@bevel-software/platform-core-backend 0.27.0 → 0.28.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bevel-software/platform-core-backend",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "Open-source core backend of the Bevel platform: git-backed knowledge workspace, workflow (branches/change requests/locks/SSE), skills, tools, secrets vault, access control and the remote MCP surface.",
   "type": "module",
   "main": "./dist/index.js",
@@ -55,8 +55,8 @@
     "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
     "yaml": "^2.9.0",
     "zod": "^3.24.0",
-    "@bevel-software/platform-shared": "0.27.0",
-    "@bevel-software/platform-mcp-core": "0.27.0"
+    "@bevel-software/platform-mcp-core": "0.28.0",
+    "@bevel-software/platform-shared": "0.28.0"
   },
   "devDependencies": {
     "@types/adm-zip": "^0.5.8",

package/src/__tests__/pg-scratch.ts

@@ -0,0 +1,48 @@
+import { randomBytes } from 'node:crypto';
+import pg from 'pg';
+
+/**
+ * The one fixture for tests that cross a real Postgres. They run where
+ * `TEST_DATABASE_URL` names a server this role may create databases on (CI
+ * carries one as a service container) and are skipped elsewhere
+ * (`describe.skipIf(!PG_ADMIN_URL)`). Each test works in a scratch database
+ * of its own, made by {@link scratchDatabaseUrl} and dropped by
+ * {@link dropScratchDatabases}; the database the URL names is only connected
+ * to, never written.
+ */
+export const PG_ADMIN_URL = process.env.TEST_DATABASE_URL;
+
+/** Long enough for migrations, and for dropping every scratch database one after another. */
+export const PG_TEST_TIMEOUT = 120_000;
+
+const created: string[] = [];
+
+/** Run `fn` on a connection to the admin URL, closed afterwards. */
+export async function withPgAdmin<T>(fn: (admin: pg.Client) => Promise<T>): Promise<T> {
+  const admin = new pg.Client({ connectionString: PG_ADMIN_URL });
+  await admin.connect();
+  try {
+    return await fn(admin);
+  } finally {
+    await admin.end();
+  }
+}
+
+/** A fresh database for this test, named with `prefix`; its URL. */
+export async function scratchDatabaseUrl(prefix: string): Promise<string> {
+  const name = `${prefix}_${randomBytes(6).toString('hex')}`;
+  await withPgAdmin((admin) => admin.query(`create database ${name}`));
+  created.push(name);
+  const url = new URL(PG_ADMIN_URL!);
+  url.pathname = `/${name}`;
+  return url.toString();
+}
+
+/** Drop every scratch database this file made; for `afterAll`, with {@link PG_TEST_TIMEOUT}. */
+export async function dropScratchDatabases(): Promise<void> {
+  const names = created.splice(0);
+  if (names.length === 0) return;
+  await withPgAdmin(async (admin) => {
+    for (const name of names) await admin.query(`drop database if exists ${name} with (force)`);
+  });
+}

package/src/core/create-core-server.ts

@@ -671,6 +671,7 @@ export async function createCoreServer(
     core.accessControl,
     core.workspaceService,
     core.authService,
+    core.authService,
     core.workflowService,
     core.eventBus,
     core.db,
@@ -759,6 +760,7 @@ export async function createCoreServer(
     core.authService,
     core.adminAccess,
     core.accountErasureService,
+    core.accountHooks,
     core.userAccessRemovalService,
   ));
   // Connection keys across the deployment (list per account, revoke any) —

package/src/core/create-core-services.ts

@@ -65,6 +65,7 @@ import type { Request } from 'express';
 import { DocExtractService } from '../modules/workspace/file-readers/doc-extract.service.js';
 import { UuidSessionSink, type ISessionSink } from '../modules/workspace/session-sink.js';
 import { AuthService } from '../modules/auth/auth.service.js';
+import { AccountHooks, type IAccountHooks } from '../modules/auth/account-hooks.js';
 import { AccountErasureService } from '../modules/auth/account-erasure.service.js';
 import { OidcAuthProvider, oidcSettingsFrom } from '../modules/auth/oidc-auth-provider.js';
 import { createAuthMiddleware, readAuthCookie } from '../modules/auth/auth.middleware.js';
@@ -302,6 +303,12 @@ export interface CoreServices {
   githubFacade: GitHubFacade;
   githubFacadeCredentials: GitHubFacadeCredentialsService;
   authService: AuthService;
+  /**
+   * The seam for "an account was invited": a deployment registers here how
+   * the person is told (the cloud's mail, say), and the invite's answer says
+   * whether somebody did. Core registers nothing.
+   */
+  accountHooks: IAccountHooks;
   authMiddleware: ReturnType<typeof createAuthMiddleware>;
   accountErasureService: AccountErasureService;
   gitService: GitService;
@@ -815,6 +822,9 @@ export async function createCoreServices(
     ports.accountAdmission,
   );
   const authMiddleware = createAuthMiddleware(authService);
+  // Who tells an invited person: the composition root of a distribution
+  // registers its listener here, after this returns (see `AccountHooks`).
+  const accountHooks = new AccountHooks();
 
