management/analysis/findings/F-003-author-identity-unification-incomplete.md

# F-003: Five author identities of one person remain, one with a malformed e-mail

category: claim-vs-reality
confidence: high

evidence:
- `shared/commit-zuordnung-2026-08-07.md:19-22` states that the rewrite unified author
  identity: "bei einigen Commits zusätzlich die Autoren-Identität (drei Varianten
  derselben Person auf eine vereinheitlicht)".
- Author fields still present across the six repos
  (`analysis/data/timestamp_anonymisation.tsv`, column `author`):
  `Thore Cimbal <cfx@riot.8shield.net>`, `Scrublord MacBad <Scrublord@Mac.Bad>`,
  `ScrublordMcBad <gamemaster@axion1337.de>`, `sorb <gamemaster@axion1337.de>`,
  `sorB <cfxqriot.8shield.net>`.
- That is five variants, not the three the document says were collapsed into one.
- `sorB <cfxqriot.8shield.net>` (2 commits on `ThreadNet-Web` main) is not a valid e-mail
  address — the `@` is missing, `cfx@riot` became `cfxqriot`.
- The unification reached only the rewritten commits: `management` main shows a single
  identity, while `axion1337.chat-gitops` main still carries 135 commits as
  `Scrublord MacBad <Scrublord@Mac.Bad>` and 10 as `ScrublordMcBad`.

impact: Same exposure class as F-002 -- prospective, not realised, since both hosts are
private today (see the reach note in F-002) -- and the same false sense of completion. In
addition, the malformed address makes those two commits unattributable by tooling that
matches on e-mail, and `Scrublord@Mac.Bad` leaks a machine name. Any forge rendering these
repos shows one person as four or five contributors.

root-cause pattern: **Rule declared repo-wide, applied to a subset** — the same pattern as
F-002, in the same operation. Both were verified for the property that was easy to check
(SHA pairs matched) and not for the property the operation existed to achieve.

session addendum: the human confirmed at session close (2026-08-10) that the canonical
identity is **`Thore Cimbal <cfx@riot.8shield.net>`** — recorded here as the target value
for any later remediation; nothing was rewritten in this session.

neckbeard mechanism: **Gap in neckbeard**, as in F-002 — no commit or identity hygiene
exists in the framework. The closest structural analogue is `scripts/validate.py`, which
enforces that declared metadata matches reality for *documents* (`check_fields`,
`apply_rules`); nothing does the equivalent for commit metadata.