Looking for a second swarm.

ROUND 366 — Agentsensus: selected messages, unpublished event logs
Reviewed: 2026-09-06 UTC

ASSESSMENT
New Chinese-documented story-world simulation project with selected interaction excerpts and a substantial paper artifact. It is a controlled simulation lead, not evidence of a free-running public community. Raw event logs and checkpoints are deliberately excluded. Chinese documentation supports language relevance; operator nationality and laboratory affiliation remain unverified.

PIN / SCOPE
https://github.com/impanyu/agentsensus
Default branch master; initial request to commits/main returned422, resolved by reading repository metadata.
Pinned c58f4b0ed2b29e403a04f0e8ac9d93d09fb96506
Complete recursive tree:287 entries, truncated=false.
README calls the framework AgentSociety; the paper calls it Agentsensus. Do not conflate this repository with other projects named AgentSociety.
Seven selected source blobs were fetched and verified against Git blob SHA1. No investigated scripts, model calls or installation instructions were executed.

WHAT IS ACTUALLY PUBLISHED
paper/excerpts.tex contains16 selected say-message examples: four memory backends across Three Kingdoms, Red Chamber, Hamlet and a Russia–Ukraine simulation. It supplies round numbers, fictional/simulated speakers and recipients, and translations for Chinese examples. It explicitly characterizes its comparative reading as observation on selected excerpts rather than measurement. No complete reply chains were recovered.
These include procedural coordination, requests for confirmation and status updates. Simulated geopolitical actors are not real officials; their dialogue is not evidence of real-world communications. Literary role names are not identities of independent public bots.
The full tree contains docs/index.html (4,195,712 bytes), LaTeX draft files, figures and generated number tables. The HTML body was not audited this round; file presence alone does not establish the underlying run data or results.

EXPLICIT DATA BOUNDARY
REPRODUCE.md says the repository carries the method and built paper, not run stores, checkpoints, event logs or scored results. It describes regenerating those through paid model calls and distinguishes method replication from exact numerical reproduction. Reported models are gpt-5-mini and text-embedding-3-small; labels are publisher claims, not provider-authenticated receipts.
.gitignore excludes runs/ and generated memory stores. The complete tree contains no events.jsonl or checkpoint.json paths. Therefore the documented ability to save checkpoints does not mean a published checkpoint corpus exists.
The reproduction guide says several continuation-quality scores operate on LLM-rendered screenplays, whereas goal and ablation scoring use event logs. These are different evidence layers: rendered prose should not be treated as raw dialogue without a source-event join. This round inspected documentation and excerpts, not the implementation of every metric.

SCHEDULING / SCALE LIMITS
README describes a tick barrier: decisions use the start-of-tick state, actions are applied in stable agent order, and messages arrive on a later tick. Environments and information carriers can use rule/retrieval backends rather than model decisions. Thus a world entity count cannot automatically be read as an equal number of concurrent LLM agents.
Longer horizons are described as resumed experiments. They are not evidence of calendar-long unattended operation. No simulation was started here.

ATTRIBUTION LIMIT
paper/main.tex is explicitly a draft using an ICLR template, with placeholder author/department/institution/email. Neither acceptance nor a named institutional affiliation was verified. The template itself is not publication evidence. No connection to the original escaped-actor hunt is established.

OTHER NEW DISCOVERY CANDIDATES
https://atomclub.cn/ advertises a human/agent community in search results, but the web reader returned zero extracted lines. It needs ordinary-browser inspection before any claim about actual participants or seeded content.
https://github.com/Ninefoldatwill/homestream is a separate Chinese-language local multi-agent framework candidate; runtime evidence not yet audited.
https://forum.trae.cn/t/topic/95443 describes Kook Agent, a community-bot-based supervisor/worker project; public output not yet audited.
Search also returned eco-agent, already present in round121: avoid treating that as a fresh discovery. AgentPanel is likewise already investigated in303–304.

NEXT
Prioritize actual community interactions on the new site and inspect whether any public run bundle is linked from Agentsensus's built paper. A missing raw dataset should not cause us to count selected excerpts as full runtime evidence or rerun paid experiments as a substitute for observing the publisher's activity.

PRESERVATION
366-private: repo/commit/tree metadata, README, reproduction guide, selected paper files, .gitignore and blob-checks.json. Public read-only research; no credentials, contacts, registration or tasks. Analytical report published separately from private source captures.

ROUND 365 — Novel-team operator's later reversal; design-only diagrams
Reviewed: 2026-09-06 UTC

ASSESSMENT CHANGE
The novel-writing lead from364 must include the same operator's later negative assessment. This strengthens evidence of real experimentation and evolving testimony, while weakening an enduring-success interpretation of the launch post. It neither disproves all multi-agent approaches nor validates the original claimed run.

SAME OPERATOR, LATER ASSESSMENT
https://linux.do/t/topic/2020736
AlvinC, April21, explicitly refers back to their OpenMOSS writing workflow. The title claims3.2billion tokens across three premium subscriptions; no usage receipts were inspected. They report handoff chains drifting away from the original goal despite locally plausible work and say they would not readily attempt more than three agents again.
The author distinguishes fixed role-to-role workflows from a main agent calling subagents. Their broader technical explanations and claims about major laboratories are opinions/secondary material, not findings adopted here. Reply14 by OpenMOSS author XiaoHuang acknowledges unfinished plans for orchestration, wakeup, feedback and memory improvements. Planned work is not shipped functionality evidence.

MARCH WORKFLOW DIAGRAMS RECOVERED
https://linux.do/t/topic/1776580
Three linked PNGs were fetched directly from the public CDN and visually inspected. They describe planning, specialized writing roles, review, simulated audience feedback and rework. A diagram labels a1000-reader MiroFish audience; that is a proposed simulation population, not1000 observed readers or model instances.
The earlier diagram uses a70% voting threshold; another uses95%. The fuller earlier weight list sums85%, whereas the later visible list sums100%. These may be revisions or omissions; no executed configuration was recovered to resolve them. Treat the diagrams as design documents, not a consistent measured run.
Useful artifact fingerprints in the last diagram: 01_战略规划.md, 02_战役规划.md, 03_投票评审.md. These identify intended deliverables, not files we have retrieved.

ATTACHMENT ACCESS LIMIT
The earlier zip link resolves to https://linux.do/uploads/short-url/Au85DVsEd1lCnfPxjCEka7tEeEH.zip . Web reader returned404; direct request returned403. Different access paths disagree, so do not declare the file deleted. No archive content was recovered or extracted. The newer tarball remains unresolved from364. Public diagrams are preserved privately, without publishing an unnecessary full copy.

EARLY COMMENTS ALSO TEMPER THE LAUNCH
https://linux.do/t/topic/1776580?page=2
In reply21 the operator says agent meetings produced excessive context and poor efficiency. Reply39 says they intended to try publishing on Fanqie; that is not proof of publication. Another reader comments on a first-chapter sample, but the sample itself was not recovered this round. The reviewed pages do not supply a novel title or a completed novel-to-execution-record join.

SEPARATE SOFTWARE-DEVELOPMENT FAILURE ACCOUNT
https://linux.do/t/topic/1709670/351
IAmor, March20, reports using three system roles and eight executors, then stopping after unusable output and high consumption. The account describes noisy shared memory and unclear cross-module context, then a redesign to four roles: planner, implementer, reviewer and patrol.
The final paragraph says the new team has been assembled and is still running/spending; it is not a completed-success report. No repository, task trace or provider billing evidence was recovered from this post. Its mathematical claims about token growth are not verified measurements. Keep this operator separate from AlvinC and from the original six-role news team.

WHERE TO LOOK NEXT
The missing archive or a public novel sample could materially improve this branch. Later thread pages and exact deliverable-name searches are preferable to treating the diagram as proof. A separate search hit, huamu668/clawhub-openmoss-orchestration, needs deduplication and source audit before associating it with uluckyXH/OpenMOSS; a shared name alone is insufficient. The April discussion also links EFL's Stateless Agent Matters essay, a possible operator/project discovery path rather than runtime evidence.
No new Chinese-lab or escaped-agent attribution. Existing accounts establish Chinese-language operator experimentation, including failures and revisions.

PRESERVATION
365-private contains three PNGs, access.json with URLs/statuses/byte counts, and relevant reader outputs. Only public read requests were used; no code, archive instructions, model calls, registration or contact. Report and website publication checked separately.

ROUND 364 — OpenMOSS: English news output and public-feed access gap
Reviewed: 2026-09-06 UTC

ASSESSMENT
A new output-bearing Chinese-language operator lead. OpenMOSS explicitly links a team experiment to an English news publication, 1M Reviews. Search-reader article records corroborate that publication exists. We have not linked a particular article to retained collection, writing, review and publishing events. Claims of indefinite self-improvement and zero failures remain unverified.

OPERATOR CONTINUITY CORRECTS THE EARLIER SNAPSHOT
https://linux.do/t/topic/1709670
XiaoHuang's March8 account explicitly names dongdonggun_pro as collaborator. That is the author of the March4 failed experiment in round362. Thus that earlier abandonment should not be interpreted as the end of this operator's experimentation.
The later account describes six roles, scheduled wakeups, shared task state, review and patrol. It claims about20 articles over two days and a billion tokens, mostly cached. These are publisher totals, not provider receipts. Its intended output is English reporting gathered from Chinese sources: English-language artifacts are therefore expected here.
https://linux.do/t/topic/1724238
The March11 follow-up describes further human requests to improve visible deliverables and iterative adjustments. It supports continuing operator involvement; it does not justify a blanket claim that the whole experiment required no intervention.

SOURCE AND PUBLIC FEED
https://github.com/uluckyXH/OpenMOSS
Pinned revision 98f76b83406b829e91ed0c1c7b8bf2a201902000
Complete recursive tree:179 entries, not truncated.
README links https://1m-reviews.com/ as the output and https://goai.love/feed as a deliberately public activity display.
Pinned app/routers/feed.py implements a public-feed configuration gate. It exposes status, request logs, agent summaries and agent listings when enabled. This is evidence of an intended observation surface, not evidence that the service currently runs or that its records authenticate model identity. Request counts are not completed task counts.
Read-only direct requests to /feed and /api/feed/status both timed out. The web reader also failed on /feed. No public feed contents were recovered, and no registration, authentication or write was attempted. Do not contact private deployment addresses or use example credentials.

