@bevel-software/platform-core-backend 0.7.5 → 0.8.0

package/src/modules/access/__tests__/access.routes.overrides.test.ts

@@ -113,9 +113,9 @@ function close(s: Server): Promise<void> {
 const fm = (body: string) => `---\n${body}\n---\n\n# Body\n`;
 
 const FILES = {
-  [`${KB}/Groups/GTM/access.md`]: fm('read:\n  - GTM Team'),
-  [`${KB}/Groups/GTM/battlecards/access.md`]: fm('read:\n  - deny everyone'),
-  [`${KB}/Groups/GTM/slack.tool`]: fm('owner: Ali <ali@bevel.software>'),
+  [`${KB}/Plugins/GTM/access.md`]: fm('read:\n  - GTM Team'),
+  [`${KB}/Plugins/GTM/battlecards/access.md`]: fm('read:\n  - deny everyone'),
+  [`${KB}/Plugins/GTM/slack.tool`]: fm('owner: Ali <ali@bevel.software>'),
 };
 
 describe('GET /access/overrides', () => {
@@ -133,20 +133,20 @@ describe('GET /access/overrides', () => {
   it('returns the declarations under a folder the caller can read', async () => {
     h = await makeHarness({ files: FILES });
 
-    const res = await get('Groups/GTM');
+    const res = await get('Plugins/GTM');
     expect(res.status).toBe(200);
     expect(await res.json()).toEqual({
       truncated: false,
       overrides: [
         {
-          path: 'Groups/GTM/battlecards/access.md',
-          governs: 'Groups/GTM/battlecards',
+          path: 'Plugins/GTM/battlecards/access.md',
+          governs: 'Plugins/GTM/battlecards',
           source: 'access-md',
           entries: [{ verb: 'read', deny: true, principal: { kind: 'everyone' } }],
         },
         {
-          path: 'Groups/GTM/slack.tool',
-          governs: 'Groups/GTM/slack.tool',
+          path: 'Plugins/GTM/slack.tool',
+          governs: 'Plugins/GTM/slack.tool',
           source: 'frontmatter',
           entries: [
             {
@@ -163,7 +163,7 @@ describe('GET /access/overrides', () => {
   it('403s a caller who cannot read the folder', async () => {
     h = await makeHarness({ files: FILES, canRead: () => false });
 
-    const res = await get('Groups/GTM');
+    const res = await get('Plugins/GTM');
     expect(res.status).toBe(403);
     expect(await res.json()).toEqual({ error: 'You do not have access to this folder.' });
   });
@@ -171,21 +171,21 @@ describe('GET /access/overrides', () => {
   it('drops rows governing something the caller cannot read', async () => {
     h = await makeHarness({
       files: FILES,
-      rowReadable: (p) => p !== 'Groups/GTM/battlecards',
+      rowReadable: (p) => p !== 'Plugins/GTM/battlecards',
     });
 
-    const res = await get('Groups/GTM');
+    const res = await get('Plugins/GTM');
     const body = (await res.json()) as { overrides: { path: string }[] };
-    expect(body.overrides.map((o) => o.path)).toEqual(['Groups/GTM/slack.tool']);
+    expect(body.overrides.map((o) => o.path)).toEqual(['Plugins/GTM/slack.tool']);
   });
 
   it('accepts a workspace-relative path exactly like a repo-relative one', async () => {
     h = await makeHarness({ files: FILES });
 
-    const repoRel = (await (await get('Groups/GTM')).json()) as unknown;
-    const wsRel = (await (await get(`${KB}/Groups/GTM`)).json()) as unknown;
+    const repoRel = (await (await get('Plugins/GTM')).json()) as unknown;
+    const wsRel = (await (await get(`${KB}/Plugins/GTM`)).json()) as unknown;
     expect(wsRel).toEqual(repoRel);
-    expect(h.canRead).toHaveBeenCalledWith(WS, USER.email, 'Groups/GTM');
+    expect(h.canRead).toHaveBeenCalledWith(WS, USER.email, 'Plugins/GTM');
   });
 
   it('400s a path that escapes the KB repo', async () => {
@@ -198,7 +198,7 @@ describe('GET /access/overrides', () => {
   it('400s a target that is a file, not a folder', async () => {
     h = await makeHarness({ files: FILES });
 
