Prehistory:

AEMaaCS - latest version.
AC Tool - latest version.
In general AC Tool works fine and installs groups to AEMaaCS in 2 phases (as per docs).

Context (group names changed due to NDA):

We have a business group config in AC Tool .yaml script (for example):

- en-editors:  
      - name: "EN Editors"  
      isMemberOf: content-managers  
      path: /home/groups/customer

This group has ACLs for some paths under '/content/...', '/conf/...' and '/etc/...'.

For that group we have one in Adobe IMS:
'IMS en-editors'
After "Apache Jackrabbit Oak Default Sync Handler" syncs groups to AEMaaCS Author service, we link those 2 groups together (for ACL inheritance), so 'IMS en-editors' is made a member of 'en-editors'.
Note: 'IMS en-editors' was not added to AC Tool. But it definitely exists on AEMaaCS Author service before a next build

When we change something in AC tool .yaml scripts - it recreates the groups (since the hash changed) and upon groups recreation - the linking above is missed ('IMS en-editors' is not member of 'en-editors' any more).

So to mitigate this we tried to add 'IMS en-editors' group to 'members' property of 'en-editors' in .yaml script.
As per documentation :

...Also choosing one approach makes the config files consistent. members should therefore only be used in special cases where it is not possible to use isMemberOf, e.g. to push rights to a group that is not in the configuration and hence that group can not be annotated with isMemberOf

Updated group config example looks like this after the change:

- en-editors:
    - name: "EN Editors"
      isMemberOf: content-managers
      members: IMS en-editors
      path: /home/groups/customer

Problem description:

Once 'members: IMS en-editors' added to config, AC Tool fails on both steps with the following errors:
Step startup_hook_image_build:

15:20:09.267: ERROR: Could not process yaml files / e=biz.netcentric.cq.tools.actool.authorizableinstaller.AuthorizableCreatorException: java.lang.IllegalStateException: Member IMS en-editors does not exist and cannot be added as external member to group en-editors
Execution time: 0 ms
Success: false

Step startup_hook:

15:32:55.779: ERROR: Could not process yaml files / e=javax.jcr.nodetype.ConstraintViolationException: org.apache.jackrabbit.oak.spi.state.ReadyOnlyBuilderException: This builder is read-only.
Execution time: 0 ms
Success: false

Once I delete 'members: IMS en-editors' property from .yaml config - AC Tool successfully installs scripts in 2 phases again.

Question:

Can you please suggest, how can we maintain the linkage of the IMS and AEM groups while using AC Tool ('IMS en-editors' is a member of 'en-editors')?

Some ideas and notes:

Looking into code I could not find why it is not working, 'member'-s processing is pretty much straightforward

Authorizable memberGroup = userManager.getAuthorizable(member);
if (memberGroup == null) {
    throw new IllegalStateException(
            "Member "   member   " does not exist and cannot be added as external member to group "
                      authorizableConfigBean.getAuthorizableId());
}
installedGroup.addMember(memberGroup);
installLog.addVerboseMessage(LOG,
        "Adding "   member   " as external member to group "   authorizableConfigBean.getAuthorizableId());

My assymption is that upon 'startup_hook_image_build' phase the composite node store is not connected, and the users/groups can not be seen at all, but still I can not understand why 'startup_hook' phase fails with an error as if it tries to write under apps/libs.

Just to proof 'IMS en-editors' group existence, if I run a simple groovy, it finds the group as expected and everything seems to be ok.

Regards,
Ivan