Hmm, looks like a test failed. I'll look at that tomorrow.

Well spotted, thanks! I think the right fix is just to replace the and with or:

if task_list.group not in request.user.groups.all() or not request.user.is_staff:

Or they could become two separate checks, which would actually be more readable. I'm fine with either. And thanks for making sure the change keeps the tests passing.

True, those would all be equiv. Good old De Morgan's laws. I ended up doing separate checks.

Not sure if I should do some fancy git-fu to remove my original commit and condense the other two into one. I know that if I were just working locally, I could git reset HEAD^; feel free to suggest options if you prefer a cleaner commit history.

Not sure if I should do some fancy git-fu to remove my original commit and condense the other two into one.

No need - I always squash PRs during merge, so it all becomes one fresh commit in the end anyway.