[RhysSullivan]

Summary

v1 now acts on the org_moved_to_v2 flag that v2 writes (from #2287) for every move state:

• moving freezes the organization. Dashboard, API and CLI writes, connection writes, OAuth completion and OAuth token refresh fail with "This workspace is moving to Executor v2. Changes are paused until the move finishes." (423, Retry-After: 60). MCP calls keep working on the frozen state.
• moved refuses writes for good, keeps the MCP forwarding from Forward MCP requests of organizations moved to v2 #2287, and redirects the organization's dashboard (for its members) to /org/<v2_org_slug> on v2.
• rolled_back, or no row, behaves as before.

The flag is read on every guarded request and never cached. If the read fails, the write is refused with a retryable 503. Nothing falls back to "not moving".

• Guards: the cloud identity layer covers org-scoped non-GET routes. A new optional workspaceWriteGate in the SDK executor covers every caller, including MCP sessions: connection, policy, integration and OAuth client writes, oauth.complete before the code exchange, and token refresh before the token endpoint is called. Further guards cover account routes, domains, billing (except Autumn's read routes) and organization deletion.
• Migration 0022 adds v2_org_slug and the rolled_back state. It grants v1_import_writer INSERT and UPDATE on the table, plus SELECT on (org_id, state, v2_org_id, v2_org_slug), only if the role exists. If the role is created later, run:

  GRANT INSERT, UPDATE ON org_moved_to_v2 TO v1_import_writer;
  GRANT SELECT (org_id, state, v2_org_id, v2_org_slug) ON org_moved_to_v2 TO v1_import_writer;

• A forwarded toolkit's v2 connection is now the caller's own copy: v1- + SHA-256 of [v2OrgId, toolkitRowId, accountId], first 40 hex characters.

Known gaps:

• The dashboard still shows its generic error toast for a refused write; the message reaches only API, CLI, MCP and the OAuth popup.
• Artifact saves from MCP and POST /executions are not frozen.
• Background tool-catalog sync and health checks keep writing.

Verification

• bun run format:check
• bun run lint
• bun run typecheck
• vitest run for cloud, sdk, api, execution and the MCP host. The new tests are in the PR above this one.

Checklist

• Added a changeset.
• Added or updated tests for the new behaviour (the PR above this one).
• No secrets, credentials, or private data in the diff.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	8156ec9	Commit Preview URL Branch Preview URL	Oct 23 2026, 02:09 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	8156ec9	Oct 23 2026, 02:09 AM

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@2337

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@2337

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@2337

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@2337

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@2337

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@2337

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@2337

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@2337

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@2337

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@2337

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@2337

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@2337

executor

npm i https://pkg.pr.new/executor@2337

commit: 8156ec9