt != null) {
-        if (options.deleted !== "allow") return null;
-        const membership = yield* activeMembershipFromMirror(userId, organizationId);
-        if (!membership) return null;
-        return authorized(held, membership, options);
-      }
-      const membership = yield* activeMembershipFromWorkOs(userId, organizationId);
-      if (!membership) return null;
-      // The row read above is reused: `resolveOrganization` would read it a
-      // second time, and a request reads the organization row ONCE (the MCP
-      // session DO relies on that — see e2e `mcp-session-cold-init`).
-      const org = held ?? (yield* resolveOrganization(organizationId));
-      return authorized(org, membership, options);
-    }
     const org = yield* heldOrResolvedForMember(userId, organizationId);
     if (!org) return null;
     // An unmarked live organization is scanned before its mirror is read
     // (see above). The row returned below still shows the mark as it was
-    // read; nothing past this point reads it.
+    // read; nothing past this point reads it. A marked-deleted organization
+    // is never scanned, so the deletion retry (`deleted: "allow"`) reaches
+    // `authorized()` below with the membership row the purge has not removed
+    // yet.
     if (org.deletedAt === null && org.backfilledAt === null) {
       yield* ensureOrganizationBackfilled(organizationId);
     }

apps/cloud/src/auth/workos-auth-provider.ts+15−21

 //   - session org not authorized -> NoOrganization 403 no_organization
 //   - no auth header             -> falls through to the sealed-session path
 // The org-resolution infra errors (`UserStoreError` / `WorkOSError` /
-// `MemberDirectoryError` / `WorkOsMirrorError`, the last from the mirror
+// `MemberDirectoryError` / `WorkOsMirrorError`) are `Effect.die`d so they
-// readiness read) are `Effect.die`d so they surface as 500 defects — the
+// surface as 500 defects — the same status the old inline resolver produced
-// same status the old inline resolver produced when those bubbled up.
+// when those bubbled up.
 //
-// The per-request `UserStoreService` + `MemberDirectory` + `MirrorReadiness`
+// The per-request `UserStoreService` + `MemberDirectory` + `WorkOsMirror`
-// + `WorkOsMirror` (read by the org-resolution path: the org row, whether
+// (read by the org-resolution path: the org row, the caller's mirrored
-// the mirror may be trusted, the caller's mirrored membership, and the
+// membership, and the on-demand scan of an organization the backfill never
-// on-demand scan of an organization the backfill never covered) stay
+// covered) stay REQUIREMENTS OF THE LAYER, satisfied by the facade's
-// REQUIREMENTS OF THE LAYER, satisfied by the facade's per-request DB combine —
+// per-request DB combine — NOT function-level requirements (that is what
-// NOT function-level requirements (that is what forced a forked tag before).
+// forced a forked tag before).
 // ---------------------------------------------------------------------------
 import { Effect, Layer } from "effect";
 import { ApiKeyService } from "./api-keys";
 import { workosApiJwtBearerConfig } from "./api-jwt-bearer";
-import { MirrorReadiness } from "./mirror-readiness";
 import { WorkOsMirror } from "./workos-mirror";
 import { BEARER_PREFIX } from "./bearer";
 import {
   | WorkOSError
   | WorkOsMirrorError
   | MemberDirectoryError,
-  WorkOSClient | ApiKeyService | UserStoreService | MemberDirectory | MirrorReadiness | WorkOsMirror
+  WorkOSClient | ApiKeyService | UserStoreService | MemberDirectory | WorkOsMirror
 > =>
   Effect.gen(function* () {
     const authHeader = request.headers.get("authorization");
   | WorkOSError
   | WorkOsMirrorError
   | MemberDirectoryError,
-  WorkOSClient | ApiKeyService | UserStoreService | MemberDirectory | MirrorReadiness | WorkOsMirror
+  WorkOSClient | ApiKeyService | UserStoreService | MemberDirectory | WorkOsMirror
 > =>
   Effect.gen(function* () {
     const auth = yield* resolveBearerAuth(request, jwt);
   | WorkOSError
   | WorkOsMirrorError
   | MemberDirectoryError,
-  WorkOSClient | ApiKeyService | UserStoreService | MemberDirectory | MirrorReadiness | WorkOsMirror
+  WorkOSClient | ApiKeyService | UserStoreService | MemberDirectory | WorkOsMirror
 > =>
   Effect.gen(function* () {
     const bearerPrincipal = yield* resolveApiKeyPrincipal(request, jwt);
 export const workosIdentityLayer: Layer.Layer<
   IdentityProvider,
   never,
-  WorkOSClient | ApiKeyService | UserStoreService | MemberDirectory | MirrorReadiness | WorkOsMirror
+  WorkOSClient | ApiKeyService | UserStoreService | MemberDirectory | WorkOsMirror
 > = Layer.effect(
   IdentityProvider,
   Effect.gen(function* () {
     const context = yield* Effect.context<
-      | WorkOSClient
+      WorkOSClient | ApiKeyService | UserStoreService | MemberDirectory | WorkOsMirror
-      | ApiKeyService
-      | UserStoreService
-      | MemberDirectory
-      | MirrorReadiness
-      | WorkOsMirror
     >();
     return IdentityProvider.of({
       authenticate: (request) =>
             WorkOSError: (error) => Effect.die(error),
             // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: membership-mirror read failure -> 500 defect, same class as the store failure above
             MemberDirectoryError: (error) => Effect.die(error),
-            // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: mirror-readiness read failure -> 500 defect, same class as the store failure above
+            // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: membership-mirror read failure -> 500 defect, same class as the store failure above
             WorkOsMirrorError: (error) => Effect.die(error),
           }),
           Effect.provide(context),