   // Shared mutex so git and diff operations on the same workspace serialize
   // against each other — a backup-reseed races a concurrent commit otherwise.
@@ -1608,6 +1618,7 @@ export async function createCoreServices(
     githubFacade,
     githubFacadeCredentials,
     authService,
+    accountHooks,
     authMiddleware,
     accountErasureService,
     gitService,

package/src/modules/access/__tests__/access-control.admin-root-floor.test.ts

@@ -280,6 +280,7 @@ describe('Admin write floor at the repository root', () => {
           service(),
           { ...ws, getOrCreateForBranch: async () => ({ id: WS, kbDirName: KB }) } as unknown as WorkspaceService,
           { getUserById: async (id: string) => users[id as 'u-admin'] ?? null } as unknown as AuthService,
+          { whileSwitchedOn: async (_email: string, write: () => Promise<void>) => write() },
           {
             getLock: async () => null,
             acquireLock: async () => ({ acquired: true, lock: {} }),

package/src/modules/access/__tests__/access.routes.admins.test.ts

@@ -0,0 +1,203 @@
+import type { Server } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import express from 'express';
+import { describe, it, expect, afterEach, vi } from 'vitest';
+
+import { AccessControlService } from '../access-control.service.js';
+import { NodeFs } from '../../kb-fs/node-fs.js';
+import type { WorkspaceService } from '../../workspace/workspace.service.js';
+import type { AuthService } from '../../auth/auth.service.js';
+import type { WorkflowService } from '../../workflow/workflow.service.js';
+import type { WorkflowEventBus } from '../../workflow/event-bus.js';
+import { createAccessRoutes } from '../access.routes.js';
+import { usersDbDouble } from './users-db-double.js';
+import { testKbContext } from '../../../__tests__/kb-context.js';
+
+/**
+ * `GET /api/access/admins`: who the admins are, for anyone signed in. It
+ * answers the Admin role's members — through a group too — and the deployment
+ * admins, each once, sorted by name, with names from the accounts table; and
+ * nothing else about roles. The roster stays admin-only.
+ */
+
+const KB = 'knowledge-base';
+const MEMBER = { id: 'u-lena', email: 'lena@acme.com', name: 'Lena Park' };
+
+const ROLES = `roles:
+  Admin:
+    - sam.ortiz@acme.com
+    - group:Ops
+  Sales:
+    - felix@acme.com
+`;
+
+const GROUPS = `groups:
+  Ops:
+    - dana@acme.com
+    - sam.ortiz@acme.com
+  Product:
+    - priya@acme.com
+`;
+
+const tmpDirs: string[] = [];
+
+async function makeHarness(
+  opts: {
+    roles?: string;
+    groups?: string;
+    signedIn?: boolean;
+    deploymentAdmins?: string[];
+    accounts?: { email: string; name?: string; deactivatedAt?: Date | null }[];
+  } = {},
+): Promise<{ server: Server; baseUrl: string }> {
+  const workspaceDir = await fs.mkdtemp(path.join(os.tmpdir(), 'bevel-admins-route-'));
+  tmpDirs.push(workspaceDir);
+  const repoDir = path.join(workspaceDir, KB);
+  await fs.mkdir(repoDir, { recursive: true });
+  await fs.writeFile(path.join(repoDir, 'roles.yaml'), opts.roles ?? ROLES, 'utf-8');
+  await fs.writeFile(path.join(repoDir, 'groups.yaml'), opts.groups ?? GROUPS, 'utf-8');
+
+  const workspaceService = {
+    getOrCreateForBranch: vi.fn(async () => ({})),
+    getWorkspacePath: vi.fn(async () => workspaceDir),
+    readFile: vi.fn(async (_id: string, wsRel: string) => fs.readFile(path.join(workspaceDir, wsRel), 'utf-8')),
+  } as unknown as WorkspaceService;
+  // The real resolver: the admins read is its own membership answer. Nobody
+  // signed in here is an Admin, so nobody may read the roster either.
+  const deploymentAdmins = opts.deploymentAdmins ?? ['Owner@Acme.com'];
+  const accessControl = new AccessControlService(workspaceService, KB, new NodeFs(), deploymentAdmins);
+  const authService = { getUserById: vi.fn(async () => MEMBER) } as unknown as AuthService;
+  const db = usersDbDouble(
+    opts.accounts ?? [
+      { email: 'dana@acme.com', name: 'Dana Admin' },
+      { email: 'sam.ortiz@acme.com', name: 'Sam Ortiz' },
+      { email: 'felix@acme.com', name: 'Felix Sales' },
+      { email: 'priya@acme.com', name: 'Priya Product' },
+      MEMBER,
+    ],
+  );
+
+  const app = express();
+  app.use(express.json());
+  app.use('/api', (req, _res, next) => {
+    if (opts.signedIn !== false) (req as unknown as { userId: string }).userId = MEMBER.id;
+    next();
+  });
+  app.use(
+    '/api',
+    createAccessRoutes(
+      accessControl,
+      workspaceService,
+      authService,
+      authService,
+      {} as unknown as WorkflowService,
