Files
management/analysis/findings/F-006-stale-branches-publish-pre-rewrite-history.md
T
Thore Cimbal ccf83da515 analysis: correct the reach of the timestamp exposure
The Gitea mirror is private to the owner. An earlier draft inferred
'public' from an anonymous git ls-remote succeeding on the owner's
machine, which does not follow -- corrected in F-002, F-003, F-006,
REPORT.md and HANDOFF.md.

The exposure is prospective and sits on the git.lab side: content there
may later be pushed to GitHub. No such path is configured today (no
remote besides origin, no github.com reference in any of the six CI
configs). The severity ranking is unchanged and its reasoning is now
stated: a protection believed present but absent is what would make a
later outward push unsafe.
2026-08-10 12:00:00 +00:00

45 lines
2.9 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# F-006: Three abandoned branches still carry exactly what the rewrite removed from main
category: dead-artifact
confidence: high
evidence:
- `axion1337.chat-gitops` `origin/turn-secret-rotation-20260728-192656`: 41 commits not on
main, head `f30d2f5` dated 2026-07-28, **not merged** (`git merge-base --is-ancestor` ->
no). All 41 carry real clock times (00h01h and 21h23h heavy). They are the *pre-rewrite*
versions of commits the mapping table lists as replaced — 42 mapping rows resolve as
`ok-both-present` in `analysis/data/sha_refs.tsv`, meaning the old SHA is still reachable.
- The same branch exists on the Gitea mirror (private to the owner, see F-002):
`git ls-remote https://rohana.axion1337.de/sorb/axion1337.chat-gitops.git` ->
`f30d2f582ba14d85a7dec97c4db9bb2677ca824d refs/heads/turn-secret-rotation-20260728-192656`,
identical to git.lab.
- `threadnet-call` `origin/livekit`: 14 own commits with real clock times, head `c12a4116`
(2026-07-31 22:22), mirrored with the same head.
- `axion1337.chat-gitops` `origin/wiki`: head `0ff598e`, 2026-05-14. `CLAUDE.md:63` already
describes it as "ein überholter Mai-Abzug von `docs/`", and management#19 ("DOC-02:
Veralteten `wiki`-Branch im gitops-Repo entfernen?") tracks it — open, `priority:low`,
no `status:` label, i.e. plain backlog.
- The rotation branch's own successor mechanism is live: the scheduled CI job
`canonize_rotation` exists at `.gitlab-ci.yml:51` in the gitops repo, as `CLAUDE.md:56-60`
describes. The branch predates it and was never cleaned up.
impact: The single most expensive operation in this repo's history — a 251-commit rewrite
that restarted three release pipelines and needed its own mapping document — is undone for
42 of those commits by a branch nobody looks at, and the branch travels with every mirror
and every future clone or push of that repo. The `wiki` branch
additionally offers a three-month-old copy of the documentation next to the current one,
which is the "zwei Wahrheiten über dieselbe Sache" failure `CLAUDE.md:94-97` names as worse
than an incomplete one.
root-cause pattern: **Artifacts outlive their purpose without an owner.** All three branches
served a finished purpose; none had a defined end. The one that is noticed (`wiki`) sits in
the backlog without a status label, which is where low-priority hygiene goes to rest.
neckbeard mechanism: **Gap in neckbeard.** The framework governs files inside a checkout,
not refs: nothing in `AGENTS.md`, `WORKFLOW.md` or `scripts/validate.py` sees a branch.
The nearest existing mechanisms are `WORKFLOW.md:122` (refinement item 2, "Backlog triage
over `docs/issues/`") and `WORKFLOW.md:126` (wiki lint, which hunts "orphan pages") — both
would need a branch equivalent to catch this. `schema.yaml`'s `warn_if_orphan` rule shows
the framework already accepts "reachable from nowhere" as a reportable condition for
documents; the field test shows refs need the same treatment.