-    const res = await get('Groups/GTM/slack.tool');
+    const res = await get('Plugins/GTM/slack.tool');
     expect(res.status).toBe(400);
     expect(await res.json()).toEqual({ error: 'path must be a folder' });
   });

package/src/modules/access/__tests__/grant-sources.test.ts

@@ -109,19 +109,19 @@ describe('AccessControlService.grantSources', () => {
     expect(src.write).toEqual([{ kind: 'ancestor', path: 'Knowledge/access.md' }]);
   });
 
-  it('a USER who holds a verb only via a group they belong to has NO source (the group row carries it)', async () => {
+  it('a USER who holds a verb only via a plugin they belong to has NO source (the plugin row carries it)', async () => {
     await writeFile(repo, 'access.md', '---\nwrite:\n  - Engineer\n---\n');
-    // Ali is an Engineer (per roles.yaml) — his write flows through the GROUP, not
+    // Ali is an Engineer (per roles.yaml) — his write flows through the PLUGIN, not
     // a per-user file entry. He isn't named in any file, so there's nothing to
-    // remove for HIM here; the Engineering group is the removable principal.
+    // remove for HIM here; the Engineering plugin is the removable principal.
     const src = await svc.grantSources(workspaceId, 'folder', 'Knowledge', ALI);
     expect(src.write).toBeUndefined();
     expect(src).toEqual({}); // no verb resolves to a per-user file entry
   });
 
-  it('the GROUP principal itself resolves to its own file scope (direct/ancestor)', async () => {
+  it('the PLUGIN principal itself resolves to its own file scope (direct/ancestor)', async () => {
     // The same Engineer grant, asked about as the ROLE principal, IS a removable
-    // file entry — the group is named directly on Knowledge/access.md.
+    // file entry — the plugin is named directly on Knowledge/access.md.
     await writeFile(repo, 'access.md', '---\nwrite:\n  - Admin\n---\n');
     await writeFile(repo, 'Knowledge/access.md', '---\nwrite:\n  - Engineer\n---\n');
     const src = await svc.grantSources(workspaceId, 'folder', 'Knowledge', {
@@ -150,20 +150,20 @@ describe('AccessControlService.grantSources', () => {
     expect(src).toEqual({});
   });
 
-  it("a folder-target admin whose access is via the Admin GROUP has NO per-user source", async () => {
-    // Razvan's effective write comes from the `Admin` group grant, not a per-user
+  it("a folder-target admin whose access is via the Admin PLUGIN has NO per-user source", async () => {
+    // Razvan's effective write comes from the `Admin` plugin grant, not a per-user
     // entry — so as a USER principal he has no removable source here (the Admin
-    // group row carries it, exactly like any other group).
+    // plugin row carries it, exactly like any other plugin).
     await writeFile(repo, 'access.md', '---\nwrite:\n  - Admin\n---\n');
     const src = await svc.grantSources(workspaceId, 'folder', 'Knowledge', RAZVAN);
     expect(src.write).toBeUndefined();
     expect(src).toEqual({});
   });
 