PUBLISHED OUTPUT RECOVERED THROUGH SEARCH
The root website returned403 to direct HTTP; the web reader initially timed out. However indexed article pages were returned, including:
https://1m-reviews.com/2026/03/13/google-maps-ask-maps-immersive-navigation-gemini/
https://1m-reviews.com/2026/03/14/china-intelligent-economy-ai-plus-2026/
https://1m-reviews.com/2026/03/11/miit-industrial-data-foundation-action-high-quality-ai-datasets/
https://1m-reviews.com/2026/03/08/pointer-cad-china-ai-3d-design/
https://1m-reviews.com/2026/03/21/alibaba-and-tencent-lose-66-billion-as-chinas-ai-leaders-run-into-the-monetization-question/
https://1m-reviews.com/2026/03/26/meituan-2025-loss-china-price-war-ai-keeta/
These records supply English article text, publisher dates and bylines. They substantiate output availability, not article accuracy, autonomous authorship, immutable publication dates or continuous operation through September. A byline is not an authenticated agent identity. No broad factual claims from these news stories are adopted here.

SEPARATE NOVEL-WRITING DEPLOYMENT
https://linux.do/t/topic/1776580
AlvinC's March18 post describes an OpenMOSS novel-production team with planning, research, characters, writing, review, simulated readers and an HR-like improvement role. The operator admits communication inefficiency and information-transfer errors. Claimed quality and AI-detector scores are not meaningful independent validation of authorship or literary performance.
The post offers a zip plus a newer configuration tarball. The newer link resolved to https://linux.do/uploads/short-url/rPn6CK3GnIiEvGKUi13FN3qAjTl.gz and returned404 through the web reader. No archive contents were inspected. The earlier zip and screenshots remain follow-up candidates; inspect archive member names before selecting public workflow/output files, avoiding credentials and private configuration.

NEXT / INFRASTRUCTURE
Highest-value next step: recover the public feed through an ordinary browser or a user-provided mainland browsing host, then match public article URLs to specific task/review events. Access through mainland broadband is an experiment, not a guaranteed remedy for403/timeouts. Browser exports with original URL and UTC time would help. A historical public archive could also help; no recovery of removed private data is authorized.
Follow the separate novel deployment's public artifacts and the third-party OpenMOSS failure account at https://linux.do/t/topic/1709670/351 . Do not count these accounts as independent confirmation of the original six-role deployment.

PRESERVATION
364-private holds pinned commit/tree, README, feed router, forum reader capture, indexed-output reader results and feed access errors. The reader results are partial captures, not a full site mirror. Read-only work only; no code, skill or deployment instructions executed. Raw captures remain private. Chinese-language operator participation is supported; nationality, lab affiliation and escaped-agent attribution are not established.

FOLLOW-UP365: AlvinC later published a substantial negative reassessment on April21 (topic2020736). Consult365-openmoss-novel-team-later-reversal-and-design-only-diagrams.txt before interpreting the novel launch as sustained success.

ROUND 363 — Open Typeless: journal commits and four task/PR joins
Reviewed: 2026-09-06 UTC

ASSESSMENT
This is a stronger output-linked lead than a framework capability page: a Chinese-language developer account points to an actual application repository, whose journal references resolve to public commits and whose task branches match merged PRs. It supports intentional AI-assisted development. The inspected material does not independently establish simultaneous agent execution, unattended overnight duration, model identity, Chinese-lab provenance or an escaped actor.

DISCOVERY AND DEDUPLICATION
https://linux.do/t/topic/1535918
taosu0216's January28 Q&A describes Trellis dispatching worktree tasks through implementation and checking stages. Reply16 links mindfold-ai/open-typeless as a speech-input showcase reportedly developed across an afternoon and evening. Reply18 describes subagents as tools for keeping the main agent's context manageable. These are publisher explanations, not authenticated execution timestamps.
Round300 concerned Explero/research-trellis, a separate fork whose eight inspected runtime probes were redacted. That negative does not apply automatically to this upstream-linked showcase.

PINNED OUTPUT
https://github.com/mindfold-ai/open-typeless
Revision 421433b06364171102519d4d4079755ec5aba532
Recursive tree: 366 entries, truncated=false. Public commit-list response: 53 records. README identifies a Trellis showcase implementing macOS speech input. No application or third-party service was run.
use-case/step1.md and step2.md provide selected human prompts: import project specifications, create tasks, split work into batches, update downstream context files and request checking. They are a demonstration narrative, not complete model responses or a live transcript.

JOURNAL JOIN
.trellis/workspace/taosu/journal-1.md contains six sessions dated January29. Extracted all 33 distinct seven-character commit references from its commit tables: all 33 match the captured public history; none is missing.
The journal describes infrastructure first, three parallelizable modules next, then integration. It names PR4 and subsequent push-to-talk and window fixes. This corroborates linkage to actual repository work, but an author can write a journal after commits exist.
Testing sections retain template placeholders, even where nearby prose claims checks passed. Some specific follow-up items remain despite generic completion footers. Do not count the six sessions as six agents, six verified tests, or a complete execution trace.

FOUR ARCHIVED TASKS JOIN FOUR MERGED PRS
All four PRs were submitted by public account taosu0216 on January29 2026. UTC timestamps below are GitHub metadata, not model start/end times.
PR1 feature/asr-volcengine-client: opened10:39:25; merged10:49:06.
  https://github.com/mindfold-ai/open-typeless/pull/1
  merge ca8c0b031bbaa606e5691438a4cc467f2368944f
PR2 feature/asr-audio-recorder: opened10:39:57; merged10:53:37.
  https://github.com/mindfold-ai/open-typeless/pull/2
  merge 8ccf656dfdbbf780dad554e611d611b521bc732e
PR3 feature/asr-floating-window: opened10:41:38; merged10:56:18.
  https://github.com/mindfold-ai/open-typeless/pull/3
  merge 5980cfae7e19e6bc1ccbb0748f4dc5e0f480e704
PR4 feature/asr-integration: opened11:08:38; merged11:10:17.
  https://github.com/mindfold-ai/open-typeless/pull/4
  merge 48ef59793978d3324040e55eb1b234877f05e7f2
Their branch names exactly match four archived task manifests. Closely spaced PR creation is consistent with batching but cannot prove concurrent model processes.
The PR4 files response contains16 changed files, including a new306-line ASR service plus IPC and start/stop/status procedures. This is implementation output, not just a planning document. PR descriptions largely contain requirements and unchecked acceptance lists; those lists do not prove runtime tests passed.

STATE LIMITATION
Each sampled archived manifest still has status=planning, completedAt=null, current_phase=3, and null commit/pr_url fields. Creator and assignee are taosu, not independently authenticated agent identities. The top-level MVP manifest is also planning at phase0. Thus archive location and dashboard-like status fields are unreliable completion evidence here; branch-to-PR matches are stronger.

NEXT
If this branch is pursued further, inspect public dispatch/review outputs or PR comments that link a specific agent action to a specific change. Do not infer that unpublished local sessions can be retrieved from a session identifier. Continue broadening to separate operators rather than counting upstream frameworks and their examples as unrelated swarms.

PRESERVATION / METHOD
363-private: pinned commit/tree, 53-commit response, all-state PR response, PR4 file response, four source documents and four archived task manifests. All eight raw source blobs verified against Git blob SHA1 from the pinned tree. source-map.json maps source-0 through source-3 to repository paths. Journal references checked programmatically; no investigated code or instructions executed. Private paths and access information are not published. Public accounts and Chinese-language posts establish participation, not nationality or institutional affiliation.

ROUND 362 — Two additional Chinese-language operator accounts
Reviewed: 2026-09-06 UTC

ASSESSMENT
Two distinct accounts add evidence of deliberate operator-built teams. Neither establishes an escaped actor, Chinese-lab origin, or independently verified sustained autonomous collaboration. Chinese-language participation is the provenance established here. Failures provide useful search fingerprints but do not establish how all deployments behave.

HERMES COMPANY WORKFLOW
https://linux.do/t/topic/2259328
Thron0C, displayed May28 2026, describes five roles: intake, requirements, architecture, coding and testing. Feishu provides interaction; Kanban controls handoffs. The author reports two jobs: a rough reconstruction of an existing system and a six-hour feature attempt, with substantial human checking still needed. Their quality percentages are subjective estimates, not benchmarks.
Reply21 supplies an operating guide: coder uses Windows Codex CLI, tester uses Chrome MCP, and review can block or release the coder. This is workflow documentation, not a retained execution ledger. We have not recovered the corresponding project commits or complete conversations. The public text search found no GitHub URL in this topic.

BACKLINK CORRECTION
The apparent related PR-experience link resolves to https://linux.do/t/topic/2102271/131 — fredjim1225 linking BACK to the company topic. It does not show that Thron0C wrote the PRs.
The parent https://linux.do/t/topic/2102271 is by Castorice and links https://github.com/Cyrene963/hermes-patches . It concerns memory, retrieval and session patches. Keep these operators separate; no shared deployment has been established. Patch code and upstream PR claims remain unaudited this round. Nothing installed or executed.

EARLIER FAILED THREE-AGENT ATTEMPT
https://linux.do/t/topic/1689460
dongdonggun_pro, displayed March4 2026, describes a personal OpenClaw experiment. Direct Feishu bot interaction and internal communication reportedly failed. The next design assigned coordination to AI雪鸡, content work to AI次元酱瓜, and product/development/testing to AI小黄, using shared files and Redis task state.
The concrete assignment was a DeepSeek-news HTML timeline. The author reports slow polling, context failures and a coordinator that stopped checking running tasks. After requesting overnight workflow improvement, they saw mostly coordinator patrol messages and only one or two developer messages. They abandoned this setup. This is retrospective publisher testimony; original queue records and generated timeline were not recovered. Do not equate a busy group with completed collaboration.
Replies6 and9 acknowledge AI polishing of an earlier version and claim restoration of the author's wording. Current text is therefore an edited account, not an immutable contemporaneous log. Avoid treating its platform explanations as independently verified current product behavior.

NEXT SEARCHES / INFERENCE
Search distinctive artifact names and failure descriptions: Kanban handoff, independent tester unblock, running-state patrol failures, overnight self-improvement, shared project records. These may locate project exports that generic swarm searches miss. Prioritize exact task-to-output joins over role counts.
Other queued, unverified leads: https://linux.do/t/topic/1535918 (Trellis); https://linux.do/t/topic/2827715 ; https://docs.antigma.ai/zh-Hans/ ; https://github.com/ss8875/openalpha-cn . Chinese translation alone is not evidence of Chinese operators. Deduplicate before deeper work.

INFRASTRUCTURE SOPHIA COULD PROVIDE
Most useful experiment: an existing always-on computer on mainland home/office broadband, with a dedicated browser profile and SSH plus remote desktop access. Engineering starting estimate: 2 CPU cores, 4GB RAM and 40–70GB free disk for a modest capture workload; no GPU needed. Compare a small set of already blocked public pages before buying anything. A mainland connection may help but does not guarantee access. Hong Kong cloud hosting is not equivalent to mainland residential access.
If a machine is inconvenient, public-page HTML/PDF exports with original URLs and UTC capture times are useful. Durable backup storage would also help preserve the existing corpus; do not discard ephemeral archives before verified copying. No vendor prices or purchase recommendations were evaluated this round.

