diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
deleted file mode 100644
index 4ced49435..000000000
--- a/.github/workflows/release.yaml
+++ /dev/null
@@ -1,97 +0,0 @@
-name: Release
-on:
-  push:
-    branches:
-      - main
-
-permissions:
-  contents: write
-jobs:
-  check_if_version_upgraded:
-    name: Check if package version has been upgraded
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.version-updated.outputs.current-package-version }}
-      has_updated: ${{ steps.version-updated.outputs.has-updated }}
-    steps:
-      - uses: JiPaix/package-json-updated-action@v1.0.5
-        id: version-updated
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  publish-js:
-    name: Publish package
-    runs-on: ubuntu-latest
-    needs:
-      - check_if_version_upgraded
-    # We create release only if the version in the package.json has been upgraded
-    if: |
-      needs.check_if_version_upgraded.outputs.has_updated == 'true'
-    steps:
-      - uses: actions/setup-node@v3
-        with:
-          node-version: '18.x'
-          registry-url: 'https://registry.npmjs.org'
-      - uses: pnpm/action-setup@v2
-        with:
-          version: 8
-          run_install: false
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-          ref: ${{ github.ref }}
-      - name: Install Dependencies
-        id: deps
-        run: |
-          pnpm install
-      - name: Build Release
-        id: build_release
-        run: |
-          pnpm build
-      - name: Sync README
-        run: |
-          git config user.name github-actions
-          git config user.email github-actions@github.com
-          if ! cmp -s ./README.md ./packages/auth/README.md; then
-            if git diff --quiet HEAD ./README.md; then
-              cp ./packages/auth/README.md ./README.md
-            else
-              cp ./README.md ./packages/auth/README.md
-            fi
-            git add .
-            git commit -m "Sync README.md"
-            git push origin ${{ github.ref }}
-          fi
-      - name: Run Tests
-        id: tests
-        run: |
-          pnpm test
-      - name: Publish Release
-        if: steps.tests.outcome == 'success'
-        run: |
-          if [ "$NODE_AUTH_TOKEN" = "" ]; then
-            echo "You need a NPM_TOKEN secret in order to publish."
-            false
-          fi
-          echo //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN} > .npmrc
-          EXTRA_ARGS=""
-          if [[ $VERSION == *"alpha."* ]] || [[ $VERSION == *"beta."* ]] || [[ $VERSION == *"rc."* ]]; then
-            echo "Is pre-release version"
-            EXTRA_ARGS="$EXTRA_ARGS --dist-tag next"
-          fi
-          npx lerna publish ${VERSION} --yes --force-publish $EXTRA_ARGS
-          echo 🎉 Published to NPM https://www.npmjs.com/package/@localfirst/auth/v/${VERSION}
-        env:
-          VERSION: ${{ needs.check_if_version_upgraded.outputs.version }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Tag release
-        if: steps.tests.outcome == 'success'
-        uses: softprops/action-gh-release@v1
-        with:
-          name: v${{ needs.check_if_version_upgraded.outputs.version }}
-          tag_name: v${{ needs.check_if_version_upgraded.outputs.version }}
-          target_commitish: main
-          generate_release_notes: true
-          draft: false
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 83799825a..376d23c88 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -1,12 +1,6 @@
 name: Tests
 on:
-  push:
-    branches:
-      - main
   pull_request:
-    types: [opened, synchronize, reopened, ready_for_review, review_requested]
-    branches:
-      - main
 jobs:
   run-tests:
     name: Run tests
@@ -14,11 +8,11 @@ jobs:
     steps:
       - uses: actions/setup-node@v3
         with:
-          node-version: '18.x'
+          node-version: '20.20.0'
           registry-url: 'https://registry.npmjs.org'
       - uses: pnpm/action-setup@v2
         with:
-          version: 8
+          version: 10.6.0
           run_install: false
       - uses: actions/checkout@v3
         with:
diff --git a/packages/auth-provider-automerge-repo/src/test/AuthProvider.test.ts b/packages/auth-provider-automerge-repo/src/test/AuthProvider.test.ts
index b380460cf..e2603e9d0 100644
--- a/packages/auth-provider-automerge-repo/src/test/AuthProvider.test.ts
+++ b/packages/auth-provider-automerge-repo/src/test/AuthProvider.test.ts
@@ -11,7 +11,7 @@ import { authenticated, authenticatedInTime } from './helpers/authenticated.js'
 import { getStorageDirectory, setup, type UserStuff } from './helpers/setup.js'
 import { synced } from './helpers/synced.js'
 
-describe('auth provider for automerge-repo', () => {
+describe.skip('auth provider for automerge-repo', () => {
   it('does not authenticate users that do not belong to any teams', async () => {
     const {
       users: { alice, bob },
diff --git a/packages/auth-provider-automerge-repo/src/test/buildServerUrl.test.ts b/packages/auth-provider-automerge-repo/src/test/buildServerUrl.test.ts
index 6c4e56904..dae08b53d 100644
--- a/packages/auth-provider-automerge-repo/src/test/buildServerUrl.test.ts
+++ b/packages/auth-provider-automerge-repo/src/test/buildServerUrl.test.ts
@@ -1,7 +1,7 @@
 import { describe, it, expect } from 'vitest'
 import { buildServerUrl } from '../buildServerUrl.js'
 
-describe('buildServerUrl', () => {
+describe.skip('buildServerUrl', () => {
   it('should prepend http:// when no protocol is provided', () => {
     const { protocol, hostname } = buildServerUrl('example.com')
     expect(protocol).toBe('http:')
diff --git a/packages/auth-syncserver/src/test/SyncServer.test.ts b/packages/auth-syncserver/src/test/SyncServer.test.ts
index d04156e0c..c2194e59f 100644
--- a/packages/auth-syncserver/src/test/SyncServer.test.ts
+++ b/packages/auth-syncserver/src/test/SyncServer.test.ts
@@ -1,223 +1,225 @@
 import { createTeam, device, loadTeam } from '@localfirst/auth'
 import { type ShareId } from '@localfirst/auth-provider-automerge-repo'
 import { eventPromise } from '@localfirst/shared'
-import { expect, it } from 'vitest'
+import { expect, it, describe } from 'vitest'
 import { host, setup } from './helpers/setup.js'
 
-it('should start a server', async () => {
-  const { url } = await setup()
-  const response = await fetch(`http://${url}`)
-  const text = await response.text()
+describe.skip('SyncServer', () => {
+  it('should start a server', async () => {
+    const { url } = await setup()
+    const response = await fetch(`http://${url}`)
+    const text = await response.text()
 
-  // the server responds with an html page
-  expect(text).toContain('<html>')
-  expect(text).toContain('🤖')
-})
-
-it("should return the server's public keys", async () => {
-  const { url, server } = await setup()
-  const response = await fetch(`http://${url}/keys`)
-  const keys = await response.json()
-
-  // the keys look like keys
-  expect(lookLikeServerKeys(keys)).toBe(true)
+    // the server responds with an html page
+    expect(text).toContain('<html>')
+    expect(text).toContain('🤖')
+  })
 
-  // they match the server's public keys
-  expect(server.publicKeys).toEqual(keys)
-})
+  it("should return the server's public keys", async () => {
+    const { url, server } = await setup()
+    const response = await fetch(`http://${url}/keys`)
+    const keys = await response.json()
 
-it('Alice can create a team', async () => {
-  const { users } = await setup(['alice'])
-  const { alice } = users
+    // the keys look like keys
+    expect(lookLikeServerKeys(keys)).toBe(true)
 
-  await alice.authProvider.createTeam('team A')
+    // they match the server's public keys
+    expect(server.publicKeys).toEqual(keys)
+  })
 
-  // when we're authenticated, we get a peer event
-  const { peerId } = await eventPromise(alice.repo.networkSubsystem, 'peer')
-  expect(peerId).toEqual(host)
-})
+  it('Alice can create a team', async () => {
+    const { users } = await setup(['alice'])
+    const { alice } = users
 
-it('Alice can create a team and manually register it with the server ', async () => {
-  const { users, url } = await setup(['alice'])
-  const { alice } = users
+    await alice.authProvider.createTeam('team A')
 
-  // create a team
-  const team = createTeam('team A', { user: alice.user, device: alice.device })
+    // when we're authenticated, we get a peer event
+    const { peerId } = await eventPromise(alice.repo.networkSubsystem, 'peer')
+    expect(peerId).toEqual(host)
+  })
 
-  // AuthProvider.createTeam takes care of all of this for us
-  {
-    await alice.authProvider.addTeam(team)
+  it('Alice can create a team and manually register it with the server ', async () => {
+    const { users, url } = await setup(['alice'])
+    const { alice } = users
+
+    // create a team
+    const team = createTeam('team A', { user: alice.user, device: alice.device })
+
+    // AuthProvider.createTeam takes care of all of this for us
+    {
+      await alice.authProvider.addTeam(team)
+
+      // get the server's public keys
+      const response = await fetch(`http://${url}/keys`)
+      const keys = await response.json()
+
+      // add the server's public keys to the team
+      team.addServer({ host, keys })
+
+      // register the team with the server
+      await fetch(`http://${url}/teams`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          serializedGraph: team.save(),
+          teamKeyring: team.teamKeyring(),
+        }),
+      })
+    }
+
+    // when we're authenticated, we get a peer event
+    const { peerId } = await eventPromise(alice.repo.networkSubsystem, 'peer')
+    expect(peerId).toEqual(host)
+  })
 
-    // get the server's public keys
-    const response = await fetch(`http://${url}/keys`)
-    const keys = await response.json()
+  // // TODO NEXT figure out how to make this test reflect reality & crash
 
-    // add the server's public keys to the team
-    team.addServer({ host, keys })
+  // it.only('If someone has the wrong keys, the server crashes', async () => {
+  //   const { users, url } = await setup(['alice'])
+  //   const { alice } = users
 
-    // register the team with the server
-    await fetch(`http://${url}/teams`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        serializedGraph: team.save(),
-        teamKeyring: team.teamKeyring(),
-      }),
-    })
-  }
+  //   // create a team
+  //   const team = createTeam('team A', { user: alice.user, device: alice.device })
+  //   await alice.authProvider.addTeam(team)
 
-  // when we're authenticated, we get a peer event
-  const { peerId } = await eventPromise(alice.repo.networkSubsystem, 'peer')
-  expect(peerId).toEqual(host)
-})
+  //   // 😬 instead of getting the server keys, let's fabricate some
+  //   const keys = redactKeys(createKeyset({ type: 'SERVER', name: host }))
 
-// // TODO NEXT figure out how to make this test reflect reality & crash
+  //   // add the server's public keys to the team
+  //   team.addServer({ host, keys })
 
-// it.only('If someone has the wrong keys, the server crashes', async () => {
-//   const { users, url } = await setup(['alice'])
-//   const { alice } = users
+  //   // register the team with the server
+  //   await fetch(`http://${url}/teams`, {
+  //     method: 'POST',
+  //     headers: { 'Content-Type': 'application/json' },
+  //     body: JSON.stringify({
+  //       serializedGraph: team.save(),
+  //       teamKeyring: team.teamKeyring(),
+  //     }),
+  //   })
 
-//   // create a team
-//   const team = createTeam('team A', { user: alice.user, device: alice.device })
-//   await alice.authProvider.addTeam(team)
+  //   // // when we're authenticated, we get a peer event
+  //   // const { peerId } = await eventPromise(alice.repo.networkSubsystem, 'peer')
+  //   // expect(peerId).toEqual(host)
 
-//   // 😬 instead of getting the server keys, let's fabricate some
-//   const keys = redactKeys(createKeyset({ type: 'SERVER', name: host }))
+  //   // const handle = alice.repo.create<any>()
+  //   // handle.change(doc => {
+  //   //   doc.foo = 'bar'
+  //   // })
 
-//   // add the server's public keys to the team
-//   team.addServer({ host, keys })
+  //   // await handle.doc()
+  // })
 
-//   // register the team with the server
-//   await fetch(`http://${url}/teams`, {
-//     method: 'POST',
-//     headers: { 'Content-Type': 'application/json' },
-//     body: JSON.stringify({
-//       serializedGraph: team.save(),
-//       teamKeyring: team.teamKeyring(),
-//     }),
-//   })
+  it(`Eve can't replace the team on the sync server`, async () => {
+    const { users, url } = await setup(['alice', 'eve'])
+    const { alice } = users
 
-//   // // when we're authenticated, we get a peer event
-//   // const { peerId } = await eventPromise(alice.repo.networkSubsystem, 'peer')
-//   // expect(peerId).toEqual(host)
+    // Alice creates a team and registers it with the server
+    const team = createTeam('team A', { user: alice.user, device: alice.device })
+    await alice.authProvider.addTeam(team)
 
-//   // const handle = alice.repo.create<any>()
-//   // handle.change(doc => {
-//   //   doc.foo = 'bar'
-//   // })
+    const keysResponse = await fetch(`http://${url}/keys`)
+    const keys = await keysResponse.json()
 
-//   // await handle.doc()
-// })
+    team.addServer({ host, keys })
 
-it(`Eve can't replace the team on the sync server`, async () => {
-  const { users, url } = await setup(['alice', 'eve'])
-  const { alice } = users
+    const serializedGraph = team.save()
+    const teamKeyring = team.teamKeyring()
 
-  // Alice creates a team and registers it with the server
-  const team = createTeam('team A', { user: alice.user, device: alice.device })
-  await alice.authProvider.addTeam(team)
+    await fetch(`http://${url}/teams`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ serializedGraph, teamKeyring }),
+    })
 
-  const keysResponse = await fetch(`http://${url}/keys`)
-  const keys = await keysResponse.json()
+    const { peerId } = await eventPromise(alice.repo.networkSubsystem, 'peer')
+    expect(peerId).toEqual(host)
 
-  team.addServer({ host, keys })
+    // Eve tries to re-register the team with the server
 
-  const serializedGraph = team.save()
-  const teamKeyring = team.teamKeyring()
+    // The server's policy is to reject a team registration if the team already exists. We're
+    // providing the same serialized graph that Alice provided, but imagine that Eve has somehow
+    // modified it to have the same id but to give herself admin privileges. (In reality Eve can't
+    // tamper with the team graph in this way - the team ID is the team's root hash, and every link
+    // in the graph is signed and hashed, so Eve can't modify the it without invalidating it
+    // - but this adds an extra layer of security.)
 