-  it("a user named DIRECTLY in a file keeps a source even if they're also in a group", async () => {
-    // Razvan is in the Admin group AND named inline on Knowledge — the inline
+  it("a user named DIRECTLY in a file keeps a source even if they're also in a plugin", async () => {
+    // Razvan is in the Admin plugin AND named inline on Knowledge — the inline
     // entry is a removable file grant, so his source is direct (tier-1 email
-    // beats the group at the same scope).
+    // beats the plugin at the same scope).
     await writeFile(repo, 'access.md', '---\nwrite:\n  - Admin\n---\n');
     await writeFile(
       repo,
@@ -177,7 +177,7 @@ describe('AccessControlService.grantSources', () => {
   it('a role principal is matched by its own scope entry, not a role indirection', async () => {
     await writeFile(repo, 'access.md', '---\nwrite:\n  - Admin\n---\n');
     await writeFile(repo, 'Knowledge/access.md', '---\nwrite:\n  - Engineer\n---\n');
-    // The Engineer GROUP itself is granted on Knowledge — for the role principal that's a direct grant.
+    // The Engineer PLUGIN itself is granted on Knowledge — for the role principal that's a direct grant.
     const src = await svc.grantSources(workspaceId, 'folder', 'Knowledge', {
       kind: 'role',
       role: 'Engineer',

package/src/modules/access/__tests__/roles-admin.service.test.ts

@@ -160,7 +160,7 @@ describe('RolesAdminService', () => {
     access = new AccessControlService(ws, KB);
     workflow = stubWorkflow();
     bus = stubEventBus();
-    svc = new RolesAdminService(ws, workflow.svc, access, KB, DEFAULT_BRANCH, bus.bus);
+    svc = new RolesAdminService(ws, workflow.svc, access, KB, () => DEFAULT_BRANCH, bus.bus);
   });
 
   afterEach(async () => {
@@ -174,6 +174,18 @@ describe('RolesAdminService', () => {
     expect(roster.find((r) => r.canonical === 'sales')!.members).toEqual(['felix@example.com']);
   });
 
+  it('resolves the default branch per call, not at construction', async () => {
+    // The deployment shape this guards: a service built during boot, before
+    // `configureBranchModel()` has applied the branch model, saw an empty
+    // `DEFAULT_BRANCH` and froze it — every roles route then failed branch
+    // validation with `Invalid branch name "": empty name` until a restart.
+    let branch = '';
+    const late = new RolesAdminService(ws, workflow.svc, access, KB, () => branch, bus.bus);
+    branch = DEFAULT_BRANCH;
+    const roster = await late.getRoster();
+    expect(roster.map((r) => r.canonical)).toEqual(['admin', 'sales']);
+  });
+
   it('getHealth reports ok for a valid file and corrupted for a broken one', async () => {
     expect(await svc.getHealth()).toEqual({ ok: true, errors: [] });
 

package/src/modules/access/access-control.interface.ts

@@ -20,8 +20,8 @@
  *
  * Only a principal NAMED in a file (a direct user grant `Name <email>`, or a
  * group/role token) produces sources. A USER who merely RESOLVES to access via a
- * group they belong to, the built-in `everyone`, or admin-rescue is NOT a
- * per-target file entry and produces NO source (the group itself shows as its own
+ * plugin they belong to, the built-in `everyone`, or admin-rescue is NOT a
+ * per-target file entry and produces NO source (the plugin itself shows as its own
  * row instead).
  */
 export type GrantSource =
@@ -138,8 +138,8 @@ export interface IAccessControl {
 
   /**
    * Batched `canOwner` — one config load per call, same `owner:`-lists-only
-   * resolution (no admin rescue). Used by group enumeration to answer "which
-   * of these folders does the caller own?" without one model load per group.
+   * resolution (no admin rescue). Used by plugin enumeration to answer "which
+   * of these folders does the caller own?" without one model load per plugin.
    */
   canOwnerBatch(
     workspaceId: string,
@@ -281,8 +281,9 @@ export interface IAccessControl {
 