apps/cloud/src/auth/workos-events-runner.node.test.ts+81−0

@@ -0,0 +1,81 @@
	1	// ---------------------------------------------------------------------------
	2	// A reconciler run that does not end `"drained"` can still leave the mirror
	3	// fresh (another run drained it moments ago) or leave it stale (nothing has
	4	// drained inside the lag budget). `alertOnStaleReconciler` is the ONLY place
	5	// that distinction is now reported — the request path no longer reads
	6	// readiness at all — so this pins both branches directly against it: a
	7	// fresh `drainedAt` logs nothing, and a stale or absent `drainedAt` logs a
	8	// structured error. `captureCauseEffect` is not swapped out: it calls
	9	// `Sentry.captureException` directly, is a no-op in this uninitialized test
	10	// environment, and its call path is exercised for real rather than mocked.
	11	// ---------------------------------------------------------------------------
	12
	13	import { describe, expect, it } from "@effect/vitest";
	14	import { Cause, Duration, Effect, Layer, Logger } from "effect";
	15
	16	import { WorkOsMirror, type WorkOsMirrorShape } from "./workos-mirror";
	17	import { alertOnStaleReconciler } from "./workos-events-runner";
	18	import type { WorkOsEventsSyncReport } from "./workos-events-sync";
	19
	20	const capturingLogger = (sink: Array<string>) =>
	21	Logger.make<unknown, void>((options) => {
	22	sink.push(String(options.message));
	23	sink.push(Cause.pretty(options.cause));
	24	});
	25
	26	const reportEndingWith = (stopped: WorkOsEventsSyncReport["stopped"]): WorkOsEventsSyncReport => ({
	27	pages: 1,
	28	events: 0,
	29	applied: 0,
	30	stale: 0,
	31	absent: 0,
	32	stopped,
	33	cursor: null,
	34	});
	35
	36	const stubMirror = (drainedAt: Date \| null) =>
	37	Layer.succeed(
	38	WorkOsMirror,
	39	new Proxy({} as WorkOsMirrorShape, {
	40	get: (_target, prop) => {
	41	if (prop === "drainedAt") return () => Effect.succeed(drainedAt);
	42	return () => Effect.die(`unexpected WorkOsMirror.${String(prop)} call`);
	43	},
	44	}),
	45	);
	46
	47	const run = (report: WorkOsEventsSyncReport, drainedAt: Date \| null) => {
	48	const logged: string[] = [];
	49	return Effect.runPromise(
	50	alertOnStaleReconciler(report).pipe(
	51	Effect.provide(stubMirror(drainedAt)),
	52	Effect.provide(Logger.layer([capturingLogger(logged)])),
	53	),
	54	).then(() => logged);
	55	};
	56
	57	describe("alertOnStaleReconciler", () => {
	58	it("does not alert when the run itself drained the stream", async () => {
	59	// A `"drained"` run just called `markDrained`, so it is healthy by
	60	// definition and `drainedAt` is never read.
	61	const logged = await run(reportEndingWith("drained"), null);
	62	expect(logged).toEqual([]);
	63	});
	64
	65	it("does not alert when the mirror drained inside the lag budget", async () => {
	66	const fresh = new Date(Date.now() - Duration.toMillis(Duration.minutes(1)));
	67	const logged = await run(reportEndingWith("page_budget"), fresh);
	68	expect(logged).toEqual([]);
	69	});
	70
	71	it("alerts when the mirror has not drained inside the lag budget", async () => {
	72	const stale = new Date(Date.now() - Duration.toMillis(Duration.minutes(11)));
	73	const logged = await run(reportEndingWith("page_budget"), stale);
	74	expect(logged.some((line) => line.includes("workos_events: reconciler stale"))).toBe(true);
	75	});
	76
	77	it("alerts when the mirror has never drained", () =>
	78	run(reportEndingWith("awaiting_backfill"), null).then((logged) => {
	79	expect(logged.some((line) => line.includes("workos_events: reconciler stale"))).toBe(true);
	80	}));
	81	});

apps/cloud/src/auth/workos-events-runner.ts+59−3

@@ -13,17 +13,28 @@ · 12 unmodified lines
13	// A failing run is captured (Sentry + structured log) and swallowed here:	13	// A failing run is captured (Sentry + structured log) and swallowed here:
14	// neither entry has a caller to report to, and the run is retried by the	14	// neither entry has a caller to report to, and the run is retried by the
15	// next cron tick from the last committed cursor.	15	// next cron tick from the last committed cursor.
		16	//
		17	// A run that does not fail outright can still leave the mirror stale: one
		18	// that stops short of `"drained"` (page budget, cursor contention) means the
		19	// reconciler did not catch up this tick, and one stuck on
		20	// `"awaiting_backfill"` past the budget means the boundary row the backfill
		21	// was supposed to hand off was lost — both are read from `drainedAt` after
		22	// the run and, past `MIRROR_RECONCILER_LAG_BUDGET`, reported the same way a
		23	// thrown failure is: a structured error log plus a Sentry capture. This is
		24	// the ONLY place a stale reconciler surfaces now; the request path
		25	// (`auth/organization.ts`) no longer checks readiness or falls back.
16	// ---------------------------------------------------------------------------	26	// ---------------------------------------------------------------------------
17		27
18	import { Effect, Layer } from "effect";	28	import { Clock, Data, Duration, Effect, Layer } from "effect";
19		29
20	import { captureCauseEffect } from "../observability";	30	import { captureCauseEffect } from "../observability";
21	import { WorkerTelemetryLive } from "../observability/telemetry";	31	import { WorkerTelemetryLive } from "../observability/telemetry";
22	import { makeDbLayer } from "../db/db";	32	import { makeDbLayer } from "../db/db";
23	import { makeUserStoreLayer } from "./context";	33	import { makeUserStoreLayer } from "./context";
		34	import { MIRROR_RECONCILER_LAG_BUDGET } from "./mirror-readiness-store";
24	import { CoreSharedServices } from "./workos";	35	import { CoreSharedServices } from "./workos";
25	import { syncWorkOsEvents } from "./workos-events-sync";	36	import { syncWorkOsEvents, type WorkOsEventsSyncReport } from "./workos-events-sync";
26	import { makeWorkOsMirrorLayer } from "./workos-mirror";	37	import { makeWorkOsMirrorLayer, WorkOsMirror } from "./workos-mirror";
27		38
28	const makeSyncServices = () => {	39	const makeSyncServices = () => {
29	const dbLive = makeDbLayer();	40	const dbLive = makeDbLayer();
@@ -34,14 +45,59 @@ const makeSyncServices = () => { · 4 unmodified lines
34	);	45	);
35	};	46	};
36		47
		48	const LAG_BUDGET_MS = Duration.toMillis(MIRROR_RECONCILER_LAG_BUDGET);
		49
		50	/**
		51	* The mirror has not drained the WorkOS events stream inside its lag budget.
		52	* Its own tagged error so Sentry groups every occurrence under one issue,
		53	* with the run's outcome and the heartbeat's age as the fields to read.
		54	*/
		55	export class WorkOsReconcilerStale extends Data.TaggedError("WorkOsReconcilerStale")<{
		56	readonly stopped: WorkOsEventsSyncReport["stopped"];
		57	readonly drainedAt: string \| null;
		58	readonly ageMs: number \| null;
		59	}> {}
		60
		61	/**
		62	* After a run that did not end `"drained"`, check whether the mirror has
		63	* fallen behind its lag budget and, if so, report it the way a failed run is
		64	* reported: a structured error log plus a Sentry capture. A run ending
		65	* `"drained"` just wrote `markDrained` and is healthy by definition, so it is
		66	* never checked. Cheap by design: one `drainedAt` read per run (about once a
		67	* minute).
		68	*/
		69	export const alertOnStaleReconciler = Effect.fn("workos_events.alert_on_stale_reconciler")(
		70	function* (report: WorkOsEventsSyncReport) {
		71	if (report.stopped === "drained") return;
		72
		73	const mirror = yield* WorkOsMirror;
		74	const drainedAt = yield* mirror.drainedAt();
		75	const now = yield* Clock.currentTimeMillis;
		76	const ageMs = drainedAt === null ? null : now - drainedAt.getTime();
		77	if (ageMs !== null && ageMs <= LAG_BUDGET_MS) return;
		78
		79	const stale = new WorkOsReconcilerStale({
		80	stopped: report.stopped,
		81	drainedAt: drainedAt === null ? null : drainedAt.toISOString(),
		82	ageMs,
		83	});
		84	yield* Effect.logError("workos_events: reconciler stale", stale);
		85	yield* captureCauseEffect(stale);
		86	},
		87	);
		88
37	/**	89	/**
38	* One reconciler pass over fresh request-scoped services. Resolves when the	90	* One reconciler pass over fresh request-scoped services. Resolves when the
39	* pass ends, whether it drained the stream, stopped at the page budget,	91	* pass ends, whether it drained the stream, stopped at the page budget,
40	* yielded to another run, or failed (a failure is reported, never thrown).	92	* yielded to another run, or failed (a failure is reported, never thrown).
		93	* A run that ends short of `"drained"` and leaves `drainedAt` past the lag
		94	* budget is ALSO reported (see {@link alertOnStaleReconciler}) — a stalled
		95	* reconciler is now an operational alert, not a per-request fallback.
41	*/	96	*/
42	export const runWorkOsEventsSync = (): Promise<void> =>	97	export const runWorkOsEventsSync = (): Promise<void> =>
43	Effect.runPromise(	98	Effect.runPromise(
44	syncWorkOsEvents().pipe(	99	syncWorkOsEvents().pipe(
		100	Effect.tap((report) => alertOnStaleReconciler(report)),
45	Effect.asVoid,	101	Effect.asVoid,
46	Effect.provide(makeSyncServices()),	102	Effect.provide(makeSyncServices()),
47	Effect.scoped,	103	Effect.scoped,

