2026-08-10 12:00:00 +00:00
|
|
|
|
# F-002: The timestamp anonymisation rule reaches one of six repos; 237 commits still carry real working hours
|
2026-08-10 12:00:00 +00:00
|
|
|
|
|
|
|
|
|
|
category: claim-vs-reality
|
|
|
|
|
|
confidence: high
|
|
|
|
|
|
|
|
|
|
|
|
evidence:
|
|
|
|
|
|
- `CLAUDE.md:116-134` declares the rule for "**alle** Repos der Gruppe `axion1337.chat`
|
|
|
|
|
|
und die ThreadNet-Dienste": author *and* committer date set to 12:00:00 UTC, with the
|
|
|
|
|
|
stated purpose "damit sich aus der Historie keine persönlichen Arbeitszeiten ablesen
|
|
|
|
|
|
lassen".
|
|
|
|
|
|
- Measured over every ref of all six repos (`analysis/data/timestamp_anonymisation.tsv`,
|
|
|
|
|
|
produced by `analysis/scripts/inv_timestamps.py`, author time rendered in UTC):
|
|
|
|
|
|
|
|
|
|
|
|
| repo | own/agent commits with real clock time |
|
|
|
|
|
|
|---|---|
|
|
|
|
|
|
| management | 0 |
|
|
|
|
|
|
| axion1337.chat-gitops | 187 |
|
|
|
|
|
|
| threadnet-operating | 21 |
|
|
|
|
|
|
| thread-net-git | 11 |
|
|
|
|
|
|
| threadnet-call | 14 (all on `origin/livekit`) |
|
|
|
|
|
|
| ThreadNet-Web | 4 |
|
|
|
|
|
|
|
|
|
|
|
|
Total 237. Upstream Element/Matrix commits are excluded from that count — they were
|
|
|
|
|
|
never this project's to rewrite.
|
|
|
|
|
|
- `thread-net-git` and `threadnet-operating` were not rewritten at all: they hold **no**
|
|
|
|
|
|
12:00:00 commits and appear in no section of `shared/commit-zuordnung-2026-08-07.md`
|
|
|
|
|
|
(sections cover gitops, management, ThreadNet-Web, threadnet-call only).
|
|
|
|
|
|
- The exposed times are exactly the ones the rule exists to hide. On
|
|
|
|
|
|
`axion1337.chat-gitops`'s `turn-secret-rotation-20260728-192656` branch alone, the
|
|
|
|
|
|
hour-of-day distribution of the 41 commits is 00h ×1, 01h ×6, 21h ×8, 22h ×1, 23h ×6.
|
2026-08-10 12:00:00 +00:00
|
|
|
|
- Reach of the exposure, stated precisely. Observed: all six repos mirror to
|
|
|
|
|
|
`rohana.axion1337.de` and `git ls-remote` succeeded there without credentials from the
|
|
|
|
|
|
owner's machine (see F-013). **Not** observed: that this host is reachable by anyone
|
|
|
|
|
|
else. The human states the Gitea host is private to them, and an earlier draft of this
|
|
|
|
|
|
finding wrongly inferred "public" from "readable from here" — corrected.
|
|
|
|
|
|
The exposure that matters is therefore **prospective and on the git.lab side**: content
|
|
|
|
|
|
from git.lab may be pushed to GitHub, which is public. No such push path is configured
|
|
|
|
|
|
today — no repo has a remote other than `origin`, and no `.gitlab-ci.yml` in the six
|
|
|
|
|
|
repos references `github.com` (the `.github/workflows/` mentions in `hosts/cfgmon.md:60,105`
|
|
|
|
|
|
are inherited Element files that were removed). The rule exists for the day that changes,
|
|
|
|
|
|
and on that day 237 commits would go out with real clock times unless the gap is closed
|
|
|
|
|
|
first.
|
2026-08-10 12:00:00 +00:00
|
|
|
|
- `CLAUDE.md:143-147` does carry a caveat, but it names push times, issue and comment
|
|
|
|
|
|
timestamps, pipeline runs and package publications — **not** the git history itself.
|
|
|
|
|
|
`shared/commit-zuordnung-2026-08-07.md:41-44` discloses the untouched pre-boundary
|
|
|
|
|
|
commits, but frames it as an SHA matter ("haben ihre SHA behalten"), not as a
|
|
|
|
|
|
147-commit hole in the privacy goal.
|
|
|
|
|
|
|
|
|
|
|
|
impact: The rule's stated goal is not achieved for five of six repos, while both the rule
|
|
|
|
|
|
and its caveat read as though the remaining exposure were limited to non-git surfaces.
|
|
|
|
|
|
Anyone reading `CLAUDE.md` would reasonably conclude the git history is clean. Effort was
|
|
|
|
|
|
spent (a 251-commit rewrite, three restarted release pipelines, a mapping document) for a
|
|
|
|
|
|
result that a `git log` on any side branch undoes.
|
2026-08-10 12:00:00 +00:00
|
|
|
|
The cost is not damage already done — both hosts are private today. It is that the
|
|
|
|
|
|
protection is believed to be in place and is not, so the decision to open any repo
|
|
|
|
|
|
outward (a GitHub push, an added collaborator, a public project toggle) would be taken on
|
|
|
|
|
|
a false premise. That is the moment the gap becomes irreversible: history, once pushed,
|
|
|
|
|
|
cannot be recalled.
|
2026-08-10 12:00:00 +00:00
|
|
|
|
|
|
|
|
|
|
root-cause pattern: **Rule declared repo-wide, applied to a subset — and the gap between
|
|
|
|
|
|
the two is documented in a third place, in different terms.**
|
|
|
|
|
|
|
2026-08-10 12:00:00 +00:00
|
|
|
|
remediation constraint (human, 2026-08-10): any rewrite of these 237 commits **must ship
|
|
|
|
|
|
a Zuordnung** — an old→new SHA mapping in the style of
|
|
|
|
|
|
`shared/commit-zuordnung-2026-08-07.md`, which F-015 verified works (251/251 rows). A
|
|
|
|
|
|
rewrite without its mapping would break the evidence-by-citation style the repo depends
|
|
|
|
|
|
on (F-012).
|
|
|
|
|
|
|
2026-08-10 12:00:00 +00:00
|
|
|
|
neckbeard mechanism: **Gap in neckbeard.** Nothing in `AGENTS.md`, `WORKFLOW.md`,
|
|
|
|
|
|
`schema.yaml` or `scripts/validate.py` concerns commit hygiene, author identity or history
|
|
|
|
|
|
rewriting; `docs/aar/2026-08-09-neckbeard-v1-creation.md` ("Git is the changelog") treats
|
|
|
|
|
|
git as a given, not as an artifact under governance. The nearest applicable rule is
|
|
|
|
|
|
`AGENTS.md:50-55` ("Never claim something works without evidence... Uncertainty is
|
|
|
|
|
|
reported, never swallowed"), which is a behavioural rule for an agent, not a check on the
|
|
|
|
|
|
repo. A field test finding worth carrying back: a framework that governs documents while
|
|
|
|
|
|
the project's most sensitive claims are about its *git history* leaves that surface
|
|
|
|
|
|
unguarded.
|