   /**
    * Enumerate the grantable principals known to the KB, for the share-dialog
-   * autocomplete. `groups` are the declared `roles.yaml` role display names
-   * (the built-in `everyone` is excluded — it isn't grantable from the UI).
+   * autocomplete. `plugins` are the built-in `everyone` role plus the declared
+   * `roles.yaml` role display names (`everyone` is surfaced so the UI can
+   * grant public read; the grant route gates it to the `read` verb only).
    * `people` are every email named in `roles.yaml` (name defaults to the local
    * part) unioned with every `Name <email>` grant in any `access.md` (named).
    * The login-only `users` table is unioned in by the caller — this method
@@ -290,7 +291,7 @@ export interface IAccessControl {
    */
   kbPrincipals(
     workspaceId: string,
-  ): Promise<{ groups: string[]; people: { name: string; email: string }[] }>;
+  ): Promise<{ plugins: string[]; people: { name: string; email: string }[] }>;
 
   /**
    * Reverse-lookup an email by its SHA-256 hash (per `hashEmail` semantics)

package/src/modules/access/access-control.service.ts

@@ -925,7 +925,7 @@ function scopeToGrantSource(
  * returning the WHOLE list of removable entries rather than just the winner.
  *
  * Only the principal's OWN named entry yields a source — a `user` by their email,
- * a `role` by its role token. A grant that reaches the user via a group they
+ * a `role` by its role token. A grant that reaches the user via a plugin they
  * belong to, the built-in `everyone`, or admin-rescue is NOT their entry, so it
  * never adds a source (the group/role shows as its own row instead). The list is:
  *   - `[]` (verb omitted by the caller) when the principal effectively holds no
@@ -941,7 +941,7 @@ function scopeToGrantSource(
  * under closest-wins), and the revoke flow needs the inherited remainder that
  * survives removing the direct entry. A group/everyone grant at some scope does
  * not add a source AND does not hide a farther own-entry the principal is named
- * in (removing it is still meaningful if the group grant is later removed).
+ * in (removing it is still meaningful if the plugin grant is later removed).
  */
 function resolveGrantSourcesForVerb(
   model: AccessModel,
@@ -1453,18 +1453,18 @@ export class AccessControlService implements IAccessControl {
 
   async kbPrincipals(
     workspaceId: string,
-  ): Promise<{ groups: string[]; people: { name: string; email: string }[] }> {
+  ): Promise<{ plugins: string[]; people: { name: string; email: string }[] }> {
     let model: AccessModel;
     try {
       model = await this.loadModel(workspaceId);
     } catch {
-      return { groups: [], people: [] };
+      return { plugins: [], people: [] };
     }
-    // Groups = the built-in `everyone` role plus every declared role's display
+    // Plugins = the built-in `everyone` role plus every declared role's display
     // name. `everyone` is surfaced so the share UI can grant public read; the
     // grant route gates it to the `read` verb only (write/owner/download
     // everyone stay a direct-access.md edit).
-    const groups = [
+    const plugins = [
       EVERYONE_DISPLAY,
       ...[...model.roles.byCanonical.values()].map((r) => r.displayName),
     ];
@@ -1487,7 +1487,7 @@ export class AccessControlService implements IAccessControl {
       name: name || email.split('@')[0],
       email,
     }));
-    return { groups, people };
+    return { plugins, people };
   }
 
   async findEmailByHash(

package/src/modules/access/access-declarations.ts

@@ -14,9 +14,9 @@ import {
  * WHERE access rules are DECLARED inside a folder — a read-only inventory, not
  * a second resolver.
  *
- * A group's `access.md` is never the whole story: resolution is closeness-first,
+ * A plugin's `access.md` is never the whole story: resolution is closeness-first,
  * so a rule written on a single skill or `.tool` inside the folder overrides the
- * folder's rule for the principals it names. An admin looking at a group's share
+ * folder's rule for the principals it names. An admin looking at a plugin's share
  * list and seeing "GTM Team can read" would otherwise have no way to know that
  * one battlecard underneath says `deny read: everyone`.
  *
@@ -66,9 +66,9 @@ export interface AccessDeclaration {
 }
 
