2026-08-10 12:00:00 +00:00
# HANDOFF.md — Session 1 → Session 2
Everything Session 2 needs, and nothing else. Session 2 designs and builds the
neckbeard-based management system in a **new branch** , starting fresh from this file.
## Where things are
| | |
|---|---|
2026-08-10 12:00:00 +00:00
| Analysis branch | `Neckbeard-v0.1.1-analyse-1` , branched from `main` at `2f012a6` (renamed from `analysis/neckbeard-fieldtest` at session close, per the human) |
| Commits | `git log main..` on this branch lists them: scope, inventory, SHA/timestamps, findings, report/handoff, reach correction, verification pass |
| Deliverables | [SCOPE.md ](SCOPE.md ) · [REPORT.md ](REPORT.md ) · [findings/ ](findings/ ) (F-001…F-017) · [data/ ](data/ ) · [scripts/ ](scripts/ ) |
2026-08-10 12:00:00 +00:00
| Read first | REPORT.md executive summary, then the pattern → mechanism → implication table |
| Neckbeard reference | `v0.1.1` @ `823a08cac6b03a47d7e2f661200a49ac6e09d38d` , `main` , clean |
Nothing outside `analysis/` was modified on this branch. `main` is untouched.
## Reproducing the raw data from zero
```bash
git clone https://git.lab/axion1337.chat/management.git
2026-08-10 12:00:00 +00:00
cd management && git checkout Neckbeard-v0.1.1-analyse-1
2026-08-10 12:00:00 +00:00
bash analysis/scripts/run_all.sh
```
Clones the five component repos into `../components/` if absent, exports group issue
metadata from git.lab, regenerates everything under `analysis/data/` . Bash + python3
stdlib only, no pip installs. Requires lab/VPN access for the clone and the issue export;
both skip cleanly without it and the rest still runs. Override the checkout location with
`NB_WORKSPACE` .
**A second run on an unchanged tree must produce no diff.** Verified with
`diff -r` after a full regeneration. No wall-clock time enters any output: "days since"
is measured against the management repo's HEAD commit date (2026-08-09), not the clock.
`inv_repo.py` aborts the whole run if anything outside `analysis/` was modified. That
guard was tested by deliberately dirtying `README.md` ; it fires.
## Scope, as frozen at the Phase-0 STOP
Five components, slugs verified against git.lab with `git ls-remote` , human-confirmed:
| Display name | Repo slug |
|---|---|
| ThreadNet Call | `threadnet-call` |
| ThreadNet Git | `thread-net-git` |
| ThreadNet Operating | `threadnet-operating` |
| ThreadNet Server Suite | `axion1337.chat-gitops` |
| ThreadNet Web | `ThreadNet-Web` |
Out of scope as analysis targets: `game-operating` , `gameserver` , the `vendor` and
`Archiv` subgroups. References into them are recorded as `points-outside-scope` .
The human confirmed their own working copy points at canonical git.lab, not the mirror.
## Decisions taken this session, and why
1. **Both repos freshly cloned; push URL set to `DISABLED-no-push` on every clone** ,
including clones `run_all.sh` creates. The mandate forbids modifying originals; making
it mechanically impossible beats remembering not to.
2. **The management repo is inventoried at `main`, not at the analysis branch.** The first
run counted this session's own commits and `analysis/` files as project reality (87
commits instead of 86, 45 files instead of 44). An analysis that observes itself
reports its own footprint as drift.
3. **Commits follow the repo's own convention** (`CLAUDE.md:116-134` ): English,
conventional style, author *and* committer date at 12:00:00 UTC, plus the mandated
`analysis:` prefix. Not anonymising would have been drift this session introduced.
4. **The GitLab token is referenced by path, never read into output.** Per `CLAUDE.md:109`
its value was not printed, logged or written anywhere; the export holds **metadata
only** — no issue descriptions, no comments.
5. **All group issues exported, open and closed** , rather than an arbitrary
"recently closed" cutoff. The group is small (111 issues); a full export is
deterministic and needs no justification for where the line was drawn.
6. ** `sha_refs.tsv` and `timestamp_anonymisation.tsv` were added** beyond the mandated file
list, prompted by the human's question about the rebase mapping list. They carry the
evidence for F-002, F-003, F-006, F-012 and F-015.
7. **Two tooling bugs were found and fixed mid-flight** , both of which would have produced
false conclusions: `git grep -E '\b…'` silently reports **zero** markers because git's
ERE has no `\b` (real count: 543), and a `TZ` that is not set on the `git` process
itself makes every commit look non-anonymised.
8. **Link statuses stayed at the three mandated values** ; the nuance moved into a `kind`
column rather than inventing a fourth status.
2026-08-10 12:00:00 +00:00
9. **The claim sweep was completed inside Session 1** , after the human asked whether
pulling it forward would break the two-session split. It does not: verifying claims is
Phase-2 analysis work; only designing/fixing belongs to Session 2. Result: F-017 and
the REPORT appendix.
