Files

T

Thore Cimbal eaa00f0ed2 analysis: add 16 evidence-backed drift findings

Twelve drift findings and four works-well findings, each citing file
paths, line numbers, commit hashes or rows in analysis/data/. Every
'neckbeard mechanism' field names a concrete rule in neckbeard v0.1.1 or
states explicitly that none exists.

2026-08-10 12:00:00 +00:00

3.2 KiB

Raw Blame History

F-002: The timestamp anonymisation rule reaches one of six repos; 237 commits still publish real working hours

category: claim-vs-reality confidence: high

evidence:

CLAUDE.md:116-134 declares the rule for "alle Repos der Gruppe axion1337.chat und die ThreadNet-Dienste": author and committer date set to 12:00:00 UTC, with the stated purpose "damit sich aus der Historie keine persönlichen Arbeitszeiten ablesen lassen".

Measured over every ref of all six repos (analysis/data/timestamp_anonymisation.tsv, produced by analysis/scripts/inv_timestamps.py, author time rendered in UTC):

repo	own/agent commits with real clock time
management	0
axion1337.chat-gitops	187
threadnet-operating	21
thread-net-git	11
threadnet-call	14 (all on `origin/livekit`)
ThreadNet-Web	4

Total 237. Upstream Element/Matrix commits are excluded from that count — they were never this project's to rewrite.

thread-net-git and threadnet-operating were not rewritten at all: they hold no 12:00:00 commits and appear in no section of shared/commit-zuordnung-2026-08-07.md (sections cover gitops, management, ThreadNet-Web, threadnet-call only).
The exposed times are exactly the ones the rule exists to hide. On axion1337.chat-gitops's turn-secret-rotation-20260728-192656 branch alone, the hour-of-day distribution of the 41 commits is 00h ×1, 01h ×6, 21h ×8, 22h ×1, 23h ×6.
All of this is publicly readable: every one of the six repos mirrors to rohana.axion1337.de, verified in sync by git ls-remote (see F-013).
CLAUDE.md:143-147 does carry a caveat, but it names push times, issue and comment timestamps, pipeline runs and package publications — not the git history itself. shared/commit-zuordnung-2026-08-07.md:41-44 discloses the untouched pre-boundary commits, but frames it as an SHA matter ("haben ihre SHA behalten"), not as a 147-commit hole in the privacy goal.

impact: The rule's stated goal is not achieved for five of six repos, while both the rule and its caveat read as though the remaining exposure were limited to non-git surfaces. Anyone reading CLAUDE.md would reasonably conclude the git history is clean. Effort was spent (a 251-commit rewrite, three restarted release pipelines, a mapping document) for a result that a git log on any side branch undoes.

root-cause pattern: Rule declared repo-wide, applied to a subset — and the gap between the two is documented in a third place, in different terms.

neckbeard mechanism: Gap in neckbeard. Nothing in AGENTS.md, WORKFLOW.md, schema.yaml or scripts/validate.py concerns commit hygiene, author identity or history rewriting; docs/aar/2026-08-09-neckbeard-v1-creation.md ("Git is the changelog") treats git as a given, not as an artifact under governance. The nearest applicable rule is AGENTS.md:50-55 ("Never claim something works without evidence... Uncertainty is reported, never swallowed"), which is a behavioural rule for an agent, not a check on the repo. A field test finding worth carrying back: a framework that governs documents while the project's most sensitive claims are about its git history leaves that surface unguarded.

3.2 KiB Raw Blame History Unescape Escape

F-002: The timestamp anonymisation rule reaches one of six repos; 237 commits still publish real working hours

3.2 KiB

Raw Blame History