apps/cloud/src/auth/workos-events-sync.node.test.ts+35−21

 import { WorkOSError } from "./errors";
 import { cloudMemberDirectoryLayer } from "./member-directory";
 import { mirrorSignIn } from "./mirror-feeders";
-import { MirrorReadiness, MirrorReadinessState } from "./mirror-readiness";
 import { authorizeOrganization } from "./organization";
 import { WorkOSClient, type WorkOSClientService, type WorkOSListEventsOptions } from "./workos";
 import {
 });
 const DbLive = DbService.Live;
-// The mirror is READY here (the authorization checks below read the mirror,
+// The authorization checks below always read the mirror, never WorkOS.
-// not WorkOS); the readiness rule is pinned in workos-mirror.node.test.ts.
-const readyMirror = Layer.succeed(MirrorReadiness)({
-  state: () => Effect.succeed(MirrorReadinessState.Ready()),
-});
 const MirrorServices = Layer.mergeAll(
   WorkOsMirror.Live,
   UserStoreService.Live,
   cloudMemberDirectoryLayer,
-  readyMirror,
 ).pipe(Layer.provideMerge(DbLive));
-type Services =
+type Services = WorkOsMirror | UserStoreService | MemberDirectory | DbService | WorkOSClient;
-  | WorkOsMirror
-  | UserStoreService
-  | MemberDirectory
-  | MirrorReadiness
-  | DbService
-  | WorkOSClient;
 const run = <A, E>(
   body: Effect.Effect<A, E, Services>,
         const promoted = yield* applyEvent(
           membershipEvent(
             "organization_membership.updated",
-            workosMembership(joiner, org, { role: { slug: "admin" }, updatedAt: T2 }),
+            workosMembership(joiner, org, {
+              role: { slug: "admin" },
+              updatedAt: T2,
+            }),
           ),
         );
         // A member WorkOS no longer has (their `user.deleted` is further down
           membershipEvent("organization_membership.created", workosMembership(gone, org)),
         );
         const goneRow = yield* readMembership(gone, org);
-        return { knownJoins, knownRow, joins, joinerRow, promoted, goneJoins, goneRow };
+        return {
+          knownJoins,
+          knownRow,
+          joins,
+          joinerRow,
+          promoted,
+          goneJoins,
+          goneRow,
+        };
       }),
       stubWorkOS({
         getUser: (userId) =>
     expect(result.joinerRow?.email).toBe(`${joiner}@placeholder.test`);
     expect(result.promoted).toBe("applied");
     expect(result.goneJoins, "a member WorkOS no longer has is still mirrored").toBe("applied");
-    expect(result.goneRow).toMatchObject({ membershipId: `om_${gone}_${org}`, name: null });
+    expect(result.goneRow).toMatchObject({
+      membershipId: `om_${gone}_${org}`,
+      name: null,
+    });
     expect(reads, "one read per unprofiled member, none for a profiled one").toEqual([
       joiner,
       gone,
         Effect.provide(
           Layer.mergeAll(
             MirrorServices,
-            stubWorkOS({ getUser: () => Effect.fail(new WorkOSError({ status: 503 })) }),
+            stubWorkOS({
+              getUser: () => Effect.fail(new WorkOSError({ status: 503 })),
+            }),
           ),
         ),
         Effect.scoped,
         // deletion, and stalled past it now writes what it holds.
         yield* mirrorSignIn(
           workosUser(userId),
-          [workosMembership(userId, org, { organizationName: "Never Mirrored" })],
+          [
+            workosMembership(userId, org, {
+              organizationName: "Never Mirrored",
+            }),
+          ],
           new Date(T1),
         );
         const afterLogin = yield* readOrganization(org);
         const cursor = yield* mirror.getCursor();
         const membership = yield* readMembership(userId, org);
         const drainedAfter = yield* mirror.drainedAt();
-        return { report, cursor, intruder, membership, drainedBefore, drainedAfter };
+        return {
+          report,
+          cursor,
+          intruder,
+          membership,
+          drainedBefore,
+          drainedAfter,
+        };
       }),
     );
     expect(requests, "the second page is never read").toHaveLength(1);

apps/cloud/src/auth/workos-mirror.node.test.ts+37−14

 import { makeWorkOsMirrorStore } from "./workos-mirror-store";
 import {
   MIRROR_RECONCILER_LAG_BUDGET,
-  MirrorReadiness,
   MirrorReadinessState,
-  makeMirrorReadinessLayer,
   mirrorReadinessFrom,
-} from "./mirror-readiness";
+  readMirrorReadiness,
+} from "./mirror-readiness-store";
 const DbLive = DbService.Live;
 const Services = Layer.mergeAll(
         // the row holds — the payload a timestamp guard would let through.
         // Same id: the membership is deleted, it never returns.
         const newerSameId = yield* mirror.upsertMembership(
-          membership(org, id, { id: membershipId, role: "admin", updatedAt: T3 }),
+          membership(org, id, {
+            id: membershipId,
+            role: "admin",
+            updatedAt: T3,
+          }),
         );
         const afterNewerSameId = yield* directory.membership(id, org, ["inactive"]);
         // The member re-added in WorkOS: a payload newer than the deletion,
       result.newerSameId,
       "a payload of the deleted id stamped AFTER the removal is refused: identity, not time",
     ).toBe(false);
-    expect(result.afterNewerSameId).toMatchObject({ status: "inactive", role: "member" });
+    expect(result.afterNewerSameId).toMatchObject({
+      status: "inactive",
+      role: "member",
+    });
     expect(result.readded, "a replacement under a new id reactivates").toBe(true);
     expect(result.afterReadd?.status).toBe("active");
     expect(result.lateDelete, "a replayed deletion of the OLD id is refused").toBe(false);
         // with status inactive): the row is inactive but still WorkOS's, with
         // no `deleted_at` to protect it.
         const deactivated = yield* mirror.upsertMembership(
-          membership(org, id, { id: membershipId, status: "inactive", updatedAt: T2 }),
+          membership(org, id, {
+            id: membershipId,
+            status: "inactive",
+            updatedAt: T2,
+          }),
         );
         const whileInactive = yield* directory.membership(id, org);
         // A payload older than the deactivation cannot undo it, nor one
         );
         // WorkOS reactivates it, same id, newer stamp: live again.
         const reactivated = yield* mirror.upsertMembership(
-          membership(org, id, { id: membershipId, role: "admin", updatedAt: T3 }),
+          membership(org, id, {
+            id: membershipId,
+            role: "admin",
+            updatedAt: T3,
+          }),
         );
         const afterReactivate = yield* directory.membership(id, org);
         return {
       result.rejoined,
       "a membership of a deleted user is refused however it is stamped: identity, not time",
     ).toBe(false);
-    expect(result.afterRejoin).toMatchObject({ status: "inactive", name: null });
+    expect(result.afterRejoin).toMatchObject({
+      status: "inactive",
+      name: null,
+    });
     expect(result.unknown, "deleting an unseen user leaves a tombstone").toBe(true);
     expect(result.unseenProfile, "which the older profile cannot fill").toBe(false);
     expect(
     const result = await run(
       Effect.gen(function* () {
         const mirror = yield* WorkOsMirror;
-        const readiness = yield* MirrorReadiness;
+        const { db } = yield* DbService;
+        const readiness = () => Effect.promise(() => readMirrorReadiness(db, new Date()));
         yield* clearEventsRow;
-        const noRow = yield* readiness.state();
+        const noRow = yield* readiness();
         yield* mirror.setReplayBoundary(T1);
         yield* mirror.markBackfillCompleted(T1);
-        const backfilledOnly = yield* readiness.state();
+        const backfilledOnly = yield* readiness();
         // A drain as of now: what a reconciler run that just read the stream
         // to its end records.
         const drainedAt = new Date();
         yield* mirror.markDrained(drainedAt);
-        const ready = yield* readiness.state();
+        const ready = yield* readiness();
         return { noRow, backfilledOnly, ready };
-      }).pipe(Effect.provide(makeMirrorReadinessLayer().pipe(Layer.provide(DbLive)))),
+      }),
     );
     expect(result.noRow).toEqual(MirrorReadinessState.BackfillPending());
     expect(result.backfilledOnly).toEqual(
         yield* mirror.applyOrganizationScan({
           organizationId: org,
           listedAt: T2,
-          members: [{ user: user(kept), membership: membership(org, kept, { updatedAt: T1 }) }],
+          members: [
+            {
+              user: user(kept),
+              membership: membership(org, kept, { updatedAt: T1 }),
+            },
+          ],
         });
         // The stalled login resumes and writes what it holds: refused, the
         // revocation predates the scan and nothing would ever undo the row.