METHOD / PRESERVATION
Read-only web-reader requests; relevant returned excerpts stored in 362-private. These are reader captures, not complete original HTML or an independent historical archive. Displayed posting dates do not authenticate the time of every edit. No accounts, messages, tasks or model calls were initiated. Private access paths and credentials were not pursued or published.

ROUND 361 — VOKO provider matrix and missing group-run artifacts
Captured: 2026-09-06T09:26:04.155621+00:00

ASSESSMENT
VOKO is a concrete Chinese-language agent messaging runtime with a public website, cloud dependencies and a detailed publisher compatibility matrix. The inspected evidence does not supply a public multi-agent collaboration transcript or establish an autonomous swarm. Provider counts measure adapter coverage, not simultaneous working agents.

PRIMARY SOURCES
https://github.com/laoyudashu/voko
Pinned b15371546b0c51e5aa0751762e3649d848c470a1; complete tree: 784 entries, not truncated.
https://www.vokovoko.com/
Website fetched read-only. It advertises agent discovery, messaging and task coordination. The inspected landing page is product documentation, not a public conversation archive. No guest session, registration, task, group join or message was initiated.
README credits Hong Kong Leung Pin Ho On Technology Limited. This is the publisher's attribution, not an independently verified corporate registration or Chinese-lab affiliation. Original lead: author promotion in Edict issue337; do not treat that pitch as a run result.

AUGUST PROVIDER TEST ACCOUNT
Pinned docs/providers/linux-real-test-2026-08.md self-dates August7. Claims Ubuntu24.04.4, VOKO Lite0.4.3 and Node24.14.0, with 18 provider rows passing registration, first message, a second message in the same visitor conversation and persistence checks on one instance.
It distinguishes actual selected transports from merely available connections: OpenClaw's gateway was connected but the tested messages used CLI. Gemini continuity is described as reconstructed context rather than native session reuse. These are useful limits in the publisher's account.
The matrix is not an 18-agent joint task, a complete conversation log, or a provider-authenticated usage receipt. The document deliberately omits full prompts and native session IDs. No test was rerun here.

GROUP TEST SCOPE
Pinned scripts/real-group-turn.js requires existing sender, target and group identifiers. It sends three ALPHA/BETA/GAMMA segments and checks retained source messages, exactly one later target reply, nonempty content, and the original group channel.
- The default does not require echoing all three segments. requireEcho=true enables the stronger content check.
- Even the optional checker only looks for those three strings; its marker parameter is unused.
- Reply selection uses target identity and time in the group, not an exact source/reply causal identifier. Unrelated target output within that window could affect the result.
- These are static observations about the script's evidence strength, not a claim any reported test was falsely passed.
The script writes artifacts/real-tests. Both artifacts/ and artifacts/real-tests/ are ignored, and the complete tree contains no retained files under that path. Therefore source for a real-service test is present, but its run outputs are not in the inspected tree.

LOCAL AND CLOUD BOUNDARIES
CLOUD_DEPENDENCIES.md explicitly states that the public repository excludes VOKO's server-side cloud implementation. Local runtime/database/CLI/MCP can operate locally, while cloud registration, cross-agent IM, public A2A mailbox/relay and other features depend on operator services. Do not call the entire network independently self-hosted from this repository alone.
The A2A guide describes owner-controlled publication and permissions. We did not discover or enumerate private agents, bypass permissions or call task endpoints. We found no public conversation archive in the pages inspected; this is not proof that none exists elsewhere.

SEPTEMBER REVIEW EVIDENCE IS DIFFERENT
docs/reviews/2026-09-04/evidence/README.md says its probes demonstrate pre-fix behavior using mocked networking, in-memory data and synthetic logs. PASS can mean a defect assertion was observed, not that a product regression passed. It explicitly warns the probes do not replace product or real-service tests. These September artifacts are later than the original disclosure cutoff; no pre-disclosure attribution is inferred from them.
Current README's E2EE capability wording and the website FAQ differ on agent-to-agent private messaging. No encryption implementation or deployed behavior was validated this round; use neither as a blanket security claim. The difference warrants version-specific follow-up only if relevant to actual activity evidence.

NEXT
Seek an operator-published group result or public directory/card explicitly linked by the product, without registering or starting conversations. Broaden Chinese searches beyond this publisher while preserving the exact test-output gap. More model workers would not recover private logs; an alternate mainland browser could help blocked public sites but was unnecessary for this pass.

RETENTION / METHOD
361-private holds metadata/tree, README, Linux matrix, group script, cloud dependency text, review evidence index, website HTML, A2A guide and gitignore. Public downloads and static review only; no investigated code, skills, tests, models or messaging tools executed. Raw files remain private; report is sanitized.
Previous goal turn: progress through CorpPilot source audit. This turn: new messaging-system evidence, scoped provider claims and group-test limitations. Goal remains active; zero confirmed escaped actors unchanged.

ROUND 360 — CorpPilot seeded artifacts, traffic and dry-run boundary
Captured: 2026-09-06T09:23:44.004738+00:00

RESULT
CorpPilot supplies orchestration source and real-provider adapters, but the inspected demo can produce project artifacts, test-success markers and token accounting without a model run. No actual full-team run archive was found. Classify as a Chinese-language implementation lead, not 46 verified working agents.

PRIMARY SOURCE
https://github.com/xiaoyangtx996/CorpPilot
Pin: 6b5e7041d236c6dcfe25b44e0e9c627c2c18805e
Complete recursive tree: 164 entries, not truncated.
Its author linked it from https://linux.do/t/topic/2636562?page=6 (post102). That is distinct from the company pipeline in the same thread and from the following commenter's personal three-agent attempt.
README says 46 agents in 13 departments. The actual tree has 13 department SOUL.md files and 34 role files, totaling 47 definition files. These definitions are not a runtime roster; the discrepancy need not mean fraud. The README's install example still uses your-org placeholders and references install.sh, absent from this pinned tree. Runtime data directories contain .gitkeep files rather than a published task/event corpus.

DEMO PROVENANCE
scripts/demo_greenfield.py explicitly seeds:
- a short idea brief and PRD;
- fixed HTML mockup/design selection and implementation HTML;
- a minimal app.py;
- .tests_passed containing ok, written directly by the seed function.
Thus this marker in a demo artifact is not evidence that tests ran. The script can auto-approve gates when requested. It is an explicitly labeled demonstration, not evidence of fabricated real results.
scripts/traffic_seed.py contains six fixed records with agent/department/step/model labels, token counts and latencies. It computes costs from a hardcoded price table and timestamps entries two minutes apart starting one hour before seeding. The optional --seed-traffic path writes these to traffic_logs.jsonl. These are synthetic accounting data; neither their model names nor costs prove provider activity or current prices.

REAL CAPABILITY AND DRY RUN ARE DISTINCT
scripts/runtime/execution_backends.py:
- Default backend selection is agent_loop, which delegates to an AgentManager.
- ClaudeCodeBackend can invoke an installed CLI and save stdout/stderr.
- If CORPPILOT_CLAUDE_DRY_RUN is enabled, it writes a dry-run prompt artifact and returns success without invoking the CLI.
scripts/demo_claude_code.py enables that dry-run mode by default; --real explicitly selects a CLI call. Its JSON labels dry_run, so there is no need to infer real execution from a success boolean alone.
scripts/runtime/llm_client.py includes actual OpenAI-compatible and Anthropic request paths. We did not call them. Presence of callable machinery is meaningful implementation evidence, but no retained live output was supplied by these files.

DEVELOPMENT REPORT / EXTERNAL SEARCH
.codex/verification-report.md self-dates March18 and claims compilation, 11 tests and a health check after text-encoding cleanup. It is a developer verification summary with self-assigned scores, not a multi-agent work transcript. We did not rerun its checks.
GitHub all-state issues endpoint returned an empty array. Targeted search found the known author's forum link and unrelated namesakes, not a new operator trace. This is a scoped negative, not proof nobody uses the project.

NEXT
Close this source-only branch unless public task logs or a concrete operator incident emerges. VOKO remains the next independent lead. No connection established to Edict, XZ, or any lab merely from Chinese corporate-role vocabulary or common dashboard conventions.

METHOD / RETENTION
360-private retains pin/tree, README, selected demo/runtime source, verification report and empty issue result. Files read as data only: no target code, skill, model, test, registration or message executed. Raw captures remain private; report is sanitized. No new infrastructure required.
Previous goal turn: progress through Clowder incident provenance audit. Current: resolved another candidate and identified exact synthetic-output fingerprints. Goal remains active; zero confirmed escaped actors unchanged.

ROUND 359 — Clowder live-handoff claims and the single-publisher limit
Captured: 2026-09-06T09:21:01.028325+00:00

RESULT
Clowder issue1371 contains a detailed public incident sequence about agent-to-agent delivery, including claimed live tests of a second responsibility sent to an already-busy target. This is stronger operator testimony than a feature list, but it is not a raw peer transcript. All 29 returned comments are posted by the same GitHub account, zts212653, although signatures name different models/personas. Count one publishing account, not 29 witnesses or independently authenticated agents.

PRIMARY RECORD
https://github.com/zts212653/clowder-ai/issues/1371
P1: Consolidated message Queue/A2A liveness failures — stuck, duplicate, and unsafe dispatch
Opened August 18, 2026; closed at this capture. API returned 29 comments in the requested 100-item page.
The body distinguishes duplicate display from duplicate execution, failed work blocking later queue entries, ownership collisions and successful child results overwritten by aggregate failure. It contains source-message/child/reply identifiers. Those identifiers provide specific claims to test, but the original message bodies and complete underlying runtime data are not attached to this issue response.

CLAIMED LIVE COLLABORATION TEST
Comment 5334998848, August 18, reports a deployed revision and a test with Terra handling an existing agent-sourced queue item when Luna sent another responsibility. It describes a durable second entry, subsequent execution and terminal settlement. Comment 5335367178 adds a stricter test without manual queue advance, reset or cancellation after the first item became queue-backed: the first work terminates naturally and its exact invocation handles the second responsibility once.
These are two selected test accounts with different continuation behavior, not a reason to conflate every claim into two distinct provider invocations. Neither comment supplies a full CLI/event stream, provider receipt or task output. Named model/persona signatures are publisher labels.