+      { emit: vi.fn() } as unknown as WorkflowEventBus,
+      db,
+      testKbContext({ kbDirName: KB }),
+      deploymentAdmins,
+    ),
+  );
+  const server = await new Promise<Server>((resolve) => {
+    const s = app.listen(0, () => resolve(s));
+  });
+  return { server, baseUrl: `http://127.0.0.1:${(server.address() as AddressInfo).port}` };
+}
+
+function close(s: Server): Promise<void> {
+  return new Promise((resolve, reject) => s.close((e) => (e ? reject(e) : resolve())));
+}
+
+describe('GET /api/access/admins', () => {
+  let server: Server | null = null;
+  afterEach(async () => {
+    if (server) await close(server);
+    server = null;
+    await Promise.all(tmpDirs.splice(0).map((d) => fs.rm(d, { recursive: true, force: true })));
+  });
+
+  it('tells a Member every admin — direct, through a group, and the deployment admin — once each, sorted by name', async () => {
+    const h = await makeHarness();
+    server = h.server;
+    const res = await fetch(`${h.baseUrl}/api/access/admins`);
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({
+      admins: [
+        { name: 'Dana Admin', email: 'dana@acme.com' },
+        // No account yet: named by address.
+        { name: 'owner@acme.com', email: 'owner@acme.com' },
+        { name: 'Sam Ortiz', email: 'sam.ortiz@acme.com' },
+      ],
+    });
+  });
+
+  it('reveals nothing else: no other role, group or member, and no other field', async () => {
+    const h = await makeHarness();
+    server = h.server;
+    const text = await (await fetch(`${h.baseUrl}/api/access/admins`)).text();
+    for (const leak of ['felix', 'priya', 'Sales', 'Product', 'Ops', 'group:', 'lena']) {
+      expect(text).not.toContain(leak);
+    }
+    const body = JSON.parse(text) as { admins: Record<string, unknown>[] };
+    expect(Object.keys(body)).toEqual(['admins']);
+    for (const admin of body.admins) expect(Object.keys(admin).sort()).toEqual(['email', 'name']);
+  });
+
+  it('answers only the deployment admins when roles.yaml does not parse, as the resolver does', async () => {
+    const h = await makeHarness({ roles: 'roles:\n  Admin: not-a-list\n' });
+    server = h.server;
+    const body = (await (await fetch(`${h.baseUrl}/api/access/admins`)).json()) as { admins: unknown[] };
+    expect(body.admins).toEqual([{ name: 'owner@acme.com', email: 'owner@acme.com' }]);
+  });
+
+  it('answers only the deployment admins when the resolver rejects roles.yaml the editing model would read', async () => {
+    // A role named with the reserved plugin prefix: the resolver refuses the
+    // whole file, so nobody in it is an Admin — and nobody is listed as one.
+    const h = await makeHarness({
+      roles: 'roles:\n  Admin:\n    - sam.ortiz@acme.com\n    - group:Ops\n  plugin/x:\n    - felix@acme.com\n',
+    });
+    server = h.server;
+    const body = (await (await fetch(`${h.baseUrl}/api/access/admins`)).json()) as { admins: unknown[] };
+    expect(body.admins).toEqual([{ name: 'owner@acme.com', email: 'owner@acme.com' }]);
+  });
+
+  it('does not count the members of a GROUP named Admin, as the resolver does not', async () => {
+    const h = await makeHarness({ groups: 'groups:\n  Admin:\n    - priya@acme.com\n' });
+    server = h.server;
+    const text = await (await fetch(`${h.baseUrl}/api/access/admins`)).text();
+    expect(text).not.toContain('priya');
+    expect(text).toContain('sam.ortiz@acme.com');
+  });
+
+  it('leaves out a role member whose account is switched off, but not a switched-off deployment admin', async () => {
+    const off = new Date('2026-01-01T00:00:00Z');
+    const h = await makeHarness({
+      accounts: [
+        { email: 'dana@acme.com', name: 'Dana Admin', deactivatedAt: off },
+        { email: 'sam.ortiz@acme.com', name: 'Sam Ortiz' },
+        { email: 'owner@acme.com', name: 'Olive Owner', deactivatedAt: off },
+        MEMBER,
+      ],
+    });
+    server = h.server;
+    const body = (await (await fetch(`${h.baseUrl}/api/access/admins`)).json()) as { admins: unknown[] };
+    expect(body.admins).toEqual([
+      { name: 'Olive Owner', email: 'owner@acme.com' },
+      { name: 'Sam Ortiz', email: 'sam.ortiz@acme.com' },
+    ]);
+  });
+
+  it('refuses a caller who is not signed in', async () => {
+    const h = await makeHarness({ signedIn: false });
+    server = h.server;
+    expect((await fetch(`${h.baseUrl}/api/access/admins`)).status).toBe(401);
+  });
+
+  it('leaves the roles roster admin-only', async () => {
+    const h = await makeHarness();
+    server = h.server;
+    expect((await fetch(`${h.baseUrl}/api/access/roles`)).status).toBe(403);
+  });
+});

