Make group sync additive-only — never remove members

scripts/provision-groups.py

@@ -33,16 +33,12 @@ def resolve_memberships(groups, heros):
     for group in groups.get("groups", []):
         name = group["name"]
 
-        if name == "helter":
-            # All heroes are implicitly in helter
-            member_emails = [h["javabin_google_email"] for h in members_list if h.get("javabin_google_email")]
-        else:
-            # Heroes whose memberships list includes this group name
-            member_emails = [
-                h["javabin_google_email"]
-                for h in members_list
-                if h.get("javabin_google_email") and name in (h.get("memberships") or [])
-            ]
+        # All groups use explicit memberships — no implicit membership
+        member_emails = [
+            h["javabin_google_email"]
+            for h in members_list
+            if h.get("javabin_google_email") and name in (h.get("memberships") or [])
+        ]
 
         resolved = dict(group)
         resolved["members"] = member_emails

scripts/sync-heros.py

@@ -190,6 +190,8 @@ def map_groups(groups_str):
             mapped.append(group_id)
         else:
             print(f"  Warning: unknown group '{g}' — not in GROUP_MAP, skipping", file=sys.stderr)
+    # Always include helter — all heroes are helter members
+    mapped.append("helter")
     return sorted(set(mapped))
 
 

terraform/lambda-src/team_provisioner/handler.py

@@ -1247,19 +1247,22 @@ def handle_sync_groups_and_heros(event):
                 )
                 added += 1
 
-            # Remove stale members
-            removed = 0
-            for email in current_emails - desired_emails:
-                member_key = urllib.parse.quote(email, safe="")
-                _google_api("DELETE", f"/groups/{group_key}/members/{member_key}", access_token)
-                removed += 1
+            # Additive only — never remove members automatically.
+            # Members added manually via Google Admin UI are preserved.
+            # To remove members, use a separate explicit process.
+            extra = current_emails - desired_emails
+            if extra:
+                logger.info(
+                    "Group %s has %d members not in YAML (preserved): %s",
+                    google_email, len(extra), ", ".join(sorted(extra)[:5]),
+                )
 
             gr["google"] = {
                 "synced": True,
                 "group": google_email,
-                "member_count": len(desired_emails),
+                "member_count": len(desired_emails | current_emails),
                 "added": added,
-                "removed": removed,
+                "extra_preserved": len(extra),
             }
         except Exception as e:
             logger.error("Google group sync failed for %s: %s", name, e)