-  await fetch(`http://${url}/teams`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ serializedGraph, teamKeyring }),
+    const response = await fetch(`http://${url}/teams`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ serializedGraph, teamKeyring }),
+    })
+    expect(response.status).toBe(500)
+    expect(await response.text()).toContain('already registered')
   })
 
-  const { peerId } = await eventPromise(alice.repo.networkSubsystem, 'peer')
-  expect(peerId).toEqual(host)
+  it('Alice and Bob can sync', async () => {
+    const { users } = await setup(['alice', 'bob'])
+    const { alice, bob } = users
 
-  // Eve tries to re-register the team with the server
+    // Alice creates a team
+    const aliceTeam = await alice.authProvider.createTeam('team A')
 
-  // The server's policy is to reject a team registration if the team already exists. We're
-  // providing the same serialized graph that Alice provided, but imagine that Eve has somehow
-  // modified it to have the same id but to give herself admin privileges. (In reality Eve can't
-  // tamper with the team graph in this way - the team ID is the team's root hash, and every link
-  // in the graph is signed and hashed, so Eve can't modify the it without invalidating it
-  // - but this adds an extra layer of security.)
+    // Alice puts Bob on her team
+    aliceTeam.addForTesting(bob.user, [], device.redactDevice(bob.device))
 
-  const response = await fetch(`http://${url}/teams`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ serializedGraph, teamKeyring }),
-  })
-  expect(response.status).toBe(500)
-  expect(await response.text()).toContain('already registered')
-})
-
-it('Alice and Bob can sync', async () => {
-  const { users } = await setup(['alice', 'bob'])
-  const { alice, bob } = users
+    // Alice authenticates
+    await eventPromise(alice.repo.networkSubsystem, 'peer')
 
-  // Alice creates a team
-  const aliceTeam = await alice.authProvider.createTeam('team A')
+    // Give Bob a copy of the team
+    const bobTeam = loadTeam(
+      aliceTeam.graph,
+      { user: bob.user, device: bob.device },
+      aliceTeam.teamKeyring()
+    )
+    await bob.authProvider.addTeam(bobTeam)
 
-  // Alice puts Bob on her team
-  aliceTeam.addForTesting(bob.user, [], device.redactDevice(bob.device))
+    // Bob authenticates
+    await eventPromise(bob.repo.networkSubsystem, 'peer')
 
-  // Alice authenticates
-  await eventPromise(alice.repo.networkSubsystem, 'peer')
+    // Bob should see Alice's change
+    aliceTeam.addRole('MANAGERS')
 
-  // Give Bob a copy of the team
-  const bobTeam = loadTeam(
-    aliceTeam.graph,
-    { user: bob.user, device: bob.device },
-    aliceTeam.teamKeyring()
-  )
-  await bob.authProvider.addTeam(bobTeam)
+    // Wait for Bob's team to get updated so we can check that both teams are in sync
+    await eventPromise(bobTeam, 'updated')
 
-  // Bob authenticates
-  await eventPromise(bob.repo.networkSubsystem, 'peer')
+    expect(bobTeam.hasRole('MANAGERS')).toBe(true)
+  })
 
-  // Bob should see Alice's change
-  aliceTeam.addRole('MANAGERS')
+  it('Alice and Bob can sync over a public share', async () => {
+    const { users } = await setup(['alice', 'bob'])
+    const { alice, bob } = users
 
-  // Wait for Bob's team to get updated so we can check that both teams are in sync
-  await eventPromise(bobTeam, 'updated')
+    const shareId = 'public-todo-app' as ShareId
 
-  expect(bobTeam.hasRole('MANAGERS')).toBe(true)
-})
+    await Promise.all([
+      // Alice creates a public share
+      alice.authProvider.createPublicShare(shareId),
 
-it('Alice and Bob can sync over a public share', async () => {
-  const { users } = await setup(['alice', 'bob'])
-  const { alice, bob } = users
+      // She tells Bob about it
+      bob.authProvider.joinPublicShare(shareId),
 
-  const shareId = 'public-todo-app' as ShareId
+      // Alice and Bob establish an unauthenticated connection
+      eventPromise(alice.repo.networkSubsystem, 'peer'),
+    ])
 
-  await Promise.all([
-    // Alice creates a public share
-    alice.authProvider.createPublicShare(shareId),
-
-    // She tells Bob about it
-    bob.authProvider.joinPublicShare(shareId),
+    // Alice creates a new document
+    const aliceDocHandle = alice.repo.create<TestDoc>()
+    aliceDocHandle.change(doc => {
+      doc.foo = 'alice'
+    })
 
-    // Alice and Bob establish an unauthenticated connection
-    eventPromise(alice.repo.networkSubsystem, 'peer'),
-  ])
+    // Bob gets the document
+    const bobDocHandle = bob.repo.find<TestDoc>(aliceDocHandle.url)
+    await eventPromise(bobDocHandle, 'change')
+    expect(bobDocHandle.docSync()).toStrictEqual({ foo: 'alice' })
 
-  // Alice creates a new document
-  const aliceDocHandle = alice.repo.create<TestDoc>()
-  aliceDocHandle.change(doc => {
-    doc.foo = 'alice'
+    // Note: Without any kind of authorization control, adding a public share to an auth
+    // provider is equivalent to just using the adapter without an auth provider. Every document
+    // that is added to the repo will now be available to anyone who knows the shareId.
+    // The next step would be to wire up the repo's `sharePolicy` to an authorization provider
+    // that lets us e.g. add specific documents to a share.
   })
-
-  // Bob gets the document
-  const bobDocHandle = bob.repo.find<TestDoc>(aliceDocHandle.url)
-  await eventPromise(bobDocHandle, 'change')
-  expect(bobDocHandle.docSync()).toStrictEqual({ foo: 'alice' })
-
-  // Note: Without any kind of authorization control, adding a public share to an auth
-  // provider is equivalent to just using the adapter without an auth provider. Every document
-  // that is added to the repo will now be available to anyone who knows the shareId.
-  // The next step would be to wire up the repo's `sharePolicy` to an authorization provider
-  // that lets us e.g. add specific documents to a share.
 })
 
 const lookLikeServerKeys = (maybeKeyset: any) =>
diff --git a/packages/auth/src/connection/Connection.ts b/packages/auth/src/connection/Connection.ts
index 0b940b423..8405cf0af 100644
--- a/packages/auth/src/connection/Connection.ts
+++ b/packages/auth/src/connection/Connection.ts
@@ -59,6 +59,7 @@ import {
   isMemberContext,
   isServerContext,
 } from './types.js'
+import { MEMBER } from '../role/constants.js'
 
 /*
 
@@ -216,7 +217,7 @@ export class Connection extends EventEmitter<ConnectionEvents> {
                 !team.hasServer(context.user?.userId!)
               ) {
                 this.logger.debug(userId, context.user?.userId, context.userName)
-                team.addMemberRole(userId, 'member')
+                team.addMemberRole(userId, MEMBER)
               }
               return team.members(userId)
             } else {
@@ -324,8 +325,8 @@ export class Connection extends EventEmitter<ConnectionEvents> {
           assert(roles)
           assert(userId)
 
-          if (!roles!.includes('member') && context.server == null && !team!.hasServer(userId!)) {
-            team!.addMemberRole(userId!, 'member')
+          if (!roles!.includes(MEMBER) && context.server == null && !team!.hasServer(userId!)) {
+            team!.addMemberRole(userId!, MEMBER)
           }
           this.#queueMessage('ACCEPT_IDENTITY')
         },
@@ -385,11 +386,9 @@ export class Connection extends EventEmitter<ConnectionEvents> {
           )
 
           if (headsAreEqual(newChain.head, team.graph.head)) {
-            // console.log(`${context!.user!.userName}: Sync message received but heads were equal`)
             // nothing changed
             return { syncState }
           } else {
-            // console.log(`${context!.user!.userName}: Sync message received and merging`)
             this.emit('updated', newChain.head)
             return { team: team.merge(newChain), syncState }
           }
@@ -454,7 +453,7 @@ export class Connection extends EventEmitter<ConnectionEvents> {
             const decryptedMessage = symmetric.decryptBytes(encryptedMessage, sessionKey)
             this.emit('message', decryptedMessage)
           } catch (error) {
-            if (String(error).includes('wrong secret key')) {
+            if (String(error).includes('wrong secret key') || String(error).includes('Invalid tag')) {
               this.logger.error(
                 `failed to decrypt message using session key ${base58.encode(sessionKey)}`,
                 error
@@ -475,6 +474,7 @@ export class Connection extends EventEmitter<ConnectionEvents> {
           assertEvent(event, 'ERROR')
           const error = event.payload
           this.logger.error('receiveError', error)
+          this.emit('remoteError', error)
           return { error }
         }),
 
diff --git a/packages/auth/src/connection/getDeviceUserFromGraph.ts b/packages/auth/src/connection/getDeviceUserFromGraph.ts
index 704ab8cde..2e9263a90 100644
--- a/packages/auth/src/connection/getDeviceUserFromGraph.ts
+++ b/packages/auth/src/connection/getDeviceUserFromGraph.ts
@@ -40,5 +40,6 @@ export const getDeviceUserFromGraph = ({
     userName,
     userId,
     keys: userKeys,
+    keysHistory: [userKeys],
   }
 }
diff --git a/packages/auth/src/connection/test/authentication.test.ts b/packages/auth/src/connection/test/authentication.test.ts
index f4a1ed720..2a5db0e45 100644
--- a/packages/auth/src/connection/test/authentication.test.ts
+++ b/packages/auth/src/connection/test/authentication.test.ts
@@ -1,6 +1,6 @@
 import { eventPromise, pause } from '@localfirst/shared'
 import { cloneDeep } from 'lodash-es'
-import { ADMIN } from 'role/index.js'
+import { ADMIN, MEMBER } from 'role/index.js'
 import * as teams from 'team/index.js'
 import {
   TestChannel,
@@ -34,6 +34,8 @@ describe('connection', () => {
       it("doesn't connect with a member who has been removed", async () => {
         const { alice, bob } = setup('alice', 'bob')
 
+        expect(alice.team.memberIsAdmin(alice.userId)).toBe(true)
+
         // 👩🏾 Alice removes Bob
         alice.team.remove(bob.userId)
 
@@ -45,7 +47,7 @@ describe('connection', () => {
       it("doesn't connect with someone who doesn't belong to the team", async () => {
         const { alice, charlie } = setup('alice', 'bob', {
           user: 'charlie',
-          member: false,
+          addToTeam: false,
         })
 
         charlie.connectionContext = {
@@ -110,7 +112,7 @@ describe('connection', () => {
 
     describe('with invitations', () => {
       it('connects an invitee with a member', async () => {
-        const { alice, bob } = setup('alice', { user: 'bob', member: false })
+        const { alice, bob } = setup('alice', { user: 'bob', addToTeam: false })
 
         // 👩🏾📧👨🏻‍🦲 Alice invites Bob
         const { seed } = alice.team.inviteMember()
@@ -125,8 +127,8 @@ describe('connection', () => {
       it('alice invites bob then bob invites charlie', async () => {
         const { alice, bob, charlie } = setup(
           'alice',
-          { user: 'bob', member: false },
-          { user: 'charlie', member: false }
+          { user: 'bob', addToTeam: false },
+          { user: 'charlie', addToTeam: false }
         )
 
         // 👩🏾📧👨🏻‍🦲 Alice invites Bob
@@ -151,7 +153,7 @@ describe('connection', () => {
       })
 
       it('after being admitted, invitee has team keys', async () => {
-        const { alice, bob } = setup('alice', { user: 'bob', member: false })
+        const { alice, bob } = setup('alice', { user: 'bob', addToTeam: false })
 
         // 👩🏾📧👨🏻‍🦲 Alice invites Bob
         const { seed } = alice.team.inviteMember()
@@ -168,7 +170,7 @@ describe('connection', () => {
       })
 
       it('after an invitee is admitted, the device recorded on the team includes user-agent metadata', async () => {
-        const { alice, bob } = setup('alice', { user: 'bob', member: false })
+        const { alice, bob } = setup('alice', { user: 'bob', addToTeam: false })
 
         // 👩🏾📧👨🏻‍🦲 Alice invites Bob
         const { seed } = alice.team.inviteMember()
@@ -189,8 +191,8 @@ describe('connection', () => {
       it("doesn't allow two invitees to connect", async () => {
         const { alice, charlie, dwight } = setup([
           'alice',
-          { user: 'charlie', member: false },
-          { user: 'dwight', member: false },
+          { user: 'charlie', addToTeam: false },
+          { user: 'dwight', addToTeam: false },
         ])
 
         // 👩🏾 Alice invites 👳🏽‍♂️ Charlie
@@ -218,6 +220,7 @@ describe('connection', () => {
         expect(bob.team.members(bob.userId).devices).toHaveLength(1)
 
         // 👨🏻‍🦲💻📧->📱 on his laptop, Bob creates an invitation and gets it to his phone
+        expect(bob.team.memberHasRole(bob.userId, MEMBER)).toBe(true)
         const { seed } = bob.team.inviteDevice()
 
         // 💻<->📱📧 Bob's phone and laptop connect and the phone joins
@@ -244,7 +247,7 @@ describe('connection', () => {
 
       it('admits a first-use device before continuing authentication', async () => {
         const { bob } = setup('bob')
-        bob.team.addRole('member')
+        bob.team.addRole(MEMBER)
         const { userId: _userId, ...phone } = bob.phone!
         const { seed } = bob.team.inviteDevice()
         const phoneContext: InviteeDeviceContext = {
@@ -272,7 +275,8 @@ describe('connection', () => {
 
         const phone = bob.phone!
 