 /**
- * How many files one scan will read. A group folder is small by construction;
+ * How many files one scan will read. A plugin folder is small by construction;
  * this cap exists so a pathological folder (a whole ontology moved under
- * `Groups/`) degrades into an honest partial answer instead of pinning the
+ * `Plugins/`) degrades into an honest partial answer instead of pinning the
  * event loop. Callers surface `truncated` to the user.
  */
 export const DECLARATION_SCAN_FILE_CAP = 400;
@@ -163,7 +163,7 @@ function toEntries(byVerb: Record<Verb, ParsedEntry[]>): DeclarationEntry[] {
  *
  * Failure modes are asymmetric on purpose, matching the resolver: a node whose
  * frontmatter is malformed is skipped silently (a typo in a skill's `owner:`
- * must not make the group's access page unreadable), while a malformed
+ * must not make the plugin's access page unreadable), while a malformed
  * `access.md` is REPORTED with its `parseError` (that file was written to
  * control access and currently controls nothing).
  *

package/src/modules/access/access-mutation.service.ts

@@ -49,7 +49,7 @@ import { WorkflowDomainError } from '../workflow/workflow.errors.js';
 /** Whether the dialog target is a folder (edit folder access.md) or a file (edit node frontmatter). */
 export type TargetKind = 'folder' | 'file';
 
-/** Bad-request-class mutation failure (invalid principal, unknown group, lockout). */
+/** Bad-request-class mutation failure (invalid principal, unknown plugin, lockout). */
 export class AccessMutationError extends WorkflowDomainError {
   constructor(message: string, status = 400, payload?: Record<string, unknown>) {
     super(message, status, payload);
@@ -305,7 +305,7 @@ export class AccessMutationService {
    * access — not just "is there a removable file entry."
    *
    * For a USER, that distinction matters: effective access includes admin-rescue
-   * on `access.md`/`roles.yaml`, group membership, and the built-in `everyone` —
+   * on `access.md`/`roles.yaml`, plugin membership, and the built-in `everyone` —
    * none of which `grantSources` reports (it is MECE over file-backed
    * direct/ancestor entries only). So we ask the same `canRead/canWrite/
    * canDownload/canOwner` resolver every real access decision uses; if the
@@ -351,7 +351,7 @@ export class AccessMutationService {
    * asynchronously in the route (it needs the roles model). Here we only run the
    * cheap injection/shape validation so a malformed principal never reaches the
    * splice. Role-exists-in-roles.yaml is the route's job (so it can offer
-   * "Create Group" for an unknown group, an admin-only flow).
+   * "Create Plugin" for an unknown plugin, an admin-only flow).
    */
   private assertPrincipalSafe(principal: Principal): void {
     try {

package/src/modules/access/access-splice.ts

@@ -122,7 +122,7 @@ export function validatePrincipal(p: Principal): Principal {
   }
   const role = p.role.trim();
   const canonical = canonicalRoleName(role);
-  if (!canonical) throw new AccessSpliceError('group grant needs a name');
+  if (!canonical) throw new AccessSpliceError('plugin grant needs a name');
   if (
     CONTROL_CHARS.test(role) ||
     role.includes('<') ||
@@ -130,16 +130,16 @@ export function validatePrincipal(p: Principal): Principal {
     role.includes(':') ||
     role.includes('#')
   ) {
-    throw new AccessSpliceError(`invalid group name: ${JSON.stringify(p.role)}`);
+    throw new AccessSpliceError(`invalid plugin name: ${JSON.stringify(p.role)}`);
   }
   // `deny` is never a grantee — it's the denial prefix. `everyone` IS grantable
   // (the built-in public role); the access route restricts it to the read verb.
   if (canonical === 'deny') {
-    throw new AccessSpliceError(`'${role}' is a reserved name and cannot be granted as a group`);
+    throw new AccessSpliceError(`'${role}' is a reserved name and cannot be granted as a plugin`);
   }
   const round = parseAccessEntry(role);
   if (!round.ok || round.entry.kind !== 'role' || round.entry.deny) {
-    throw new AccessSpliceError(`group grant does not round-trip: ${JSON.stringify(p)}`);
+    throw new AccessSpliceError(`plugin grant does not round-trip: ${JSON.stringify(p)}`);
   }
   return { kind: 'role', role };
 }