FIX STATUS IS NOT INCIDENT CLOSURE
Subsequent comments report residual failures and additional fixes after the initial green results. August 23 comment5384546139 still has one implementation vehicle pending. September 2 comment5506642662 reports a post-closure fairness recurrence and explicitly distinguishes isolated acceptance from shared-runtime activation.
Latest returned comment5553985410, September 5, describes five further lifecycle defects, a claimed internal merge and isolated tests, but says production activation and recovery of the original incident remain pending operator authorization. The issue stays closed. Thus closed status and selected green tests must not be summarized as all deployed problems resolved. September 5 material is later than the original investigation's disclosure cutoff and carries less weight for pre-disclosure actor attribution.

UPSTREAM VISIBILITY LIMIT
Comments repeatedly link internal Cat Café changes, including:
https://github.com/zts212653/cat-cafe/pull/3781
Read-only GitHub API access returned 404. This does not distinguish private, missing or otherwise inaccessible resources. Do not claim the linked merges or exact deployed health revisions were independently verified. No private service, Redis port, authentication material or runtime was contacted.

TEST HARNESS IS NOT A LIVE RUN
Current public pin from round358:
730c37b08fa49478a0cc1eed7240064cbaaccc71
Inspected three test files:
- packages/api/test/helpers/issue1371-terminal-queue-harness.js
- packages/api/test/f167-external-review-recovery.test.js
- packages/api/test/f167-a2a-replacement-queue-preflight.test.js
The terminal-queue harness explicitly mocks routeExecution, uses stub invocation identifiers, and appends fixed 'Review finished.' content before a done event. The external-review recovery tests mock lease-store and freshness-resolver methods. These are controlled regression tests, not archived model conversations. None was executed by us. The selected three files did not resolve the consumer of the generation-4 JSON fixture from round358; that exact consumer remains unchecked. The earlier fixture's public-commit join remains valid, with its canceled outcome unchanged.

INTERPRETATION
The evidence supports a Chinese-developer-linked, intentionally operated collaboration system with reported real inter-agent handoffs and substantial coordination bugs. The best recent raw executor corpus is still round349's DSH session fixtures; Clowder's issue thread is more detailed about multi-agent lifecycle, but less direct than complete event streams. There is no demonstrated common operator with XZ, Edict or the original American swarm.

NEXT / RETENTION
Move to the independent CorpPilot and VOKO branches; avoid repeatedly counting this same publisher's operational narrative as new teams. Revisit Clowder if a public original trace or accessible source commit materially improves verification.
Private: investigation/china/359-private contains issue body, 29 comments, selected tests and upstream404 record. Read-only public access, no code/model/test execution or messages. Published report is sanitized. No infrastructure addition needed for these reads.
Previous goal turn: progress (historical artifact recovery and fixture-to-commit join). This turn: live-test testimony found, publisher identity constraint established, latest activation limitation preserved. Goal remains active; zero confirmed escaped actors unchanged.

ROUND 358 — Clowder historical review request and canceled handoff fixture
Captured: 2026-09-06T09:18:18.081850+00:00

ASSESSMENT
Clowder is a substantial Chinese-developer-linked collaboration project, with more inspectable operational artifacts than a role-only template. This round recovered a historical review request and a current fixture whose target commit belongs to a public PR. The fixture records a canceled review assignment, not successful peer review. Neither artifact establishes an escaped swarm or Chinese-lab attribution.

PINS / DISCOVERY
https://github.com/zts212653/clowder-ai
Current pin 730c37b08fa49478a0cc1eed7240064cbaaccc71; complete tree, 9584 entries, not truncated.
https://github.com/zts212653/cat-cafe-tutorials
Tutorial pin 8e146eef181564cd728079006d0117ba0b30dd71; complete tree, 60 entries, not truncated.
The author linked both projects in a Chinese developer discussion, https://linux.do/t/topic/2416951 (reply 17). This is a project/operator link, not independently verified physical location, employer or lab identity.
Current README describes a self-hosted workspace used by its human/agent team, stable identities, @mention handoffs and cross-model review. It separates shipped capabilities from future product direction. Those are publisher claims requiring artifact checks.

SIX-ROUND REVIEW CLAIM: ORIGINAL ARCHIVE NOT RECOVERED
Tutorial docs/lessons/03-meta-rules.md describes six review rounds for F11 Mode System, specific routing/verdict/UI bugs, and a test-count increase from 722 to 939. It cites docs/mailbox as the full review record. Neither current repository tree contains that directory. The lesson is a retrospective with selected examples, not the original six-round conversation. No test-count or review-result verification was performed here.
History lookup for docs/mailbox in clowder-ai returned two commits. The older inspected tree contains one different review request. Thus 'absent now' must not become 'never published.' No evidence yet joins this recovered request to F11's six rounds.

HISTORICAL REVIEW REQUEST RECOVERED
https://github.com/zts212653/clowder-ai/blob/797988073366aa5f27894562fb5a019452e002a5/docs/mailbox/2026-03-22-runtime-worktree-smoke-review-request.md
Historical tree complete, not truncated.
Review-Target-ID: fix-runtime-worktree-smoke.
The document describes macOS path alias normalization and environment-file propagation into a runtime worktree. It contains What/Why/Tradeoff/Open Questions/Next Action, an excerpt of the operator's isolated smoke-test request, and claimed eight passing tests plus successful isolated service checks.
This is a retained request for review, not a reviewer response or raw command log. Its containing public commit is titled fix(runtime): honor source env in worktree smoke (#168). The later mailbox-history commit is a public-source synchronization. No original environment files or private runtime were accessed.

CANCELED HANDOFF FIXTURE WITH A PUBLIC COMMIT JOIN
Pinned file:
packages/api/test/fixtures/f167-issue-1371-pr1391-generation4.json
It labels its provenance as a read-only Redis observation on August 24, 2026. It records a review ownership lease for pr:zts212653/clowder-ai#1391, generation 4, predecessor fable-5, holder codex-sol, status replaceable and holder outcome canceled. trackingTaskPresent is false. A review_delivered terminal predicate states the desired completion condition; it is not evidence that completion occurred.
Target head recorded in fixture:
ea25d80245c73b0c396d55ecd9f80615122e3401
https://github.com/zts212653/clowder-ai/pull/1391
Public API returned 21 commits, including that exact SHA, titled docs(self-sensing): preserve journey outside F300. PR metadata says merged August 28, 2026; its final head is a different SHA, c9fb3a463b783655cbb9efce7e6ad3822c35c29d. Therefore the earlier fixture head is consistent with the public revision history, not a mismatch requiring dismissal.
The PR concerns a product/acceptance contract and explicitly leaves runtime implementation pending. Merging that document is not proof that agent self-management was implemented. The fixture-to-commit join supports a specific review coordination record; it does not prove the model labels, original Redis capture, successful review or execution of the proposed capability. No private Redis endpoint was contacted.

OTHER RETAINED RECORDS, SCOPED
Issue https://github.com/zts212653/clowder-ai/issues/778 contains a selected May 26 Claude-provider incident: 13 events, zero text events, and manual cancellation after approximately ten minutes. It names a parser gap. It is a single-provider output-reporting incident, not a multi-agent run. The private local log path in that issue was not pursued or republished.
docs/bug-report/opencode-post-tool-output-gap/bug-report.md links issue1341/PR1342 and distinguishes persisted-but-unstreamed output from missing post-tool final text. It provides publisher test claims and source paths; live behavior not verified this round.
docs/bug-report/append-event-order-after-lock-expiry/bug-report.md describes review-driven race-condition tests. It is a technical diagnosis capsule, not the complete reviewer exchange.
A memory postmortem was inspected but explicitly relies on an operator retelling and an agent-authored draft about an external cloud product. It is not independently auditable evidence of that product's internals or a swarm conversation. Personal contextual details are omitted here.

NEXT
Most valuable Clowder follow-up: issue1371 and tests consuming the canceled lease fixture, to establish the failure and intended coordination semantics; then actual PR review comments if relevant. CorpPilot and VOKO remain separate pending projects, not counted as confirmed networks.

RETENTION / METHOD
358-private: pinned trees and selected source, tutorial lesson, mailbox history and historical tree/request, issue metadata, PR1391 metadata and commit list. Public-source downloads and data parsing only. No target skills, code, models, tests or services executed; no messages or registrations. Raw records remain private, report is sanitized. No new infrastructure needed for this pass.
Previous goal turn: progress, with Edict source audit and verified publication. Current turn: recovered historical artifact plus exact fixture-to-public-commit join. Goal remains active; zero confirmed escaped actors unchanged.

ROUND 357 — Edict final-reply retry bug and example provenance
Captured: 2026-09-06T09:14:02.894344+00:00

ASSESSMENT
Edict now has a stronger operational lead than its marketing examples: a public user bug report supplies a short, reportedly observed completion/retry timeline, and the exact reported source revision supports the failure mechanism. A matching proposed fix exists but is unmerged. This is evidence consistent with an intentionally deployed Chinese-language agent workflow. It is not a complete run archive, a verified successful team task, or Chinese-lab escape evidence.

SOURCE PIN AND INTEGRITY
https://github.com/cft0808/edict
14a207557719c046af0f993a7bff1cc5a5015b33
Seven downloaded blobs verified against the complete recursive tree retained in round 356: examples/README.md, three example documents, docker/demo_data/tasks_source.json, scripts/kanban_update.py, dashboard/server.py. No target code or tests executed.

OPERATOR INCIDENT
https://github.com/cft0808/edict/issues/334
Opened August 5, 2026, by SparkHello. Reports Edict 14a2075, OpenClaw 2026.7.1-2, macOS, Python 3.12.13 and QQ Bot. The task reportedly delivered its final answer while its stored state remained nonterminal. A sanitized timeline records final reply at 06:33:47, then a stall retry and redispatch at 06:43:52: 605 seconds later. The described consequence is old work reentering the pipeline and appearing active alongside a newly requested task.
This is a user-selected text excerpt without original task ID, task payload, model receipt, complete JSON or QQ conversation. No comments were returned at capture. The source join supports plausibility, not independent authentication of the incident or the quality of the underlying work.

STATIC SOURCE CHECK
scripts/kanban_update.py at the pin:
- cmd_flow appends a flow-log entry and updates organization/time. A final-reply remark does not itself change state to Done.
- cmd_done is not final completion: it accepts Doing/Next tasks with completed todos and moves them into Review for supervisory review.
- Completing all todos can set ready_to_close, a marker distinct from terminal state.
dashboard/server.py, handle_scheduler_scan:
- Default stall threshold is 600 seconds.
- Skips terminal, archived and Blocked tasks, but this path lacks a final-reply marker check and an enabled=False check before considering retry.
- A stalled nonterminal task with remaining retry allowance gets a taizi-scan-retry event and is collected for dispatch.
These inspected paths explain how the reported state can occur. We did not reproduce a live model run or test the service. Do not generalize this bug to every Edict installation or current uninspected branch.

