chgrp during provision strips off setgid directory bit

So I was wondering why setgid directories weren't working properly during provisioning. I realized just now that it's because provision is calling chgrp.

POSIX mandates that the S_ISUID and S_ISGID bits are cleared when a file's ownership is changed by a non-root user.

While it doesn't state that that applies to directories as well, many operating systems appear to not make a distinction here.

So, the chmod has to happen AFTER the chgrp.