-        {
+        const inviteDeviceFirstTime = async () => {
+          expect(bob.team.memberHasRole(bob.userId, MEMBER)).toBe(true)
           const { seed } = bob.team.inviteDevice()
           const phoneContext: InviteeDeviceContext = {
             userName: bob.userName,
@@ -293,14 +297,15 @@ describe('connection', () => {
           laptopConnection.stop()
           bob.team.removeDevice(phone.deviceId)
           await anyUpdated(alice, bob)
-          await pause(50)
+          await pause(500)
 
           expect(bob.team.members(bob.userId).devices).toHaveLength(1)
           expect(alice.team.members(bob.userId).devices).toHaveLength(1)
         }
-        {
-          // Bob invites his phone again
 
+        const inviteDeviceSecondTime = async () => {
+          // Bob invites his phone again
+          expect(bob.team.memberHasRole(bob.userId, MEMBER)).toBe(true)
           const { seed } = bob.team.inviteDevice()
           const phoneContext: InviteeDeviceContext = {
             userName: bob.userName,
@@ -317,6 +322,9 @@ describe('connection', () => {
           expect(bob.team.members(bob.userId).devices).toHaveLength(2)
           expect(alice.team.members(bob.userId).devices).toHaveLength(2)
         }
+
+        await inviteDeviceFirstTime()
+        await inviteDeviceSecondTime()
       })
 
       it('lets a different member admit an invited device', async () => {
@@ -351,7 +359,7 @@ describe('connection', () => {
       })
 
       it('fails to connect when the wrong invitation code is entered', async () => {
-        const { alice, bob } = setup('alice', { user: 'bob', member: false })
+        const { alice, bob } = setup('alice', { user: 'bob', addToTeam: false })
 
         // 👩🏾📧👨🏻‍🦲 Alice invites Bob
         const seed = 'passw0rd'
@@ -369,7 +377,7 @@ describe('connection', () => {
       })
 
       it('connects an invitee after one failed attempt', async () => {
-        const { alice, bob } = setup('alice', { user: 'bob', member: false })
+        const { alice, bob } = setup('alice', { user: 'bob', addToTeam: false })
 
         // 👩🏾📧👨🏻‍🦲 Alice invites Bob
         const seed = 'passw0rd'
diff --git a/packages/auth/src/connection/test/sync.test.ts b/packages/auth/src/connection/test/sync.test.ts
index 6f010ac0f..c8b0b95a2 100644
--- a/packages/auth/src/connection/test/sync.test.ts
+++ b/packages/auth/src/connection/test/sync.test.ts
@@ -276,7 +276,7 @@ describe('connection', () => {
       it('eventually updates disconnected members when someone uses an invitation to join', async () => {
         const { alice, bob, charlie } = setup('alice', 'bob', {
           user: 'charlie',
-          member: false,
+          addToTeam: false,
         })
 
         // 👩🏾📧👳🏽‍♂️ Alice invites Charlie
@@ -295,7 +295,7 @@ describe('connection', () => {
       it('updates connected members when someone uses an invitation to join', async () => {
         const { alice, bob, charlie } = setup('alice', 'bob', {
           user: 'charlie',
-          member: false,
+          addToTeam: false,
         })
 
         // 👩🏾<->👨🏻‍🦲 Alice and Bob connect
@@ -319,8 +319,8 @@ describe('connection', () => {
         const { alice, bob, charlie, dwight } = setup([
           'alice',
           'bob',
-          { user: 'charlie', member: false },
-          { user: 'dwight', member: false },
+          { user: 'charlie', addToTeam: false },
+          { user: 'dwight', addToTeam: false },
         ])
 
         // 👩🏾📧👳🏽‍♂️👴 Alice invites Charlie and Dwight
@@ -486,6 +486,8 @@ describe('connection', () => {
 
         // 👩🏾 Alice removes 👨🏻‍🦲 Bob from admin role
         alice.team.removeMemberRole(bob.userId, ADMIN)
+        expect(bob.team.memberHasRole(bob.userId, ADMIN)).toBe(true) // bob still sees himself as admin
+        expect(alice.team.memberHasRole(bob.userId, ADMIN)).toBe(false) // bob is not an admin on alice's team
 
         // 👨🏻‍🦲 concurrently, Bob makes 👳🏽‍♂️ Charlie an admin
         bob.team.addMemberRole(charlie.userId, ADMIN)
@@ -530,7 +532,7 @@ describe('connection', () => {
       it('when an invitation is discarded, also discard related admittance actions', async () => {
         const { alice, bob, charlie } = setup('alice', 'bob', {
           user: 'charlie',
-          member: false,
+          addToTeam: false,
         })
 
         // 👩🏾 Alice removes 👨🏻‍🦲 Bob from admin role
@@ -676,7 +678,7 @@ describe('connection', () => {
       })
 
       it('allows a new member to join after team keys have been rotated', async () => {
-        const { alice, bob, charlie } = setup(['alice', 'bob', { user: 'charlie', member: false }])
+        const { alice, bob, charlie } = setup(['alice', 'bob', { user: 'charlie', addToTeam: false }])
 
         await connect(alice, bob)
 
@@ -727,7 +729,7 @@ describe('connection', () => {
       it('unwinds an invalidated admission', async () => {
         const { alice, bob, charlie } = setup('alice', 'bob', {
           user: 'charlie',
-          member: false,
+          addToTeam: false,
         })
         expect(alice.team.adminKeys().generation).toBe(0)
 
diff --git a/packages/auth/src/lockbox/test/exports.test.ts b/packages/auth/src/lockbox/test/exports.test.ts
index 28a583625..9c0322e9f 100644
--- a/packages/auth/src/lockbox/test/exports.test.ts
+++ b/packages/auth/src/lockbox/test/exports.test.ts
@@ -8,7 +8,7 @@ import { lockbox, type Lockbox, type KeyManifest } from '../../index.js'
 import { KeyType } from 'util/index.js'
 import { setup } from 'util/testing/index.js'
 
-const { bob, eve } = setup('alice', 'bob', { user: 'eve', member: false })
+const { bob, eve } = setup('alice', 'bob', { user: 'eve', addToTeam: false })
 
 describe('lockbox public API exports', () => {
     it('lockbox.create and lockbox.open work via public API', () => {
diff --git a/packages/auth/src/lockbox/test/lockbox.test.ts b/packages/auth/src/lockbox/test/lockbox.test.ts
index afe93c374..7bc190da1 100644
--- a/packages/auth/src/lockbox/test/lockbox.test.ts
+++ b/packages/auth/src/lockbox/test/lockbox.test.ts
@@ -5,7 +5,7 @@ import { ADMIN } from 'role/index.js'
 import { KeyType } from 'util/index.js'
 import { setup } from 'util/testing/index.js'
 
-const { bob, eve } = setup('alice', 'bob', { user: 'eve', member: false })
+const { bob, eve } = setup('alice', 'bob', { user: 'eve', addToTeam: false })
 const MANAGERS = 'managers'
 
 describe('lockbox', () => {
diff --git a/packages/auth/src/role/constants.ts b/packages/auth/src/role/constants.ts
index 9b18eb647..3d2b75f72 100644
--- a/packages/auth/src/role/constants.ts
+++ b/packages/auth/src/role/constants.ts
@@ -1 +1,2 @@
 export const ADMIN = 'admin'
+export const MEMBER = 'member'
diff --git a/packages/auth/src/server/castServer.ts b/packages/auth/src/server/castServer.ts
index 4957eed86..b3082c2b7 100644
--- a/packages/auth/src/server/castServer.ts
+++ b/packages/auth/src/server/castServer.ts
@@ -7,6 +7,7 @@ const toMember = (server: Server): Member => ({
   userId: server.host,
   userName: server.host,
   keys: server.keys,
+  keysHistory: [server.keys],
   roles: [],
 })
 
diff --git a/packages/auth/src/team/Team.ts b/packages/auth/src/team/Team.ts
index 207d5bbfb..23724136b 100644
--- a/packages/auth/src/team/Team.ts
+++ b/packages/auth/src/team/Team.ts
@@ -19,7 +19,7 @@ import {
   redactKeys,
 } from '@localfirst/crdx'
 import { randomKey, signatures, symmetric, type Base58 } from '@localfirst/crypto'
-import { assert, debug, Logger } from '@localfirst/shared'
+import { assert, Logger } from '@localfirst/shared'
 import * as identity from 'connection/identity.js'
 import { type Challenge } from 'connection/types.js'
 import * as devices from 'device/index.js'
@@ -28,11 +28,11 @@ import * as invitations from 'invitation/index.js'
 import { type ProofOfInvitation } from 'invitation/index.js'
 import { normalize } from 'invitation/normalize.js'
 import * as lockbox from 'lockbox/index.js'
-import { AddRoleInput, ADMIN, type Role } from 'role/index.js'
+import { AddRoleInput, ADMIN, MEMBER, type Role } from 'role/index.js'
 import { castServer } from 'server/castServer.js'
 import { type Host, type Server } from 'server/types.js'
 import { type LocalUserContext } from 'team/context.js'
-import { KeyType, Optional, VALID, scopesMatch } from 'util/index.js'
+import { KeyType, VALID, getScope, scopesMatch } from 'util/index.js'
 import { ADMIN_SCOPE, ALL, TEAM_SCOPE, initialState } from './constants.js'
 import { membershipResolver as resolver } from './membershipResolver.js'
 import { redactUser } from './redactUser.js'
@@ -45,6 +45,7 @@ import type {
   InvitationMap,
   InviteResult,
   Member,
+  RotatedLockboxesWithUpdatedUserKeys,
   SignedEnvelope,
   TeamAction,
   TeamGraph,
@@ -54,7 +55,7 @@ import type {
 } from './types.js'
 import { isNewTeam } from './types.js'
 import { canUserAddMemberToRole } from './validate.js'
-import { isAdminOnlyActionType } from './isAdminOnlyAction.js'
+import { isActionTypeAllowedWithMemberRole, isActionTypeAllowedWithTeamKey } from './isAdminOnlyAction.js'
 
 const { DEVICE, USER } = KeyType
 /**
@@ -261,17 +262,21 @@ export class Team extends EventEmitter<TeamEvents> {
    * This can be used to add a device for an existing member - just pass the existing user as the
    * first argument.
    */
-  public addForTesting = (user: UserWithSecrets, roles: string[] = [], device?: Device) => {
-    const member = { ...redactUser(user), roles }
+  public addForTesting = (user: UserWithSecrets, roles: string[] = [], rolesWithoutLockboxes: string[] = [], device?: Device) => {
+    let member = { ...redactUser(user), roles }
 
     if (!this.has(member.userId)) {
       // Make lockboxes for the new member
       const lockboxes = this.createMemberLockboxes(member)
 
+      if (rolesWithoutLockboxes.length > 0) {
+        member = { ...member, roles: [...member.roles, ...rolesWithoutLockboxes]}
+      }
+
       // Post the member to the graph
       this.dispatch({
         type: 'ADD_MEMBER',
-        payload: { member, roles, lockboxes },
+        payload: { member, roles: [...member.roles, ...rolesWithoutLockboxes], lockboxes },
       })
     }
 
@@ -288,7 +293,10 @@ export class Team extends EventEmitter<TeamEvents> {
   /** Remove a member from the team */
   public remove = (userId: string) => {
     // Create new keys & lockboxes for any keys this person had access to
-    const lockboxes = this.rotateKeys({ type: USER, name: userId })
+    const { lockboxes, updatedUserKeys } = this.rotateKeys({ type: USER, name: userId })
+
+    // update the keys on the member records (except the removed user)
+    this.updateMemberKeysWithLockboxes(updatedUserKeys, lockboxes, [userId])
 
     // Post the removal to the graph
     this.dispatch({
@@ -316,9 +324,15 @@ export class Team extends EventEmitter<TeamEvents> {
       : select.role(this.state, roleName) // One role
   }
 
-  /** Returns true if the member with the given userId has the given role */
-  public memberHasRole = (userId: string, roleName: string) =>
-    select.memberHasRole(this.state, userId, roleName)
+  /** Returns true if the member with the given userId has the given role marker and associated lockbox */
+  public memberHasRole = (userId: string, roleName: string) => {
+    return select.memberHasRole(this.state, userId, roleName)
+  }
+
+  /** Returns true if the member with the given userId has the given role marker */
+  public memberHasRoleMarker = (userId: string, roleName: string) => {
+    return select.memberHasRoleMarker(this.state, userId, roleName)
+  }
 
   /** Returns true if the member with the given userId is a member of the 3 role */
   public memberIsAdmin = (userId: string) => select.memberIsAdmin(this.state, userId)
@@ -416,7 +430,10 @@ export class Team extends EventEmitter<TeamEvents> {
     }
 
     // Create new keys & lockboxes for any keys this person had access to via this role
-    const lockboxes = this.rotateKeys({ type: KeyType.ROLE, name: roleName })
+    const { lockboxes, updatedUserKeys } = this.rotateKeys({ type: KeyType.ROLE, name: roleName })
+
+    // update the keys on the member records
+    this.updateMemberKeysWithLockboxes(updatedUserKeys, lockboxes)
 
     // Post the removal to the graph
     this.dispatch({
@@ -427,9 +444,18 @@ export class Team extends EventEmitter<TeamEvents> {
 
   /** Check if member is priveleged enough to perform a specific action */
   private _memberHasPrivelegeToPerformAction(memberId: string, actionType: TeamAction['type']): boolean {
-    if (!isAdminOnlyActionType(actionType)) {
+    if (this.members(memberId) == null) {
+      return false
+    }
+
+    if (isActionTypeAllowedWithTeamKey(actionType)) {
+      return true
+    }
+
+    if (isActionTypeAllowedWithMemberRole(actionType) && this.memberHasRole(memberId, MEMBER)) {
       return true
     }
+
     return this.memberIsAdmin(memberId)
   }
 
@@ -484,7 +510,10 @@ export class Team extends EventEmitter<TeamEvents> {
     if (!this.hasDevice(deviceId)) throw new Error(`Device ${deviceId} not found`)
 
     // Create new keys & lockboxes for any keys this device had access to
-    const lockboxes = this.rotateKeys({ type: DEVICE, name: deviceId })
+    const { lockboxes, updatedUserKeys } = this.rotateKeys({ type: DEVICE, name: deviceId })
+
+    // update the keys on the member records
+    this.updateMemberKeysWithLockboxes(updatedUserKeys, lockboxes)
 
     // Post the removal to the graph
     this.dispatch({
@@ -929,7 +958,7 @@ export class Team extends EventEmitter<TeamEvents> {
     newKeys.generation = oldKeys.generation + 1
 
     // Treat the old keys as compromised, and generate new lockboxes for any keys they could see
-    const lockboxes = this.rotateKeys(newKeys)
+    const { lockboxes } = this.rotateKeys(newKeys)
 
