management/analysis/findings/F-002-timestamp-anonymisation-covers-one-of-six-repos.md

F-002: The timestamp anonymisation rule reaches one of six repos; 237 commits still carry real working hours

category: claim-vs-reality confidence: high

evidence:

• CLAUDE.md:116-134 declares the rule for "alle Repos der Gruppe axion1337.chat und die ThreadNet-Dienste": author and committer date set to 12:00:00 UTC, with the stated purpose "damit sich aus der Historie keine persönlichen Arbeitszeiten ablesen lassen".

• Measured over every ref of all six repos (analysis/data/timestamp_anonymisation.tsv, produced by analysis/scripts/inv_timestamps.py, author time rendered in UTC):

  repo	own/agent commits with real clock time
  management	0
  axion1337.chat-gitops	187
  threadnet-operating	21
  thread-net-git	11
  threadnet-call	14 (all on origin/livekit)
  ThreadNet-Web	4

  Total 237. Upstream Element/Matrix commits are excluded from that count — they were never this project's to rewrite.

• thread-net-git and threadnet-operating were not rewritten at all: they hold no 12:00:00 commits and appear in no section of shared/commit-zuordnung-2026-08-07.md (sections cover gitops, management, ThreadNet-Web, threadnet-call only).

• The exposed times are exactly the ones the rule exists to hide. On axion1337.chat-gitops's turn-secret-rotation-20260728-192656 branch alone, the hour-of-day distribution of the 41 commits is 00h ×1, 01h ×6, 21h ×8, 22h ×1, 23h ×6.

• Reach of the exposure, stated precisely. Observed: all six repos mirror to rohana.axion1337.de and git ls-remote succeeded there without credentials from the owner's machine (see F-013). Not observed: that this host is reachable by anyone else. The human states the Gitea host is private to them, and an earlier draft of this finding wrongly inferred "public" from "readable from here" — corrected. The exposure that matters is therefore prospective and on the git.lab side: content from git.lab may be pushed to GitHub, which is public. No such push path is configured today — no repo has a remote other than origin, and no .gitlab-ci.yml in the six repos references github.com (the .github/workflows/ mentions in hosts/cfgmon.md:60,105 are inherited Element files that were removed). The rule exists for the day that changes, and on that day 237 commits would go out with real clock times unless the gap is closed first.

• CLAUDE.md:143-147 does carry a caveat, but it names push times, issue and comment timestamps, pipeline runs and package publications — not the git history itself. shared/commit-zuordnung-2026-08-07.md:41-44 discloses the untouched pre-boundary commits, but frames it as an SHA matter ("haben ihre SHA behalten"), not as a 147-commit hole in the privacy goal.

impact: The rule's stated goal is not achieved for five of six repos, while both the rule and its caveat read as though the remaining exposure were limited to non-git surfaces. Anyone reading CLAUDE.md would reasonably conclude the git history is clean. Effort was spent (a 251-commit rewrite, three restarted release pipelines, a mapping document) for a result that a git log on any side branch undoes. The cost is not damage already done — both hosts are private today. It is that the protection is believed to be in place and is not, so the decision to open any repo outward (a GitHub push, an added collaborator, a public project toggle) would be taken on a false premise. That is the moment the gap becomes irreversible: history, once pushed, cannot be recalled.

root-cause pattern: Rule declared repo-wide, applied to a subset — and the gap between the two is documented in a third place, in different terms.

neckbeard mechanism: Gap in neckbeard. Nothing in AGENTS.md, WORKFLOW.md, schema.yaml or scripts/validate.py concerns commit hygiene, author identity or history rewriting; docs/aar/2026-08-09-neckbeard-v1-creation.md ("Git is the changelog") treats git as a given, not as an artifact under governance. The nearest applicable rule is AGENTS.md:50-55 ("Never claim something works without evidence... Uncertainty is reported, never swallowed"), which is a behavioural rule for an agent, not a check on the repo. A field test finding worth carrying back: a framework that governs documents while the project's most sensitive claims are about its git history leaves that surface unguarded.