package/src/modules/access/__tests__/access.routes.batch.test.ts

@@ -28,11 +28,14 @@ interface Harness {
   baseUrl: string;
   canWriteBatch: ReturnType<typeof vi.fn>;
   canOwnerBatch: ReturnType<typeof vi.fn>;
+  canReadBatch: ReturnType<typeof vi.fn>;
 }
 
-// Alice WRITES both skills but is named in the `owner:` grant of one.
+// Alice WRITES both skills but is named in the `owner:` grant of one, and
+// READS a folder she may not write.
 const WRITABLE = new Set(['Skills/a/SKILL.md', 'Skills/b/SKILL.md']);
 const OWNED = new Set(['Skills/a/SKILL.md']);
+const READABLE = new Set(['Skills/a/SKILL.md', 'Skills/b/SKILL.md', 'KnowledgeBase/Sales']);
 
 const verdicts = (set: Set<string>) =>
   vi.fn(async (_w: string, _e: string, paths: string[]) => new Map(paths.map((p) => [p, set.has(p)])));
@@ -40,7 +43,8 @@ const verdicts = (set: Set<string>) =>
 async function makeHarness(): Promise<Harness> {
   const canWriteBatch = verdicts(WRITABLE);
   const canOwnerBatch = verdicts(OWNED);
-  const accessControl = { canWriteBatch, canOwnerBatch } as unknown as IAccessControl;
+  const canReadBatch = verdicts(READABLE);
+  const accessControl = { canWriteBatch, canOwnerBatch, canReadBatch } as unknown as IAccessControl;
 
   const workspaceService = {} as unknown as WorkspaceService;
   const authService = { getUserById: vi.fn(async () => USER) } as unknown as AuthService;
@@ -57,6 +61,7 @@ async function makeHarness(): Promise<Harness> {
       accessControl,
       workspaceService,
       authService,
+      authService,
       {} as unknown as WorkflowService,
       { emit: vi.fn() } as unknown as WorkflowEventBus,
       usersDbDouble(),
@@ -68,7 +73,7 @@ async function makeHarness(): Promise<Harness> {
     const s = app.listen(0, () => resolve(s));
   });
   const addr = server.address() as AddressInfo;
-  return { server, baseUrl: `http://127.0.0.1:${addr.port}`, canWriteBatch, canOwnerBatch };
+  return { server, baseUrl: `http://127.0.0.1:${addr.port}`, canWriteBatch, canOwnerBatch, canReadBatch };
 }
 
 function close(s: Server): Promise<void> {
@@ -119,16 +124,31 @@ describe('POST /access/batch', () => {
     expect(h.canWriteBatch).not.toHaveBeenCalled();
   });
 