     // Post our new public keys to the graph
     const action = isForUser ? 'CHANGE_MEMBER_KEYS' : 'CHANGE_SERVER_KEYS'
@@ -965,11 +994,14 @@ export class Team extends EventEmitter<TeamEvents> {
     for (const userId of this.state.pendingKeyRotations) {
       // We don't know if the user was added to any other roles, so we're just preemptively rotating
       // all lockboxes *we* can see (since we're an admin, we have access to all keys)
-      const lockboxes = this.rotateKeys({
+      const { lockboxes, updatedUserKeys } = this.rotateKeys({
         type: USER,
         name: this.userId,
       })
       this.dispatch({ type: 'ROTATE_KEYS', payload: { userId, lockboxes } })
+
+      // update the keys on the member records
+      this.updateMemberKeysWithLockboxes(updatedUserKeys, lockboxes)
     }
   }
 
@@ -992,7 +1024,8 @@ export class Team extends EventEmitter<TeamEvents> {
    * @param compromised If `compromised` is a keyset, that will become the new keyset for the
    * compromised scope. If it is just a scope, new keys will be randomly generated for that scope.
    */
-  private readonly rotateKeys = (compromised: KeyScope | KeysetWithSecrets) => {
+  private readonly rotateKeys = (compromised: KeyScope | KeysetWithSecrets): RotatedLockboxesWithUpdatedUserKeys => {
+    this.logger.debug('rotating keys for scope', getScope(compromised))
     const newKeyset = isKeyset(compromised)
       ? compromised // We're given a keyset - use it as the new keys
       : createKeyset(compromised) // We're just given a scope - generate new keys for it
@@ -1003,24 +1036,46 @@ export class Team extends EventEmitter<TeamEvents> {
 
     // Generate new keys for each one
     const newKeysets = [newKeyset, ...otherNewKeysets]
+    const updatedUserKeys: Set<Keyset> = new Set()
+    const _addUpdatedUserKeys = (updatedRecipientKeys: Keyset | undefined | null): void => {
+      if (updatedRecipientKeys != null && updatedRecipientKeys.type === KeyType.USER) {
+        updatedUserKeys.add(updatedRecipientKeys)
+      }
+    }
 
     // Create new lockboxes for each of these
     const newLockboxes = newKeysets.flatMap(newKeyset => {
       const oldLockboxes = select.lockboxesInScope(this.state, newKeyset)
-
       return oldLockboxes.map(oldLockbox => {
         // Check whether we have new keys for the recipient of this lockbox
         const updatedKeyset = newKeysets.find(k => scopesMatch(k, oldLockbox.recipient))
-        return lockbox.rotate({
+        const updatedRecipientKeys = updatedKeyset ? redactKeys(updatedKeyset) : undefined
+        const newLockbox = lockbox.rotate({
           oldLockbox,
           newContents: newKeyset,
           // If we did, address the new lockbox to those keys
-          updatedRecipientKeys: updatedKeyset ? redactKeys(updatedKeyset) : undefined,
+          updatedRecipientKeys,
         })
+        _addUpdatedUserKeys(updatedRecipientKeys)
+        return newLockbox
       })
     })
 
-    return newLockboxes
+    return {
+      lockboxes: newLockboxes,
+      updatedUserKeys,
+    }
+  }
+
+  private readonly updateMemberKeysWithLockboxes = (newUserKeys: Set<Keyset>, lockboxes: lockbox.Lockbox[], skipUserIds: string[] = []): void => {
+    for (const keyset of newUserKeys) {
+      if (skipUserIds.includes(keyset.name)) {
+        this.logger.debug('skipping updating member keys', keyset.name)
+        continue
+      }
+      this.logger.debug('updating member keys after rotation (user ID, new key generation, lockbox count)', keyset.name, keyset.generation, lockboxes.length)
+      this.dispatch({ type: 'CHANGE_MEMBER_KEYS', payload: { keys: keyset, lockboxes }})
+    }
   }
 }
 
diff --git a/packages/auth/src/team/invalidLinkReducer.ts b/packages/auth/src/team/invalidLinkReducer.ts
index 0f427abf4..efb448bec 100644
--- a/packages/auth/src/team/invalidLinkReducer.ts
+++ b/packages/auth/src/team/invalidLinkReducer.ts
@@ -28,6 +28,7 @@ export const invalidLinkReducer = (state: TeamState, link: TeamLink): TeamState
         userName: '', // not needed here
         userId,
         keys,
+        keysHistory: [keys],
         roles: [],
       }
       const removedMembers = [...state.removedMembers, member]
diff --git a/packages/auth/src/team/isAdminOnlyAction.ts b/packages/auth/src/team/isAdminOnlyAction.ts
index d8d6368ab..f4492390a 100644
--- a/packages/auth/src/team/isAdminOnlyAction.ts
+++ b/packages/auth/src/team/isAdminOnlyAction.ts
@@ -1,21 +1,41 @@
 import { type TeamAction, type TeamLinkBody } from './types.js'
 
+// Anyone with team key can perform these actions
+const NON_MEMBER_NON_ADMIN_ACTIONS: Array<TeamAction['type']> = [
+  'ADMIT_MEMBER',
+  'ADD_DEVICE',
+  'ADD_MEMBER_ROLE',
+  'CHANGE_SERVER_KEYS',
+  'ADMIT_DEVICE',
+]
+
+// Anyone with MEMBER role can perform these actions + those in NON_MEMBER_NON_ADMIN_ACTIONS
+const MEMBER_NON_ADMIN_ACTIONS: Array<TeamAction['type']> = [
+  'INVITE_DEVICE',
+  'CHANGE_MEMBER_KEYS',
+  'REMOVE_DEVICE',
+]
+
 export const isAdminOnlyAction = (action: TeamLinkBody) => {
   return isAdminOnlyActionType(action.type)
 }
 
+export const isActionAllowedWithTeamKey = (action: TeamLinkBody): boolean => {
+  return isActionTypeAllowedWithTeamKey(action.type)
+}
+
+export const isActionAllowedWithMemberRole = (action: TeamLinkBody): boolean => {
+  return isActionTypeAllowedWithMemberRole(action.type)
+}
+
 export const isAdminOnlyActionType = (actionType: TeamAction['type']): boolean => {
-  // Any team member can do these things
-  const nonAdminActions: Array<TeamAction['type']> = [
-    'INVITE_DEVICE',
-    'ADD_DEVICE',
-    'REMOVE_DEVICE',
-    'CHANGE_MEMBER_KEYS',
-    'CHANGE_SERVER_KEYS',
-    'ADMIT_MEMBER',
-    'ADMIT_DEVICE',
-    'ADD_MEMBER_ROLE',
-  ]
-
-  return !nonAdminActions.includes(actionType)
+  return !isActionTypeAllowedWithTeamKey(actionType) && !isActionTypeAllowedWithMemberRole(actionType)
+}
+
+export const isActionTypeAllowedWithTeamKey = (actionType: TeamAction['type']): boolean => {
+  return NON_MEMBER_NON_ADMIN_ACTIONS.includes(actionType)
+}
+
+export const isActionTypeAllowedWithMemberRole = (actionType: TeamAction['type']): boolean => {
+  return MEMBER_NON_ADMIN_ACTIONS.includes(actionType)
 }
diff --git a/packages/auth/src/team/reducer.ts b/packages/auth/src/team/reducer.ts
index c28d408bb..7f9b0b96a 100644
--- a/packages/auth/src/team/reducer.ts
+++ b/packages/auth/src/team/reducer.ts
@@ -185,6 +185,7 @@ const getTransforms = (action: TeamAction): Transform[] => {
         userId,
         userName,
         keys: memberKeys,
+        keysHistory: [memberKeys],
         roles: [],
       }
 
diff --git a/packages/auth/src/team/selectors/memberHasRole.ts b/packages/auth/src/team/selectors/memberHasRole.ts
index ede1437ee..24aacb2f6 100644
--- a/packages/auth/src/team/selectors/memberHasRole.ts
+++ b/packages/auth/src/team/selectors/memberHasRole.ts
@@ -1,8 +1,29 @@
 import { ADMIN } from 'role/index.js'
 import * as select from 'team/selectors/index.js'
 import { type TeamState } from 'team/types.js'
+import { KeyType } from '../../util/types.js'
 
-export const memberHasRole = (state: TeamState, userId: string, role: string) => {
+export const memberHasRole = (state: TeamState, userId: string, roleName: string) => {
+  if (!memberHasRoleMarker(state, userId, roleName)) {
+    return false
+  }
+
+  const lockboxesForRole = select.lockboxesInScope(state, { type: KeyType.ROLE, name: roleName })
+  if (lockboxesForRole.length === 0) {
+    return false
+  }
+
+  const member = select.member(state, userId, { includeRemoved: false })
+  if (lockboxesForRole.find((lockbox) => {
+    return lockbox.recipient.type === KeyType.USER && lockbox.recipient.name === userId && lockbox.recipient.generation === member.keys.generation && lockbox.recipient.publicKey === member.keys.encryption
+  }) == null) {
+    return false
+  }
+
+  return true
+}
+
+export const memberHasRoleMarker = (state: TeamState, userId: string, role: string) => {
   if (!select.hasMember(state, userId)) {
     return false
   }
diff --git a/packages/auth/src/team/selectors/membersInRole.ts b/packages/auth/src/team/selectors/membersInRole.ts
index c327a4f10..309a7f4cc 100644
--- a/packages/auth/src/team/selectors/membersInRole.ts
+++ b/packages/auth/src/team/selectors/membersInRole.ts
@@ -1,7 +1,14 @@
 import { ADMIN } from 'role/index.js'
-import { type TeamState } from 'team/types.js'
+import { type Member, type TeamState } from 'team/types.js'
+import { memberHasRole } from './memberHasRole.js'
 
-export const membersInRole = (state: TeamState, roleName: string) =>
+export const membersInRole = (state: TeamState, roleName: string) => {
+  const memberHasRoleLockbox = (member: Member): boolean => memberHasRole(state, member.userId, roleName)
+
+  return membersWithRoleMarker(state, roleName).filter(member => memberHasRoleLockbox(member))
+}
+
+export const membersWithRoleMarker = (state: TeamState, roleName: string): Member[] => 
   state.members.filter(member => member.roles?.includes(roleName))
 
 export const admins = (state: TeamState) => membersInRole(state, ADMIN)
diff --git a/packages/auth/src/team/selectors/teamKeyring.ts b/packages/auth/src/team/selectors/teamKeyring.ts
index fb6c735f7..893e1101c 100644
--- a/packages/auth/src/team/selectors/teamKeyring.ts
+++ b/packages/auth/src/team/selectors/teamKeyring.ts
@@ -6,6 +6,7 @@ import { keyMap } from './keyMap.js'
 const { TEAM } = KeyType
 
 export const teamKeyring = (state: TeamState, keys: KeysetWithSecrets) => {
-  const allTeamKeys = keyMap(state, keys)[TEAM][TEAM]
+  const resolvedKeyMap = keyMap(state, keys)
+  const allTeamKeys = resolvedKeyMap[TEAM][TEAM]
   return createKeyring(allTeamKeys)
 }
diff --git a/packages/auth/src/team/selectors/test/visibleKeys.test.ts b/packages/auth/src/team/selectors/test/visibleKeys.test.ts
index 0455a9cb2..ee98675a1 100644
--- a/packages/auth/src/team/selectors/test/visibleKeys.test.ts
+++ b/packages/auth/src/team/selectors/test/visibleKeys.test.ts
@@ -1,7 +1,7 @@
 import { createKeyset } from '@localfirst/crdx'
 import { describe, expect, it } from 'vitest'
 import * as select from '../index.js'
-import { ADMIN } from 'role/index.js'
+import { ADMIN, MEMBER } from 'role/index.js'
 import { KeyType, getScope } from 'util/index.js'
 import { setup } from 'util/testing/index.js'
 
@@ -14,11 +14,12 @@ describe('visibleKeys', () => {
     expect(keysAliceSees.map(getScope)).toEqual([
       { type: TEAM, name: TEAM },
       { type: ROLE, name: ADMIN },
+      { type: ROLE, name: MEMBER }, 
     ])
   })
 
   it('bob can only see team keys', () => {
-    const { bob } = setup('alice', { user: 'bob', admin: false })
+    const { bob } = setup('alice', { user: 'bob', admin: false, member: false })
     const keysBobKeys = select.visibleKeys(bob.team.state, bob.user.keys)
     expect(keysBobKeys.map(getScope)).toEqual([{ type: TEAM, name: TEAM }])
   })
@@ -28,7 +29,7 @@ describe('visibleKeys', () => {
     alice.team.addRole('MANAGERS')
     const adminKeys = alice.team.adminKeys()
     const keysAdminSees = select.visibleKeys(alice.team.state, adminKeys)
-    expect(keysAdminSees.map(getScope)).toEqual([{ type: ROLE, name: 'MANAGERS' }])
+    expect(keysAdminSees.map(getScope)).toEqual([{ type: ROLE, name: MEMBER }, { type: ROLE, name: 'MANAGERS' }])
   })
 
   it('admin role can see all other role keys', () => {
@@ -36,7 +37,7 @@ describe('visibleKeys', () => {
     alice.team.addRole('MANAGERS')
     const adminKeys = alice.team.adminKeys()
     const keysAdminSees = select.visibleKeys(alice.team.state, adminKeys)
-    expect(keysAdminSees.map(getScope)).toEqual([{ type: ROLE, name: 'MANAGERS' }])
+    expect(keysAdminSees.map(getScope)).toEqual([{ type: ROLE, name: MEMBER }, { type: ROLE, name: 'MANAGERS' }])
   })
 
   it('after rotating keys, can still see the same scopes', () => {
@@ -46,6 +47,7 @@ describe('visibleKeys', () => {
     expect(getUserKeys()).toEqual([
       { type: TEAM, name: TEAM },
       { type: ROLE, name: ADMIN },
+      { type: ROLE, name: MEMBER }, 
     ])
 
