Severity: medium. Defect in #24. Found by a platform-engineer user test.
The static non-commuting-batch refusal added in #24 ends with:
run set_owners(*, [@acme/everyone]) on its own first and the narrower op(s) in a second run, which is two exit-0 invocations
The operator did exactly that. The displacing run stripped @acme/appsec and @acme/security-leads from a security repo: exit 0, proven: tree, no warning, and a PR body reading only "paths whose owners change: 5" (#32).
The guardrail is correct to refuse the batch. But its remedy points at the single most destructive operation the tool offers, and the closing clause reads as reassurance — the reporter quoted it back as the reason they ran it without a preview.
Suggested fix
Reword so the remedy carries its own warning: say that running a set_owners alone replaces the owners of everything in scope, and recommend --dry-run / plan --out first. Drop "which is two exit-0 invocations" — an exit code is not a safety property.
Depends on / pairs with #32.
Severity: medium. Defect in #24. Found by a platform-engineer user test.
The static non-commuting-batch refusal added in #24 ends with:
The operator did exactly that. The displacing run stripped
@acme/appsecand@acme/security-leadsfrom a security repo: exit 0,proven: tree, no warning, and a PR body reading only "paths whose owners change: 5" (#32).The guardrail is correct to refuse the batch. But its remedy points at the single most destructive operation the tool offers, and the closing clause reads as reassurance — the reporter quoted it back as the reason they ran it without a preview.
Suggested fix
Reword so the remedy carries its own warning: say that running a
set_ownersalone replaces the owners of everything in scope, and recommend--dry-run/plan --outfirst. Drop "which is two exit-0 invocations" — an exit code is not a safety property.Depends on / pairs with #32.