+  it('answers READ for `verb: read` — a folder the caller may read but not write gets true', async () => {
+    h = await makeHarness();
+
+    const paths = [...PATHS, 'KnowledgeBase/Sales'];
+    const res = await post({ paths, verb: 'read' });
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({
+      results: { 'Skills/a/SKILL.md': true, 'Skills/b/SKILL.md': true, 'KnowledgeBase/Sales': true },
+    });
+    expect(h.canReadBatch).toHaveBeenCalledWith(WS, USER.email, paths);
+    expect(h.canWriteBatch).not.toHaveBeenCalled();
+    expect(h.canOwnerBatch).not.toHaveBeenCalled();
+  });
+
   it('400s a verb it does not dispatch, resolving nothing', async () => {
     h = await makeHarness();
 
-    for (const verb of ['read', 'admin', 42, null]) {
+    for (const verb of ['download', 'admin', 42, null]) {
       const res = await post({ paths: PATHS, verb });
       expect(res.status).toBe(400);
-      expect(await res.json()).toEqual({ error: 'verb must be "write" or "owner"' });
+      expect(await res.json()).toEqual({ error: 'verb must be "write", "owner" or "read"' });
     }
     expect(h.canWriteBatch).not.toHaveBeenCalled();
     expect(h.canOwnerBatch).not.toHaveBeenCalled();
+    expect(h.canReadBatch).not.toHaveBeenCalled();
   });
 
   it('keeps the paths validation ahead of the verb', async () => {

package/src/modules/access/__tests__/access.routes.folder-governs.test.ts

@@ -156,6 +156,7 @@ describe('access mutations on a file that cannot carry frontmatter', () => {
         accessControl,
         workspaceService,
         { getUserById: vi.fn(async () => USER) } as unknown as AuthService,
+        { whileSwitchedOn: async (_email: string, write: () => Promise<void>) => write() },
         workflowService,
         { emit: vi.fn() } as unknown as WorkflowEventBus,
         usersDbDouble(),

package/src/modules/access/__tests__/access.routes.group-grant.test.ts

@@ -88,7 +88,7 @@ async function makeHarness(opts: {
     (req as unknown as { userId: string }).userId = USER.id;
     next();
   });
-  app.use('/api', createAccessRoutes(accessControl, workspaceService, authService, workflowService, eventBus, db, testKbContext({ kbDirName: KB })));
+  app.use('/api', createAccessRoutes(accessControl, workspaceService, authService, authService, workflowService, eventBus, db, testKbContext({ kbDirName: KB })));
 
   const server = await new Promise<Server>((resolve) => {
     const s = app.listen(0, () => resolve(s));

package/src/modules/access/__tests__/access.routes.overrides.test.ts

@@ -98,7 +98,7 @@ async function makeHarness(opts: {
   });
   app.use(
     '/api',
-    createAccessRoutes(accessControl, workspaceService, authService, workflowService, eventBus, db, testKbContext({ kbDirName: KB })),
+    createAccessRoutes(accessControl, workspaceService, authService, authService, workflowService, eventBus, db, testKbContext({ kbDirName: KB })),
   );
 
   const server = await new Promise<Server>((resolve) => {

package/src/modules/access/__tests__/access.routes.proposal-branch.test.ts

@@ -134,6 +134,7 @@ describe('access routes on a proposal branch (real git)', () => {
         access,
         workspaceService,
         authService,
+        authService,
         workflowService,
         { emit: () => {} } as unknown as WorkflowEventBus,
         usersDbDouble(),

package/src/modules/access/__tests__/access.routes.prospective.test.ts

@@ -64,6 +64,7 @@ async function makeHarness(opts: { canRead?: boolean } = {}): Promise<Harness> {
       accessControl,
       {} as unknown as WorkspaceService,
       { getUserById: vi.fn(async () => USER) } as unknown as AuthService,
+      { whileSwitchedOn: async (_email: string, write: () => Promise<void>) => write() },
       {} as unknown as WorkflowService,
       { emit: vi.fn() } as unknown as WorkflowEventBus,
       {} as unknown as Database,