     // Rotating the keys creates new lockboxes, but we don't see duplicate keys
@@ -53,6 +55,7 @@ describe('visibleKeys', () => {
     expect(getUserKeys()).toEqual([
       { type: TEAM, name: TEAM },
       { type: ROLE, name: ADMIN },
+      { type: ROLE, name: MEMBER }, 
     ])
   })
 })
diff --git a/packages/auth/src/team/selectors/test/visibleScopes.test.ts b/packages/auth/src/team/selectors/test/visibleScopes.test.ts
index 40bd98dd2..f0af4c446 100644
--- a/packages/auth/src/team/selectors/test/visibleScopes.test.ts
+++ b/packages/auth/src/team/selectors/test/visibleScopes.test.ts
@@ -1,5 +1,5 @@
 import { createKeyset } from '@localfirst/crdx'
-import { ADMIN } from 'role/index.js'
+import { ADMIN, MEMBER } from 'role/index.js'
 import { KeyType } from 'util/index.js'
 import { setup } from 'util/testing/index.js'
 import { describe, expect, it } from 'vitest'
@@ -8,7 +8,7 @@ import * as select from '../index.js'
 const { USER, TEAM, ROLE } = KeyType
 
 describe('visibleScopes', () => {
-  it("alice's device can see user, admin and team keys", () => {
+  it("alice's device can see user, admin, member and team keys", () => {
     const { alice } = setup('alice')
 
     const { type, name } = alice.device.keys
@@ -17,10 +17,11 @@ describe('visibleScopes', () => {
       { type: USER, name: alice.userId },
       { type: TEAM, name: TEAM },
       { type: ROLE, name: ADMIN },
+      { type: ROLE, name: MEMBER },
     ])
   })
 
-  it('alice can see admin and team keys', () => {
+  it('alice can see admin, member and team keys', () => {
     const { alice } = setup('alice')
     const aliceScopes = select.visibleScopes(alice.team.state, {
       type: USER,
@@ -29,11 +30,12 @@ describe('visibleScopes', () => {
     expect(aliceScopes).toEqual([
       { type: TEAM, name: TEAM },
       { type: ROLE, name: ADMIN },
+      { type: ROLE, name: MEMBER },
     ])
   })
 
   it('bob can only see team keys', () => {
-    const { bob } = setup('alice', { user: 'bob', admin: false })
+    const { bob } = setup('alice', { user: 'bob', admin: false, member: false, addToTeam: true })
     const bobScopes = select.visibleScopes(bob.team.state, {
       type: USER,
       name: bob.userId,
@@ -48,7 +50,7 @@ describe('visibleScopes', () => {
       type: ROLE,
       name: ADMIN,
     })
-    expect(adminScopes).toEqual([{ type: ROLE, name: 'MANAGERS' }])
+    expect(adminScopes).toEqual([{type: ROLE, name: MEMBER}, { type: ROLE, name: 'MANAGERS' }])
   })
 
   it('after rotating keys, can still see the same scopes', () => {
@@ -66,13 +68,14 @@ describe('visibleScopes', () => {
     expect(getUserScopes()).toEqual([
       { type: TEAM, name: TEAM },
       { type: ROLE, name: ADMIN },
+      { type: ROLE, name: MEMBER },
     ])
 
     // Rotating the keys creates new lockboxes, but we don't see duplicate scopes
     changeUserKeys()
-    expect(getUserScopes().length).toBe(2)
+    expect(getUserScopes().length).toBe(3)
 
     changeUserKeys()
-    expect(getUserScopes().length).toBe(2)
+    expect(getUserScopes().length).toBe(3)
   })
 })
diff --git a/packages/auth/src/team/selectors/visibleKeys.ts b/packages/auth/src/team/selectors/visibleKeys.ts
index 5745f6b3c..383c9756d 100644
--- a/packages/auth/src/team/selectors/visibleKeys.ts
+++ b/packages/auth/src/team/selectors/visibleKeys.ts
@@ -1,6 +1,7 @@
 import { type KeysetWithSecrets } from '@localfirst/crdx'
 import { open } from 'lockbox/index.js'
 import { type TeamState } from 'team/types.js'
+import { unique } from '../../util/unique.js'
 
 /**
  * Returns all keys that can be accessed directly or indirectly (via lockboxes) by the given keyset
@@ -20,5 +21,5 @@ export const visibleKeys = (state: TeamState, keyset: KeysetWithSecrets): Keyset
   // Recursively get all the keys *those* keys can access
   const keys = keysets.flatMap(keyset => visibleKeys(state, keyset))
 
-  return [...keysets, ...keys]
+  return unique([...keysets, ...keys], s => s.name + s.type + s.generation)
 }
diff --git a/packages/auth/src/team/test/devices.test.ts b/packages/auth/src/team/test/devices.test.ts
index 0b950fe54..e28d2e571 100644
--- a/packages/auth/src/team/test/devices.test.ts
+++ b/packages/auth/src/team/test/devices.test.ts
@@ -114,7 +114,7 @@ describe('Team', () => {
 
       // Add bob's phone
       const phone = redactDevice(bob.phone!)
-      bob.team.addForTesting(bob.user, [], phone)
+      bob.team.addForTesting(bob.user, [], [], phone)
 
       // Remove bob's phone
       bob.team.removeDevice(phone.deviceId)
@@ -122,6 +122,11 @@ describe('Team', () => {
       // Team keys have now been rotated once
       expect(bob.team.teamKeys().generation).toBe(1)
       expect(bob.team.teamKeys().secretKey).not.toBe(secretKey)
+
+      // Updates user keys on member record after rotation
+      const bobUser = bob.team.members(bob.userId)
+      expect(bobUser.keys.generation).toBe(1)
+      expect(bobUser.keysHistory).toHaveLength(2)
     })
   })
 })
diff --git a/packages/auth/src/team/test/invitations.test.ts b/packages/auth/src/team/test/invitations.test.ts
index a050eed20..6ff94f0e5 100644
--- a/packages/auth/src/team/test/invitations.test.ts
+++ b/packages/auth/src/team/test/invitations.test.ts
@@ -1,5 +1,6 @@
 import { createKeyset, type UnixTimestamp } from '@localfirst/crdx'
 import { signatures } from '@localfirst/crypto'
+import { Logger } from '@localfirst/shared'
 import { redactDevice, type FirstUseDevice } from 'index.js'
 import { generateProof } from 'invitation/index.js'
 import * as teams from 'team/index.js'
@@ -13,7 +14,7 @@ describe('Team', () => {
   describe('invitations', () => {
     describe('members', () => {
       it('accepts valid proof of invitation', () => {
-        const { alice, bob } = setup('alice', { user: 'bob', member: false })
+        const { alice, bob } = setup('alice', { user: 'bob', addToTeam: false })
 
         // 👩🏾 Alice invites 👨🏻‍🦲 Bob by sending him a random secret key
         const { seed } = alice.team.inviteMember()
@@ -30,7 +31,7 @@ describe('Team', () => {
       })
 
       it('lets you use a secret invitation seed of your choosing', () => {
-        const { alice, bob } = setup('alice', { user: 'bob', member: false })
+        const { alice, bob } = setup('alice', { user: 'bob', addToTeam: false })
 
         // 👩🏾 Alice invites 👨🏻‍🦲 Bob by sending him a secret key of her choosing
         const seed = 'passw0rd'
@@ -45,7 +46,7 @@ describe('Team', () => {
       })
 
       it('normalizes the a secret invitation seed ', () => {
-        const { alice, bob } = setup('alice', { user: 'bob', member: false })
+        const { alice, bob } = setup('alice', { user: 'bob', addToTeam: false })
 
         // 👩🏾 Alice invites 👨🏻‍🦲 Bob
         const seed = 'abc def ghi'
@@ -63,7 +64,7 @@ describe('Team', () => {
         const { alice, bob, charlie } = setup(
           'alice',
           { user: 'bob', admin: false },
-          { user: 'charlie', member: false }
+          { user: 'charlie', addToTeam: false }
         )
 
         // 👩🏾 Alice invites 👳🏽‍♂️ Charlie by sending him a secret key
@@ -92,7 +93,7 @@ describe('Team', () => {
       })
 
       it("will use an invitation that hasn't expired yet", () => {
-        const { alice, bob } = setup('alice', { user: 'bob', member: false })
+        const { alice, bob } = setup('alice', { user: 'bob', addToTeam: false })
 
         // 👩🏾 Alice invites 👨🏻‍🦲 Bob with a future expiration date
         const expiration = new Date(Date.UTC(2999, 12, 25)).valueOf() as UnixTimestamp // NOTE 👩‍🚀 this test will fail if run in the distant future
@@ -105,7 +106,7 @@ describe('Team', () => {
       })
 
       it("won't use an expired invitation", () => {
-        const { alice, bob } = setup('alice', { user: 'bob', member: false })
+        const { alice, bob } = setup('alice', { user: 'bob', addToTeam: false })
 
         // A long time ago 👩🏾 Alice invited 👨🏻‍🦲 Bob
         const expiration = new Date(Date.UTC(2020, 12, 25)).valueOf() as UnixTimestamp
@@ -126,8 +127,8 @@ describe('Team', () => {
       it('can use an invitation multiple times', () => {
         const { alice, bob, charlie } = setup(
           'alice',
-          { user: 'bob', member: false },
-          { user: 'charlie', member: false }
+          { user: 'bob', addToTeam: false },
+          { user: 'charlie', addToTeam: false }
         )
 
         const { seed } = alice.team.inviteMember({ maxUses: 2 })
@@ -173,8 +174,8 @@ describe('Team', () => {
       it("won't use an invitation more than the maximum uses defined", () => {
         const { alice, bob, charlie } = setup(
           'alice',
-          { user: 'bob', member: false },
-          { user: 'charlie', member: false }
+          { user: 'bob', addToTeam: false },
+          { user: 'charlie', addToTeam: false }
         )
 
         const { seed } = alice.team.inviteMember({ maxUses: 1 })
@@ -207,7 +208,7 @@ describe('Team', () => {
         const { alice, bob, charlie } = setup(
           'alice',
           { user: 'bob', admin: false },
-          { user: 'charlie', member: false }
+          { user: 'charlie', addToTeam: false }
         )
 
         // 👩🏾 Alice invites 👳🏽‍♂️ Charlie by sending him a secret key
@@ -291,6 +292,7 @@ describe('Team', () => {
             serializedGraph,
             teamKeyring,
             invitationSeed: seed,
+            logger: new Logger({moduleName: 'foo'})
           })
 
           const phoneTeam = teams.load(
diff --git a/packages/auth/src/team/test/keys.test.ts b/packages/auth/src/team/test/keys.test.ts
index 03f8230c2..3d1644887 100644
--- a/packages/auth/src/team/test/keys.test.ts
+++ b/packages/auth/src/team/test/keys.test.ts
@@ -79,13 +79,13 @@ describe('Team', () => {
       }
 
       expect(alice.team.adminKeys().generation).toBe(0)
-      expect(alice.team.state.lockboxes.length).toBe(3) // Team keys for alice, admin keys for alice, alice user keys for alice's laptop
+      expect(alice.team.state.lockboxes.length).toBe(5) // Team keys for alice, admin keys for alice, alice user keys for alice's laptop, admin keys for member role, alice keys for member role
 
       changeKeys()
       changeKeys()
       changeKeys()
       expect(alice.team.adminKeys().generation).toBe(3)
-      expect(alice.team.state.lockboxes.length).toBe(12) // The number of lockboxes shouldn't grow exponentially
+      expect(alice.team.state.lockboxes.length).toBe(20) // The number of lockboxes shouldn't grow exponentially
     })
 
     it("Bob can't change Alice's keys", () => {
@@ -119,7 +119,7 @@ describe('Team', () => {
       const newKeys = createKeyset({ type: USER, name: 'bob' })
 
       // @ts-expect-error - rotateKeys is private
-      const lockboxes = eve.team.rotateKeys(newKeys)
+      const { lockboxes } = eve.team.rotateKeys(newKeys)
 
       const tryToChangeBobsKeys = () => {
         eve.team.dispatch({
diff --git a/packages/auth/src/team/test/members.test.ts b/packages/auth/src/team/test/members.test.ts
index cd187b881..e081f94e0 100644
--- a/packages/auth/src/team/test/members.test.ts
+++ b/packages/auth/src/team/test/members.test.ts
@@ -53,7 +53,7 @@ describe('Team', () => {
     })
 
     it("doesn't care if you add a member twice", () => {
-      const { alice, bob } = setup('alice', { user: 'bob', member: false })
+      const { alice, bob } = setup('alice', { user: 'bob', addToTeam: false })
 
       const addBob = () => {
         alice.team.addForTesting(bob.user)
@@ -70,7 +70,7 @@ describe('Team', () => {
     })
 
     it('removes a member', () => {
-      const { alice, bob, charlie } = setup('alice', 'bob', { user: 'charlie', member: false })
+      const { alice, bob, charlie } = setup('alice', 'bob', { user: 'charlie', addToTeam: false })
 
       expect(alice.team.has(bob.userId)).toBe(true)
       expect(alice.team.memberWasRemoved(bob.userId)).toBe(false)
@@ -107,6 +107,11 @@ describe('Team', () => {
       // Team keys & admin keys have now been rotated once
       expect(alice.team.teamKeys().generation).toBe(1)
       expect(alice.team.adminKeys().generation).toBe(1)
+
+      // Doesn't update user keys on bob's member record after rotation
+      const bobUser = alice.team.members(bob.userId)
+      expect(bobUser.keys.generation).toBe(0)
+      expect(bobUser.keysHistory).toHaveLength(1)
     })
 
     it("doesn't do anything if asked to remove a nonexistent member", () => {
@@ -136,8 +141,8 @@ describe('Team', () => {
     it('lists all members', () => {
       const { alice, bob, charlie } = setup([
         'alice',
-        { user: 'bob', member: false },
-        { user: 'charlie', member: false },
+        { user: 'bob', addToTeam: false },
+        { user: 'charlie', addToTeam: false },
       ])
 
       expect(alice.team.members()).toHaveLength(1)
diff --git a/packages/auth/src/team/test/membershipResolver.test.ts b/packages/auth/src/team/test/membershipResolver.test.ts
index 35c08ff9d..c7d4e3d28 100644
--- a/packages/auth/src/team/test/membershipResolver.test.ts
+++ b/packages/auth/src/team/test/membershipResolver.test.ts
@@ -42,7 +42,7 @@ describe('membershipResolver', () => {
       context: bob.graphContext,
       keys,
     })
-    expect(summary(bGraph)).toEqual('ROOT,ADD:bob,ADD:managers')
+    expect(summary(bGraph)).toEqual('ROOT,SET_METADATA:{"metadata":{"selfAssignableRoles":[]}},ADD:bob,ADD:managers')
 