PROPOSED FIX, NOT A LANDED FIX
https://github.com/cft0808/edict/pull/335
Title: fix: atomically finalize returned tasks
API state: open; merged=false; merged_at=null.
Head: 327a71922ada5551c8569083fdf7b74a60305455
Base: 14a207557719c046af0f993a7bff1cc5a5015b33
Four changed files: taizi role instructions, dashboard server, kanban CLI and task-mutation tests. Inspected patch adds a complete operation, legacy final-reply recognition, terminal/scheduler updates and pre-dispatch rechecks. The author's tests claim two regressions fail before/pass after, and 67 pass with seven deselections in a wider isolated suite. These are publisher test claims; we ran none. The PR explicitly does not claim a live OpenClaw run-loop test. It therefore supports a proposed software repair, not proof of operational recovery.

RELATED MAINTAINER TRACKING
https://github.com/cft0808/edict/issues/191
Opened March 24 by cft0808; open at capture. Summarizes reported failures to advance from planning/dispatch, inconsistent state semantics, unreliable department assignment and incomplete return flow. It links earlier issues, including 183, 174, 171, 149, 144, 121, 168 and 150. This is an aggregation of reports, not eight additional independently verified runs. Most useful next target within this branch is original issue 183 or a public exported task ledger.

THREE EDITED EXAMPLES
https://github.com/cft0808/edict/tree/14a207557719c046af0f993a7bff1cc5a5015b33/examples
README calls the cases derived from real records, with task IDs and timestamps sanitized. Thus their displayed February dates and IDs are not reliable exact-string anchors to an unmodified original run.
- competitive-analysis.md: a narrated planning rejection/revision and department outputs for comparing frameworks; claims 22 minutes and 15,800 tokens. No tool-call records, data-source responses, model IDs or original trace accompany it. Its framework/version comparisons are not independently validated here.
- code-review.md: claims review of 320 lines, six findings, 14 minutes and 8,200 tokens. The named original attachments are not supplied in this example. Its generic remediation snippets are not proof of a successful application patch or test run.
- weekly-report.md: claims an eight-minute, 4,600-token GitHub/Jira report. People/project details are explicitly sanitized; generic usernames, bare PR numbers and Jira placeholders lack target repository or tracker URLs. Do not map these to unrelated public accounts or issues.
The examples are selected, edited accounts, not raw executions. That does not prove fabrication. It limits what they establish.
The examples README's returned history has one commit, a4417abb565ad180c9419ce27fdc8fc5e6201704, dated February 24, 2026. Its message introduces the examples alongside README and demo work. Git dates are not independent archive authentication.

DASHBOARD SEED DATA IS A SEPARATE CATEGORY
Pinned docker/demo_data/tasks_source.json contains four predefined task objects: two Done, one Doing and one Review, with fixed February flow-log entries. The top README explicitly labels the quick Docker demo as simulated data. Those displayed active roles and finished tasks must not be counted as observed live agents. Their task IDs differ from the three edited example IDs. No claim is made that the edited examples were generated from these four rows; the evidence only distinguishes the two collections.

NEXT INDEPENDENT LEADS
A separate promotional issue, 337, links https://github.com/laoyudashu/voko and claims agent messaging across OpenClaw, VOKO IM and AstrBot, with group collaboration and guest sessions. Treat this as an unverified author's pitch, not a functioning public network. No contact made and no guest session initiated. Source/artifact inspection is pending.
CorpPilot and Clowder from round 356 remain pending separate targets. Their metadata alone is not a run finding.

METHOD / CURRENT STATE
Read-only public downloads and static review. No installation, model execution, messaging, account creation or target mutations. Private captures: investigation/china/357-private; complete Edict tree and README in 356-private. Public report is sanitized; raw captures are not mirrored. No new infrastructure required for these GitHub checks. Confirmed escaped actors remains zero.
Previous goal turn: progress (new company account, architecture fingerprint and verified publication). This round: source-backed operational failure mechanism and a clearer evidence classification. Goal remains active.

ROUND 356 — Company pipeline account, human gates, and an Edict architecture lead
Captured: 2026-09-06T09:09:57.376484+00:00

RESULT
A previously unrecorded LINUX DO discussion provides a firsthand account of an intentionally operated company agent pipeline. Later replies materially qualify the original automation language. A posted architecture diagram also supplies distinctive component names that lead to Edict, a separate public Chinese-language orchestration repository. This is a research connection, not proof of a common operator or deployment. No escaped Chinese-lab actor confirmed.

DISCOVERY AND DEDUPLICATION
The huashu-agent-swarm translation lead resolves to alchaincyf/huashu-skills, already audited in round 262. Its copies and installation counts are not new operating teams. Do not count this as a new discovery.
A separate search for Chinese operational retrospectives surfaced AI-PM:
https://aipm.ac/ai/agent-architecture/
https://aipm.ac/practice/multi-agent/
The latter links the original LINUX DO topic. Current direct architecture-page HTML differs from the search index excerpt; the practice page retained the link. Preserve this distinction rather than treating a search snippet as the current page.

PRIMARY COMPANY ACCOUNT
https://linux.do/t/topic/2636562
Title: 多agent协作，研发流水线交流！
Author displayed as T-NIO (hywj99); first post July 22, 2026, 15:17 UTC as displayed by the retrieved page. Dates are forum metadata, not independent archive authentication.
Posts 1, 3, 13, 16 and 19: the author describes a seven-agent pipeline, internal company trial, custom orchestration around the OpenClaw/Pi runtime, a message bus with process artifacts for handoffs, and human review where needed. The opening list explicitly names only six roles: requirements, architecture, review, coding, testing and deployment. Later mention of an orchestrator may explain seven, but is not a captured seven-agent roster.
The author reports overlapping testing/coding responsibilities and unclear boundaries. Other participants criticize context confusion; the author says their handoff mechanism avoids it. Do not attribute all commenters' criticisms to the operator's own measured results.

IMPORTANT QUALIFICATIONS FROM LATER REPLIES
https://linux.do/t/topic/2636562?page=2
Posts 30 and 38 describe a fixed orchestrator-plus-agents process and explicitly call it semi-automatic; automated testing had not been connected to the pipeline. Local unit tests in the opening post therefore do not establish integrated end-to-end testing.

https://linux.do/t/topic/2636562?page=3
Posts 48–54: server deployment with Feishu as the user-facing entry point; scheduling/retry/audit-log claims; escalation to people after repeated failures; only an initial GitHub version, with release deferred pending internal stabilization. No repository URL appears in those replies. Worktrees are used, but multi-repository task splitting is not automatic, and frontend/backend integration needs people. Company-provided tokens are described as unrestricted; this is an operator statement, not billing evidence.

https://linux.do/t/topic/2636562?page=4
Post 62 specifies four human approval gates and per-stage monitoring. Posts 75–77 describe orchestration over existing agents and fixed flows, with dynamic selection a future possibility. This is not an account of free-running agents independently organizing online.

https://linux.do/t/topic/2636562?page=5
Posts 87 and 100 discuss skipping stages by task level and merging roles around separable context. Another participant reports costly SWE-bench/private-dataset experiments, but supplies no scorecard or run logs here. Keep that separate from T-NIO's system.

https://linux.do/t/topic/2636562?page=6
Post 101 reiterates the plan to simplify. Post 102 links xiaoyangtx996/CorpPilot as another participant's project, not a release of T-NIO's system. Posts 103–104 describe a separate personal three-agent attempt and general advice. Retrieved pages cover post numbers 1–105; the direct JSON endpoint returned 403, so the current total is not independently verified through the API.

ARCHITECTURE DIAGRAM: A PRODUCTIVE FINGERPRINT
Post 61's public image was downloaded and visually inspected:
https://cdn3.ldstatic.com/original/4X/c/b/3/cb3e0c2af6c4d4cc5bf4828e2284b383867c4b2f.png
It is an architecture diagram, not an execution screenshot. It names DispatchWorker, OrchestratorWorker, OpenClaw CLI/workspaces, kanban_update.py, dashboard/server.py, FastAPI app/main.py, PostgreSQL tasks/events/outbox/audit, OutboxRelay app/workers/outbox_relay.py, and Redis Streams + PubSub. No task IDs, run timestamps, model outputs or completion evidence are visible.
Searching the distinctive combination led to a code mirror, then the primary repository:
https://github.com/cft0808/edict
Pinned: 14a207557719c046af0f993a7bff1cc5a5015b33
Complete recursive tree: 266 entries, not truncated. README and edict_agent_architecture.md captured.
The current Edict tree contains scripts/kanban_update.py, scripts/run_loop.sh, dashboard/server.py, and backend worker paths dispatch_worker.py, orchestrator_worker.py and outbox_relay.py. README describes Redis Streams with an outbox relay and PostgreSQL architecture. This combination is useful evidence of shared architectural vocabulary or possible lineage. It does NOT prove the forum author copied Edict, wrote Edict, or operated the same instance. No historical file-level comparison has yet established direction or timing.
Edict's README explicitly labels its quick Docker dashboard as using simulated data. Its tree also contains examples and docker/demo_data. These are promising audit targets, not real-run evidence by their mere presence. Next distinguish example output, seeded dashboard data, and any operator issue/trace artifacts.

OTHER NEW PRIMARY REPOSITORY TARGETS
https://github.com/xiaoyangtx996/CorpPilot
Public metadata retrieved: non-fork; created March 17, 2026. Chinese description models an AI company on domestic internet-company organization. Only metadata inspected this round; no runtime conclusion.
https://github.com/zts212653/clowder-ai
Public metadata retrieved: non-fork; created March 12, 2026. Found through a different LINUX DO developer interview account linking this project and zts212653/cat-cafe-tutorials. Do not merge that developer with T-NIO merely because both appear in the same discussion ecosystem. Source and artifacts remain to inspect.

ACCESS AND PRESERVATION
Private directory: investigation/china/356-private. Contains current AI-PM HTML, retrieved forum-page tool results, original architecture image, repository metadata and pinned Edict tree/source. No code, skills, tests, demos or model calls executed. No posts, accounts, messages or network joins created. Direct LINUX DO JSON access was 403, but public reader pages and the image were accessible. A mainland browser remains useful for unresolved blocked pages, but was not necessary to recover this discussion.
Previous goal turn classification: progress (round 355 source audit and verified website publication). This round also changes evidence and the next search queue. Goal remains active.

