Skip to content

docs(provenance): remove fabricated history, and write nothing that is not true #63

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Inkithai merged 3 commits into from
Oct 11, 2026
Merged

docs(provenance): remove fabricated history, and write nothing that is not true #63

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
81f5fbb
docs(provenance): remove the fabricated release timeline
arena-ai-coding-agent[bot] Oct 11, 2026
73874b4
docs(provenance): record the evidence, and add a tested rewrite proce…
arena-ai-coding-agent[bot] Oct 11, 2026
bee460e
docs(provenance): remove the invented-date option; add the honest pat…
arena-ai-coding-agent[bot] Oct 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
116 changes: 116 additions & 0 deletions ATTRIBUTION.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,116 @@
# Attribution

Who actually wrote Oyster360, and what cannot be established about it.

The Git history of this repository was removed and replaced with a single import
commit. Everything the old history asserted about authorship and dates had to be
reproduced here by hand or dropped, because there is nothing left in the
repository to read it from. The raw dump of the old history is kept outside the
repository by its owner — see [Keeping this honest](#keeping-this-honest).

## Who wrote the code

- **Inkithai Meiyalagan** ([@Inkithai](https://github.com/Inkithai)) — the
application: backend platform, multi-tenancy and tenant isolation, data model,
API, services, frontend, deployment and CI.

Automated tooling also appears in the removed history. None of these are people,
and none should be listed as a human contributor:

| Account | What it did |
|---|---|
| `arena-ai-coding-agent[bot]` | AI coding agent: test coverage, CI hardening, refactoring |
| `dependabot[bot]` | Dependency update pull requests |
| `github-actions[bot]` | Lockfile regeneration on Dependabot pull requests |
| `Arena Agent <agent@arena.ai>` | Early commits later replaced by the bot account above |

No other human has contributed a merged pull request or a commit under a
verifiable account. If that changes, add them above in the same pull request
that adds their work, as described in
[CONTRIBUTING.md](CONTRIBUTING.md).

## What cannot be established

**Nobody can say when any of this code was written.** The commits were copied
into this repository from a private GitLab, and the dates attached to them were
constructed rather than recorded. The distribution of work between individuals
is likewise unrecoverable: there is no source, no ticket, and no artifact that
says who wrote which line.

Nothing on this page should be read as a claim about chronology or about how the
work was divided. The only attribution that holds is the one above: one human
author, plus tooling.

## Names in the removed history that must never be credited

The removed history attributed 181 of its 329 commits to ten identities. **None of
them exist.** None has a GitHub account. None contributed. If you are reading a
citation, a contributor graph, a fork, or a cached page that credits any of the
names below, that source is repeating fabricated metadata.

| Name | Addresses used | Commits |
|---|---|---|
| Priya Nair | `priya.nair@oyster360.dev`, `priya.nair.swe@gmail.com` | 37 |
| Sofia Ramirez | `sofia.ramirez@oyster360.dev`, `sofia.ramirez.dev@gmail.com` | 34 |
| Marcus Lee | `marcus.lee@oyster360.dev`, `marcus.lee.eng@gmail.com` | 34 |
| Daniel Cho | `daniel.cho@oyster360.dev`, `daniel.cho.codes@gmail.com` | 19 |
| James Wright | `james.wright@oyster360.dev`, `james.wright.dev@outlook.com` | 19 |
| Elena Vasquez | `elena.vasquez.eng@gmail.com` | 18 |
| Aisha Rahman | `aisha.rahman@oyster360.dev`, `aisha.rahman.dev@gmail.com` | 17 |
| Thomas Okonkwo | `thomas.okonkwo@oyster360.dev` | 1 |
| Maya Chen | `maya.chen@oyster360.dev` | 1 |
| Your Name | `youremail@example.com` | 1 |

`Your Name` was a placeholder that was never replaced. It authored a root commit
whose message was "copied from my gitlab", which is the clearest single
explanation of where this codebase came from. The `oyster360.dev` domain in the
addresses above did not exist at the dates those commits claimed.

The ten names were also listed as maintainers in `AUTHORS.md` and
`pyproject.toml`. Those listings were removed.

## What those 181 commits actually changed

The table below is derived from the commit messages of the removed history, and
it is the only useful thing they still carry. **Read the left column as a label,
not a person.** The code changes are real; the names attached to them were
invented.

| Label in the removed history | Commits | Areas those commits touched |
|---|---|---|
| Priya Nair | 37 | models (9), backend (6), frontend (5), chore (4), test (4), api (2), services (2) |
| Marcus Lee | 34 | backend (6), services (5), models (5), frontend (4), api (4), test (2), ci (2) |
| Sofia Ramirez | 34 | frontend (6), services (6), docs (4), models (4), security (3), test (1) |
| Daniel Cho | 19 | chore (5), models (3), docs (2), frontend (2), backend (2), api (1) |
| James Wright | 19 | services (4), chore (2), deps (1), frontend (1), docs (1), db (1), test (1) |
| Elena Vasquez | 18 | services (7), chore (2), test (2), docs (1), api (1) |
| Aisha Rahman | 17 | models (4), docs (2), frontend (1), build (1), security (1), api (1) |
| Thomas Okonkwo | 1 | docs (1) |
| Maya Chen | 1 | docs (1) |
| Your Name | 1 | initial import |

Between them those commits cover the shell of the application: the SQLAlchemy
model layer, the service layer, the API routers, the Next.js frontend, the test
suites, and the deployment and CI scaffolding.

