To guard against unwanted changes, it should be possible to create a pre-commit hook that checks if a file/folder is under control of dfetch.