Severity: medium. Found by a platform-engineer user test. Pre-existing.
One policy, one op, two repos — two different owner sets:
# repo HAS .github/workflows/
/.github/workflows/ @acme/everyone @acme/platform-ci
# repo does NOT
/.github/workflows/ @acme/platform-ci
Where the directory exists, the op amends against the tree and the catch-all owner is carried onto the narrowing rule. Where it does not, the rule is declared at EOF from nothing and the catch-all owner is absent. The moment someone adds a workflow to the second repo, @acme/everyone is displaced from it.
The reporter's "identical org baseline" left 3 of 12 repos with workflows owned solely by @acme/platform-ci, and they found it only by diffing two output files against each other.
Why this is a docs defect, not just a behavior one
docs/REFERENCE.md ("What declare costs") is honest about the mechanism — "When someone later adds a matching file, this rule takes it. If that wasn't what you wanted, nothing will have caught it" — but frames it as a single-repo INV-1 question. It never says the fleet-level consequence: the same policy yields divergent ownership depending on whether a directory happens to exist, which is the thing a baseline rollout exists to prevent.
README.md's own bootstrap example demonstrates the divergence without remarking on it:
/docs/ @org/everyone @org/docs-team
/.github/workflows/ @org/ci <- no @org/everyone
Suggested fix
Document it in "What declare costs" and in FLEET.md, with the workaround the reporter had to derive unaided: state the intended owner set explicitly on the declared op rather than relying on a catch-all being carried.
Severity: medium. Found by a platform-engineer user test. Pre-existing.
One policy, one op, two repos — two different owner sets:
Where the directory exists, the op amends against the tree and the catch-all owner is carried onto the narrowing rule. Where it does not, the rule is declared at EOF from nothing and the catch-all owner is absent. The moment someone adds a workflow to the second repo,
@acme/everyoneis displaced from it.The reporter's "identical org baseline" left 3 of 12 repos with workflows owned solely by
@acme/platform-ci, and they found it only by diffing two output files against each other.Why this is a docs defect, not just a behavior one
docs/REFERENCE.md("Whatdeclarecosts") is honest about the mechanism — "When someone later adds a matching file, this rule takes it. If that wasn't what you wanted, nothing will have caught it" — but frames it as a single-repo INV-1 question. It never says the fleet-level consequence: the same policy yields divergent ownership depending on whether a directory happens to exist, which is the thing a baseline rollout exists to prevent.README.md's own bootstrap example demonstrates the divergence without remarking on it:Suggested fix
Document it in "What
declarecosts" and in FLEET.md, with the workaround the reporter had to derive unaided: state the intended owner set explicitly on the declared op rather than relying on a catch-all being carried.