management/analysis/HANDOFF.md

HANDOFF.md — Session 1 → Session 2

Everything Session 2 needs, and nothing else. Session 2 designs and builds the neckbeard-based management system in a new branch, starting fresh from this file.

Where things are

Analysis branch	analysis/neckbeard-fieldtest, branched from main at 2f012a6
Commits	f6a9b9f scope · b8b8531 inventory · 959bf88 SHA + timestamps · eaa00f0 findings · this file
Deliverables	SCOPE.md · REPORT.md · findings/ (F-001…F-016) · data/ · scripts/
Read first	REPORT.md executive summary, then the pattern → mechanism → implication table
Neckbeard reference	v0.1.1 @ 823a08cac6b03a47d7e2f661200a49ac6e09d38d, main, clean

Nothing outside analysis/ was modified on this branch. main is untouched.

Reproducing the raw data from zero

git clone https://git.lab/axion1337.chat/management.git
cd management && git checkout analysis/neckbeard-fieldtest
bash analysis/scripts/run_all.sh

Clones the five component repos into ../components/ if absent, exports group issue metadata from git.lab, regenerates everything under analysis/data/. Bash + python3 stdlib only, no pip installs. Requires lab/VPN access for the clone and the issue export; both skip cleanly without it and the rest still runs. Override the checkout location with NB_WORKSPACE.

A second run on an unchanged tree must produce no diff. Verified with diff -r after a full regeneration. No wall-clock time enters any output: "days since" is measured against the management repo's HEAD commit date (2026-08-09), not the clock.

inv_repo.py aborts the whole run if anything outside analysis/ was modified. That guard was tested by deliberately dirtying README.md; it fires.

Scope, as frozen at the Phase-0 STOP

Five components, slugs verified against git.lab with git ls-remote, human-confirmed:

Display name	Repo slug
ThreadNet Call	threadnet-call
ThreadNet Git	thread-net-git
ThreadNet Operating	threadnet-operating
ThreadNet Server Suite	axion1337.chat-gitops
ThreadNet Web	ThreadNet-Web

Out of scope as analysis targets: game-operating, gameserver, the vendor and Archiv subgroups. References into them are recorded as points-outside-scope. The human confirmed their own working copy points at canonical git.lab, not the mirror.

Decisions taken this session, and why

1. Both repos freshly cloned; push URL set to DISABLED-no-push on every clone, including clones run_all.sh creates. The mandate forbids modifying originals; making it mechanically impossible beats remembering not to.
2. The management repo is inventoried at main, not at the analysis branch. The first run counted this session's own commits and analysis/ files as project reality (87 commits instead of 86, 45 files instead of 44). An analysis that observes itself reports its own footprint as drift.
3. Commits follow the repo's own convention (CLAUDE.md:116-134): English, conventional style, author and committer date at 12:00:00 UTC, plus the mandated analysis: prefix. Not anonymising would have been drift this session introduced.
4. The GitLab token is referenced by path, never read into output. Per CLAUDE.md:109 its value was not printed, logged or written anywhere; the export holds metadata only — no issue descriptions, no comments.
5. All group issues exported, open and closed, rather than an arbitrary "recently closed" cutoff. The group is small (111 issues); a full export is deterministic and needs no justification for where the line was drawn.
6. sha_refs.tsv and timestamp_anonymisation.tsv were added beyond the mandated file list, prompted by the human's question about the rebase mapping list. They carry the evidence for F-002, F-003, F-006, F-012 and F-015.
7. Two tooling bugs were found and fixed mid-flight, both of which would have produced false conclusions: git grep -E '\b…' silently reports zero markers because git's ERE has no \b (real count: 543), and a TZ that is not set on the git process itself makes every commit look non-anonymised.
8. Link statuses stayed at the three mandated values; the nuance moved into a kind column rather than inventing a fourth status.

Where Session 2 should start

The pattern → mechanism → implication table in REPORT.md is the input. Two things gate everything else:

• Question 1 in REPORT.md — where the 71 open issues live after migration. ADR-0002 Option C versus pure Option B changes the shape of the whole design.
• Neckbeard gap 1 — how five repos share one AGENTS.md. Unanswered, this blocks any multi-repo adoption.

Neckbeard's own rules for Session 2: PROJECT.md is absent from the management repo, so Gate 0 fires there (AGENTS.md:57-63) — it was suspended for this session only. The migration is size L, so WORKFLOW.md Gates 1–5 with a design doc in docs/design/ apply.

The decisions I am least confident about

In descending order of how much they could mislead Session 2.

1. Claim extraction is trigger-based, not semantic. claims.tsv holds 813 candidate lines matched by regex patterns, biased toward recall. I verified the claims the mandatory checks and the findings required — not all 813. A claim that is false but matched no trigger, or matched one and was not among the ones I chased, is not in this report. This is the largest hole in the analysis.
2. git ls-remote against rohana.axion1337.de/sorb/<name> is how I concluded game-operating has no mirror (F-007). That rests on the naming convention holding, which I verified for six repos but cannot prove for the seventh. The contradiction between CLAUDE.md:36 and hosts/overmind.md:28 is solid; the cause is not.
3. F-009 and F-010 are judgement calls, marked medium. "Doc attention should follow work mass" assumes dormancy is unintended, and a "Stand" label may legitimately mean "system state as last verified" rather than "state of this text". Both could be dismissed by an answer I do not have.
4. The severity I assigned to F-002/F-003. I first called the Gitea mirror public, inferring it from an anonymous git ls-remote succeeding on the owner's machine. The human corrected this: the host is private to them. The findings were rewritten; the exposure is prospective (a future push from git.lab to GitHub) rather than realised. The severity ranking still puts F-002 first, on the argument that a protection believed present but absent is what makes a later outward push unsafe. That weighting is mine and is contestable.
5. F-011's confidence is medium because the sentence is ambiguous. "Projekt-Repos haben eigene CLAUDE.mds" may be descriptive rather than a claim about all five. I read it as a claim because the sentence goes on to define conflict resolution against it.
6. I did not verify claims made inside issue bodies. CLAUDE.md:52 says the migration footnote in the issue is authoritative for shifted gitops numbers — so the one source that could settle F-005's numbering question is the one I deliberately did not export.
7. markers.tsv was produced and then barely used. 543 markers, 538 of them inherited upstream. I recorded "management: 0 markers, checked, no drift found" and moved on. If technical debt in the components matters to Session 2, that file is unmined.