package/src/modules/access/access.routes.ts

@@ -69,19 +69,19 @@ export function createAccessRoutes(
     workflowService,
     accessControl,
     kbDirName,
-    DEFAULT_BRANCH,
+    () => DEFAULT_BRANCH,
     eventBus,
   );
 
-  // Roles (groups) are authoritative on the DEFAULT branch — the Roles admin
-  // screen only ever edits roles.yaml there. Resolve the group list from the
+  // Roles (plugins) are authoritative on the DEFAULT branch — the Roles admin
+  // screen only ever edits roles.yaml there. Resolve the plugin list from the
   // default-branch workspace so the share dialog suggests (and the grant route
   // accepts) the same roles the Roles screen manages, regardless of which branch
   // the caller is viewing. People stay branch-local (the caller's own workspace).
-  const defaultBranchGroups = async (): Promise<string[]> => {
+  const defaultBranchPlugins = async (): Promise<string[]> => {
     await workspaceService.getOrCreateForBranch(DEFAULT_BRANCH);
-    const { groups } = await accessControl.kbPrincipals(workspaceIdForBranch(DEFAULT_BRANCH));
-    return groups;
+    const { plugins } = await accessControl.kbPrincipals(workspaceIdForBranch(DEFAULT_BRANCH));
+    return plugins;
   };
 
   // Authentication gate only. Per PLAN §3 the workspace `:id` is a branch
@@ -177,7 +177,7 @@ export function createAccessRoutes(
    *
    * Every access declaration living INSIDE a folder — the descendant
    * `access.md` files and the node frontmatter that override the folder's own
-   * rules for the principals they name. Display-only: the group access surface
+   * rules for the principals they name. Display-only: the plugin access surface
    * shows it so nobody reads a folder's share list as the whole story.
    *
    * Gating is stricter than the sibling `GET /access`, which hands its eligible
@@ -267,9 +267,9 @@ export function createAccessRoutes(
 
   /**
    * GET /api/workspace/:id/access/suggest?q=<query>
-   * Autocomplete for the share dialog. Returns matching groups (roles.yaml role
+   * Autocomplete for the share dialog. Returns matching plugins (roles.yaml role
    * names — resolved from the DEFAULT branch, the authoritative roles source)
-   * and people (branch-local to `:id`). Groups are small + non-sensitive so they
+   * and people (branch-local to `:id`). Plugins are small + non-sensitive so they
    * always show;
    * PEOPLE are withheld until `q` is ≥ 2 chars, so an empty query can't dump the
    * whole directory (email-harvesting guard). People are the union of the
@@ -283,10 +283,10 @@ export function createAccessRoutes(
     const q = (typeof req.query.q === 'string' ? req.query.q : '').trim().toLowerCase();
     const CAP = 15;
     try {
-      const groups = await defaultBranchGroups();
+      const plugins = await defaultBranchPlugins();
       const { people: kbPeople } = await accessControl.kbPrincipals(req.params.id);
 
-      const matchedGroups = groups
+      const matchedPlugins = plugins
         .filter((g) => !q || g.toLowerCase().includes(q))
         .slice(0, CAP);
 
@@ -311,7 +311,7 @@ export function createAccessRoutes(
           .slice(0, CAP);
       }
 
-      res.json({ groups: matchedGroups, people, peopleWithheld: q.length < 2 });
+      res.json({ plugins: matchedPlugins, people, peopleWithheld: q.length < 2 });
     } catch (err) {
       const { status, body } = toHttpError(err);
       res.status(status).json(body);
@@ -542,19 +542,19 @@ export function createAccessRoutes(
       }
       const { repoRelTarget, kind, principal } = parseMutationBody(req.body);
 
