PSPNG: Group Selection - too much or too little

The default group-selection logic is behaving as an all-or-nothing setting.

From the grouper-users list:
I’m attempting to give PSPNG a spin, and am having some difficulty with the default groupSelectionExpression.
The goal is to provision a single security group to an active directory service. I’m using Grouper 2.3.0, and the matching PSPNG.

If I have no groups or folders assigned the attribute “provision_to”, nothing gets provisioned to the active directory target as expected.
If I have at least one group or folder assigned the “provision_to” attribute with the target name as a value, ALL groups get provisioned to the active directory target.
If I have one group assigned the “provision_to” attribute with target name, and “do_not_provision_to” attribute with target name assigned to all other groups, ALL groups get provisioned to the active directory (including those assigned do_not_provision_to).
Have I missed a step, or mis-understood something?

Somewhat sanitized configuration below:

1. 1. 1. 1. PSPNG Config ####
2. Nexus Active Directory Groups
   ldap.AD.ldapUrl = ldap://example.com:389
   ldap.AD.bindDn = !!blah@example.com
   ldap.AD.bindCredential = XXXXX

changeLog.consumer.pspng_nexus.class = edu.internet2.middleware.grouper.pspng.PspChangelogConsumerShim
changeLog.consumer.pspng_nexus.type = edu.internet2.middleware.grouper.pspng.LdapGroupProvisioner
changeLog.consumer.pspng_nexus.quartzCron = 0 * * * * ?
changeLog.consumer.pspng_nexus.ldapPoolName = AD
changeLog.consumer.pspng_nexus.memberAttributeName = member
changeLog.consumer.pspng_nexus.memberAttributeValueFormat = ${ldapUser.getDn()}
changeLog.consumer.pspng_nexus.groupSearchBaseDn = OU=Security Groups,DC=Example,DC=com
changeLog.consumer.pspng_nexus.allGroupsSearchFilter = objectclass=group
changeLog.consumer.pspng_nexus.singleGroupSearchFilter = (&(objectclass=group)(cn=${group.name}))
changeLog.consumer.pspng_nexus.groupCreationLdifTemplate = dn: cn=${group.name}||cn: ${group.name}||objectclass: group
changeLog.consumer.pspng_nexus.userSearchBaseDn = OU=people,DC=example,DC=com
changeLog.consumer.pspng_nexus.userSearchFilter = samAccountName=${subject.id}
changeLog.consumer.pspng_nexus.isActiveDirectory = TRUE

changeLog.psp.fullSync.class = edu.internet2.middleware.grouper.pspng.FullSyncStarter
changeLog.psp.fullSync.quartzCron = 0 0 * * * ?
changeLog.psp.fullSync.runAtStartup = true

Thanks,
Sean.