apps/cloud/src/extensions/billing/route.node.test.ts+1−10

 import { MemberDirectory } from "@executor-js/api/server";
 import { UserStoreService } from "../../auth/context";
-import { MirrorReadiness, MirrorReadinessState } from "../../auth/mirror-readiness";
 import { WorkOSClient, type WorkOSClientService } from "../../auth/workos";
 import { WorkOsMirror, type WorkOsMirrorShape } from "../../auth/workos-mirror";
 import { resolveBillingOrganization } from "./route";
 );
 // MEMBER is active in both orgs, as the mirror reports it.
-// The mirror is READY in these tests (backfill complete, reconciler caught
-// up), so membership is read from the stubbed directory, never from WorkOS.
-const stubReadiness = Layer.succeed(MirrorReadiness)({
-  state: () => Effect.succeed(MirrorReadinessState.Ready()),
-});
 const stubDirectory = Layer.succeed(MemberDirectory)({
   membership: (accountId, organizationId) =>
     Effect.succeed(
   resolveBillingOrganization(
     new Request("https://executor.test/api/billing/customer", { headers }),
     { userId: MEMBER },
-  ).pipe(
+  ).pipe(Effect.provide(Layer.mergeAll(stubWorkOS, stubUsers, stubDirectory, stubMirror)));
-    Effect.provide(Layer.mergeAll(stubWorkOS, stubUsers, stubDirectory, stubMirror, stubReadiness)),
-  );
 describe("billing route org selector", () => {
   it.effect("fails closed when no selector header is sent", () =>

apps/cloud/src/extensions/routes.ts+4−5

 import { requestScopedMiddleware, type MemberDirectory } from "@executor-js/api/server";
 import { UserStoreService } from "../auth/context";
-import { MirrorReadiness } from "../auth/mirror-readiness";
 import { WorkOsMirror } from "../auth/workos-mirror";
 import {
   CloudAuthPublicHandlers,
  * core.
  */
 export const makeCloudExtensionRoutes = (
-  rsLive: Layer.Layer<
+  rsLive: Layer.Layer<DbService | UserStoreService | WorkOsMirror | MemberDirectory>,
-    DbService | UserStoreService | WorkOsMirror | MemberDirectory | MirrorReadiness
-  >,
 ) => {
   // Session routes (login / callback / me / switch-org / …). Handlers yield
   // `UserStoreService` directly; the per-request DB combine keeps the postgres
   // rather than on the protected API because the protected plane's middleware
   // binds a product-view executor to one acting member — this one authorizes an
   // org key (or an admin session) and builds a subject-less platform view.
-  const AdminUsersRoutes = makeCloudAdminUsersRoutes(rsLive, { router: apiPrefixedRouter });
+  const AdminUsersRoutes = makeCloudAdminUsersRoutes(rsLive, {
+    router: apiPrefixedRouter,
+  });
   // The WorkOS webhook needs no per-request DB layer: it verifies the
   // signature with the boot `WorkOSClient` and detaches a reconciler pass

apps/cloud/src/mcp/auth-provider.ts+16−11

 // Cloud McpAuthProvider adapter — the cloud analog of selfHostMcpAuthProviderLayer.
 //
 // Folds the entire cloud edge auth/authz surface (WorkOS JWT verify + API-key
-// bearer + per-request org-liveness check + the two OAuth discovery docs) into
+// bearer + per-request membership check + the two OAuth discovery docs) into
 // ONE `McpAuthProvider` Layer behind the shared host-mcp envelope.
 //
 // `authenticate(request)` runs on EVERY /mcp request and resolves a typed
 //   - missing bearer       -> Unauthorized (challenge: Bearer resource_metadata=…)
 //   - invalid token/api key -> Unauthorized (challenge: Bearer error="invalid_token" …)
 //   - transient JWKS OR membership-lookup infra -> Unavailable (caught here;
-//       envelope renders a retryable 503 -32001). A WorkOS blip during the live
+//       envelope renders a retryable 503 -32001). The membership check reads
-//       org check is a TRANSIENT failure, not evidence the org is gone, so it
+//       the local mirror (`auth/organization.ts`), so the infra that can fail
-//       must NOT reach the Forbidden/destroy path below.
+//       here is the database — or WorkOS, on the one path that still asks it
+//       (an organization the mirror has never seen). Either is TRANSIENT, not
+//       evidence the org is gone, and must NOT reach the Forbidden/destroy
+//       path below.
 //   - no org / revoked org  -> Forbidden ("No organization in session …", -32001).
 //       This requires a POSITIVE determination (the lookup SUCCEEDED and the org
 //       is absent), never a failed lookup. Because authenticate reads the
-//       mcp-session-id header to do the live org check, the envelope's
+//       mcp-session-id header to do the membership check, the envelope's
 //       dispose-on-Forbidden-with-sessionId path reproduces the old inline
 //       clearExistingSession.
 //   - verified + org allowed -> Authenticated(principal)
 const NO_ORGANIZATION_MESSAGE = "No organization in session — log in via the web app first";
-// A transient WorkOS failure (429 / 5xx / timeout / network) during the live
+// A transient failure during the membership lookup must NOT masquerade as
-// membership lookup must NOT masquerade as "org revoked" — but the failure
+// "org revoked". The lookup reads the local mirror, so in steady state its
-// channel alone is not enough to tell them apart: WorkOS also answers with
+// only failure is the database; the one path that still asks WorkOS (an
-// DEFINITIVE 4xx denials (401 revoked/invalid API key, 403, 404 deleted org)
+// organization the mirror has never seen, resolved for a caller WorkOS
-// that the SDK throws as typed exceptions. So the classification is:
+// confirms as its member) can also fail with a DEFINITIVE 4xx denial (401
+// revoked/invalid API key, 403, 404 deleted org) that the SDK throws as a
+// typed exception. So the classification is:
 //   - lookup SUCCEEDS with `null`            -> genuine absence -> Forbidden
 //   - lookup FAILS with WorkOS 401/403/404   -> definitive denial -> Forbidden
 //       (fail CLOSED: WorkOS answered and said no; retrying cannot help)
-//   - lookup FAILS any other way (429/5xx/timeout/network/no status)
+//   - lookup FAILS any other way (database, 429/5xx/timeout/network/no status)
 //       -> transient -> retryable 503, session preserved
 // The status rides on `WorkOSError.status` (threaded from the SDK exception at
 // the service boundary in auth/workos.ts); `isDefinitiveWorkOSDenial` is the