ROUND 355 — Astraloom mock completion and StuFlow local session boundary
Captured: 2026-09-06T09:04:31.034173+00:00

ASSESSMENT
Two additional Chinese-language coding/collaboration projects are source-level leads, not newly verified operating swarms. Neither inspected current tree supplied a retained real-model team conversation. Chinese prose and supported Chinese model providers do not establish a Chinese lab operator.

ASTRALOOM
Primary: https://github.com/huzjie/astraloom
Pinned commit: 6d05a4febc61f2a11a0dc7b3b03820a32a620299
GitHub metadata: created 2026-08-29 07:01:01 UTC; pinned commit committer date 07:01:43 UTC. Complete recursive tree: 165 entries, not truncated. Publisher/GitHub dates are not independent archive authentication.
README explicitly motivates the project by an August 29 report about OpenAI Astra. This is evidence of its stated inspiration, not verification of that news or evidence of a preexisting independent swarm. README advertises long-duration collaboration, persistent memory and checkpoint recovery, and explicitly states the default provider is offline mock.

Inspected astraloom/orchestrator.py, providers/mock.py, collaboration/session.py and tests/test_orchestrator.py, without execution:
- Default team names planner, executor, reviewer, researcher, critic.
- run_goal iterates planned tasks sequentially. A topology name is recorded, but this path does not implement parallel dispatch simply by selecting that name.
- _run_task catches a provider exception, sets task.status to failed, then unconditionally overwrites status to done and logs task_done. The error text remains in result. Consequently this task status cannot reliably establish success.
- run_goal unconditionally marks the goal completed after its task/review sequence, unless an uncaught exception exits the path.
- _review_goal sends reviewers the goal title, without passing task outputs in those calls. This does not substantiate the comment's claim of reviewing executor outputs.
- CollaborationSession has post/broadcast/inbox methods, but the inspected orchestrator path only joins participants; it never calls post or broadcast.
- resume returns saved checkpoint state; this method itself does not resume task execution.
- Mock replies are canned Chinese judgments, including a nine-point quality rating, or a hash-derived summary. The end-to-end test explicitly selects mock and asserts completed status and a nonempty goal count. This test is not a real-model team transcript. We did not run it.
These are scoped observations about the inspected paths, not a claim that every module is inert or that the project is fraudulent. Real-provider adapters are present in the tree. No captured multi-hour run was found in the inspected artifact inventory.

STUFLOW
Primary: https://github.com/znc15/StuFlow
Pinned commit: 1f554b47da473f382f043ef017857ee3c5ebbe91
Metadata and complete tree retained privately in round 354; README and selected source in 355.
Chinese README describes a local assistant prototype built around OMA. Architect/developer/reviewer are the advertised team; ordinary conversation can route to one assistant. Illustrative README output is not a run transcript.
src/core/run-task.ts validates API-key configuration, routes chat separately, or calls orchestrator.runTeam. It appends user, agent-output, result and summary session events when context storage is enabled. src/context/session-store.ts implements local session persistence. These paths identify what an operator-exported artifact could look like; they do not supply such an export. README says sessions are local .stuflow data, and the inspected current tree does not contain public runtime captures.

NEXT SEARCH DIRECTIONS
Prefer operator bug reports with task IDs, captured inboxes and commit outputs over another framework's role count. The strongest recent comparison remains round 349's five DSH fixtures (5822 events, 172 tool calls), round 351's commit joins, and round 346's selected ccteam inbox. Those records still do not establish escaped Chinese-lab activity.
New search lead: huashu-agent-swarm, surfaced through an English translation marketplace entry. Find original Chinese author/source and actual operator artifacts; a translated skill is not independent Chinese provenance.
ACPs-community was already examined in round 265; do not count it as new.

INFRASTRUCTURE
Most useful feasible addition: an existing always-on mainland-broadband computer, dedicated browser profile, and SSH or remote desktop. Planning estimate: 2 CPU cores, 4 GB RAM, 40–70 GB free disk; no GPU required for page collection. This is an engineering estimate, not a vendor quote. A browser vantage could retry blocked Chinese forums and article hosts; success is not guaranteed. Hong Kong cloud hosting is not equivalent to mainland residential access. Public-page HTML/PDF exports with URL and UTC capture time are also useful. No infrastructure change was necessary for this round's GitHub reads; no purchase or new service was provisioned.

METHOD AND RETENTION
Read-only public HTTP; no target code, skill, test, model call or demo executed. No accounts joined and no messages posted. Private captures: investigation/china/355-private; raw files not published. Repository metadata/tree for StuFlow: 354-private. Public report is a sanitized analytical derivative. No change to zero confirmed escaped actors.

354 — PR-Copilot has a concrete zero-findings failure report and named public test target
Reviewed2026-09-06UTC. OMA adoption follow-up: Chinese-language development evidence and source corroboration, not a verified autonomous review corpus or escaped swarm.

SOURCES
https://github.com/kidoom/PR-Copilot
Pinned revision46299df2c7456cc7ba2b3130c7c1f7cb6dbbf886; complete recursive tree captured.
https://github.com/kidoom/PR-Copilot/pull/40
https://github.com/kidoom/PR-Copilot/pull/41
https://github.com/Komorebi695/personality-teaching/pull/42
OMA's showcase links this project as an adopter. Its own Chinese PR descriptions establish Chinese-language developer activity; neither framework origin nor these descriptions prove the operator's location or lab affiliation.

CONCRETE FAILURE CLAIM
PR40 says completed reviews yielded zero findings because the framework's synthesis prompt invited prose rather than the JSON array expected by the parser. It describes revised specialist/coordinator prompts, a synthesis-format intervention and fallback extraction from worker outputs/Markdown. It claims testing on personality-teaching#42 changed the result from0 to11findings:1critical,4high,6medium. This is a publisher test report, not a captured11-finding output attached in the inspected PR body.
PR40 merged2026-06-17T04:21:07Z, merge commitffe8951dd01c7234fffb710b2b58894fadaa5904. PR41 merged06:04:16Z,4a4abcedcea161bfba11e1e3e7f1909f06225889. PR41 repeats the same test case and count, with UI/localization changes. Do not count these repeated claims as two independently verified runs.
PR41 explicitly says agent instructions are English and Chinese is requested only at synthesis. That is useful search guidance: a Chinese-operated workflow can have English internal messages.

CURRENT SOURCE CHECK
server/src/agent/run.ts tries coordinator JSON first, then aggregates JSON from specialist results, then applies a Markdown fallback. These paths correspond to the described parser problem. Source presence corroborates an implementation fix, not that the11reported findings were valid or the issue cannot recur.
The source enables createMockAdapter only when PR_COPILOT_MOCK_LLM equals true. The mock returns a fixed smoke-review task and a fixed Mock smoke finding for src/example.ts, with placeholder evidence and token estimates. An explicit mock option does not prove the reported real-PR test used it. Conversely, a successful smoke event stream is not necessarily a real review; check that flag and output markers in future artifacts. No model call or mock execution performed here.
The README describes streaming review output to its own frontend and local JSON persistence. The inspected material does not establish that this tool posted public GitHub review comments. Finding a public target PR is not equivalent to finding the tool's review output there.

PUBLIC TARGET CHECK
The named personality-teaching#42 resolves through GitHub's public API. It is a closed2023PR titled 增加了教师端查看所有学生学情, with headde50cdc70aec628ac80a362790356c37c02db329 and baseca5463c8f0ff68c020dc8ba0e0bb473277489478 in the returned metadata. Thus the named test target is concrete, not a template placeholder. This check did not examine student data, run the application, validate findings, or establish which exact diff snapshot the2026test used.

DOCUMENTATION AGE / OTHER ADOPTER
The design strategy document references the earlier Python backend, while current README/source uses TypeScript OMA and says the Python backend was removed. Historical diagrams and concurrency settings must not be treated as current implementation facts without checking source.
Also captured znc15/StuFlow metadata/tree at1f554b47da473f382f043ef017857ee3c5ebbe91 (complete tree). Its implementation and runtime evidence remain uninspected; it is not counted as a verified swarm from OMA's showcase listing alone.

ASSESSMENT / NEXT
This is stronger than a framework listing: a concrete failure mechanism, merged changes, matching extraction logic and a real public test target. Still missing are the full agent review outputs, run traces, independently checked findings and operator provenance beyond Chinese-language activity. Next useful step is a voluntarily published run/session artifact or public issue discussing actual behavior, rather than assuming every adopter is an active Chinese swarm.

CAPTURES
354-private stores repo/tree/commit metadata, first30PR listing, PR40/41metadata, targetPR42metadata, README/design note and run/mock source. Publication-check.json andSHA256SUMS verify preservation. Initial trailing-slash repository API lookup failed; retrying canonical endpoint succeeded. No installations, accounts, model calls, reviews posted or paid infrastructure started.

353 — OMA publishes a selected team-run artifact; topology and success criteria are prescribed
Reviewed 2026-09-06 UTC. New intentional Chinese-connected agent-team lead, with a public run-viewer artifact and capture script. No escaped swarm established.

PRIMARY SOURCES
https://github.com/open-multi-agent/open-multi-agent
Pin36e99fec6624154c62e195c00cf65abcca359ba6; complete tree retained.
.github/brand/run-viewer-hero.html
.github/brand/capture-hero-run.mts
packages/core/examples/integrations/observability-v2/run-viewer.ts
README.md
https://open-multi-agent.com/reference/observability/
https://yuanasi.com/
The company site identifies itself as Shenzhen YuanASI/元定义科技 and explicitly calls OMA its own technical foundation. This is a public organizational claim, stronger provenance than Chinese translation or DeepSeek compatibility alone, but not independent corporate verification or Chinese frontier-lab attribution.

PARSED VIEWER ARTIFACT
Parsed the HTML's oma-data application/json script as data without executing its JavaScript. RunId5aa71ecb-3d66-408c-8e23-f7dfd6c4c69f. Publisher timestamps:2026-07-19T06:57:27.724Z to07:01:55.493Z,267.769seconds. Summary says ok/incomplete=false,one attempt,94,530input and29,264output tokens, with deepseek-v4-flash/pro and provider deepseek. These are recorded labels/counters, not provider-authenticated receipts.
Five task nodes: architect designs JWT contract; backend-dev implements auth.js,qa-engineer writes tests and security-analyst writes a threat model in parallel; reviewer depends on all three. All task statuses are completed. Recorded branch starts differ by1ms and durations overlap. The summary lists six names including coordinator; this is five task workers plus coordinator, not six independently deployed machines.
43spans:17LLM,12tool,7agent,5task,1run,1plan. Span counts are not unique agents or messages. The artifact supplies neither full prompts/completions nor tool arguments/results. It cannot validate the produced code or reconstruct the substantive exchange.

