docs(provenance): remove fabricated history, and write nothing that is not true

[Inkithai]

Three commits. The rule they implement: write nothing that is not true.

The first revision of this work offered a way to keep the commit graph by clamping impossible dates forward to a marker. That was wrong and has been deleted — moving a date from 2025-01-14 to a plausible marker does not remove a false claim, it launders one. An impossible date announces itself; a plausible one does not.

The constraint that decides the design

Git requires an author and a date on every commit. There is no "author unknown". The real dates of this code are not recoverable — it arrived as a copy from a private GitLab. So a commit that cannot be honestly attributed has exactly three options:

1. Write an invented author and date — what happened, what we are removing.
2. Write a true author and date that do not describe the original work.
3. Delete the commit.

Options 2 and 3 both discard the per-commit record. Nothing recovers it. That is the price, and it is unavoidable.

Three measurements that decided the shape of the fix

Measurement	Result
Commits on main with metadata that cannot be true	213 of 329
Commits with a fabricated-free ancestry	0 — the corruption is at the root, so there was no honest portion of the history to carry forward
Taggers landing on exactly 15:00:00 UTC on the changelog's asserted release days	4 (v0.6.0–v0.9.0)

Plus: the tagger timestamps of v0.6.0 and v0.7.0 precede the commits they tag — by 11 and 4 weeks. A tag created in normal use cannot predate its target.

What the tooling now does

scripts/rewrite_history.sh --squash-import (recommended). Replaces the history with one commit holding the byte-identical tree, authored by the real owner, dated when it was created, with a message stating the real numbers. Every field is true. Verified end to end against a real clone of this repo:

before:  329 commits on main, 4 roots, 213 with impossible metadata
after:   1 commit on main, 1 root, 0 fabricated identities

main tree before:  d38494ca8e20f36a4bd765b43808d0a9ad8824c7
main tree after:   d38494ca8e20f36a4bd765b43808d0a9ad8824c7   <- identical

The unchanged tree hash is the proof no file content moved. The script never pushes, never touches a remote, dry-runs by default, and writes a bundle backup plus a git log --format=raw dump before changing an object.

--mailmap (documented, marked not recommended). Keeps the commit graph, but attributes 181 commits to the owner on inference and leaves every fabricated timestamp in place. It is available because the choice between "no history" and "history with inferred authors" is the owner's to make — but the file and the script both say plainly which one writes unverifiable claims.

Deleted: scripts/rewrite_dates_callback.py, which implemented the clamping approach.

ATTRIBUTION.md — the record that replaces the deleted metadata

• The genuine author and the tooling that is not a person.
• The ten names that must never be credited, with their addresses and counts.
• What their 181 commits actually changed, labelled as such — the labels are fabricated, the code changes are real.
• An explicit statement that no date and no split of work between individuals can be established.

Remote changes made alongside this PR

• Deleted v0.1.0–v0.9.0 (nine fabricated tags). v1.0.0 and v1.1.0 remain. Deleting a ref removes the easiest way to inspect it, so the tag objects, taggers and targets are recorded by hash in the evidence document first.
• Corrected the v1.0.0 release note, which said "first stable tag on the rewritten maintenance history".

Verification

• Markdown, shell and Python only; no application code, no dependency, no CI surface touched.
• The shipped script was executed against a fresh clone of this repository, not just a synthetic fixture.
• Every number was regenerated from the current main with git log / git for-each-ref / git cat-file, and the README claims were re-derived rather than copied from the previous disclosure.
• docs/history_provenance_evidence.md now records that its own hashes will not resolve from a fresh clone once the rewrite is applied, and names the backup that keeps them checkable.

Not done, deliberately

The rewrite has not been applied to main. That is a force-push which invalidates every clone and open PR, and it belongs to the owner. The tested tooling is here so it can be a deliberate choice.