-      // For a group grant, the role must exist in roles.yaml (Slice 1 grants
-      // existing groups only; Create Group is Slice 2). Reject loudly otherwise.
+      // For a plugin grant, the role must exist in roles.yaml (Slice 1 grants
+      // existing plugins only; Create Plugin is Slice 2). Reject loudly otherwise.
       // Validate against the DEFAULT-branch roles (same authoritative source the
       // suggest autocomplete uses) so a default-branch role can't be suggested
       // then rejected here on a feature branch whose roles.yaml has diverged.
       if (principal.kind === 'role') {
-        const groups = await defaultBranchGroups();
-        const known = groups.some((g) => canonicalRoleName(g) === canonicalRoleName(principal.role));
+        const plugins = await defaultBranchPlugins();
+        const known = plugins.some((g) => canonicalRoleName(g) === canonicalRoleName(principal.role));
         if (!known) {
           throw new AccessMutationError(
-            `No group named "${principal.role}". Pick an existing group, or ask an admin to create it.`,
+            `No plugin named "${principal.role}". Pick an existing plugin, or ask an admin to create it.`,
             404,
-            { kind: 'unknown-group', role: principal.role },
+            { kind: 'unknown-plugin', role: principal.role },
           );
         }
         // The built-in `everyone` role is grantable from the share UI for READ
@@ -563,7 +563,7 @@ export function createAccessRoutes(
         // access.md edit.
         if (canonicalRoleName(principal.role) === EVERYONE_CANONICAL && verb !== 'read') {
           throw new AccessMutationError(
-            '"Everyone" can only be granted read access (public). Grant other access levels to specific people or groups.',
+            '"Everyone" can only be granted read access (public). Grant other access levels to specific people or plugins.',
           );
         }
       }
@@ -735,7 +735,7 @@ export function createAccessRoutes(
       // any source left is an `ancestor`. Distinguish "inherited" (still named in
       // an ancestor access.md — offer cascade/deny) from "no removable source
       // here" (nothing named in any file we can edit — a genuine no-op). A
-      // principal who only RESOLVES via a group / everyone / admin-rescue has no
+      // principal who only RESOLVES via a plugin / everyone / admin-rescue has no
       // source at all (it's not their own file entry) and so is correctly a 200
       // no-op: there is nothing to remove here and no Remove was ever offered for
       // them in the dialog. NEVER a silent unchanged-success when there IS a

package/src/modules/access/creator-access.ts

@@ -88,8 +88,8 @@ export interface ICreatorAccess {
 }
 
 /**
- * The splice-safe principal for a creator — exported because group
- * provisioning (`GroupProvisionService`) writes the same `Name <email>`
+ * The splice-safe principal for a creator — exported because plugin
+ * provisioning (`PluginProvisionService`) writes the same `Name <email>`
  * entries into the access.md files it seeds, and two spellings of the same
  * person would read as two people.
  */
@@ -169,9 +169,9 @@ export class CreatorAccessService implements ICreatorAccess {
           warnSkipped(rel, err);
           return null;
         }
-        // NOTE: a direct group folder (`Groups/<Name>`) is no longer special
-        // here. Groups — and personal folders — are made by the dedicated
-        // provisioning endpoint (`GroupProvisionService`), which writes the
+        // NOTE: a direct plugin folder (`Plugins/<Name>`) is no longer special
+        // here. Plugins — and personal folders — are made by the dedicated
+        // provisioning endpoint (`PluginProvisionService`), which writes the
         // full ownership template itself; this generic read-grant only covers
         // ad-hoc folder creation elsewhere in the tree.
         return {