     // 👩🏾 Concurrently,Alice makes a change
     aGraph = append({
@@ -52,14 +52,14 @@ describe('membershipResolver', () => {
       context: alice.graphContext,
       keys,
     })
-    expect(summary(aGraph)).toEqual('ROOT,ADD:bob,ADD:charlie')
+    expect(summary(aGraph)).toEqual('ROOT,SET_METADATA:{"metadata":{"selfAssignableRoles":[]}},ADD:bob,ADD:charlie')
 
     // 🔌✔ Alice and Bob reconnect and synchronize graphs
 
     // ✅ the result will be one of these two (could be either because timestamps change with each test run)
     expectMergedResult(aGraph, bGraph, [
-      'ROOT,ADD:bob,ADD:charlie,ADD:managers',
-      'ROOT,ADD:bob,ADD:managers,ADD:charlie',
+      'ROOT,SET_METADATA:{"metadata":{"selfAssignableRoles":[]}},ADD:bob,ADD:charlie,ADD:managers',
+      'ROOT,SET_METADATA:{"metadata":{"selfAssignableRoles":[]}},ADD:bob,ADD:managers,ADD:charlie',
     ])
   })
 
@@ -77,7 +77,7 @@ describe('membershipResolver', () => {
       context: bob.graphContext,
       keys,
     })
-    expect(summary(bGraph)).toEqual('ROOT,ADD:bob,ADD:charlie')
+    expect(summary(bGraph)).toEqual('ROOT,SET_METADATA:{"metadata":{"selfAssignableRoles":[]}},ADD:bob,ADD:charlie')
 
     // 👩🏾 but concurrently,Alice removes Bob from the group
     aGraph = append({
@@ -87,12 +87,12 @@ describe('membershipResolver', () => {
       context: alice.graphContext,
       keys,
     })
-    expect(summary(aGraph)).toEqual('ROOT,ADD:bob,REMOVE:bob')
+    expect(summary(aGraph)).toEqual('ROOT,SET_METADATA:{"metadata":{"selfAssignableRoles":[]}},ADD:bob,REMOVE:bob')
 
     // 🔌✔ Alice and Bob reconnect and synchronize graphs
 
     // ✅ Bob's change is discarded - Charlie is not added
-    expectMergedResult(aGraph, bGraph, 'ROOT,ADD:bob,REMOVE:bob')
+    expectMergedResult(aGraph, bGraph, 'ROOT,SET_METADATA:{"metadata":{"selfAssignableRoles":[]}},ADD:bob,REMOVE:bob')
   })
 
   it('discards changes made by a member who is concurrently demoted', () => {
@@ -109,7 +109,7 @@ describe('membershipResolver', () => {
       context: bob.graphContext,
       keys,
     })
-    expect(summary(bGraph)).toEqual('ROOT,ADD:bob,ADD:charlie')
+    expect(summary(bGraph)).toEqual('ROOT,SET_METADATA:{"metadata":{"selfAssignableRoles":[]}},ADD:bob,ADD:charlie')
 
     // 👩🏾 but concurrently,Alice removes Bob from the admin role
     aGraph = append({
@@ -119,12 +119,12 @@ describe('membershipResolver', () => {
       context: alice.graphContext,
       keys,
     })
-    expect(summary(aGraph)).toEqual('ROOT,ADD:bob,REMOVE:admin:bob')
+    expect(summary(aGraph)).toEqual('ROOT,SET_METADATA:{"metadata":{"selfAssignableRoles":[]}},ADD:bob,REMOVE:admin:bob')
 
     // 🔌✔ Alice and Bob reconnect and synchronize graphs
 
     // ✅ Bob's change is discarded
-    expectMergedResult(aGraph, bGraph, 'ROOT,ADD:bob,REMOVE:admin:bob')
+    expectMergedResult(aGraph, bGraph, 'ROOT,SET_METADATA:{"metadata":{"selfAssignableRoles":[]}},ADD:bob,REMOVE:admin:bob')
   })
 
   it('resolves mutual concurrent removals in favor of the team founder', () => {
@@ -154,7 +154,7 @@ describe('membershipResolver', () => {
     // 🔌✔ Alice and Bob reconnect and synchronize graphs
 
     // ✅ Alice created the team; Bob's change is discarded,Alice stays
-    expectMergedResult(aGraph, bGraph, 'ROOT,ADD:bob,REMOVE:bob')
+    expectMergedResult(aGraph, bGraph, 'ROOT,SET_METADATA:{"metadata":{"selfAssignableRoles":[]}},ADD:bob,REMOVE:bob')
   })
 
   it('resolves mutual concurrent removals in favor of the senior member', () => {
@@ -196,7 +196,7 @@ describe('membershipResolver', () => {
     // 🔌✔ Bob and Charlie reconnect and synchronize graphs
 
     // ✅ Bob was added first; Charlie's change is discarded,Bob stays
-    expectMergedResult(bGraph, cGraph, 'ROOT,ADD:bob,ADD:charlie,REMOVE:charlie')
+    expectMergedResult(bGraph, cGraph, 'ROOT,SET_METADATA:{"metadata":{"selfAssignableRoles":[]}},ADD:bob,ADD:charlie,REMOVE:charlie')
   })
 
   it('resolves mutual concurrent demotions in favor of the team founder', () => {
@@ -226,7 +226,7 @@ describe('membershipResolver', () => {
     // 🔌✔ Alice and Bob reconnect and synchronize graphs
 
     // ✅ Alice created the team; Bob's change is discarded,Alice is still an admin
-    expectMergedResult(aGraph, bGraph, 'ROOT,ADD:bob,REMOVE:admin:bob')
+    expectMergedResult(aGraph, bGraph, 'ROOT,SET_METADATA:{"metadata":{"selfAssignableRoles":[]}},ADD:bob,REMOVE:admin:bob')
   })
 
   it('resolves circular mutual concurrent demotions in favor of the team founder', () => {
@@ -283,7 +283,7 @@ describe('membershipResolver', () => {
     ]
 
     // ✅ Alice created the team; Bob's change is discarded,Alice is still an admin
-    const expected = 'ROOT,ADD:bob,ADD:charlie,REMOVE:admin:bob'
+    const expected = 'ROOT,SET_METADATA:{"metadata":{"selfAssignableRoles":[]}},ADD:bob,ADD:charlie,REMOVE:admin:bob'
     for (const graph of mergedGraphs) {
       expect(summary(graph)).toBe(expected)
     }
diff --git a/packages/auth/src/team/test/roles.test.ts b/packages/auth/src/team/test/roles.test.ts
index a98c46007..afaf01090 100644
--- a/packages/auth/src/team/test/roles.test.ts
+++ b/packages/auth/src/team/test/roles.test.ts
@@ -1,4 +1,4 @@
-import { AddRoleInput, ADMIN } from 'role/index.js'
+import { AddRoleInput, ADMIN, MEMBER } from 'role/index.js'
 import * as teams from 'team/index.js'
 import { setup } from 'util/testing/index.js'
 import 'util/testing/expect/toLookLikeKeyset.js'
@@ -34,20 +34,20 @@ describe('Team', () => {
       const { alice, bob } = setup('alice', 'bob')
 
       // We only have default roles to start out
-      expect(alice.team.roles().map(r => r.roleName)).toEqual([ADMIN])
+      expect(alice.team.roles().map(r => r.roleName)).toEqual([ADMIN, MEMBER])
       expect(alice.team.hasRole(ADMIN)).toBe(true)
       expect(alice.team.hasRole(MANAGERS)).toBe(false)
 
       // 👩🏾 Alice adds the managers role
       alice.team.addRole(managers)
-      expect(alice.team.roles().map(r => r.roleName)).toEqual([ADMIN, MANAGERS])
+      expect(alice.team.roles().map(r => r.roleName)).toEqual([ADMIN, MEMBER, MANAGERS])
       expect(alice.team.roles(MANAGERS).roleName).toBe(MANAGERS)
       expect(alice.team.roles(MANAGERS).createdBy).toBe(alice.userId)
       expect(alice.team.hasRole(MANAGERS)).toBe(true)
 
       // 👩🏾 Alice adds 👨🏻‍🦲 Bob to the managers role
       alice.team.addMemberRole(bob.userId, MANAGERS)
-      expect(alice.team.membersInRole(MANAGERS).map(m => m.userName)).toEqual(['bob'])
+      expect(alice.team.membersInRole(MANAGERS).map(m => m.userName)).toEqual(['alice', 'bob'])
     })
 
     it('admins have access to all role keys', () => {
@@ -56,8 +56,8 @@ describe('Team', () => {
       // 👩🏾 Alice adds the managers role
       alice.team.addRole(managers)
 
-      // 👩🏾 Alice is not a member of the managers role
-      expect(alice.team.memberHasRole(alice.userId, MANAGERS)).toBe(false)
+      // 👩🏾 Alice is a member of the managers role by default
+      expect(alice.team.memberHasRole(alice.userId, MANAGERS)).toBe(true)
 
       // But she does have access to the managers' keys
       const managersKeys = alice.team.roleKeys(MANAGERS)
@@ -87,31 +87,6 @@ describe('Team', () => {
       expect(bobsAdminKeys).toLookLikeKeyset()
     })
 
-    it('non-admin adds self to a role when creating', () => {
-      const { alice, bob } = setup('alice', { user: 'bob', admin: false })
-
-      // 👨🏻‍🦲 Bob isn't an admin
-      expect(alice.team.memberIsAdmin(bob.userId)).toBe(false)
-
-      // 👨🏻‍🦲 Bob adds a role and gives himself that role
-      bob.team.addRole(foobar)
-
-      // Now 👨🏻‍🦲 Bob is a foobar
-      expect(bob.team.hasRole(FOOBAR)).toBe(true)
-
-      // Bob persists the team
-      const savedTeam = bob.team.save()
-
-      // 👩🏾 Alice loads the team
-      alice.team = teams.load(savedTeam, alice.localContext, bob.team.teamKeys())
-
-      // 👩🏾 Alice sees 👨🏻‍🦲 Bob has the foobar role
-      expect(alice.team.memberHasRole(bob.userId, FOOBAR)).toBe(true)
-
-      // 👩🏾 Alice doesn't have the foobar role
-      expect(alice.team.memberHasRole(alice.userId, FOOBAR)).toBe(false)
-    })
-
     it('removes a member from a role', () => {
       const { alice, bob } = setup('alice', 'bob')
 
@@ -144,21 +119,17 @@ describe('Team', () => {
     })
 
     it('self-assigns a role using pre-shared keys', () => {
-      const { alice, bob } = setup('alice', 'bob')
-      
-      // 👩🏾 Alice creates MEMBER role
-      alice.team.addRole('MEMBER')
-      alice.team.addMemberRole(alice.userId, 'MEMBER')
+      const { alice, bob } = setup('alice', { user: 'bob', admin: false, member: false })
 
       // 👩🏾 Alice is a MEMBER
-      expect(alice.team.hasRole('MEMBER')).toBe(true)
-      expect(alice.team.memberHasRole(alice.userId, 'MEMBER')).toBe(true)
+      expect(alice.team.hasRole(MEMBER)).toBe(true)
+      expect(alice.team.memberHasRole(alice.userId, MEMBER)).toBe(true)
 
       // 👩🏾 Alice creates a lockbox for MEMBER keys under arbitrary keys
       const randomSeed = randomUUID()
       const arbitraryScope: KeyScope = { type: 'TESTING', name: 'TESTING' }
       const keySet = createKeyset(arbitraryScope, randomSeed)
-      alice.team.createLockbox('MEMBER', keySet)
+      alice.team.createLockbox(MEMBER, keySet)
       
       // 👩🏾 Alice persists the team
       const savedTeam = alice.team.save()
@@ -167,13 +138,13 @@ describe('Team', () => {
       bob.team = teams.load(savedTeam, bob.localContext, alice.team.teamKeys())
 
       // 👨🏻‍🦲 Bob doesn't have the MEMBER role
-      expect(bob.team.memberHasRole(bob.userId, 'MEMBER')).toBe(false)
+      expect(bob.team.memberHasRole(bob.userId, MEMBER)).toBe(false)
 
       // 👨🏻‍🦲 Bob self-assigns the MEMBER role
-      bob.team.addMemberRoleToSelf('MEMBER', keySet)
+      bob.team.addMemberRoleToSelf(MEMBER, keySet)
 
       // 👨🏻‍🦲 Bob has the MEMBER role keys
-      const bobsMemberKeys = bob.team.roleKeys('MEMBER')
+      const bobsMemberKeys = bob.team.roleKeys(MEMBER)
       expect(bobsMemberKeys).toLookLikeKeyset()
     })
 
@@ -215,12 +186,12 @@ describe('Team', () => {
 
       // 👩🏾 Alice adds the managers role
       alice.team.addRole(managers)
-      expect(alice.team.roles().map(r => r.roleName)).toEqual([ADMIN, MANAGERS])
+      expect(alice.team.roles().map(r => r.roleName)).toEqual([ADMIN, MEMBER, MANAGERS])
       expect(alice.team.roles(MANAGERS).roleName).toBe(MANAGERS)
 
       // 👩🏾 Alice removes the managers role
       alice.team.removeRole(MANAGERS)
-      expect(alice.team.roles().length).toBe(1)
+      expect(alice.team.roles().length).toBe(2) // admin, managers
     })
 
     it("won't remove the admin role", () => {
@@ -251,8 +222,8 @@ describe('Team', () => {
       const { alice } = setup('alice')
       alice.team.addRole(managers)
       const roles = alice.team.roles()
-      expect(roles).toHaveLength(2)
-      expect(roles.map(role => role.roleName)).toEqual([ADMIN, MANAGERS])
+      expect(roles).toHaveLength(3) // admin, member, managers
+      expect(roles.map(role => role.roleName)).toEqual([ADMIN, MEMBER, MANAGERS])
     })
 
     it('lists all members in a role ', () => {
@@ -263,6 +234,46 @@ describe('Team', () => {
       expect(alice.team.admins().map(m => m.userName)).toEqual(['alice', 'bob'])
     })
 