apps/cloud/src/mcp/auth.ts+6−5

 import { authorizeOrganization } from "../auth/organization";
 import { UserStoreService, makeUserStoreLayer } from "../auth/context";
 import { makeMemberDirectoryLayer } from "../auth/member-directory";
-import { makeMirrorReadinessLayer } from "../auth/mirror-readiness";
 import { makeWorkOsMirrorLayer } from "../auth/workos-mirror";
 import { CoreSharedServices } from "../auth/workos";
 import { makeDbLayer } from "../db/db";
   const dbLive = makeDbLayer();
   const userStoreLive = makeUserStoreLayer().pipe(Layer.provide(dbLive));
   const memberDirectoryLive = makeMemberDirectoryLayer().pipe(Layer.provide(dbLive));
-  const mirrorReadinessLive = makeMirrorReadinessLayer().pipe(Layer.provide(dbLive));
   const workOsMirrorLive = makeWorkOsMirrorLayer().pipe(Layer.provide(dbLive));
   return Layer.mergeAll(
     dbLive,
     userStoreLive,
     memberDirectoryLive,
-    mirrorReadinessLive,
     workOsMirrorLive,
     CoreSharedServices,
   );
       if (!verified) return mcpUnauthorized("invalid_token", "The access token is invalid");
       if (Predicate.isTagged(verified, "Unauthorized")) return verified;
       if (!verified.accountId) {
-        yield* Effect.annotateCurrentSpan({ "mcp.auth.outcome": "missing_subject" });
+        yield* Effect.annotateCurrentSpan({
+          "mcp.auth.outcome": "missing_subject",
+        });
         return mcpUnauthorized("invalid_token", "The access token is invalid");
       }
       yield* Effect.annotateCurrentSpan({
       verifyBearer: Effect.fn("mcp.auth.verify_bearer")(function* (request) {
         const authHeader = request.headers.get("authorization");
         if (!authHeader?.startsWith(BEARER_PREFIX)) {
-          yield* Effect.annotateCurrentSpan({ "mcp.auth.outcome": "missing_bearer" });
+          yield* Effect.annotateCurrentSpan({
+            "mcp.auth.outcome": "missing_bearer",
+          });
           return mcpUnauthorized("missing_bearer");
         }
         const token = authHeader.slice(BEARER_PREFIX.length).trim();

apps/cloud/src/org/auth-middleware.ts+8−11

 import { UserStoreService } from "../auth/context";
 import { sessionFromSealed } from "../auth/middleware";
-import { MirrorReadiness } from "../auth/mirror-readiness";
 import { WorkOsMirror } from "../auth/workos-mirror";
 import { ORG_SELECTOR_HEADER, authorizeOrganizationSelector } from "../auth/organization";
 import { WorkOSClient } from "../auth/workos";
 /**
  * The caller's role in the session org, as `authorizeOrganizationSelector`
- * read it for THIS request: from the mirror while the mirror is ready, from
+ * read it for THIS request from the membership mirror (`auth/organization.ts`).
- * WorkOS otherwise (`auth/organization.ts`). Provided beside `AuthContext` —
+ * Provided beside `AuthContext` — the shared seam, which carries no role — so
- * the shared seam, which carries no role — so the domain handlers' admin gate
+ * the domain handlers' admin gate is this one value, never a second read of
- * is this one value, never a second read of the mirror that would skip the
+ * the mirror.
- * readiness rule and admit a demoted admin on a stale row while the
- * reconciler is behind.
  */
 export class OrgMemberRole extends Context.Service<
   OrgMemberRole,
   { readonly memberRole: "admin" | "member" }
 >()("@executor-js/cloud/OrgMemberRole") {}
-const OrgAuthMiddleware = HttpRouter.middleware<{ provides: AuthContext | OrgMemberRole }>()(
+const OrgAuthMiddleware = HttpRouter.middleware<{
+  provides: AuthContext | OrgMemberRole;
+}>()(
   Effect.gen(function* () {
     const captured = yield* Effect.context<WorkOSClient>();
     const workos = yield* WorkOSClient;
 );
 export const orgAuthMiddleware = (
-  rsLive: Layer.Layer<
+  rsLive: Layer.Layer<DbService | UserStoreService | MemberDirectory | WorkOsMirror>,
-    DbService | UserStoreService | MemberDirectory | MirrorReadiness | WorkOsMirror
-  >,
 ) => OrgAuthMiddleware.combine(requestScopedMiddleware(rsLive)).layer;

