diff --git a/keyserver/src/creators/role-creator.js b/keyserver/src/creators/role-creator.js
index 36b7b835e..2b0bb2579 100644
--- a/keyserver/src/creators/role-creator.js
+++ b/keyserver/src/creators/role-creator.js
@@ -1,295 +1,298 @@
 // @flow
 
 import {
   type RoleInfo,
   threadPermissions,
   threadPermissionPropagationPrefixes,
   threadPermissionFilterPrefixes,
   type ThreadRolePermissionsBlob,
   type ThreadType,
   threadTypes,
 } from 'lib/types/thread-types.js';
 
 import createIDs from './id-creator.js';
 import { dbQuery, SQL } from '../database/database.js';
 
 type InitialRoles = {
   default: RoleInfo,
   creator: RoleInfo,
 };
 async function createInitialRolesForNewThread(
   threadID: string,
   threadType: ThreadType,
 ): Promise<InitialRoles> {
   const rolePermissions = getRolePermissionBlobs(threadType);
   const ids = await createIDs('roles', Object.values(rolePermissions).length);
 
   const time = Date.now();
   const newRows = [];
   const namesToIDs = {};
   for (const name in rolePermissions) {
     const id = ids.shift();
     namesToIDs[name] = id;
     const permissionsBlob = JSON.stringify(rolePermissions[name]);
     newRows.push([id, threadID, name, permissionsBlob, time]);
   }
 
   const query = SQL`
     INSERT INTO roles (id, thread, name, permissions, creation_time)
     VALUES ${newRows}
   `;
   await dbQuery(query);
 
   const defaultRoleInfo = {
     id: namesToIDs.Members,
     name: 'Members',
     permissions: rolePermissions.Members,
     isDefault: true,
   };
   if (!rolePermissions.Admins) {
     return {
       default: defaultRoleInfo,
       creator: defaultRoleInfo,
     };
   }
 
   const adminRoleInfo = {
     id: namesToIDs.Admins,
     name: 'Admins',
     permissions: rolePermissions.Admins,
     isDefault: false,
   };
   return {
     default: defaultRoleInfo,
     creator: adminRoleInfo,
   };
 }
 
 type RolePermissionBlobs = {
   +Members: ThreadRolePermissionsBlob,
   +Admins?: ThreadRolePermissionsBlob,
 };
 
 const { CHILD, DESCENDANT } = threadPermissionPropagationPrefixes;
 const { OPEN, TOP_LEVEL, OPEN_TOP_LEVEL } = threadPermissionFilterPrefixes;
 const OPEN_CHILD = CHILD + OPEN;
 const OPEN_DESCENDANT = DESCENDANT + OPEN;
 const TOP_LEVEL_DESCENDANT = DESCENDANT + TOP_LEVEL;
 const OPEN_TOP_LEVEL_DESCENDANT = DESCENDANT + OPEN_TOP_LEVEL;
 
 const voicedPermissions = {
   [threadPermissions.VOICED]: true,
   [threadPermissions.EDIT_ENTRIES]: true,
   [threadPermissions.EDIT_THREAD_NAME]: true,
   [threadPermissions.EDIT_THREAD_COLOR]: true,
   [threadPermissions.EDIT_THREAD_DESCRIPTION]: true,
   [threadPermissions.CREATE_SUBCHANNELS]: true,
   [threadPermissions.ADD_MEMBERS]: true,
 };
 
 function getRolePermissionBlobsForCommunity(
   threadType: ThreadType,
 ): RolePermissionBlobs {
   const openDescendantKnowOf = OPEN_DESCENDANT + threadPermissions.KNOW_OF;
   const openDescendantVisible = OPEN_DESCENDANT + threadPermissions.VISIBLE;
   const openTopLevelDescendantJoinThread =
     OPEN_TOP_LEVEL_DESCENDANT + threadPermissions.JOIN_THREAD;
   const openChildJoinThread = OPEN_CHILD + threadPermissions.JOIN_THREAD;
+  const openChildAddMembers = OPEN_CHILD + threadPermissions.ADD_MEMBERS;
 
