Thore Cimbal
feab9bda73
The human answered the report's open questions: the game-operating mirror exists (a controlled re-probe shows Gitea hides repo existence behind an auth prompt, so the anonymous negative was inconclusive -- withdrawn in F-007); component dormancy is intentional and staged (F-009 addendum); any F-002/F-003 remediation must ship an old->new Zuordnung in the proven style of commit-zuordnung-2026-08-07 (F-002).
78 lines
4.7 KiB
Markdown
78 lines
4.7 KiB
Markdown
# F-002: The timestamp anonymisation rule reaches one of six repos; 237 commits still carry real working hours
|
||
|
||
category: claim-vs-reality
|
||
confidence: high
|
||
|
||
evidence:
|
||
- `CLAUDE.md:116-134` declares the rule for "**alle** Repos der Gruppe `axion1337.chat`
|
||
und die ThreadNet-Dienste": author *and* committer date set to 12:00:00 UTC, with the
|
||
stated purpose "damit sich aus der Historie keine persönlichen Arbeitszeiten ablesen
|
||
lassen".
|
||
- Measured over every ref of all six repos (`analysis/data/timestamp_anonymisation.tsv`,
|
||
produced by `analysis/scripts/inv_timestamps.py`, author time rendered in UTC):
|
||
|
||
| repo | own/agent commits with real clock time |
|
||
|---|---|
|
||
| management | 0 |
|
||
| axion1337.chat-gitops | 187 |
|
||
| threadnet-operating | 21 |
|
||
| thread-net-git | 11 |
|
||
| threadnet-call | 14 (all on `origin/livekit`) |
|
||
| ThreadNet-Web | 4 |
|
||
|
||
Total 237. Upstream Element/Matrix commits are excluded from that count — they were
|
||
never this project's to rewrite.
|
||
- `thread-net-git` and `threadnet-operating` were not rewritten at all: they hold **no**
|
||
12:00:00 commits and appear in no section of `shared/commit-zuordnung-2026-08-07.md`
|
||
(sections cover gitops, management, ThreadNet-Web, threadnet-call only).
|
||
- The exposed times are exactly the ones the rule exists to hide. On
|
||
`axion1337.chat-gitops`'s `turn-secret-rotation-20260728-192656` branch alone, the
|
||
hour-of-day distribution of the 41 commits is 00h ×1, 01h ×6, 21h ×8, 22h ×1, 23h ×6.
|
||
- Reach of the exposure, stated precisely. Observed: all six repos mirror to
|
||
`rohana.axion1337.de` and `git ls-remote` succeeded there without credentials from the
|
||
owner's machine (see F-013). **Not** observed: that this host is reachable by anyone
|
||
else. The human states the Gitea host is private to them, and an earlier draft of this
|
||
finding wrongly inferred "public" from "readable from here" — corrected.
|
||
The exposure that matters is therefore **prospective and on the git.lab side**: content
|
||
from git.lab may be pushed to GitHub, which is public. No such push path is configured
|
||
today — no repo has a remote other than `origin`, and no `.gitlab-ci.yml` in the six
|
||
repos references `github.com` (the `.github/workflows/` mentions in `hosts/cfgmon.md:60,105`
|
||
are inherited Element files that were removed). The rule exists for the day that changes,
|
||
and on that day 237 commits would go out with real clock times unless the gap is closed
|
||
first.
|
||
- `CLAUDE.md:143-147` does carry a caveat, but it names push times, issue and comment
|
||
timestamps, pipeline runs and package publications — **not** the git history itself.
|
||
`shared/commit-zuordnung-2026-08-07.md:41-44` discloses the untouched pre-boundary
|
||
commits, but frames it as an SHA matter ("haben ihre SHA behalten"), not as a
|
||
147-commit hole in the privacy goal.
|
||
|
||
impact: The rule's stated goal is not achieved for five of six repos, while both the rule
|
||
and its caveat read as though the remaining exposure were limited to non-git surfaces.
|
||
Anyone reading `CLAUDE.md` would reasonably conclude the git history is clean. Effort was
|
||
spent (a 251-commit rewrite, three restarted release pipelines, a mapping document) for a
|
||
result that a `git log` on any side branch undoes.
|
||
The cost is not damage already done — both hosts are private today. It is that the
|
||
protection is believed to be in place and is not, so the decision to open any repo
|
||
outward (a GitHub push, an added collaborator, a public project toggle) would be taken on
|
||
a false premise. That is the moment the gap becomes irreversible: history, once pushed,
|
||
cannot be recalled.
|
||
|
||
root-cause pattern: **Rule declared repo-wide, applied to a subset — and the gap between
|
||
the two is documented in a third place, in different terms.**
|
||
|
||
remediation constraint (human, 2026-08-10): any rewrite of these 237 commits **must ship
|
||
a Zuordnung** — an old→new SHA mapping in the style of
|
||
`shared/commit-zuordnung-2026-08-07.md`, which F-015 verified works (251/251 rows). A
|
||
rewrite without its mapping would break the evidence-by-citation style the repo depends
|
||
on (F-012).
|
||
|
||
neckbeard mechanism: **Gap in neckbeard.** Nothing in `AGENTS.md`, `WORKFLOW.md`,
|
||
`schema.yaml` or `scripts/validate.py` concerns commit hygiene, author identity or history
|
||
rewriting; `docs/aar/2026-08-09-neckbeard-v1-creation.md` ("Git is the changelog") treats
|
||
git as a given, not as an artifact under governance. The nearest applicable rule is
|
||
`AGENTS.md:50-55` ("Never claim something works without evidence... Uncertainty is
|
||
reported, never swallowed"), which is a behavioural rule for an agent, not a check on the
|
||
repo. A field test finding worth carrying back: a framework that governs documents while
|
||
the project's most sensitive claims are about its *git history* leaves that surface
|
||
unguarded.
|