57 lines
3.2 KiB
Markdown
57 lines
3.2 KiB
Markdown
|
# F-002: The timestamp anonymisation rule reaches one of six repos; 237 commits still publish real working hours
|
|||
|
|
|
|||
|
|
category: claim-vs-reality
|
|||
|
|
confidence: high
|
|||
|
|
|
|||
|
|
evidence:
|
|||
|
|
- `CLAUDE.md:116-134` declares the rule for "**alle** Repos der Gruppe `axion1337.chat`
|
|||
|
|
und die ThreadNet-Dienste": author *and* committer date set to 12:00:00 UTC, with the
|
|||
|
|
stated purpose "damit sich aus der Historie keine persönlichen Arbeitszeiten ablesen
|
|||
|
|
lassen".
|
|||
|
|
- Measured over every ref of all six repos (`analysis/data/timestamp_anonymisation.tsv`,
|
|||
|
|
produced by `analysis/scripts/inv_timestamps.py`, author time rendered in UTC):
|
|||
|
|
|
|||
|
|
| repo | own/agent commits with real clock time |
|
|||
|
|
|---|---|
|
|||
|
|
| management | 0 |
|
|||
|
|
| axion1337.chat-gitops | 187 |
|
|||
|
|
| threadnet-operating | 21 |
|
|||
|
|
| thread-net-git | 11 |
|
|||
|
|
| threadnet-call | 14 (all on `origin/livekit`) |
|
|||
|
|
| ThreadNet-Web | 4 |
|
|||
|
|
|
|||
|
|
Total 237. Upstream Element/Matrix commits are excluded from that count — they were
|
|||
|
|
never this project's to rewrite.
|
|||
|
|
- `thread-net-git` and `threadnet-operating` were not rewritten at all: they hold **no**
|
|||
|
|
12:00:00 commits and appear in no section of `shared/commit-zuordnung-2026-08-07.md`
|
|||
|
|
(sections cover gitops, management, ThreadNet-Web, threadnet-call only).
|
|||
|
|
- The exposed times are exactly the ones the rule exists to hide. On
|
|||
|
|
`axion1337.chat-gitops`'s `turn-secret-rotation-20260728-192656` branch alone, the
|
|||
|
|
hour-of-day distribution of the 41 commits is 00h ×1, 01h ×6, 21h ×8, 22h ×1, 23h ×6.
|
|||
|
|
- All of this is publicly readable: every one of the six repos mirrors to
|
|||
|
|
`rohana.axion1337.de`, verified in sync by `git ls-remote` (see F-013).
|
|||
|
|
- `CLAUDE.md:143-147` does carry a caveat, but it names push times, issue and comment
|
|||
|
|
timestamps, pipeline runs and package publications — **not** the git history itself.
|
|||
|
|
`shared/commit-zuordnung-2026-08-07.md:41-44` discloses the untouched pre-boundary
|
|||
|
|
commits, but frames it as an SHA matter ("haben ihre SHA behalten"), not as a
|
|||
|
|
147-commit hole in the privacy goal.
|
|||
|
|
|
|||
|
|
impact: The rule's stated goal is not achieved for five of six repos, while both the rule
|
|||
|
|
and its caveat read as though the remaining exposure were limited to non-git surfaces.
|
|||
|
|
Anyone reading `CLAUDE.md` would reasonably conclude the git history is clean. Effort was
|
|||
|
|
spent (a 251-commit rewrite, three restarted release pipelines, a mapping document) for a
|
|||
|
|
result that a `git log` on any side branch undoes.
|
|||
|
|
|
|||
|
|
root-cause pattern: **Rule declared repo-wide, applied to a subset — and the gap between
|
|||
|
|
the two is documented in a third place, in different terms.**
|
|||
|
|
|
|||
|
|
neckbeard mechanism: **Gap in neckbeard.** Nothing in `AGENTS.md`, `WORKFLOW.md`,
|
|||
|
|
`schema.yaml` or `scripts/validate.py` concerns commit hygiene, author identity or history
|
|||
|
|
rewriting; `docs/aar/2026-08-09-neckbeard-v1-creation.md` ("Git is the changelog") treats
|
|||
|
|
git as a given, not as an artifact under governance. The nearest applicable rule is
|
|||
|
|
`AGENTS.md:50-55` ("Never claim something works without evidence... Uncertainty is
|
|||
|
|
reported, never swallowed"), which is a behavioural rule for an agent, not a check on the
|
|||
|
|
repo. A field test finding worth carrying back: a framework that governs documents while
|
|||
|
|
the project's most sensitive claims are about its *git history* leaves that surface
|
|||
|
|
unguarded.
|