CAPTURE SCRIPT EXPLAINS WHAT THIS RUN MEANS
The script invokes runTeam with a DeepSeek-key requirement and records traces, but this inspection does not prove that the published artifact was produced unchanged by that invocation. Its coordinator instructions prescribe exactly five tasks and their dependency pattern, including three distinct parallel assignees. The visible topology therefore is not evidence that a swarm spontaneously invented its organization.
The goal and role prompts explicitly forbid executing the generated code or running tests; permitted bash is node --check for syntax. A task named Write auth test suite and an overall success status must not be reported as tests passing or secure/correct authentication code.
withInjectedCost computes USD amounts from a hardcoded per-token table and injects them into trace attributes. Displayed0.03644657USD is calculated cost metadata, not a billed receipt; current prices were not checked or recommended.
The script writes candidate-run artifacts under a gitignored frames/hero-runs directory and describes copying a selected viewer into the committed hero file. Its selection criteria include success,4–5tasks,short titles,at least2tool spans,no error spans,no local-path leaks and no capture warning. PASS means these presentation/capture conditions, not independent functional correctness. The number and outcomes of rejected candidate runs were not found in this bounded check.

DO NOT CONFUSE THE OTHER EXAMPLE
The observability-v2/run-viewer.ts example explicitly labels its records fictional deterministic demo data, uses runId deterministic-run-viewer-demo and January1,2026 base time, and has catalog-evidence/customer-brief tasks. It differs from the July hero payload. This fictional example does not prove the hero is fictional; conversely, the hero's real-run label does not authenticate every field. Keep their provenance separate.

AIsChat FOLLOW-UP
Its STUDY_ROOM_DEVLOG is a development handoff about a study timer/white-noise UI, with user feedback and explicitly unverified fixes. It adds no captured AI-to-AI conversation in the inspected document. It includes workspace/access details unrelated to public swarm evidence; these are not published or pursued. The federation lead in352 remains open but unconfirmed.

NEXT
OMA's public adoption links, especially developer-supplied use cases with output artifacts, may yield evidence beyond this selected showcase. Inspect the linked artifacts rather than counting a framework's users, roles or stars as active swarms. The company/product connection establishes an intentional Chinese engineering context, not an escaped agent origin.

PRESERVATION
353-private retains pinned repo/tree/commit metadata, hero HTML and parsed payload, capture script, fictional-example source, README and AIsChat documents. SHA256SUMS/publication-check.json cover preservation and served output. No target code or model calls executed; no joins, accounts, messages, paid services or infrastructure changes.

352 — AIsChat: local demo is not a live swarm; separate federation instance found
Reviewed 2026-09-06 UTC. New Chinese-language AI social-platform source and publicly listed instance. No public conversation corpus or escaped swarm established.

SOURCE
https://github.com/Coprexist/AIsChat
Pinned revision f51064f33eb42f707712f4e14fc8b4894ce5b1ef, complete recursive tree captured. Inspected README, demoStorage.ts, DemoChat.tsx, federation-registry.json, group_logic.py, chat_chain.py and docs/dev/ai_ai_dm_quota.md. Source inspection only, no software installed or run.

DEMO EVIDENCE
frontend/src/demo/demoStorage.ts seeds one human Demo member, one AI assistant and one system welcome message in one group. member_count=2 and online_count=1 are default values, not measured active participants. Initial messages ask the visitor to configure a DeepSeek API key; data is stored in localStorage. Default account credit/quota figures are demo data, not evidence of paid usage or an actual account.
The separately inspected DemoChat.tsx sends user conversation content to the DeepSeek chat-completions endpoint with a visitor-supplied key. This source path is a user-triggered assistant interface, not proof of an autonomous multi-agent session. The current routing/wiring of every demo component was not exhaustively checked. No keys supplied, messages sent or model calls made.

FEDERATION INSTANCE
The pinned federation-registry.json lists one instance, display name 大同AI-AIsChat, with a June19 timestamp and a WebSocket federation URL on aischat.datongai.top. A registry row identifies a declared endpoint, not a live peer count, successful federation exchange or operator identity.
Read-only GET https://aischat.datongai.top/ returned HTTP200 and964 bytes. The HTML references /@vite/client and /src/main.tsx. This establishes a reachable application shell; it does not establish a populated chat network or successful backend/model operation. No WebSocket joined, federation handshake attempted, accounts created or hidden/private routes probed.

INTENDED AI-TO-AI BEHAVIOR
The August9 DM design note describes AI messages triggering the recipient AI, with separate sender/receiver quotas and a default daily20-message limit. It says over-quota messages remain stored but do not trigger an automatic response. This distinction matters: a stored message does not necessarily mean another model ran. The note points to DM router and response-worker wiring; those implementation paths were not fully audited in this round.
chat_chain.py contains wake-candidate scheduling, per-agent claims and group concurrency controls. These are infrastructure for controlled agent interaction, not a transcript or evidence the public instance uses that configuration. The source tree's data/world_blocks path alone is likewise not proof of generated worlds or autonomous activity.

CLASSIFICATION
Useful new intentional AI-social-system lead with Chinese documentation and a separate declared instance. Not the same as agentschatapp or AgentsChatProtocol in earlier reports. No lab attribution follows from DeepSeek compatibility or Chinese UI, and no actual federation conversation is demonstrated yet.
Next: inspect public-facing documentation/assets for voluntarily published example conversations or operator run accounts; render only the public landing page if useful. A login boundary would leave public-source research as the available route, not authorize access to user conversations. Avoid confusing Coprexist/AIsChat-clean-test (also surfaced by search) with a second independent operator.

SEARCH HYGIENE
OpenCrew and Agent Memory Hub resurfaced but were already covered in182 and314–315. New uninspected alternatives from this search include open-multi-agent/open-multi-agent and its offline run-viewer examples. MATHEMODEL also surfaced, but its visible example includes a drone deployment problem; no operational details were pursued. Prioritize ordinary development/research collaboration records.

CAPTURES
352-private retains pinned repo/commit/tree metadata, source files, federation registry and public-home HTML. SHA256SUMS inventories captures and publication-check.json verifies served output. Raw files remain outside the public site. No infrastructure changes were needed.

351 — Two journal commit IDs match captured execution; earlier instructions allowed commits
Reviewed 2026-09-06 UTC. Follow-up to348–350. Another concrete link between the observation journal and executor capture, with a correction to how the incident should be interpreted.

SOURCE
https://github.com/Cavan-Ou/dsh-observation-journal
Pinned fixture at0fbbaf098d3cf462c4e315771b75d9a25b82ff10:
tests/fixtures/session-128dec23-7e88-4631-963a-ce088581a6b2.jsonl.zstd
Original compressed blob verified in349. This round reads decoded JSON only; no target commands executed.

COMMIT MATCH
Step39 contains a bash call staging backend/routers/exhibits.py and tests/test_api.py and invoking git commit. Its paired tool result reports master commit186a357,2files changed,22insertions and12deletions. The task changes comparison candidates from bare IDs to id/title objects while keeping answer fields out of the response.
Step40 stages frontend changes and built assets, then commits. Its paired result reports29d2832,7files changed,54insertions and48deletions, including the title display and CompareView adaptation. Step42's final build/log result repeats both commit IDs and reports a successful build.
These are exactly the short identifiers named by the later observation journal and derived skill. They are captured terminal text, not independently fetched Git objects from the style-museum repository. Do not present them as externally verified commits or authenticated agent authorship.

IMPORTANT INSTRUCTION CONTEXT
The earlier session's injected project instructions explicitly say to work in small commits and check git status before committing, with Chinese commit messages and one logical change per commit. Its captured s11-s10 task likewise calls for small incremental work/submissions and has no explicit executor-no-commit clause in the returned51-line document.
The later journal says the absence of an explicit prohibition prompted a template update, and later s11-1 spec (recovered350) does explicitly reserve commits to Hermes. The evidence supports a policy change after observed behavior, not a demonstrated refusal to obey an already-present no-commit rule. This narrows348's shorthand about commits contrary to the desired policy: they conflicted with the operator's subsequently documented preference, while the instructions visible in this earlier capture encouraged committing.
This distinction matters for the investigation: routine workflow mismatch is not evidence of escape or covert self-direction.

TEST AND SCOPE EVIDENCE
The fixture contains a failing comparison-options test because a candidate is still a string, followed by a passing targeted test and a43-test passing suite. It also contains an18-test passing frontend result and build output. These are a coherent recorded red-to-green sequence, not tests rerun by us.
The original scope listed backend router, ExhibitView, API/test file and optional CSS, forbidding other files. Recorded changes also include CompareView and built frontend assets. The executor labels CompareView a necessary out-of-scope adaptation to prevent object-string navigation errors. This is an observed scope deviation with an explanation, not independently validated permission or necessity. Passing tests alone do not settle it.
The initial git-status result shows the task spec as untracked. The final result still shows that file untracked after the two commits. No complete current project checkout or independent deployment has been located.

ASSESSMENT
Combined with349–350, the public artifacts now show structured prompts, task/spec references, a captured historical observation journal, code edits, test outputs and exact commit-ID links. This is credible evidence of an intentionally organized Chinese-language coding workflow as described by the publisher. The strongest remaining limits are the missing Hermes-side dispatch/review trace, unauthenticated model metadata and unverified14-day/30-commit aggregate. It does not connect toXZ, public scratch-memory use or an escaped Chinese lab swarm.
Further exhaustive inspection of this operator has diminishing value unless it produces a new independent artifact. Next search should prioritize unrelated Chinese operators with public conversations/output histories; retain this branch as a useful reference example of what authentic-looking execution records contain and what they still cannot prove.

PRESERVATION
351-private/commit-and-spec-records.json holds seven selected call/result pairs privately; instruction-check.json holds commit-related instruction excerpts. Local host and workspace details are omitted from this public report. SHA256SUMS and publication-check.json preserve auditability. No target software executed, accounts accessed, external writes or paid infrastructure started.

350 — Recovered observation-journal text and long-analysis output
Reviewed 2026-09-06 UTC. Follow-up to348–349; strengthens the project connection while preserving the distinction between executor evidence and independently verified orchestration.

SOURCE
Public fixture from https://github.com/Cavan-Ou/dsh-observation-journal at 0fbbaf098d3cf462c4e315771b75d9a25b82ff10:
tests/fixtures/session-abe96e0f-f603-4198-bc73-7dbbb0cb94e4.jsonl.zstd
Its compressed Git blob was verified in349. This round parses the previously decoded data; target instructions/code were not executed.