apps/cloud/src/org/handlers.test.ts+48−64

 import { AuthContext, MemberDirectory, type DirectoryMember } from "@executor-js/api/server";
 import { UserStoreService } from "../auth/context";
-import { MirrorReadiness, MirrorReadinessState } from "../auth/mirror-readiness";
 import { ORG_SELECTOR_HEADER } from "../auth/organization";
 import { WorkOSClient, type WorkOSClientService } from "../auth/workos";
 import { WorkOsMirror, type WorkOsMirrorShape } from "../auth/workos-mirror";
 // share — the REAL `requireAdmin` and `assertDomainInSessionOrg` exported from
 // `org/handlers.ts`, so a change to the gate cannot pass on a stale copy — and
 // the admin gate's SOURCE: the role `orgAuthMiddleware` resolved for the
-// request, so a stale mirror row cannot admit a demoted admin while the mirror
+// request, read from the local membership mirror unconditionally
-// is not trusted (the readiness rule in `auth/organization.ts`).
+// (`auth/organization.ts`).
 // ---------------------------------------------------------------------------
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- test stub needs wide function types
         Effect.provide(
           provide("admin", {
             getOrganizationDomain: () =>
-              Effect.succeed({ id: "dom_1", organizationId: "org_1", domain: "acme.test" }),
+              Effect.succeed({
+                id: "dom_1",
+                organizationId: "org_1",
+                domain: "acme.test",
+              }),
           }),
         ),
       ),
         Effect.provide(
           provide("admin", {
             getOrganizationDomain: () =>
-              Effect.succeed({ id: "dom_other", organizationId: "org_2", domain: "evil.test" }),
+              Effect.succeed({
+                id: "dom_other",
+                organizationId: "org_2",
+                domain: "evil.test",
+              }),
           }),
         ),
       ),
 // ---------------------------------------------------------------------------
 // The admin gate over HTTP, through `orgAuthMiddleware`: the role the gate
-// sees is the one the middleware resolved through `authorizeOrganizationSelector`
+// sees is the one the middleware resolved through `authorizeOrganizationSelector`,
-// — the mirror while it is ready, WorkOS otherwise. The mirror row below is
+// which reads the local membership mirror unconditionally — there is no
-// STALE: it still says `admin` for a caller WorkOS has demoted to `member`.
+// readiness gate and no WorkOS fallback (`auth/organization.ts`). The mirror
-// While the mirror is not trusted (the reconciler is behind), WorkOS's answer
+// row below is the sole source of the role, so `stubWorkOS` here serves only
-// must decide, and the delete must be refused.
+// session authentication and dies on anything else, proving membership is
+// never re-checked against WorkOS.
 // ---------------------------------------------------------------------------
 const ORG = "org_1";
 const DOMAIN = "dom_1";
 const createdAt = new Date("2026-01-01T00:00:00.000Z");
-// The mirror's row for the caller: an active admin — stale once WorkOS has
+// The mirror's row for the caller, at whatever role a test sets.
-// demoted them and the reconciler has not landed the change yet.
+const callerRow = (role: "admin" | "member"): DirectoryMember => ({
-const staleAdminRow: DirectoryMember = {
   accountId: CALLER,
   membershipId: `om_${CALLER}_${ORG}`,
   organizationId: ORG,
   email: null,
   name: null,
   avatarUrl: null,
-  role: "admin",
+  role,
   status: "active",
   lastActiveAt: null,
-};
-const unread = (why: string) => () => Effect.die(why);
-const stubDirectory = Layer.succeed(MemberDirectory)({
-  membership: (accountId, organizationId) =>
-    Effect.succeed(accountId === CALLER && organizationId === ORG ? staleAdminRow : null),
-  membershipById: unread("the org plane does not look up by membership id"),
-  membershipsOf: unread("the org plane reads one membership, not the list"),
-  members: unread("the org plane does not list members"),
-  membersById: unread("the org plane does not batch members"),
-  findByEmail: unread("the org plane does not resolve emails"),
 });
-const readiness = (state: MirrorReadinessState) =>
+const unread = (why: string) => () => Effect.die(why);
-  Layer.succeed(MirrorReadiness)({ state: () => Effect.succeed(state) });
+const stubDirectory = (role: "admin" | "member") =>
+  Layer.succeed(MemberDirectory)({
+    membership: (accountId, organizationId) =>
+      Effect.succeed(accountId === CALLER && organizationId === ORG ? callerRow(role) : null),
+    membershipById: unread("the org plane does not look up by membership id"),
+    membershipsOf: unread("the org plane reads one membership, not the list"),
+    members: unread("the org plane does not list members"),
+    membersById: unread("the org plane does not batch members"),
+    findByEmail: unread("the org plane does not resolve emails"),
+  });
 const organizationRow = (id: string) => ({
   id,
   setMemberSeats: unread("the delete does not count seats"),
 });
-// WorkOS as the org plane sees it: the caller's session, their CURRENT
+// WorkOS as the org plane sees it: session authentication and the domain to
-// membership list (demoted to member), and the domain to delete.
+// delete. `stubWorkOS` dies on anything else, so a `listUserMemberships` call
-const workosWithCallerAs = (role: "admin" | "member", deleted: string[]) =>
+// would fail the test — membership is never re-checked against WorkOS.
+const workosForCaller = (deleted: string[]) =>
   stubWorkOS({
     authenticateSealedSession: () =>
-      Effect.succeed({ userId: CALLER, email: "caller@placeholder.test", organizationId: ORG }),
-    listUserMemberships: () =>
       Effect.succeed({
-        data: [
+        userId: CALLER,
-          {
+        email: "caller@placeholder.test",
-            id: staleAdminRow.membershipId,
+        organizationId: ORG,
-            organizationId: ORG,
-            status: "active",
-            role: { slug: role },
-          },
-        ],
       }),
     getOrganizationDomain: () =>
       Effect.succeed({ id: DOMAIN, organizationId: ORG, domain: "acme.test" }),
       }),
   });
-const orgApp = (state: MirrorReadinessState, workos: Layer.Layer<WorkOSClient>) => {
+const orgApp = (role: "admin" | "member", workos: Layer.Layer<WorkOSClient>) => {
-  const rsLive = Layer.mergeAll(stubDb, stubUsers, stubDirectory, stubMirror, readiness(state));
+  const rsLive = Layer.mergeAll(stubDb, stubUsers, stubDirectory(role), stubMirror);
   const App = HttpApiBuilder.layer(OrgHttpApi).pipe(
     Layer.provide(OrgHandlers),
     Layer.provide(orgAuthMiddleware(rsLive)),
   await Promise.all(apps.map((app) => app.dispose()));
 });
-const deleteDomain = async (state: MirrorReadinessState, role: "admin" | "member") => {
+const deleteDomain = async (role: "admin" | "member") => {
   const deleted: string[] = [];
-  const app = orgApp(state, workosWithCallerAs(role, deleted));
+  const app = orgApp(role, workosForCaller(deleted));
   apps.push(app);
   const response = await app.handler(
     new Request(`https://executor.test/org/domains/${DOMAIN}`, {
 };
 describe("Org domain handlers over HTTP: the admin gate is the authorized role", () => {
-  it("lets a mirrored admin delete a domain while the mirror is ready", async () => {
+  it("lets a mirrored admin delete a domain", async () => {
-    const { status, deleted } = await deleteDomain(MirrorReadinessState.Ready(), "member");
+    const { status, deleted } = await deleteDomain("admin");
-    // WorkOS is not consulted for membership while the mirror is ready: the
-    // mirror row (admin) decides, and the demotion lands through the
-    // reconciler within its lag budget.
     expect(status).toBe(200);
     expect(deleted).toEqual([DOMAIN]);
   });
-  it("refuses a demoted admin while the mirror is not ready, however stale the mirror row is", async () => {
+  it("refuses a mirrored plain member, without ever consulting WorkOS", async () => {
-    const { status, deleted } = await deleteDomain(
+    const { status, deleted } = await deleteDomain("member");
-      MirrorReadinessState.ReconcilerStale({ drainedAt: null }),
+    expect(status).toBe(403);
-      "member",
-    );
-    expect(status, "WorkOS says member; the stale admin row does not grant the delete").toBe(403);
     expect(deleted).toEqual([]);
   });
-  it("lets an admin WorkOS confirms delete a domain while the mirror is not ready", async () => {
-    const { status, deleted } = await deleteDomain(
-      MirrorReadinessState.ReconcilerStale({ drainedAt: null }),
-      "admin",
-    );
-    expect(status).toBe(200);
-    expect(deleted).toEqual([DOMAIN]);
-  });
 });

