Add tenant-reach platform view with internal admin reads

[RhysSullivan]

Third step, stacked on #1464. Adds the platform view: a read-only reach: "tenant" mode on the owner policy (writes reject under tenant reach — including tenant-wide update/delete row filters, which would otherwise widen), an opt-in executor.admin surface (listSubjects / listSubjectConnections / listSubjectsWithConnections, credential-bearing fields excluded), and cloud groundwork for org-scoped API keys resolving to a PlatformAuth distinct from Principal. Org keys are rejected on product and MCP surfaces. Public /admin/users endpoints land next.

Stack

1. Add tenant-scoped subject table to core schema #1463
2. Populate subject table at request seam and connection create #1464
3. Add tenant-reach platform view with internal admin reads #1465 👈 current
4. Add /connect/:integrationSlug deep links #1466
5. Add public admin users API and org API keys #1467
6. Add admin Users console page #1469

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	33f410b	Jul 29 2026, 03:01 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	33f410b	Commit Preview URL Branch Preview URL	Jul 29 2026, 03:02 AM

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1465

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1465

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1465

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1465

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1465

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1465

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1465

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1465

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1465

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1465

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1465

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1465

executor

npm i https://pkg.pr.new/executor@1465

commit: 33f410b

[RhysSullivan]

Consolidated into #1469.