The human answered the report's open questions: the game-operating
mirror exists (a controlled re-probe shows Gitea hides repo existence
behind an auth prompt, so the anonymous negative was inconclusive --
withdrawn in F-007); component dormancy is intentional and staged
(F-009 addendum); any F-002/F-003 remediation must ship an old->new
Zuordnung in the proven style of commit-zuordnung-2026-08-07 (F-002).
verify_claims.py gives all 813 claim rows a mechanical disposition;
the 28 flags were adjudicated by hand (REPORT.md appendix). Two survived
as genuine drift (F-017): a closed issue still described as open in
shared/lab-netzwerk.md, and a 'pending' decision block in hosts/cfgmon.md
whose premise the same file records as executed.
Also: narrow the vendored-path filter (it silently dropped 7 tracked
icon files and produced false path-miss flags), record the confirmed
canonical author identity in F-003, verify the Gitea#48->GitLab#46
numbering shift by title in F-005, and add the ADR-0010 draft under
analysis/drafts/ for the human to git-mv into decisions/.
Branch renamed to Neckbeard-v0.1.1-analyse-1 per the human.
The Gitea mirror is private to the owner. An earlier draft inferred
'public' from an anonymous git ls-remote succeeding on the owner's
machine, which does not follow -- corrected in F-002, F-003, F-006,
REPORT.md and HANDOFF.md.
The exposure is prospective and sits on the git.lab side: content there
may later be pushed to GitHub. No such path is configured today (no
remote besides origin, no github.com reference in any of the six CI
configs). The severity ranking is unchanged and its reasoning is now
stated: a protection believed present but absent is what would make a
later outward push unsafe.
REPORT.md groups the 16 findings by their four root-cause patterns,
maps each pattern to the neckbeard mechanism that would have caught it,
and lists the seven framework gaps the field test exposed.
HANDOFF.md carries scope, reproduction, this session's decisions and
the seven calls I am least confident about.
Twelve drift findings and four works-well findings, each citing file
paths, line numbers, commit hashes or rows in analysis/data/. Every
'neckbeard mechanism' field names a concrete rule in neckbeard v0.1.1 or
states explicitly that none exists.
Two checks the human asked for after Phase 1: whether the mapping list
from the 2026-08-07 history rewrite still resolves older references, and
how far the anonymisation rule actually reaches.
sha_refs.tsv verifies all 251 mapping rows against the repos and
resolves every SHA cited in a management doc.
timestamp_anonymisation.tsv separates the project's own commits from
upstream fork history before counting non-compliant timestamps.
run_all.sh reproduces every file under analysis/data/ from zero: it
clones the in-scope components if missing, exports group issue metadata
from git.lab, and regenerates the inventories. Reruns are diff-clean --
no wall-clock time enters an output; 'days since' is measured against
the management repo's HEAD date.
The management repo is inventoried at main, not at the analysis branch,
so this analysis does not observe its own commits. inv_repo.py aborts
the run if anything outside analysis/ was modified.
Thore Cimbal