   const genesisMemberPermissions = {
     [threadPermissions.KNOW_OF]: true,
     [threadPermissions.VISIBLE]: true,
     [openDescendantKnowOf]: true,
     [openDescendantVisible]: true,
     [openTopLevelDescendantJoinThread]: true,
   };
   const baseMemberPermissions = {
     ...genesisMemberPermissions,
     [threadPermissions.LEAVE_THREAD]: true,
     [threadPermissions.CREATE_SIDEBARS]: true,
+    [threadPermissions.ADD_MEMBERS]: true,
     [openChildJoinThread]: true,
+    [openChildAddMembers]: true,
   };
 
   let memberPermissions;
   if (threadType === threadTypes.COMMUNITY_ANNOUNCEMENT_ROOT) {
     memberPermissions = baseMemberPermissions;
   } else if (threadType === threadTypes.GENESIS) {
     memberPermissions = genesisMemberPermissions;
   } else {
     memberPermissions = {
       ...baseMemberPermissions,
       ...voicedPermissions,
     };
   }
 
   const descendantKnowOf = DESCENDANT + threadPermissions.KNOW_OF;
   const descendantVisible = DESCENDANT + threadPermissions.VISIBLE;
   const topLevelDescendantJoinThread =
     TOP_LEVEL_DESCENDANT + threadPermissions.JOIN_THREAD;
   const childJoinThread = CHILD + threadPermissions.JOIN_THREAD;
   const descendantVoiced = DESCENDANT + threadPermissions.VOICED;
   const descendantEditEntries = DESCENDANT + threadPermissions.EDIT_ENTRIES;
   const descendantEditThreadName =
     DESCENDANT + threadPermissions.EDIT_THREAD_NAME;
   const descendantEditThreadColor =
     DESCENDANT + threadPermissions.EDIT_THREAD_COLOR;
   const descendantEditThreadDescription =
     DESCENDANT + threadPermissions.EDIT_THREAD_DESCRIPTION;
   const topLevelDescendantCreateSubchannels =
     TOP_LEVEL_DESCENDANT + threadPermissions.CREATE_SUBCHANNELS;
   const topLevelDescendantCreateSidebars =
     TOP_LEVEL_DESCENDANT + threadPermissions.CREATE_SIDEBARS;
   const descendantAddMembers = DESCENDANT + threadPermissions.ADD_MEMBERS;
   const descendantDeleteThread = DESCENDANT + threadPermissions.DELETE_THREAD;
   const descendantEditPermissions =
     DESCENDANT + threadPermissions.EDIT_PERMISSIONS;
   const descendantRemoveMembers = DESCENDANT + threadPermissions.REMOVE_MEMBERS;
   const descendantChangeRole = DESCENDANT + threadPermissions.CHANGE_ROLE;
 
   const baseAdminPermissions = {
     [threadPermissions.KNOW_OF]: true,
     [threadPermissions.VISIBLE]: true,
     [threadPermissions.VOICED]: true,
     [threadPermissions.EDIT_ENTRIES]: true,
     [threadPermissions.EDIT_THREAD_NAME]: true,
     [threadPermissions.EDIT_THREAD_COLOR]: true,
     [threadPermissions.EDIT_THREAD_DESCRIPTION]: true,
     [threadPermissions.CREATE_SUBCHANNELS]: true,
     [threadPermissions.CREATE_SIDEBARS]: true,
     [threadPermissions.ADD_MEMBERS]: true,
     [threadPermissions.DELETE_THREAD]: true,
     [threadPermissions.REMOVE_MEMBERS]: true,
     [threadPermissions.CHANGE_ROLE]: true,
     [descendantKnowOf]: true,
     [descendantVisible]: true,
     [topLevelDescendantJoinThread]: true,
     [childJoinThread]: true,
     [descendantVoiced]: true,
     [descendantEditEntries]: true,
     [descendantEditThreadName]: true,
     [descendantEditThreadColor]: true,
     [descendantEditThreadDescription]: true,
     [topLevelDescendantCreateSubchannels]: true,
     [topLevelDescendantCreateSidebars]: true,
     [descendantAddMembers]: true,
     [descendantDeleteThread]: true,
     [descendantEditPermissions]: true,
     [descendantRemoveMembers]: true,
     [descendantChangeRole]: true,
   };
 
   let adminPermissions;
   if (threadType === threadTypes.GENESIS) {
     adminPermissions = baseAdminPermissions;
   } else {
     adminPermissions = {
       ...baseAdminPermissions,
       [threadPermissions.LEAVE_THREAD]: true,
     };
   }
 