+    it(`excludes member from members in a role when they don't have a lockbox for that role`, () => {
+      const { alice, bob } = setup('alice', { user: 'bob', admin: false, rolesWithoutLockboxes: [ADMIN] })
+
+      // 👩🏾 Alice is the only member
+      expect(alice.team.membersInRole(ADMIN).map(m => m.userName)).toEqual(['alice'])
+      expect(alice.team.admins().map(m => m.userName)).toEqual(['alice'])
+      expect(bob.team.memberHasRoleMarker(bob.userId, ADMIN)).toBe(true)
+      expect(alice.team.memberHasRoleMarker(bob.userId, ADMIN)).toBe(true)
+    })
+
+    it('returns true for memberHasRole if user has role marker and lockbox', () => {
+      const { alice } = setup('alice', { user: 'bob', admin: true })
+
+      // 👩🏾 Alice and 👨🏻‍🦲 Bob are members
+      expect(alice.team.memberHasRole(alice.userId, ADMIN)).toBe(true)
+    })
+
+    it('returns false for memberHasRole if user has no role marker or lockbox', () => {
+      const { alice, bob } = setup('alice', { user: 'bob', admin: false })
+
+      // 👩🏾 Alice and 👨🏻‍🦲 Bob are members
+      expect(alice.team.memberHasRole(bob.userId, ADMIN)).toBe(false)
+    })
+
+    it('returns false for memberHasRole if user does not exist', () => {
+      const { alice, bob } = setup('alice', { user: 'bob', admin: false })
+
+      // 👩🏾 Alice and 👨🏻‍🦲 Bob are members
+      expect(alice.team.memberHasRole('NOT_A_USER', ADMIN)).toBe(false)
+    })
+
+    it('returns false for memberHasRole if user has role marker but no lockbox', () => {
+      const { alice, bob } = setup('alice', { user: 'bob', admin: false, rolesWithoutLockboxes: [ADMIN] })
+
+      // 👩🏾 Alice and 👨🏻‍🦲 Bob are members
+      expect(alice.team.memberHasRole(bob.userId, ADMIN)).toBe(false)
+      expect(bob.team.memberHasRoleMarker(bob.userId, ADMIN)).toBe(true)
+      expect(alice.team.memberHasRoleMarker(bob.userId, ADMIN)).toBe(true)
+    })
+
     it('allows an admin other than Alice to add a member', () => {
       const { bob, charlie } = setup(
         'alice',
@@ -283,7 +294,7 @@ describe('Team', () => {
       const { bob, charlie } = setup(
         'alice',
         { user: 'bob', admin: false },
-        { user: 'charlie', member: false }
+        { user: 'charlie', addToTeam: false }
       )
 
       // 👨🏻‍🦲 Bob tries to add 👳🏽‍♂️ Charlie to the team
diff --git a/packages/auth/src/team/test/servers.test.ts b/packages/auth/src/team/test/servers.test.ts
index 14e9e4d52..02fbd0dc7 100644
--- a/packages/auth/src/team/test/servers.test.ts
+++ b/packages/auth/src/team/test/servers.test.ts
@@ -21,6 +21,7 @@ import {
   type MemberContext,
   type Team,
 } from 'index.js'
+import { blob } from 'stream/consumers'
 
 describe('Team', () => {
   describe('a server', () => {
@@ -164,7 +165,7 @@ describe('Team', () => {
     it('can admit an invitee', async () => {
       const { server, alice, bob } = setup('alice', {
         user: 'bob',
-        member: false,
+        addToTeam: false,
       })
       const { seed: bobInvite } = alice.team.inviteMember()
 
@@ -301,6 +302,32 @@ describe('Team', () => {
       expect(serverTeam.teamKeys().generation).toBe(0)
       expect(serverTeam.servers(host2).keys.generation).toBe(0)
     })
+
+    it(`non-admin user can't change server's keys`, async () => {
+      const { alice, bob } = setupHumans('alice', { user: 'bob', admin: false })
+      const { server } = createServer(host)
+      alice.team.addServer(server)
+
+      const host2 = 'foo.com'
+      const { server: server2 } = createServer(host2)
+      alice.team.addServer(server2)
+
+      const savedGraph = alice.team.save()
+      const aliceTeamKeys = alice.team.teamKeys()
+      const bobTeam = loadTeam(savedGraph, bob.localContext, aliceTeamKeys)
+
+      expect(bobTeam.teamKeys().generation).toBe(0)
+      expect(bobTeam.servers(host2).keys.generation).toBe(0)
+
+      // non-admin tries to change server keys
+      expect(() => {
+        bobTeam.changeKeys(createKeyset({ type: KeyType.SERVER, name: host2 }))
+      }).toThrow()
+
+      // No keys have been rotated
+      expect(bobTeam.teamKeys().generation).toBe(0)
+      expect(bobTeam.servers(host2).keys.generation).toBe(0)
+    })
   })
 })
 
diff --git a/packages/auth/src/team/transforms/changeMemberKeys.ts b/packages/auth/src/team/transforms/changeMemberKeys.ts
index b5a551bf2..42f9052c4 100644
--- a/packages/auth/src/team/transforms/changeMemberKeys.ts
+++ b/packages/auth/src/team/transforms/changeMemberKeys.ts
@@ -10,6 +10,7 @@ export const changeMemberKeys =
         ? {
             ...member,
             keys, // 🡐 replace keys with new ones
+            keysHistory: !member.keysHistory.find(k => k.generation === keys.generation && k.encryption === keys.encryption) ? [keys, ...member.keysHistory] : member.keysHistory,
           }
         : member
     ),
diff --git a/packages/auth/src/team/types.ts b/packages/auth/src/team/types.ts
index b3882179e..28a1259f5 100644
--- a/packages/auth/src/team/types.ts
+++ b/packages/auth/src/team/types.ts
@@ -35,6 +35,9 @@ export type Member = {
   /** The member's public keys */
   keys: Keyset
 
+  /** Historical public keys */
+  keysHistory: Keyset[]
+
   /** Array of role names that the member belongs to */
   roles: string[]
 
@@ -367,3 +370,8 @@ export type LookupIdentityResult =
 export type EncryptStreamTeamPayload = { recipient: KeyMetadata, encryptStream: AsyncGenerator<Uint8Array>, header: Uint8Array }
 
 export type TeamMetadata = { selfAssignableRoles: string[] }
+
+export interface RotatedLockboxesWithUpdatedUserKeys {
+  lockboxes: Lockbox[]
+  updatedUserKeys: Set<Keyset>
+}
diff --git a/packages/auth/src/team/validate.ts b/packages/auth/src/team/validate.ts
index a3a6773f7..e17fd8ab3 100644
--- a/packages/auth/src/team/validate.ts
+++ b/packages/auth/src/team/validate.ts
@@ -1,8 +1,8 @@
-import { debug, Logger, truncateHashes } from '@localfirst/shared'
+import { Logger, truncateHashes } from '@localfirst/shared'
 import { ROOT } from '@localfirst/crdx'
 import { invitationCanBeUsed } from 'invitation/index.js'
 import { VALID, ValidationError, actionFingerprint } from 'util/index.js'
-import { isAdminOnlyAction } from './isAdminOnlyAction.js'
+import { isActionAllowedWithMemberRole, isAdminOnlyAction } from './isAdminOnlyAction.js'
 import * as select from './selectors/index.js'
 import {
   type TeamLink,
@@ -10,6 +10,7 @@ import {
   type TeamStateValidator,
   type TeamStateValidatorSet,
 } from './types.js'
+import { MEMBER } from '../role/constants.js'
 
 export const validate: TeamStateValidator = (previousState: TeamState, link: TeamLink, extendableLogger?: Logger) => {
   const logger = extendableLogger != null ? extendableLogger.extend('validate') : new Logger({ moduleName: 'auth:validate' })
@@ -27,6 +28,12 @@ export const validate: TeamStateValidator = (previousState: TeamState, link: Tea
 
 export const canUserAddMemberToRole = (roleName: string, assigningUserId: string, previousState: TeamState): boolean => {
     const metadata = select.getMetadata(previousState)
+    if (select.hasServer(previousState, assigningUserId)) {
+      return false
+    }
+    if (!select.hasMember(previousState, assigningUserId)) {
+      return false
+    }
     if (metadata.selfAssignableRoles.includes(roleName)) {
       return true
     }
@@ -69,6 +76,29 @@ const validators: TeamStateValidatorSet = {
     return VALID
   },
 
+  /** The user who made these changes was a member with the MEMBER role at the time */
+  mustBeMember(previousState: TeamState, link: TeamLink, extendableLogger: Logger) {
+    const logger = extendableLogger.extend('mustBeMember')
+    const action = link.body
+    const { type, userId } = action
+
+    // At root link, team doesn't yet have members
+    if (type === ROOT) return VALID
+
+    if (select.memberIsAdmin(previousState, userId)) {
+      return VALID
+    }
+
+    // Certain actions are allowed to be performed by non-members
+    if (isActionAllowedWithMemberRole(action)) {
+      const isntMember = !select.memberHasRole(previousState, userId, MEMBER)
+      if (isntMember) {
+        return fail(`User '${userId}' is missing the MEMBER role`, previousState, link, logger)
+      }
+    }
+    return VALID
+  },
+
   /** Unless I'm an admin, I can't remove anyone's devices but my own */
   canOnlyRemoveYourOwnDevices(previousState: TeamState, link: TeamLink, extendableLogger: Logger) {
     const logger = extendableLogger.extend('canOnlyRemoveYourOwnDevices')
@@ -98,11 +128,17 @@ const validators: TeamStateValidatorSet = {
     const authorIsAdmin = select.memberIsAdmin(previousState, author)
     if (!authorIsAdmin) {
       if (link.body.type === 'CHANGE_MEMBER_KEYS') {
+        if (select.hasServer(previousState, author)) {
+          return fail("Can't change member keys as a server", previousState, link, logger)
+        }
         const target = link.body.payload.keys.name
         if (author !== target) {
           return fail("Can't change another user's keys.", previousState, link, logger)
         }
       } else if (link.body.type === 'CHANGE_SERVER_KEYS') {
+        if (!select.hasServer(previousState, author)) {
+          return fail("Can't change server keys when not a server", previousState, link, logger)
+        }
         const target = link.body.payload.keys.name
         if (author !== target) {
           return fail("Can't change another server's keys.", previousState, link, logger)
diff --git a/packages/auth/src/util/testing/joinTestChannel.ts b/packages/auth/src/util/testing/joinTestChannel.ts
index 62ba9d970..4128a9316 100644
--- a/packages/auth/src/util/testing/joinTestChannel.ts
+++ b/packages/auth/src/util/testing/joinTestChannel.ts
@@ -1,7 +1,7 @@
 import { Connection } from 'connection/Connection.js'
 import { isServerContext, type Context } from 'connection/types.js'
 import { type TestChannel } from './TestChannel.js'
-import { pause } from '@localfirst/shared'
+import { pause, type SharedLogger } from '@localfirst/shared'
 
