# F-002: The timestamp anonymisation rule reaches one of six repos; 237 commits still carry real working hours

category: claim-vs-reality
confidence: high

evidence:
- `CLAUDE.md:116-134` declares the rule for "**alle** Repos der Gruppe `axion1337.chat`
  und die ThreadNet-Dienste": author *and* committer date set to 12:00:00 UTC, with the
  stated purpose "damit sich aus der Historie keine persönlichen Arbeitszeiten ablesen
  lassen".
- Measured over every ref of all six repos (`analysis/data/timestamp_anonymisation.tsv`,
  produced by `analysis/scripts/inv_timestamps.py`, author time rendered in UTC):

  | repo | own/agent commits with real clock time |
  |---|---|
  | management | 0 |
  | axion1337.chat-gitops | 187 |
  | threadnet-operating | 21 |
  | thread-net-git | 11 |
  | threadnet-call | 14 (all on `origin/livekit`) |
  | ThreadNet-Web | 4 |

  Total 237. Upstream Element/Matrix commits are excluded from that count — they were
  never this project's to rewrite.
- `thread-net-git` and `threadnet-operating` were not rewritten at all: they hold **no**
  12:00:00 commits and appear in no section of `shared/commit-zuordnung-2026-08-07.md`
  (sections cover gitops, management, ThreadNet-Web, threadnet-call only).
- The exposed times are exactly the ones the rule exists to hide. On
  `axion1337.chat-gitops`'s `turn-secret-rotation-20260728-192656` branch alone, the
  hour-of-day distribution of the 41 commits is 00h ×1, 01h ×6, 21h ×8, 22h ×1, 23h ×6.
- Reach of the exposure, stated precisely. Observed: all six repos mirror to
  `rohana.axion1337.de` and `git ls-remote` succeeded there without credentials from the
  owner's machine (see F-013). **Not** observed: that this host is reachable by anyone
  else. The human states the Gitea host is private to them, and an earlier draft of this
  finding wrongly inferred "public" from "readable from here" — corrected.
  The exposure that matters is therefore **prospective and on the git.lab side**: content
  from git.lab may be pushed to GitHub, which is public. No such push path is configured
  today — no repo has a remote other than `origin`, and no `.gitlab-ci.yml` in the six
  repos references `github.com` (the `.github/workflows/` mentions in `hosts/cfgmon.md:60,105`
  are inherited Element files that were removed). The rule exists for the day that changes,
  and on that day 237 commits would go out with real clock times unless the gap is closed
  first.
- `CLAUDE.md:143-147` does carry a caveat, but it names push times, issue and comment
  timestamps, pipeline runs and package publications — **not** the git history itself.
  `shared/commit-zuordnung-2026-08-07.md:41-44` discloses the untouched pre-boundary
  commits, but frames it as an SHA matter ("haben ihre SHA behalten"), not as a
  147-commit hole in the privacy goal.

impact: The rule's stated goal is not achieved for five of six repos, while both the rule
and its caveat read as though the remaining exposure were limited to non-git surfaces.
Anyone reading `CLAUDE.md` would reasonably conclude the git history is clean. Effort was
spent (a 251-commit rewrite, three restarted release pipelines, a mapping document) for a
result that a `git log` on any side branch undoes.
The cost is not damage already done — both hosts are private today. It is that the
protection is believed to be in place and is not, so the decision to open any repo
outward (a GitHub push, an added collaborator, a public project toggle) would be taken on
a false premise. That is the moment the gap becomes irreversible: history, once pushed,
cannot be recalled.

root-cause pattern: **Rule declared repo-wide, applied to a subset — and the gap between
the two is documented in a third place, in different terms.**

remediation constraint (human, 2026-08-10): any rewrite of these 237 commits **must ship
a Zuordnung** — an old→new SHA mapping in the style of
`shared/commit-zuordnung-2026-08-07.md`, which F-015 verified works (251/251 rows). A
rewrite without its mapping would break the evidence-by-citation style the repo depends
on (F-012).

neckbeard mechanism: **Gap in neckbeard.** Nothing in `AGENTS.md`, `WORKFLOW.md`,
`schema.yaml` or `scripts/validate.py` concerns commit hygiene, author identity or history
rewriting; `docs/aar/2026-08-09-neckbeard-v1-creation.md` ("Git is the changelog") treats
git as a given, not as an artifact under governance. The nearest applicable rule is
`AGENTS.md:50-55` ("Never claim something works without evidence... Uncertainty is
reported, never swallowed"), which is a behavioural rule for an agent, not a check on the
repo. A field test finding worth carrying back: a framework that governs documents while
the project's most sensitive claims are about its *git history* leaves that surface
unguarded.