   return {
     Members: memberPermissions,
     Admins: adminPermissions,
   };
 }
 
 function getRolePermissionBlobs(threadType: ThreadType): RolePermissionBlobs {
   if (threadType === threadTypes.SIDEBAR) {
     const memberPermissions = {
       [threadPermissions.VOICED]: true,
       [threadPermissions.EDIT_THREAD_NAME]: true,
       [threadPermissions.EDIT_THREAD_COLOR]: true,
       [threadPermissions.EDIT_THREAD_DESCRIPTION]: true,
       [threadPermissions.ADD_MEMBERS]: true,
       [threadPermissions.EDIT_PERMISSIONS]: true,
       [threadPermissions.REMOVE_MEMBERS]: true,
       [threadPermissions.LEAVE_THREAD]: true,
     };
     return {
       Members: memberPermissions,
     };
   }
 
   const openDescendantKnowOf = OPEN_DESCENDANT + threadPermissions.KNOW_OF;
   const openDescendantVisible = OPEN_DESCENDANT + threadPermissions.VISIBLE;
   const openChildJoinThread = OPEN_CHILD + threadPermissions.JOIN_THREAD;
 
   if (threadType === threadTypes.PRIVATE) {
     const memberPermissions = {
       [threadPermissions.KNOW_OF]: true,
       [threadPermissions.VISIBLE]: true,
       [threadPermissions.VOICED]: true,
       [threadPermissions.EDIT_THREAD_COLOR]: true,
       [threadPermissions.EDIT_THREAD_DESCRIPTION]: true,
       [threadPermissions.CREATE_SIDEBARS]: true,
       [threadPermissions.EDIT_ENTRIES]: true,
       [openDescendantKnowOf]: true,
       [openDescendantVisible]: true,
       [openChildJoinThread]: true,
     };
     return {
       Members: memberPermissions,
     };
   }
 
   if (threadType === threadTypes.PERSONAL) {
     return {
       Members: {
         [threadPermissions.KNOW_OF]: true,
         [threadPermissions.VISIBLE]: true,
         [threadPermissions.VOICED]: true,
         [threadPermissions.EDIT_ENTRIES]: true,
         [threadPermissions.EDIT_THREAD_NAME]: true,
         [threadPermissions.EDIT_THREAD_COLOR]: true,
         [threadPermissions.EDIT_THREAD_DESCRIPTION]: true,
         [threadPermissions.CREATE_SIDEBARS]: true,
         [openDescendantKnowOf]: true,
         [openDescendantVisible]: true,
         [openChildJoinThread]: true,
       },
     };
   }
 
   const openTopLevelDescendantJoinThread =
     OPEN_TOP_LEVEL_DESCENDANT + threadPermissions.JOIN_THREAD;
 
   const subthreadBasePermissions = {
     [threadPermissions.KNOW_OF]: true,
     [threadPermissions.VISIBLE]: true,
     [threadPermissions.CREATE_SIDEBARS]: true,
     [threadPermissions.LEAVE_THREAD]: true,
     [openDescendantKnowOf]: true,
     [openDescendantVisible]: true,
     [openTopLevelDescendantJoinThread]: true,
     [openChildJoinThread]: true,
   };
 
   if (
     threadType === threadTypes.COMMUNITY_OPEN_SUBTHREAD ||
     threadType === threadTypes.COMMUNITY_SECRET_SUBTHREAD
   ) {
     const memberPermissions = {
       [threadPermissions.REMOVE_MEMBERS]: true,
       [threadPermissions.EDIT_PERMISSIONS]: true,
       ...subthreadBasePermissions,
       ...voicedPermissions,
     };
     return {
       Members: memberPermissions,
     };
   }
 
   if (
     threadType === threadTypes.COMMUNITY_OPEN_ANNOUNCEMENT_SUBTHREAD ||
     threadType === threadTypes.COMMUNITY_SECRET_ANNOUNCEMENT_SUBTHREAD
   ) {
     return {
       Members: subthreadBasePermissions,
     };
   }
 
