Files

T

Thore Cimbal ccf83da515 analysis: correct the reach of the timestamp exposure

The Gitea mirror is private to the owner. An earlier draft inferred
'public' from an anonymous git ls-remote succeeding on the owner's
machine, which does not follow -- corrected in F-002, F-003, F-006,
REPORT.md and HANDOFF.md.

The exposure is prospective and sits on the git.lab side: content there
may later be pushed to GitHub. No such path is configured today (no
remote besides origin, no github.com reference in any of the six CI
configs). The severity ranking is unchanged and its reasoning is now
stated: a protection believed present but absent is what would make a
later outward push unsafe.

2026-08-10 12:00:00 +00:00

2.9 KiB

Raw Blame History

F-006: Three abandoned branches still carry exactly what the rewrite removed from main

category: dead-artifact confidence: high

evidence:

axion1337.chat-gitops origin/turn-secret-rotation-20260728-192656: 41 commits not on main, head f30d2f5 dated 2026-07-28, not merged (git merge-base --is-ancestor -> no). All 41 carry real clock times (00h–01h and 21h–23h heavy). They are the pre-rewrite versions of commits the mapping table lists as replaced — 42 mapping rows resolve as ok-both-present in analysis/data/sha_refs.tsv, meaning the old SHA is still reachable.
The same branch exists on the Gitea mirror (private to the owner, see F-002): git ls-remote https://rohana.axion1337.de/sorb/axion1337.chat-gitops.git -> f30d2f582ba14d85a7dec97c4db9bb2677ca824d refs/heads/turn-secret-rotation-20260728-192656, identical to git.lab.
threadnet-call origin/livekit: 14 own commits with real clock times, head c12a4116 (2026-07-31 22:22), mirrored with the same head.
axion1337.chat-gitops origin/wiki: head 0ff598e, 2026-05-14. CLAUDE.md:63 already describes it as "ein überholter Mai-Abzug von docs/", and management#19 ("DOC-02: Veralteten wiki-Branch im gitops-Repo entfernen?") tracks it — open, priority:low, no status: label, i.e. plain backlog.
The rotation branch's own successor mechanism is live: the scheduled CI job canonize_rotation exists at .gitlab-ci.yml:51 in the gitops repo, as CLAUDE.md:56-60 describes. The branch predates it and was never cleaned up.

impact: The single most expensive operation in this repo's history — a 251-commit rewrite that restarted three release pipelines and needed its own mapping document — is undone for 42 of those commits by a branch nobody looks at, and the branch travels with every mirror and every future clone or push of that repo. The wiki branch additionally offers a three-month-old copy of the documentation next to the current one, which is the "zwei Wahrheiten über dieselbe Sache" failure CLAUDE.md:94-97 names as worse than an incomplete one.

root-cause pattern: Artifacts outlive their purpose without an owner. All three branches served a finished purpose; none had a defined end. The one that is noticed (wiki) sits in the backlog without a status label, which is where low-priority hygiene goes to rest.

neckbeard mechanism: Gap in neckbeard. The framework governs files inside a checkout, not refs: nothing in AGENTS.md, WORKFLOW.md or scripts/validate.py sees a branch. The nearest existing mechanisms are WORKFLOW.md:122 (refinement item 2, "Backlog triage over docs/issues/") and WORKFLOW.md:126 (wiki lint, which hunts "orphan pages") — both would need a branch equivalent to catch this. schema.yaml's warn_if_orphan rule shows the framework already accepts "reachable from nowhere" as a reportable condition for documents; the field test shows refs need the same treatment.

2.9 KiB Raw Blame History Unescape Escape

F-006: Three abandoned branches still carry exactly what the rewrite removed from main

2.9 KiB

Raw Blame History