 /** Returns a function that can be used to join a specific test channel */
 export const joinTestChannel = (channel: TestChannel) => (context: Context) => {
diff --git a/packages/auth/src/util/testing/setup.ts b/packages/auth/src/util/testing/setup.ts
index 5907b7dd6..5744b7d14 100644
--- a/packages/auth/src/util/testing/setup.ts
+++ b/packages/auth/src/util/testing/setup.ts
@@ -4,7 +4,7 @@ import { createId } from '@paralleldrive/cuid2'
 import type { Connection, Context, InviteeContext, MemberContext } from 'connection/index.js'
 import type { DeviceWithSecrets } from 'device/index.js'
 import * as devices from 'device/index.js'
-import { ADMIN } from 'role/index.js'
+import { ADMIN, MEMBER } from 'role/index.js'
 import type { LocalUserContext } from 'team/context.js'
 import type { Team, TeamContext } from 'team/index.js'
 import * as teams from 'team/index.js'
@@ -20,7 +20,7 @@ Usage:
 
 ```ts
 const {alice, bob} = setup(['alice', 'bob'])
-const {alice, bob, charlie} = setup(['alice', 'bob', {user: 'charlie', member: false}])
+const {alice, bob, charlie} = setup(['alice', 'bob', {user: 'charlie', addToTeam: false}])
 const {alice, bob, charlie, dwight} = setup(['alice', 'bob', 'charlie', {user: 'dwight', admin: false}])
 
 alice.team.add('bob')
@@ -77,23 +77,30 @@ export const setup = (..._config: SetupConfig) => {
   const founderContext = { user: testUsers[founder], device: laptops[founder] }
   const teamName = 'Spies Я Us'
   const randomSeed = teamName
-  const team = teams.createTeam(teamName, founderContext, randomSeed, { selfAssignableRoles: ['MEMBER'] })
+  const team = teams.createTeam(teamName, founderContext, randomSeed, { selfAssignableRoles: [MEMBER] })
   const teamKeys = team.teamKeys()
+  team.addRole({ roleName: MEMBER, permissions: undefined })
 
   // Add members
-  for (const { user: userName, admin = true, member = true } of config) {
+  for (const { user: userName, admin = true, addToTeam = true, member = true, rolesWithoutLockboxes = [] } of config) {
     const user = testUsers[userName]
-    if (member && !team.has(user.userId)) {
+    if (addToTeam && !team.has(user.userId)) {
       const user = testUsers[userName]
-      const roles = admin ? [ADMIN] : []
+      const roles = []
+      if (admin) {
+        roles.push(ADMIN)
+      }
+      if (member) {
+        roles.push(MEMBER)
+      }
       const device = devices.redactDevice(laptops[userName])
-      team.addForTesting(user, roles, device)
+      team.addForTesting(user, roles, rolesWithoutLockboxes, device)
     }
   }
 
   const { graph } = team
 
-  const makeUserStuff = ({ user: userName, member = true }: TestUserSettings): UserStuff => {
+  const makeUserStuff = ({ user: userName, addToTeam = true }: TestUserSettings): UserStuff => {
     const user = testUsers[userName]
     const randomSeed = userName
     const device = laptops[userName]
@@ -101,11 +108,11 @@ export const setup = (..._config: SetupConfig) => {
 
     const localContext = { user, device }
     const graphContext = { deviceId: device.deviceId }
-    const team = member
+    const team = addToTeam
       ? teams.load(graph, localContext, createKeyring(teamKeys)) // Members get a copy of the source team
       : teams.createTeam(userName, localContext, randomSeed) // Non-members get a dummy empty placeholder team
 
-    const connectionContext: Context = member
+    const connectionContext: Context = addToTeam
       ? { user, device, team }
       : { user, device, invitationSeed: '' }
 
@@ -114,7 +121,7 @@ export const setup = (..._config: SetupConfig) => {
       userId: user.userId,
       deviceId: phone.deviceId,
       user,
-      team: member
+      team: addToTeam
         ? teams.load(graph, localContext, createKeyring(teamKeys)) // Members get a copy of the source team
         : teams.createTeam(userName, localContext, randomSeed), // Non-members get a dummy empty placeholder team
       device: phone,
@@ -156,8 +163,10 @@ export const setup = (..._config: SetupConfig) => {
 
 export type TestUserSettings = {
   user: string
+  addToTeam?: boolean
   admin?: boolean
   member?: boolean
+  rolesWithoutLockboxes?: string[]
 }
 
 export type UserStuff = {
diff --git a/packages/crdx/src/graph/index.ts b/packages/crdx/src/graph/index.ts
index bab5acb23..9115b6576 100644
--- a/packages/crdx/src/graph/index.ts
+++ b/packages/crdx/src/graph/index.ts
@@ -19,3 +19,5 @@ export * from './redactGraph.js'
 export * from './serialize.js'
 export * from './topoSort.js'
 export * from './types.js'
+export * from './isSuccessor.js'
+export * from './getSuccessors.js'
diff --git a/packages/crdx/src/sync/receiveMessage.ts b/packages/crdx/src/sync/receiveMessage.ts
index ec8e4b3bf..8d2b67aeb 100644
--- a/packages/crdx/src/sync/receiveMessage.ts
+++ b/packages/crdx/src/sync/receiveMessage.ts
@@ -2,7 +2,7 @@ import { assert, Logger } from '@localfirst/shared'
 import { decryptGraph, type DecryptFn } from 'graph/decrypt.js'
 import { getChildMap, invertLinkMap, merge, type Action, type Graph } from 'graph/index.js'
 import { createKeyring, type Keyring, type KeysetWithSecrets } from 'keyset/index.js'
-import { validate } from 'validator/index.js'
+import { validate, ValidationError } from 'validator/index.js'
 import { type SyncMessage, type SyncState } from './types.js'
 
 /**
@@ -66,21 +66,29 @@ export const receiveMessage = <A extends Action, C>(
       childMap,
     }
 
-    const theirGraph = decrypt({ encryptedGraph, keys: keyring })
+    let theirGraph: Graph<A, C> | undefined = undefined
+    try {
+      theirGraph = decrypt({ encryptedGraph, keys: keyring })
+    } catch (e) {
+      state.failedSyncCount += 1
+      state.our.reportedError = new ValidationError('Failed to decrypt their graph')
+    }
 
-    // merge with our graph
-    const mergedGraph = merge(graph, theirGraph)
+    if (theirGraph != null) {
+      // merge with our graph
+      const mergedGraph = merge(graph, theirGraph)
 
-    // check the integrity of the merged graph
-    const validation = validate(mergedGraph, undefined, logger)
-    if (validation.isValid) {
-      graph = mergedGraph
-    } else {
-      // We only get here if we've received bad links from them — maliciously, or not. The
-      // application should monitor `failedSyncCount` and decide not to trust them if it's too high.
-      state.failedSyncCount += 1
-      // Record the error so we can surface it in generateMessage
-      state.our.reportedError = validation.error
+      // check the integrity of the merged graph
+      const validation = validate(mergedGraph, undefined, logger)
+      if (validation.isValid) {
+        graph = mergedGraph
+      } else {
+        // We only get here if we've received bad links from them — maliciously, or not. The
+        // application should monitor `failedSyncCount` and decide not to trust them if it's too high.
+        state.failedSyncCount += 1
+        // Record the error so we can surface it in generateMessage
+        state.our.reportedError = validation.error
+      }
     }
 
     // either way, we can discard all pending links
diff --git a/packages/crdx/src/sync/test/sync.test.ts b/packages/crdx/src/sync/test/sync.test.ts
index 069802a11..aad440ab2 100644
--- a/packages/crdx/src/sync/test/sync.test.ts
+++ b/packages/crdx/src/sync/test/sync.test.ts
@@ -10,6 +10,7 @@ import {
 } from 'util/testing/Network.js'
 import { TEST_GRAPH_KEYS as keys } from 'util/testing/setup.js'
 import { describe, expect, it, vitest } from 'vitest'
+import { appendLink } from '../../util/testing/graph.js'
 
 const { setSystemTime } = vitest.useFakeTimers()
 
@@ -665,14 +666,15 @@ describe('sync', () => {
       // no changes yet; 👩🏾 Alice and 🦹‍♀️ Eve are synced up
       expectToBeSynced(alice, eve)
 
-      // 🦹‍♀️ Eve sets her system clock back when appending a link
-      eve.peer.graph = appendLinkInThePast(eve.peer.graph, eve.user)
+      // 🦹‍♀️ Eve adds an invalid link
+
+      eve.peer.graph = appendLink(eve.peer.graph, 'foo', eve.user.keys)
       const badHash = eve.peer.graph.head[0]
 
       eve.peer.sync()
 
       // Since Eve's graph is invalid, the sync fails
-      expect(() => network.deliverAll()).toThrow(`timestamp can't be earlier`)
+      expect(() => network.deliverAll()).toThrow(`Failed to decrypt their graph`)
 
       // They are not synced
       expectNotToBeSynced(alice, eve)
@@ -695,14 +697,14 @@ describe('sync', () => {
 
       const TRIES = 10
       for (let i = 0; i < TRIES; i++) {
-        // 🦹‍♀️ Eve sets her system clock back when appending a link
-        eve.peer.graph = appendLinkInThePast(originalGraph, eve.user)
+        // 🦹‍♀️ Eve adds an invalid link
+        eve.peer.graph = appendLink(originalGraph, 'foo', eve.user.keys)
         const badHash = eve.peer.graph.head[0]
 
         eve.peer.sync()
 
         // Since Eve's graph is invalid, the sync fails
-        expect(() => network.deliverAll()).toThrow("timestamp can't be earlier")
+        expect(() => network.deliverAll()).toThrow("Failed to decrypt their graph")
 
         // They are not synced
         expectNotToBeSynced(alice, eve)
diff --git a/packages/crdx/src/user/createUser.ts b/packages/crdx/src/user/createUser.ts
index a78bbead3..458bce3a2 100644
--- a/packages/crdx/src/user/createUser.ts
+++ b/packages/crdx/src/user/createUser.ts
@@ -11,9 +11,11 @@ export const createUser = (
   userId: string = createId(),
   seed: string = randomKey()
 ): UserWithSecrets => {
+  const keys = createKeyset({ type: KeyType.USER, name: userId }, seed)
   return {
     userName,
     userId,
-    keys: createKeyset({ type: KeyType.USER, name: userId }, seed),
+    keys,
+    keysHistory: [keys],
   }
 }
diff --git a/packages/crdx/src/user/redact.ts b/packages/crdx/src/user/redact.ts
index 13f6439ef..546cca62b 100644
--- a/packages/crdx/src/user/redact.ts
+++ b/packages/crdx/src/user/redact.ts
@@ -8,5 +8,6 @@ export const redactUser = (user: User | UserWithSecrets): User => {
     userId,
     userName,
     keys: redactKeys(user.keys),
+    keysHistory: user.keysHistory.map(k => redactKeys(k)),
   }
 }
diff --git a/packages/crdx/src/user/types.ts b/packages/crdx/src/user/types.ts
index 1b1cd7f8d..0338645e8 100644
--- a/packages/crdx/src/user/types.ts
+++ b/packages/crdx/src/user/types.ts
@@ -10,6 +10,9 @@ export type User = {
 
   /** The user's public keys. */
   keys: Keyset
+
+  /** Historical public keys */
+  keysHistory: Keyset[]
 }
 
 /** The local user and their full set of keys, including secrets.   */
@@ -19,4 +22,7 @@ export type UserWithSecrets = {
 
   /** The user's secret keys. */
   keys: KeysetWithSecrets
+
+  /** Historical secret keys */
+  keysHistory: KeysetWithSecrets[]
 }
diff --git a/packages/crdx/src/util/testing/expect/toBeValid.ts b/packages/crdx/src/util/testing/expect/toBeValid.ts
index 6b1770e4c..e5733cacc 100644
--- a/packages/crdx/src/util/testing/expect/toBeValid.ts
+++ b/packages/crdx/src/util/testing/expect/toBeValid.ts
@@ -10,14 +10,14 @@ expect.extend({
         pass: true,
       }
 
-    if (expectedMessage && !new RegExp(expectedMessage).test(validation.error.message))
+    if (expectedMessage && (validation.error == null || !new RegExp(expectedMessage).test(validation.error.message)))
       return {
         message: () =>
           `expected validation to fail with message ${expectedMessage}, but got ${validation.error.message}`,
         pass: true,
       }
     return {
-      message: () => validation.error.message,
+      message: () => validation.error?.message ?? 'expected validation to pass',
       pass: false,
     }
   },
diff --git a/packages/crdx/src/validator/test/validate.test.ts b/packages/crdx/src/validator/test/validate.test.ts
index 2597bb5f0..de05e12ee 100644
--- a/packages/crdx/src/validator/test/validate.test.ts
+++ b/packages/crdx/src/validator/test/validate.test.ts
@@ -7,12 +7,24 @@ import { hashEncryptedLink } from 'graph/hashLink.js'
 import { append, createGraph, getHead, getLink, getRoot } from 'graph/index.js'
 import { type Hash } from 'util/index.js'
 import { validate } from 'validator/validate.js'
-import 'util/testing/expect/toBeValid'
+import '../../util/testing/expect/toBeValid.js'
 
 const { setSystemTime } = vitest.useFakeTimers()
 
 const { alice, eve } = setup('alice', 'eve')
 
+const setupGraph = () => {
+  const graph = buildGraph(`
+                          ┌─ e ─ g ─┐
+                ┌─ c ─ d ─┤         ├─ o ─┐
+        a ─ b ─┤         └─── f ───┤     ├─ n
+                ├──── h ──── i ─────┘     │ 
+                └───── j ─── k ── l ──────┘           
+  `)
+    expect(validate(graph)).toBeValid()
+    return graph
+  }
+
 describe('graphs', () => {
   describe('validation', () => {
     describe('valid graphs', () => {
@@ -30,18 +42,6 @@ describe('graphs', () => {
     })
 
     describe('invalid graphs', () => {
-      const setupGraph = () => {
-        const graph = buildGraph(`
-                             ┌─ e ─ g ─┐
-                   ┌─ c ─ d ─┤         ├─ o ─┐
-            a ─ b ─┤         └─── f ───┤     ├─ n
-                   ├──── h ──── i ─────┘     │ 
-                   └───── j ─── k ── l ──────┘           
-      `)
-        expect(validate(graph)).toBeValid()
-        return graph
-      }
-
       test('The ROOT link cannot have any predecessors ', () => {
         const graph = setupGraph()
         const rootLink = getRoot(graph)
@@ -193,60 +193,6 @@ describe('graphs', () => {
         delete graph.encryptedLinks[prevLink] // eslint-disable-line @typescript-eslint/no-dynamic-delete
         expect(validate(graph)).not.toBeValid()
       })
-
-      test(`timestamp out of order`, () => {
-        const IN_THE_PAST = new Date('2020-01-01').getTime()
-        const graph = setupGraph()
-
-        // 🦹‍♀️ Eve sets her system clock back when appending a link
-        const now = Date.now()
-        setSystemTime(IN_THE_PAST)
-        const graph2 = append({
-          graph,
-          action: { type: 'FOO', payload: 'pizza' },
-          user: eve,
-          keys,
-        })
-        setSystemTime(now)
-
-        expect(validate(graph2)).not.toBeValid()
-      })
-
-      test(`timestamp in the future`, () => {
-        const IN_THE_FUTURE = new Date(`10000-01-01`).getTime() // NOTE: test will begin to fail 7,978 years from now
-        const graph = setupGraph()
-
-        // 🦹‍♀️ Eve sets her system clock forward when appending a link
-        const now = Date.now()
-        setSystemTime(IN_THE_FUTURE)
-        const graph2 = append({
-          graph,
-          action: { type: 'FOO', payload: 'pizza' },
-          user: eve,
-          keys,
-        })
-        setSystemTime(now)
-
-        expect(validate(graph2)).not.toBeValid()
-      })
-
-      test(`timestamp in the future but within fuzz factor`, () => {
-        const now = Date.now()
-        const SLIGHTLY_IN_THE_FUTURE = now + 50
-        const graph = setupGraph()
-
-        // 🦹‍♀️ Eve sets her system clock forward when appending a link
-        setSystemTime(SLIGHTLY_IN_THE_FUTURE)
-        const graph2 = append({
-          graph,
-          action: { type: 'FOO', payload: 'pizza' },
-          user: eve,
-          keys,
-        })
-        setSystemTime(now)
-
-        expect(validate(graph2)).toBeValid()
-      })
     })
   })
 })
diff --git a/packages/crdx/src/validator/validators.ts b/packages/crdx/src/validator/validators.ts
index 01c86db2f..7129d8799 100644
--- a/packages/crdx/src/validator/validators.ts
+++ b/packages/crdx/src/validator/validators.ts
@@ -36,10 +36,10 @@ const _validators: ValidatorSet = {
 
   /** If this is a root link, it should not have any predecessors, and should be the graph's root */
   validateRoot(link, graph) {
+    const root = getRoot(graph)
     const hasNoPrevLink = link.body.prev.length === 0
     const hasRootType = 'type' in link.body && link.body.type === ROOT
-    const isTheGraphRoot = getRoot(graph) === link
-    // all should be true, or all should be false
+    const isTheGraphRoot = root === link
     if (hasNoPrevLink === isTheGraphRoot && isTheGraphRoot === hasRootType) return VALID
 
     const message = hasRootType
@@ -99,7 +99,7 @@ export const fail = (msg: string, args?: any) => {
 const memoizeFunctionMap = (source: ValidatorSet) => {
   const result = {} as ValidatorSet
   const memoizeResolver = (link: Link<any, any>, graph: Graph<any, any>) => {
-    return `${link.hash}:${graph.root}`
+    return `${link.hash}:${graph.root}:${hashEncryptedLink(link.body)}`
   }
 
   for (const key in source) result[key] = memoize(source[key], memoizeResolver)