   return getRolePermissionBlobsForCommunity(threadType);
 }
 
 export { createInitialRolesForNewThread, getRolePermissionBlobs };
diff --git a/keyserver/src/database/migration-config.js b/keyserver/src/database/migration-config.js
index eaaafc896..cbaf5743d 100644
--- a/keyserver/src/database/migration-config.js
+++ b/keyserver/src/database/migration-config.js
@@ -1,302 +1,303 @@
 // @flow
 
 import fs from 'fs';
 
 import { policyTypes } from 'lib/facts/policies.js';
 
 import { dbQuery, SQL } from '../database/database.js';
 import { updateRolesAndPermissionsForAllThreads } from '../updaters/thread-permission-updaters.js';
 
 const migrations: $ReadOnlyMap<number, () => Promise<void>> = new Map([
   [
     0,
     async () => {
       await makeSureBaseRoutePathExists('facts/commapp_url.json');
       await makeSureBaseRoutePathExists('facts/squadcal_url.json');
     },
   ],
   [
     1,
     async () => {
       try {
         await fs.promises.unlink('facts/url.json');
       } catch {}
     },
   ],
   [
     2,
     async () => {
       await fixBaseRoutePathForLocalhost('facts/commapp_url.json');
       await fixBaseRoutePathForLocalhost('facts/squadcal_url.json');
     },
   ],
 
   [3, updateRolesAndPermissionsForAllThreads],
   [
     4,
     async () => {
       await dbQuery(SQL`ALTER TABLE uploads ADD INDEX container (container)`);
     },
   ],
   [
     5,
     async () => {
       await dbQuery(SQL`
         ALTER TABLE cookies
           ADD device_id varchar(255) DEFAULT NULL,
           ADD public_key varchar(255) DEFAULT NULL,
           ADD social_proof varchar(255) DEFAULT NULL;
       `);
     },
   ],
   [
     7,
     async () => {
       await dbQuery(
         SQL`
           ALTER TABLE users
             DROP COLUMN IF EXISTS public_key,
             MODIFY hash char(60) COLLATE utf8mb4_bin DEFAULT NULL;
     
           ALTER TABLE sessions 
             DROP COLUMN IF EXISTS public_key;
         `,
         { multipleStatements: true },
       );
     },
   ],
   [
     8,
     async () => {
       await dbQuery(
         SQL`
           ALTER TABLE users
             ADD COLUMN IF NOT EXISTS ethereum_address char(42) DEFAULT NULL;
         `,
       );
     },
   ],
   [
     9,
     async () => {
       await dbQuery(
         SQL`
           ALTER TABLE messages
             ADD COLUMN IF NOT EXISTS target_message bigint(20) DEFAULT NULL;
 
           ALTER TABLE messages
             ADD INDEX target_message (target_message);
         `,
         { multipleStatements: true },
       );
     },
   ],
   [
     10,
     async () => {
       await dbQuery(SQL`
         CREATE TABLE IF NOT EXISTS policy_acknowledgments (
           user bigint(20) NOT NULL,
           policy varchar(255) NOT NULL,
           date bigint(20) NOT NULL,
           confirmed tinyint(1) UNSIGNED NOT NULL DEFAULT 0,
           PRIMARY KEY (user, policy)
         ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
       `);
     },
   ],
   [
     11,
     async () => {
       const time = Date.now();
       await dbQuery(SQL`
         INSERT IGNORE INTO policy_acknowledgments (policy, user, date, 
           confirmed)
         SELECT ${policyTypes.tosAndPrivacyPolicy}, id, ${time}, 1
         FROM users
       `);
     },
   ],
   [
     12,
     async () => {
       await dbQuery(SQL`
         CREATE TABLE IF NOT EXISTS siwe_nonces (
           nonce char(17) NOT NULL,
           creation_time bigint(20) NOT NULL,
           PRIMARY KEY (nonce)
         ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
       `);
     },
   ],
   [
     13,
     async () => {
       await Promise.all([
         writeSquadCalRoute('facts/squadcal_url.json'),
         moveToNonApacheConfig('facts/commapp_url.json', '/comm/'),
         moveToNonApacheConfig('facts/landing_url.json', '/commlanding/'),
       ]);
     },
   ],
   [
     14,
     async () => {
       await dbQuery(SQL`
         ALTER TABLE cookies MODIFY COLUMN social_proof mediumtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL;
       `);
     },
   ],
   [
     15,
     async () => {
       await dbQuery(
         SQL`
           ALTER TABLE uploads 
             ADD COLUMN IF NOT EXISTS thread bigint(20) DEFAULT NULL,
             ADD INDEX IF NOT EXISTS thread (thread);
           