e2e/cloud/mcp-workos-blip-session-survival.test.ts+136−105

-// Cloud: how the per-request live-membership check classifies WorkOS failures,
+// Cloud: an MCP session's relationship to WorkOS after the membership mirror.
-// pinned in BOTH directions at the real upstream (faults armed on the WorkOS
-// emulator's membership endpoint — the same emulator the product's real WorkOS
-// SDK talks to; no product code or stubs touched):
 //
-// 1. A TRANSIENT WorkOS outage (5xx/timeout) must NOT destroy a live MCP
+// Membership is authorized from the local mirror on every /mcp request
-//    session. This is the churn-risk defect: a WorkOS blip used to collapse to
+// (`auth/organization.ts`); WorkOS is a write target and an event source, not
-//    Forbidden, and a Forbidden carrying a session id schedules the session
+// a per-request read. Two contracts follow, pinned here at the real upstream
-//    Durable Object for destruction (in-flight executions, paused approvals,
+// (faults armed on the WorkOS emulator's membership endpoint — the same
-//    undelivered results — all gone). For a shared-API-key org a single blip
+// emulator the product's real WorkOS SDK talks to; no product code or stubs
-//    could mass-condemn every session at once. Contract: the blip request fails
+// touched):
-//    RETRYABLY (503 + Retry-After), and once WorkOS recovers the SAME session
-//    id keeps serving requests.
 //
-// 2. A DEFINITIVE WorkOS denial (401 — the revoked/invalid API key answer) must
+// 1. A WorkOS OUTAGE is INVISIBLE to a live session. Before the mirror, a
-//    fail CLOSED: Forbidden, session condemned. Retrying cannot help; treating
+//    5xx from the membership lookup had to be classified as transient (a
-//    it as transient would preserve sessions indefinitely for a revoked
+//    retryable 503 that left the session alive) so a blip could not
-//    customer (the fail-open inversion the adversarial review caught).
+//    mass-condemn every session of a shared-API-key org. Now the request never
+//    asks WorkOS at all: a request issued during the outage is a plain 200,
+//    and the SAME session id keeps serving afterwards. The fault is armed on
+//    the exact endpoint the old check hit, so an unnoticed regression back to
+//    a per-request WorkOS read would fail this as a 503 (or worse, a 403).
 //
-// Red/green for (1): pre-fix, the outage request returns a session-destroying
+// 2. A REVOKED membership still fails CLOSED. The mirror is not a cache with a
-// Forbidden and the post-outage request gets 404 "reconnect". With the fix the
+//    TTL: a removal made through the product writes the mirror in the same
-// outage request is a 503 and the post-outage request is a clean 200.
+//    request, so the removed member's next /mcp request is a Forbidden, the
+//    session is condemned, and the id is dead. Retrying cannot help.
 import { expect } from "@effect/vitest";
 import { Effect } from "effect";
 import { Mcp, Target } from "../src/services";
 import type { Identity } from "../src/target";
 import { WORKOS_EMULATOR_PORT } from "../targets/cloud";
+import { cookieOf, joinOrg, orgSelectorOf } from "./support/session";
 const JSON_AND_SSE = "application/json, text/event-stream";
 const PROTOCOL_VERSION = "2025-03-26";
   return sessionId;
 };
-// The live membership check is `GET /user_management/organization_memberships`
+// The endpoint the pre-mirror per-request check hit
-// (WorkOS `listOrganizationMemberships`). A bounded count covers the outage
+// (`GET /user_management/organization_memberships`). Armed to prove it is no
-// request without leaking into later (post-clear) requests; we also clear
+// longer on the request path: a request that reached it would fail. `times`
-// explicitly. `times` is generous so any internal retry inside the one faulted
+// is generous so any retry inside a faulted request still sees the outage; the
-// request still sees the outage, but the finalizer removes whatever remains.
+// finalizer removes whatever remains.
 const MEMBERSHIP_FAULT = {
   match: {
     method: "GET",
   times: 8,
 } as const;
-// The definitive-denial counterpart: WorkOS ANSWERS the membership lookup with
-// 401 — the shape of a revoked/invalid API key. Not a blip; must fail closed.
-const MEMBERSHIP_DENIAL_FAULT = {
-  match: {
-    method: "GET",
-    pathPattern: "/user_management/organization_memberships*",
-  },
-  response: {
-    status: 401,
-    body: { message: "Could not authorize the request. Maybe your API key is invalid?" },
-  },
-  times: 8,
-} as const;
 scenario(
-  "MCP sessions · a transient WorkOS outage 503s retryably and leaves the session alive",
+  "MCP sessions · a WorkOS outage is invisible to a live session, which is authorized from the mirror",
   {},
   Effect.gen(function* () {
     const target = yield* Target;
     const healthy = yield* Effect.promise(() =>
       mcpPost(target.mcpUrl, { bearer, sessionId, body: toolsList(2) }),
     );
-    expect(healthy.status, "the session serves requests before the blip").toBe(200);
+    expect(healthy.status, "the session serves requests before the outage").toBe(200);
     yield* Effect.promise(() => healthy.text());
     yield* Effect.gen(function* () {
-      // The blip: WorkOS membership lookups start failing with 503.
+      // The outage: WorkOS membership lookups would fail with 503 — if
+      // anything asked.
       yield* Effect.promise(() => workos.faults.arm(MEMBERSHIP_FAULT));
-      // A request issued DURING the outage. The membership lookup fails
+      // A request issued DURING the outage. Membership is read from the
-      // transiently — this must be a retryable 503, NOT a Forbidden (which
+      // mirror, so WorkOS is never consulted and the request is a plain
-      // would condemn the session).
+      // success — not a retryable 503 (the pre-mirror contract) and never a
+      // Forbidden (which would condemn the session).
       const duringOutage = yield* Effect.promise(() =>
         mcpPost(target.mcpUrl, { bearer, sessionId, body: toolsList(3) }),
       );
-      const outageBody = (yield* Effect.promise(() => duringOutage.json())) as JsonRpcError;
       expect(
         duringOutage.status,
-        "a WorkOS blip is a retryable 503, not a session-destroying error",
+        "a WorkOS outage does not touch a request: membership comes from the mirror",
-      ).toBe(503);
+      ).toBe(200);
-      expect(
+      yield* Effect.promise(() => duringOutage.text());
-        duringOutage.status,
-        "the blip is NOT surfaced as a 404 reconnect (which would mean the session was destroyed)",
-      ).not.toBe(404);
-      expect(
-        outageBody.error.code,
-        "the 503 is a JSON-RPC error envelope the transport retries",
-      ).toBe(-32001);
-      expect(
-        duringOutage.headers.get("retry-after"),
-        "the 503 advertises a Retry-After so clients back off",
-      ).toEqual(expect.any(String));
     }).pipe(
-      // Always lift the outage, even if an assertion above fails, so the
+      // Always lift the outage, even if an assertion above fails.
-      // recovery request runs against a healthy WorkOS.
       Effect.ensuring(Effect.promise(() => workos.faults.clear())),
     );
-    // WorkOS has recovered. The SAME session id must still serve requests: the
+    // The SAME session id keeps serving after the outage: nothing condemned it.
-    // blip left it untouched. On the pre-fix code this is a 404 (the outage
-    // request destroyed the DO); with the fix it is a clean 200.
     const afterOutage = yield* Effect.promise(() =>
       mcpPost(target.mcpUrl, { bearer, sessionId, body: toolsList(4) }),
     );
-    expect(
+    expect(afterOutage.status, "the session is untouched by the outage").toBe(200);
-      afterOutage.status,
-      "the session survived the blip and resumes work once WorkOS recovers",
-    ).toBe(200);
     yield* Effect.promise(() => afterOutage.text());