package/src/modules/access/__tests__/access.routes.revoke.test.ts

@@ -134,7 +134,7 @@ async function makeHarness(opts: {
     (req as unknown as { userId: string }).userId = USER.id;
     next();
   });
-  app.use('/api', createAccessRoutes(accessControl, workspaceService, authService, workflowService, eventBus, db, testKbContext({ kbDirName: KB })));
+  app.use('/api', createAccessRoutes(accessControl, workspaceService, authService, authService, workflowService, eventBus, db, testKbContext({ kbDirName: KB })));
 
   const server = await new Promise<Server>((resolve) => {
     const s = app.listen(0, () => resolve(s));

package/src/modules/access/__tests__/access.routes.unknown-email.test.ts

@@ -105,6 +105,7 @@ async function makeHarness(opts: {
       accessControl,
       workspaceService,
       authService,
+      authService,
       workflowService,
       { emit: vi.fn() } as unknown as WorkflowEventBus,
       opts.db ?? usersDbDouble(opts.accounts ?? []),

package/src/modules/access/__tests__/roles-admin.security.test.ts

@@ -146,7 +146,7 @@ describe('SECURITY: Admin-role removal takes effect on the next request', () =>
       (req as unknown as { userEmail?: string }).userEmail = req.header('x-test-email') ?? undefined;
       next();
     });
-    app.use('/api', createAccountRoutes(authService, adminAccess, erasure));
+    app.use('/api', createAccountRoutes(authService, adminAccess, erasure, { runAccountInvited: async () => [] }));
     server = await new Promise<Server>((resolve) => {
       const s = app.listen(0, () => resolve(s));
     });

package/src/modules/access/__tests__/roles-admin.service.test.ts

@@ -637,6 +637,18 @@ describe('Admin fixed members — the deployment admin', () => {
     expect(roster.find((r) => r.canonical === 'sales')!.fixedMembers).toEqual([]);
   });
 
+  it('sends the note with the roster, and the refusal leads with that same note', async () => {
+    // The page prints `fixedMembersNote` as sent, so this is the one copy of
+    // the wording: the note and the API refusal cannot drift apart.
+    const svc = serviceWith([OWNER]);
+    const roster = await svc.getRoster();
+    const note = roster.find((r) => r.canonical === 'admin')!.fixedMembersNote;
+    expect(note).toBe('Owner; cannot be removed here');
+    expect(roster.find((r) => r.canonical === 'sales')!.fixedMembersNote).toBeNull();
+    const refusal = await svc.addMember(ADMIN, 'admin', OWNER).catch((e: Error) => e);
+    expect((refusal as Error).message.startsWith(`${note}. `)).toBe(true);
+  });
+
   it('canonicalises the configured address and drops a blank one', async () => {
     // The composition root passes `[config.adminEmail]` unconditionally, so an
     // unset ADMIN_EMAIL arrives as [''] — that must not become a member "".
@@ -665,7 +677,7 @@ describe('Admin fixed members — the deployment admin', () => {
       status: 422,
       payload: { kind: 'fixed-deployment-admin' },
       message: expect.stringContaining(
-        'Deployment admin, set in the server configuration; cannot be removed here',
+        'Owner; cannot be removed here',
       ),
     });
     // Nothing written: the file is byte-identical.
@@ -685,7 +697,7 @@ describe('Admin fixed members — the deployment admin', () => {
       status: 422,
       payload: { kind: 'fixed-deployment-admin' },
       message: expect.stringContaining(
-        'Deployment admin, set in the server configuration; cannot be removed here',
+        'Owner; cannot be removed here',
       ),
     });
     expect(await fs.readFile(path.join(repo, 'roles.yaml'), 'utf-8')).toContain(OWNER);
@@ -700,6 +712,7 @@ describe('Admin fixed members — the deployment admin', () => {
   it('with no ADMIN_EMAIL configured, no role has a fixed member', async () => {
     const roster = await serviceWith([]).getRoster();
     expect(roster.every((r) => r.fixedMembers.length === 0)).toBe(true);
+    expect(roster.every((r) => r.fixedMembersNote === null)).toBe(true);
     // ...and ordinary Admin membership stays editable.
     await expect(serviceWith([]).addMember(ADMIN, 'admin', OWNER)).resolves.toBeDefined();
   });