           UPDATE uploads 
             SET thread = (
               SELECT thread FROM messages 
               WHERE messages.id = uploads.container
             );
         `,
         { multipleStatements: true },
       );
     },
   ],
   [
     16,
     async () => {
       await dbQuery(
         SQL`
           ALTER TABLE cookies
             DROP COLUMN IF EXISTS public_key;
 
           ALTER TABLE cookies 
             ADD COLUMN IF NOT EXISTS signed_identity_keys mediumtext 
               CHARACTER SET utf8mb4 
               COLLATE utf8mb4_bin 
               DEFAULT NULL;
         `,
         { multipleStatements: true },
       );
     },
   ],
   [
     17,
     async () => {
       await dbQuery(
         SQL`
           ALTER TABLE cookies 
             DROP INDEX device_token,
             DROP INDEX user_device_token;
 
           ALTER TABLE cookies
             MODIFY device_token mediumtext 
               CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
             ADD UNIQUE KEY device_token (device_token(512)),
             ADD KEY user_device_token (user,device_token(512));
         `,
         { multipleStatements: true },
       );
     },
   ],
+  [18, updateRolesAndPermissionsForAllThreads],
 ]);
 const newDatabaseVersion: number = Math.max(...migrations.keys());
 
 async function writeJSONToFile(data: any, filePath: string): Promise<void> {
   console.warn(`updating ${filePath} to ${JSON.stringify(data)}`);
   const fileHandle = await fs.promises.open(filePath, 'w');
   await fileHandle.writeFile(JSON.stringify(data, null, '  '), 'utf8');
   await fileHandle.close();
 }
 
 async function makeSureBaseRoutePathExists(filePath: string): Promise<void> {
   let readFile, json;
   try {
     readFile = await fs.promises.open(filePath, 'r');
     const contents = await readFile.readFile('utf8');
     json = JSON.parse(contents);
   } catch {
     return;
   } finally {
     if (readFile) {
       await readFile.close();
     }
   }
   if (json.baseRoutePath) {
     return;
   }
   let baseRoutePath;
   if (json.baseDomain === 'http://localhost') {
     baseRoutePath = json.basePath;
   } else if (filePath.endsWith('commapp_url.json')) {
     baseRoutePath = '/commweb/';
   } else {
     baseRoutePath = '/';
   }
   const newJSON = { ...json, baseRoutePath };
   console.warn(`updating ${filePath} to ${JSON.stringify(newJSON)}`);
   await writeJSONToFile(newJSON, filePath);
 }
 
 async function fixBaseRoutePathForLocalhost(filePath: string): Promise<void> {
   let readFile, json;
   try {
     readFile = await fs.promises.open(filePath, 'r');
     const contents = await readFile.readFile('utf8');
     json = JSON.parse(contents);
   } catch {
     return;
   } finally {
     if (readFile) {
       await readFile.close();
     }
   }
   if (json.baseDomain !== 'http://localhost') {
     return;
   }
   const baseRoutePath = '/';
   json = { ...json, baseRoutePath };
   console.warn(`updating ${filePath} to ${JSON.stringify(json)}`);
   await writeJSONToFile(json, filePath);
 }
 
 async function moveToNonApacheConfig(
   filePath: string,
   routePath: string,
 ): Promise<void> {
   if (process.env.COMM_DATABASE_HOST) {
     return;
   }
   // Since the non-Apache config is so opinionated, just write expected config
   const newJSON = {
     baseDomain: 'http://localhost:3000',
     basePath: routePath,
     baseRoutePath: routePath,
     https: false,
     proxy: 'none',
   };
 
   await writeJSONToFile(newJSON, filePath);
 }
 
 async function writeSquadCalRoute(filePath: string): Promise<void> {
   if (process.env.COMM_DATABASE_HOST) {
     return;
   }
   // Since the non-Apache config is so opinionated, just write expected config
   const newJSON = {
     baseDomain: 'http://localhost:3000',
     basePath: '/comm/',
     baseRoutePath: '/',
     https: false,
     proxy: 'apache',
   };
 
   await writeJSONToFile(newJSON, filePath);
 }
 
 export { migrations, newDatabaseVersion };