Severity: medium (product gap, not a bug). Found by a repo-owner user test, which rated the tool 5/10 for the person who did not choose to use it — forensics 9, agency 2. Pre-existing.
Four related gaps, from one engineer receiving somebody else's baseline PR:
1. Comments carry no weight. A file said, in English, # do not widen: /internal/crypto is deliberately narrow — legal/compliance requirement. The next wave widened it: exit 0, no warning, not even a note in the record. Every guardrail in the tool (--max-paths-changed, verify --scope, plan/apply) is held by the person running the rollout; the repo owner holds none.
2. Inserted rules land between a comment and the line it annotates, so the comment silently ends up captioning a different rule:
# do not widen: /internal/crypto is deliberately narrow — legal/compliance requirement.
+/services/billing @acme/platform-eng
/internal/crypto/ @acme/crypto-guild
Bytes are preserved — INV-5 holds — but the meaning moved, and a diff-based review cannot see it. The declared rule was placed carefully (EOF, where nothing can override it); the same care isn't extended to comment adjacency.
3. No opt-out of any kind. grep -inE "opt|ignore|exclude|skip|disable|exempt|freeze|hold" over every verb's --help returns one unrelated hit. A marker comment (# codeowners-tool: ignore) is ignored. docs/FLEET.md's needs-human bucket always means the tool declined, never the repo owner declined. Their only recourse is to comment on the PR and hope.
4. No way to attribute new audit findings. Post-merge CI shows three findings with no indication which are new or whose they are. The reporter invented audit --branch HEAD~1 to diff against the pre-merge state — a method no doc suggests. At fleet scale every repo owner reinvents it, or gives up and adds --fail-on error without reading.
Their proposed fix, which addresses several at once
Write intent into the file: when an op carries a note or on_zero_match: declare, emit it as a trailing comment on the line it produces, and have A-4 read it back as declared intent rather than a finding.
/db/migrations @acme/data-platform # declared by wave-3 baseline (migrations-declared): pre-declare ownership before the dir exists
That makes the dead-looking rule self-explanatory, stops it reddening a downstream CI for someone else's deliberate choice, and establishes the principle that would eventually fix (1) and (2): comments in this file are data the tool must respect, not decoration it may step over.
Severity: medium (product gap, not a bug). Found by a repo-owner user test, which rated the tool 5/10 for the person who did not choose to use it — forensics 9, agency 2. Pre-existing.
Four related gaps, from one engineer receiving somebody else's baseline PR:
1. Comments carry no weight. A file said, in English,
# do not widen: /internal/crypto is deliberately narrow — legal/compliance requirement.The next wave widened it: exit 0, no warning, not even a note in the record. Every guardrail in the tool (--max-paths-changed,verify --scope,plan/apply) is held by the person running the rollout; the repo owner holds none.2. Inserted rules land between a comment and the line it annotates, so the comment silently ends up captioning a different rule:
# do not widen: /internal/crypto is deliberately narrow — legal/compliance requirement. +/services/billing @acme/platform-eng /internal/crypto/ @acme/crypto-guildBytes are preserved — INV-5 holds — but the meaning moved, and a diff-based review cannot see it. The declared rule was placed carefully (EOF, where nothing can override it); the same care isn't extended to comment adjacency.
3. No opt-out of any kind.
grep -inE "opt|ignore|exclude|skip|disable|exempt|freeze|hold"over every verb's--helpreturns one unrelated hit. A marker comment (# codeowners-tool: ignore) is ignored.docs/FLEET.md'sneeds-humanbucket always means the tool declined, never the repo owner declined. Their only recourse is to comment on the PR and hope.4. No way to attribute new audit findings. Post-merge CI shows three findings with no indication which are new or whose they are. The reporter invented
audit --branch HEAD~1to diff against the pre-merge state — a method no doc suggests. At fleet scale every repo owner reinvents it, or gives up and adds--fail-on errorwithout reading.Their proposed fix, which addresses several at once
Write intent into the file: when an op carries a
noteoron_zero_match: declare, emit it as a trailing comment on the line it produces, and have A-4 read it back as declared intent rather than a finding.That makes the dead-looking rule self-explanatory, stops it reddening a downstream CI for someone else's deliberate choice, and establishes the principle that would eventually fix (1) and (2): comments in this file are data the tool must respect, not decoration it may step over.