10. **ADR-0010 exists as a draft under [drafts/](drafts/)** , not under `decisions/` —
the human decided it is filed in the old scheme, but this session must not create
files outside `analysis/` ; placing it is one `git mv` by the human. Deliberately in
German, matching the old scheme it belongs to (a stated deviation from this
session's English-artifacts rule).
2026-08-10 12:00:00 +00:00
11a. **Session-close answers by the human (2026-08-10)** : F-002/F-003 remediation must
produce a Zuordnung (old→new mapping, style of `shared/commit-zuordnung-2026-08-07.md` );
`game-operating` mirror exists (private — the analysis negative was withdrawn);
`thread-net-git` /`threadnet-operating` dormancy is intentional and staged (base
features → monitoring → security; no polish detours) — see F-002/F-007/F-009 addenda.
2026-08-10 12:00:00 +00:00
11. **Session-close corrections by the human** , both binding for Session 2: the Gitea
mirror is **private to the owner** , not public (reach of F-002/F-003 rewritten —
the exposure is prospective, via a possible future git.lab→GitHub push); canonical
author identity is `Thore Cimbal <cfx@riot.8shield.net>` (F-003 addendum).
2026-08-10 12:00:00 +00:00
## Where Session 2 should start
2026-08-10 12:00:00 +00:00
**Standing directive from the human (session close):** before applying anything, work
through the failures of *both* approaches — the drift this report found in the
management approach *and* the seven neckbeard gaps it exposed — and where the old
approach carries value that fits neckbeard's philosophy (candidates are the four
works-well findings, the milestone/priority evidence in F-014, the mirror-topology
prose in F-013), fold that value into neckbeard rather than discarding it. Adoption
comes after that two-way harvest, not before.
2026-08-10 12:00:00 +00:00
The pattern → mechanism → implication table in REPORT.md is the input. Two things gate
everything else:
- **Question 1 in REPORT.md** — where the 71 open issues live after migration. ADR-0002
Option C versus pure Option B changes the shape of the whole design.
- **Neckbeard gap 1** — how five repos share one `AGENTS.md` . Unanswered, this blocks any
multi-repo adoption.
Neckbeard's own rules for Session 2: `PROJECT.md` is absent from the management repo, so
**Gate 0 fires there** (`AGENTS.md:57-63` ) — it was suspended for this session only. The
migration is size L, so `WORKFLOW.md` Gates 1– `docs/design/` apply.
## The decisions I am least confident about
In descending order of how much they could mislead Session 2.
2026-08-10 12:00:00 +00:00
1. **The claim sweep is complete mechanically, not semantically.** Every one of the 813
rows now has a disposition (REPORT appendix), and all 28 mechanical failures were
adjudicated by hand. What remains open is honest but real: 360 rows carry no
mechanically checkable token — their truth is prose about hosts, procedures and
history that only a human or a live system can judge. And extraction itself is still
trigger-based: a false sentence containing no path, issue, ID, date, count or
status word was never in `claims.tsv` to begin with.
2026-08-10 12:00:00 +00:00
2. **The `game-operating` no-mirror conclusion did not survive** (F-007 addendum): Gitea
hides repo existence behind an auth prompt, my first probe discarded stderr, and the
human confirmed the mirror exists (private visibility). Twice in one session an
anonymous-`ls-remote` inference broke — treat such negatives as inconclusive by
default. The `CLAUDE.md:36` vs `hosts/overmind.md:28` contradiction stands.
2026-08-10 12:00:00 +00:00
3. **F-009 and F-010 are judgement calls, marked `medium`.** "Doc attention should follow
work mass" assumes dormancy is unintended, and a "Stand" label may legitimately mean
"system state as last verified" rather than "state of this text". Both could be
dismissed by an answer I do not have.
2026-08-10 12:00:00 +00:00
4. **The severity I assigned to F-002/F-003.** I first called the Gitea mirror public,
inferring it from an anonymous `git ls-remote` succeeding on the owner's machine. The
human corrected this: the host is private to them. The findings were rewritten; the
exposure is prospective (a future push from git.lab to GitHub) rather than realised.
The severity ranking still puts F-002 first, on the argument that a protection believed
present but absent is what makes a later outward push unsafe. That weighting is mine
and is contestable.
2026-08-10 12:00:00 +00:00
5. **F-011's confidence is `medium` because the sentence is ambiguous.** "Projekt-Repos
haben eigene CLAUDE.mds" may be descriptive rather than a claim about all five. I read
it as a claim because the sentence goes on to define conflict resolution against it.
6. **I did not verify claims made inside issue bodies.** `CLAUDE.md:52` says the migration
footnote *in the issue* is authoritative for shifted gitops numbers — so the one source
that could settle F-005's numbering question is the one I deliberately did not export.
7. ** `markers.tsv` was produced and then barely used.** 543 markers, 538 of them inherited
upstream. I recorded "management: 0 markers, checked, no drift found" and moved on. If
technical debt in the components matters to Session 2, that file is unmined.