   }),
 );
 scenario(
-  "MCP sessions · a definitive WorkOS denial fails closed and condemns the session",
+  "MCP sessions · a revoked membership fails closed on the next request and condemns the session",
   {},
   Effect.gen(function* () {
     const target = yield* Target;
     const mcp = yield* Mcp;
-    const identity = yield* target.newIdentity();
-    const bearer = yield* mcp.mintBearer(emailOf(identity));
-    const workos = yield* Effect.promise(() =>
+    // An admin's org with one plain member, joined through the real invite →
-      connectEmulator({ baseUrl: `http://127.0.0.1:${WORKOS_EMULATOR_PORT}` }),
+    // accept flow. The member is the one whose access is revoked.
-    );
+    const admin = yield* target.newIdentity();
+    const invitee = yield* target.newIdentity({ org: false });
+    const member = yield* joinOrg(target, admin, invitee);
+    const bearer = yield* mcp.mintBearer(emailOf(member));
+    const orgSelector = orgSelectorOf(member);
-    // A healthy session doing real work before the denial.
+    // The member's healthy session doing real work before the revocation.
-    const sessionId = yield* Effect.promise(() => openSession(target.mcpUrl, bearer));
+    const mcpUrl = `${target.mcpUrl}`;
-    const healthy = yield* Effect.promise(() =>
+    const withOrg = (body: unknown, sessionId?: string) =>
-      mcpPost(target.mcpUrl, { bearer, sessionId, body: toolsList(2) }),
+      fetch(mcpUrl, {
-    );
+        method: "POST",
-    expect(healthy.status, "the session serves requests before the denial").toBe(200);
+        headers: {
+          accept: JSON_AND_SSE,
+          "content-type": "application/json",
+          authorization: `Bearer ${bearer}`,
+          "x-executor-mcp-organization": orgSelector,
+          ...(sessionId ? { "mcp-session-id": sessionId } : {}),
+        },
+        body: JSON.stringify(body),
+      });
+    const initialize = yield* Effect.promise(() => withOrg(INITIALIZE_REQUEST));
+    const sessionId = initialize.headers.get("mcp-session-id");
+    yield* Effect.promise(() => initialize.text());
+    expect(initialize.status, "the member opens a session in the org").toBe(200);
+    if (!sessionId) throw new Error("initialize returned no session id");
+    const initialized = yield* Effect.promise(() => withOrg(INITIALIZED_NOTIFICATION, sessionId));
+    yield* Effect.promise(() => initialized.text());
+    const healthy = yield* Effect.promise(() => withOrg(toolsList(2), sessionId));
+    expect(healthy.status, "the session serves requests before the revocation").toBe(200);
     yield* Effect.promise(() => healthy.text());
-    yield* Effect.gen(function* () {
+    // The admin removes the member through the product. The removal writes
-      // WorkOS starts ANSWERING the membership lookup with 401 — the
+    // the mirror in the same request (a deletion tombstone keyed to the
-      // revoked/invalid API key shape. Deterministic denial, not a blip.
+    // WorkOS membership id), so no reconciler tick is needed for it to land.
-      yield* Effect.promise(() => workos.faults.arm(MEMBERSHIP_DENIAL_FAULT));
+    const members = yield* Effect.promise(async () => {
+      const response = await fetch(new URL("/api/account/members", target.baseUrl), {
+        headers: { ...(admin.headers ?? {}) },
+      });
+      if (!response.ok) throw new Error(`/api/account/members failed (${response.status})`);
+      return (await response.json()) as {
+        readonly members: ReadonlyArray<{ readonly id: string; readonly isCurrentUser: boolean }>;
+      };
+    });
+    const removed = members.members.find((row) => !row.isCurrentUser);
+    if (!removed) throw new Error("the joined member is not listed in the org");
+    const removal = yield* Effect.promise(() =>
+      fetch(new URL(`/api/account/members/${removed.id}`, target.baseUrl), {
+        method: "DELETE",
+        headers: { ...(admin.headers ?? {}), origin: new URL(target.baseUrl).origin },
+      }),
+    );
+    expect(removal.status, "the admin removes the member").toBe(200);
+    yield* Effect.promise(() => removal.text());
-      const denied = yield* Effect.promise(() =>
+    // The removed member's NEXT request on the live session: a positive
-        mcpPost(target.mcpUrl, { bearer, sessionId, body: toolsList(3) }),
+    // determination from the mirror that they hold no active membership — a
-      );
+    // real Forbidden, which condemns the session.
-      const deniedBody = (yield* Effect.promise(() => denied.json())) as JsonRpcError;
+    const denied = yield* Effect.promise(() => withOrg(toolsList(3), sessionId));
-      expect(
+    const deniedBody = (yield* Effect.promise(() => denied.json())) as JsonRpcError;
-        denied.status,
+    expect(denied.status, "a revoked member fails closed as Forbidden on the next request").toBe(
-        "a definitive WorkOS denial fails closed as Forbidden, never a retryable 503",
+      403,
-      ).toBe(403);
+    );
-      expect(deniedBody.error.code, "the denial is a JSON-RPC error envelope").toBe(-32001);
+    expect(deniedBody.error.code, "the denial is a JSON-RPC error envelope").toBe(-32001);
-    }).pipe(Effect.ensuring(Effect.promise(() => workos.faults.clear())));
-    // The Forbidden carried the session id, so the session was condemned: the
+    // While revoked, every further request is refused at the gate — still a
-    // id must NOT serve requests once WorkOS recovers. If this returned 200 the
+    // Forbidden, never a 200 (a removed member kept a live session) and never
-    // fail-closed contract is broken (a revoked customer kept a live session).
+    // a retryable 503 (nothing about this is transient).
-    const afterDenial = yield* Effect.promise(() =>
+    const stillDenied = yield* Effect.promise(() => withOrg(toolsList(4), sessionId));
-      mcpPost(target.mcpUrl, { bearer, sessionId, body: toolsList(4) }),
+    expect(stillDenied.status, "a revoked member stays refused, deterministically").toBe(403);
+    yield* Effect.promise(() => stillDenied.text());
+    // The Forbidden carried the session id, so the session was condemned. A
+    // caller the gate admits proves it: the admin, still a member, presents
+    // the condemned id with their own bearer. Had the id survived, the answer
+    // would be the ownership Forbidden (-32003: the session belongs to someone
+    // else); condemned, it is dead and the client is told to reconnect.
+    const adminBearer = yield* mcp.mintBearer(emailOf(admin));
+    const condemned = yield* Effect.promise(() =>
+      fetch(mcpUrl, {
+        method: "POST",
+        headers: {
+          accept: JSON_AND_SSE,
+          "content-type": "application/json",
+          authorization: `Bearer ${adminBearer}`,
+          "x-executor-mcp-organization": orgSelectorOf(admin),
+          "mcp-session-id": sessionId,
+        },
+        body: JSON.stringify(toolsList(5)),
+      }),
     );
-    expect(
+    expect(condemned.status, "the condemned session id is dead (reconnect required)").toBe(404);
-      afterDenial.status,
+    const condemnedBody = (yield* Effect.promise(() => condemned.json())) as JsonRpcError;
-      "the condemned session id is dead after a definitive denial (reconnect required)",
+    expect(condemnedBody.error.message, "the client is told to reconnect").toMatch(
-    ).toBe(404);
-    const afterBody = (yield* Effect.promise(() => afterDenial.json())) as JsonRpcError;
-    expect(afterBody.error.message, "the client is told to reconnect").toMatch(
       /timed out|reconnect|not found/i,
     );
+    // The admin's own access is unaffected by removing someone else.
+    const adminStillIn = yield* Effect.promise(() =>
+      fetch(new URL("/api/account/me", target.baseUrl), { headers: { cookie: cookieOf(admin) } }),
+    );
+    expect(adminStillIn.status, "the admin keeps their access").toBe(200);
+    yield* Effect.promise(() => adminStillIn.text());
   }),
 );