package/src/modules/access/roles-admin.service.ts

@@ -119,8 +119,14 @@ export class RolesAdminService {
     private readonly workflowService: IWorkflowService,
     private readonly accessControl: IAccessControl,
     private readonly kbDirName: string,
-    /** The branch whose roles.yaml is authoritative for admin status. */
-    private readonly defaultBranch: string,
+    /**
+     * The branch whose roles.yaml is authoritative for admin status, read
+     * through a thunk rather than taken by value. `DEFAULT_BRANCH` is an ES
+     * module live binding that stays empty until `configureBranchModel()` runs
+     * at boot; a service constructed before that would freeze the empty string
+     * and every roles route would fail branch validation until a restart.
+     */
+    private readonly defaultBranchOf: () => string,
     /**
      * Optional so existing tests can construct the service without an event
      * bus. When present, every committed write announces itself so already-open
@@ -131,6 +137,11 @@ export class RolesAdminService {
     private readonly eventBus?: WorkflowEventBus,
   ) {}
 
+  /** Resolved per call — see the constructor note on `defaultBranchOf`. */
+  private get defaultBranch(): string {
+    return this.defaultBranchOf();
+  }
+
   private get workspaceId(): string {
     return workspaceIdForBranch(this.defaultBranch);
   }

package/src/modules/admin/admin-access.routes.ts

@@ -1,29 +1,29 @@
-import express from 'express';
-import type { IAdminAccessService } from './admin.interface.js';
-import '../auth/auth.middleware.js'; // Express Request augmentation
-
-/**
- * The CORE slice of the admin surface: just the admin-status resolver the
- * frontend branches on (AdminMenu's "Admin only" section, the roles-recovery
- * banner). The full admin router (feedback inbox, user administration /
- * GDPR erasure) is an enterprise extension mounted via
- * `ServerExtensions.authed`.
- *
- * NOTE (core split): in bevel-platform this endpoint lives in the enterprise
- * `admin.routes.ts`; core serves it itself so a core-only deployment can
- * resolve admin status. Express keeps first-match-wins, so an enterprise
- * overlay's own `/admin/access` (mounted later) never shadows this one —
- * both resolve through the same {@link IAdminAccessService}.
- */
-export function createAdminAccessRoutes(adminAccess: IAdminAccessService): express.Router {
-  const router = express.Router();
-
-  // Open to any authenticated user — returns `false` for non-admins instead of
-  // 403 so the frontend can branch on the answer without treating a normal
-  // user as an error case.
-  router.get('/admin/access', async (req, res) => {
-    res.json({ isAdmin: await adminAccess.isAdmin(req.userEmail) });
-  });
-
-  return router;
-}
+import express from 'express';
+import type { IAdminAccessService } from './admin.interface.js';
+import '../auth/auth.middleware.js'; // Express Request augmentation
+
+/**
+ * The CORE slice of the admin surface: just the admin-status resolver the
+ * frontend branches on (AdminMenu's "Admin only" section, the roles-recovery
+ * banner). The full admin router (feedback inbox, user administration /
+ * GDPR erasure) is an enterprise extension mounted via
+ * `ServerExtensions.authed`.
+ *
+ * NOTE (core split): in bevel-platform this endpoint lives in the enterprise
+ * `admin.routes.ts`; core serves it itself so a core-only deployment can
+ * resolve admin status. Express keeps first-match-wins, so an enterprise
+ * overlay's own `/admin/access` (mounted later) never shadows this one —
+ * both resolve through the same {@link IAdminAccessService}.
+ */
+export function createAdminAccessRoutes(adminAccess: IAdminAccessService): express.Router {
+  const router = express.Router();
+
+  // Open to any authenticated user — returns `false` for non-admins instead of
+  // 403 so the frontend can branch on the answer without treating a normal
+  // user as an error case.
+  router.get('/admin/access', async (req, res) => {
+    res.json({ isAdmin: await adminAccess.isAdmin(req.userEmail) });
+  });
+
+  return router;
+}