## Keeping this honest

The claim that the history was fabricated is only checkable against records that
survived it. Those records are:

- [`docs/history_provenance_evidence.md`](history_provenance_evidence.md) — the
identities, addresses, commit counts, root commit hashes, timestamp
collisions and the full tag table, captured from the history before it was
removed.
- A backup bundle and a raw `git log --format=raw` dump of the old history,
written by `scripts/rewrite_history.sh` before it changed anything and kept by
the repository owner outside the repository.

If those are lost, this page becomes an unverifiable assertion, which is exactly
the failure it exists to correct. Keep them.

## If you are listed here and disagree

Open an issue. Attribution on this page is deliberately conservative: a name is
listed as a contributor only when a merged pull request or a commit under a
verifiable account exists to support it.
56 changes: 37 additions & 19 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,20 @@

All notable changes to Oyster360 are documented here. This project follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and uses Semantic Versioning.

> **Release dates before `1.0.0` are not recorded here.** Earlier revisions of
> this file carried a dated timeline running from `0.1.0` (2025-08-16) to
> `0.9.0` (2026-07-18). That timeline cannot be accurate: eight of those nine
> dates precede the creation of this GitHub repository on 2026-07-07, and the
> `v0.x` tags do not form a chronology either — `v0.1.0` resolves to a commit
> dated 2026-08-21 while `v0.9.0` resolves to one dated 2026-04-24, and the
> targets of `v0.7.0`, `v0.8.0` and `v0.9.0` predate the repository itself.
>
> The feature content of those entries is retained; the invented dates are not,
> and the headings read `date unrecorded` rather than carry a date implying a
> release history that did not happen. See the
> [Repository history and provenance](README.md#repository-history-and-provenance)
> section of the README.

## [Unreleased]

### Added
Expand Down Expand Up @@ -40,6 +54,12 @@ All notable changes to Oyster360 are documented here. This project follows [Keep
- `make verify` now runs flake8 and mypy in addition to the test lanes, matching CI exactly.
- Shrank the mypy baseline from 36 to 28 modules by annotating SQLAlchemy enum columns (`app/models/{user,batch,purchase,inventory,harvest_grade}.py`) and narrowing the organization dependencies' return type. Removed from the baseline: `app.api.webhooks`, `app.core.tenant`, `app.core.tenant_decorators`, and the five model modules.
- **Corrected contributor provenance.** `AUTHORS.md` and `pyproject.toml` previously listed ten named maintainers; nine of those identities never contributed and had no GitHub accounts. They have been removed, leaving the single genuine author plus the automated tooling that appears in the history. A new [Repository history and provenance](README.md#repository-history-and-provenance) section documents the evidence, including four unrelated root commits, two pairs of byte-identical root trees, and 98 commits confined to three times of day. Commit timestamps were deliberately not rewritten.
- **Corrected the release timeline.** This file previously presented releases `0.1.0` through `0.9.0` on a dated, evenly spaced schedule from 2025-08-16 to 2026-07-18. Eight of those nine dates fall before the repository was created on 2026-07-07, and the `v0.x` tags contradict them further: `v0.9.0` resolves to a 2026-04-24 commit while `v0.1.0` resolves to a 2026-08-21 commit, so the tags do not order by version, and the targets of `v0.7.0`, `v0.8.0` and `v0.9.0` predate the repository. The dates have been removed from the `0.x` headings, which now read `date unrecorded`; the feature content is unchanged and verifiable in the codebase. Unlike the commit timestamps, these dates were assertions in the working tree rather than part of the historical record, so correcting them removes a false claim without erasing any evidence.
- **Removed the fabricated release tags.** `v0.1.0` through `v0.9.0` were deleted. Three pointed at commits dated before the repository existed, and the tagger timestamps of `v0.6.0` and `v0.7.0` preceded the commits they tagged — a tag cannot be created before its target. `v1.0.0` and `v1.1.0` remain. The tag objects, taggers, targets and the impossible dates are recorded by hash in [`docs/history_provenance_evidence.md`](docs/history_provenance_evidence.md), so removing the refs did not remove the evidence.
- **Corrected the `v1.0.0` release notes**, which described the release as the "first stable tag on the rewritten maintenance history", to a precise pointer to the README provenance section.
- [`docs/history_provenance_evidence.md`](docs/history_provenance_evidence.md): the raw evidence behind the provenance disclosure — every fabricated identity and address, the four root commits, the timestamp collisions, and the full tag table with hashes.
- [`ATTRIBUTION.md`](ATTRIBUTION.md): the human-readable provenance record. States the single genuine author and the automated tooling, names the ten fabricated identities that must never be credited, records what their 181 commits actually changed, and says explicitly that no date and no split of work between individuals can be established.
- [`docs/history_rewrite.md`](docs/history_rewrite.md) and [`scripts/rewrite_history.sh`](scripts/rewrite_history.sh): a tested, opt-in procedure for removing fabricated metadata from the history. It never pushes; it writes a full bundle backup plus a raw text record of the old history before changing an object; and it implements the rule that **nothing is written that is not true**. Since Git requires an author and a date on every commit, and neither can be recovered for the fabricated commits, the recommended path replaces the history with a single import commit whose tree is byte-identical, whose author is the real owner, and whose date is when it was created. The alternative in-place rewrite, which would attribute 181 commits to the owner on inference while keeping every fabricated timestamp, is documented but not recommended. An earlier date-clamping approach was deleted: moving impossible dates to a plausible marker replaces an obviously false value with a quietly false one.

## [1.1.0] - 2026-08-24

Expand Down Expand Up @@ -84,64 +104,62 @@ All notable changes to Oyster360 are documented here. This project follows [Keep
- Dashboard renders API values exactly and displays honest error/empty states.
- Yield prediction aggregates real Harvest and EnvironmentLog records.

## [0.9.0] - 2026-07-18
## [0.9.0] - date unrecorded

### Added
- Playwright end-to-end specs for login and dashboard (network-level API mocks).
- Login, register, and reset-password page specs.

## [0.8.0] - 2026-06-20
## [0.8.0] - date unrecorded

### Added
- Trivy filesystem scanning and Dependabot for npm, pip, and GitHub Actions.
- Coverage-gated backend pytest (`--cov-fail-under=60`).

## [0.7.0] - 2026-05-23
## [0.7.0] - date unrecorded

### Added
- Stripe billing, signed webhooks, and subscription lifecycle.
- GDPR export/delete compliance endpoints.

## [0.6.0] - 2026-04-25
## [0.6.0] - date unrecorded

### Added
- Next.js App Router frontend with role-aware navigation.
- Reusable UI components, TanStack Query client, and Zod forms.

## [0.5.0] - 2026-03-28
## [0.5.0] - date unrecorded

### Added
- FastAPI routers for batches, recipes, inventory, purchases, analytics, and AI.

## [0.4.0] - 2026-02-21
## [0.4.0] - date unrecorded

### Added
- Domain services for inventory movements, harvest grading, MFA, and onboarding.

## [0.3.0] - 2026-01-24
## [0.3.0] - date unrecorded

### Added
- SQLAlchemy models for organizations, farms, batches, harvests, and inventory.

## [0.2.0] - 2025-11-15
## [0.2.0] - date unrecorded

### Added
- Multi-tenant middleware, rate limiting, and JWT authentication utilities.

## [0.1.0] - 2025-08-16
## [0.1.0] - date unrecorded

### Added
- Initial repository, Docker Compose topology, backend configuration, and product docs.

[Unreleased]: https://github.com/Inkithai/Oyster360/compare/v1.1.0...HEAD
[1.1.0]: https://github.com/Inkithai/Oyster360/compare/v1.0.0...v1.1.0
[1.0.0]: https://github.com/Inkithai/Oyster360/compare/v0.9.0...v1.0.0
[0.9.0]: https://github.com/Inkithai/Oyster360/compare/v0.8.0...v0.9.0
[0.8.0]: https://github.com/Inkithai/Oyster360/compare/v0.7.0...v0.8.0
[0.7.0]: https://github.com/Inkithai/Oyster360/compare/v0.6.0...v0.7.0
[0.6.0]: https://github.com/Inkithai/Oyster360/compare/v0.5.0...v0.6.0
[0.5.0]: https://github.com/Inkithai/Oyster360/compare/v0.4.0...v0.5.0
[0.4.0]: https://github.com/Inkithai/Oyster360/compare/v0.3.0...v0.4.0
[0.3.0]: https://github.com/Inkithai/Oyster360/compare/v0.2.0...v0.3.0
[0.2.0]: https://github.com/Inkithai/Oyster360/compare/v0.1.0...v0.2.0
[0.1.0]: https://github.com/Inkithai/Oyster360/releases/tag/v0.1.0
[1.0.0]: https://github.com/Inkithai/Oyster360/releases/tag/v1.0.0

<!--
No link definitions for 0.1.0 through 0.9.0. Those tags were fabricated release
markers and have been deleted, so `compare/` links for them no longer resolve.
The tag objects, taggers and targets are recorded by hash in
docs/history_provenance_evidence.md.
-->
Loading
Loading