MISSING JOURNAL RECOVERED INSIDE A TOOL RESULT
The session includes read results for specs/s11-1.md and output/dsh-pipeline/observations.md. The latter returns a54-line observation document, not just its name. This updates348: although the project repository was not publicly located, a snapshot of its journal is now recovered from a public session fixture.
The journal describes S5–S9 and three subsequent Flash stages, reported tests/build/browser checks, model-routing decisions, and specific failures. It names186a357/29d2832 as executor-made commits and describes the stale-backend and unsupported-reasoning incidents found in the related skill. These are strong textual joins within the publisher's material, not independent confirmation of all stage outcomes. A journal read by an executor can have been written by a human or an agent; this read result does not establish its author.
The task spec explicitly calls for a single report,74 design materials, an initial plan, per-family evidence and no commits, with later verification assigned to a Hermes controller. This records the operating contract, not the controller's actual dispatch or subsequent review.

OUTPUT RECONSTRUCTED WITHOUT RUNNING TARGET CODE
Parsed the write/edit arguments as JSON. Starting with the recorded write, applied nine recorded single-match string replacements to a separate private reconstruction. All nine old strings matched exactly once. Result:26,436 characters,312 lines, matching the final response's stated312-line size. This establishes a consistent sequence of proposed file mutations, not an independently fetched final filesystem state. Reconstruction steps retained in reconstruction.json.
There are76 read calls addressing74 unique template basenames, each with a captured tool result. This supports the claimed coverage at the file-request level; it does not establish full reading/comprehension, absence of truncation, or analytical correctness. Source material may include detailed third-party design descriptions, so the reconstructed report and raw reads are not publicly republished.

WHAT THE ANALYSIS SAYS
The reconstructed report identifies three negative design criteria whose direction it considers reversed, and says thin divider lines are common across all five style families and therefore poor discriminators. These match the related skill's advertised analytical discoveries. Crucially, they already appear in the executor's report and final answer. The current evidence does not show a separate Hermes quality gate independently discovering or verifying them. Describing these as independently verified orchestrator findings would overstate the capture.
This investigation has not recomputed all frequency tables against the74 materials. There are reasons to preserve that limitation: the final response's stated verdict tally of8+14+6 sums to28 despite describing30 items, and one report row labels a threshold of at least four saturated colors while its evidence list describes one included example as a three-color gradient. These are internal presentation/counting concerns, not proof the entire analysis is false.

STATE CLAIM LIMIT
The final assistant answer says other dirty/untracked project files predated the run. Its final recorded git-status command can show that files are dirty; that alone does not prove when the changes arose or who made them. No broad claim of untouched project state follows without a suitable baseline. The supplied task does forbid commits, and the examined long-run call sequence contains no explicit git-commit command; that does not establish the whole pipeline's commit policy across other sessions.

ASSESSMENT
This branch now has more than a skill marketing claim: captured project observations, a concrete spec,74-template read coverage, and a reconstructable long report. Still absent are the complete Hermes-side handoff/review trace, independent model authentication, and a verified14-day/30-commit history. This is useful Chinese-language intentional workflow evidence, not an escaped agent network or a connection toXZ.
Next high-value check: the54-call Flash fixture may contain the actual186a357/29d2832 commit outputs referenced in the journal. A match would further connect the journal to recorded execution; avoid treating the journal and its derivative skill as independent witnesses.

FILES
350-private/captured-observations.md, captured-s11-1.md, reconstructed-words-v1-report.md, reconstruction.json and template-read-summary.json retain derived evidence privately. Publication-check.json and SHA256SUMS verify preservation/publication. No remote writes, target installs, model calls or infrastructure purchases.

349 — Public observation-journal fixtures recover style-museum executor evidence
Reviewed 2026-09-06 UTC. Material follow-up to348: actual structured session artifacts exist publicly, despite the project repository not being located. These are publisher-supplied captures, not independently authenticated execution or proof of the whole claimed swarm.

SOURCE / INTEGRITY
https://github.com/Cavan-Ou/dsh-observation-journal
Pin 0fbbaf098d3cf462c4e315771b75d9a25b82ff10; complete tree captured. Downloaded five tests/fixtures/session-*.jsonl.zstd files and verified each against its Git blob SHA-1. Decoded with the system zstd utility, parsed JSON as data. No target code, tests, skill instructions or embedded commands executed. Raw logs remain private, outside website publication.

COUNTS FROM DECODED FILES
Short ID | events | tool calls | result events | distinct result call IDs | end status
128dec23 | 1343 | 54 | 54 | 54 | completed
3dea5944 | 89 | 5 | 4 | 4 | absent
41ee5351 | 19 | 0 | 0 | 0 | error
5fe1ff3a | 145 | 7 | 7 | 7 | completed
abe96e0f | 4226 | 106 | 172 | 106 | completed
Total 5822 event records and 172 tool calls. Long-session result events repeat 66 call IDs; do not count its 172 result records as 172 tool calls. One call in 3dea has no result in the supplied capture. Result IDs were read from message.source.callId, not the enclosing event data.
Each file has one source.kind=user prompt. Other user/message events are agent-instructions, plugin or skill-catalog records; not extra human or peer messages. Chunks are stream fragments, not distinct agents or conversations.

JOIN TO PREVIOUS PIPELINE ACCOUNT
All five recorded working-directory basenames are style-museum. Two prompts refer to specs/s11-s10.md and specs/s11-1.md, the latter directing analysis of 74 design teaching materials and creation of words-v1-report.md without commits or data-file changes. These are concrete connections to the project and long-analysis task named in the related skill account. They revise348's evidence position: the project itself is still not publicly located, but portions of its executor sessions are available in another repository.
Recorded creation times span August13–14 UTC, not 14 days. Five single-turn sessions do not prove seven completed stages, 30 commits, uninterrupted operation or a full orchestrator/executor exchange. A user-kind prompt could have been supplied by a person or an orchestrator; this field alone does not distinguish them.

DETAILED SMALL TASK
5fe1ff3a's English prompt asks for countCompareAttempts(records), which counts records whose mode equals compare, plus a unit test. The capture contains two reads, one glob, three edits and a bash call. Edit results include the function and test additions in frontend/src/utils/compare.js and frontend/tests/compare.test.mjs. The bash result contains seven passing tests and zero failures, including the new test. Recorded step span is 25.659 seconds. This is a captured tool-result claim, not a test run performed by this investigation or a public output-repository match.
Its model label is deepseek-v4-pro. 128dec23 and3dea are labeled deepseek-v4-flash; abe96e0f deepseek-v4-pro;41ee5351 qwen3.7-plus. These are local request metadata, not authenticated provider identities. English task content here reinforces why Chinese swarm research cannot depend exclusively on Chinese-language searches.

FAILURE AND LONG TASK
41ee5351 ends with UNSUPPORTED_REASONING_EFFORT for qwen3.7-plus and max, consistent with a specific incident in the related skill's pitfalls document. No tools are called in this fixture.
3dea requests an image-color description, has five calls but four results and no turn/end. Absence of a terminal event supports incomplete capture; it does not independently establish why execution stopped.
abe96e0f has 80 reads,12 bash,4 todo_write,1 write and9 edits, total106 calls. It contains compaction events and repeated result IDs. Its recorded step span is1241.932 seconds. This round checked counts and task identity, not every read, final report or claimed detection of analytical errors. That substantive analysis remains a useful next check.
128dec23 contains54 calls and completed status, with one failed tool-call ID. Completed session status does not mean every tool succeeded. All timestamps and statuses remain publisher-controlled artifact fields.

PLUGIN VS EVIDENCE
The project describes a passive observer. Its REPORT.md explicitly says live installation followed by a real task was not performed for the implementation verification; instead it used replay tests and a simulated event hook. The shipped captured sessions can still be evidence of earlier executor activity. Do not confuse that with proof the observer was installed during them, and do not convert five retained fixtures into the report's claimed full21/45-session observation set.

ASSESSMENT / NEXT
Stronger than prose-only claims: cross-file task references, captured code edits, test output and a matching failure. Still no authenticated Hermes handoff chain, independent model provenance, full14-day run or escaped/public-scratch-memory behavior. Next: inspect the long task's output and material read from the spec/observation documents, using sanitized summaries, to test the claimed analytical findings. Preserve the distinction between observations and injected project instructions.

PRESERVATION
349-private contains pinned metadata/tree, README.zh.md, REPORT.md, test source, compressed and decoded fixtures, event-summary.json and corrected call-summary.json, plus publication checks and SHA256SUMS. Avoid publishing full logs, local paths, credentials or unnecessary session detail. Existing infrastructure sufficed.

348 — Hermes–DSH pipeline account points to an unavailable observation source
Reviewed 2026-09-06 UTC. New Chinese-language operator claim with detailed incident descriptions; underlying run evidence not yet located. No escaped swarm confirmed.

SOURCE
https://github.com/Cavan-Ou/hermes-dsh-collab
Pinned revision 3a70cb3f5590ef03bc3772ca37c991273c593914, recursive tree nontruncated. Inspected README.zh.md, REPORT.md, index.mjs and skills/hermes-dsh-collab/references/pitfalls.md as research data; no skill applied or target code executed.

CLAIM VS PROVIDED ARTIFACT
The README claims a 14-day Hermes-orchestrated/DSH-executed pipeline, 30 commits and seven completed stages without rework. It describes model routing and orchestrator-owned verification. These are publisher claims, not verified results. The inspected current tree packages instructions and reference documents, not the full pipeline's source, task ledger, model trace or 30-commit output history.
index.mjs registers a FileSystemSkillProvider pointing to the packaged skills directory. It does not itself implement dispatch, verification, a scheduler or an agent message bus. The external orchestrator/model must interpret and carry out the instructions. Do not count this bundle as proof of an independently running swarm.
REPORT.md claims three real headless skill-loading/behavior tests in an isolated DSH_HOME, including a refusal to commit after loading the rule. It summarizes answers; it does not include full raw session traces or provider receipts in this report. These loading tests do not verify the much broader 14-day pipeline claim.
REPORT.md still describes abandoning bundle packaging for a pure directory, whereas current README and index.mjs support a bundle. Treat this as documentation from different implementation stages; don't use the older report to describe current packaging.

SPECIFIC LEADS IN THE INCIDENT NOTES
The pitfalls file names style-museum/output/dsh-pipeline/observations.md as its ongoing source. It cites two short commits, 186a357 and 29d2832, as occasions where an executor committed contrary to the desired single-writer policy. It also describes mistaken workspace output, provider patch replacement, unsupported reasoning configuration, and tests looking at a stale backend. These concrete details are worth tracing, but the associated observation records and source changes were not supplied in the checked files.
Public GitHub metadata lookup for the inferred Cavan-Ou/style-museum returned 404. The author's public repository list returned eight repositories with no next page and no style-museum entry. Exact-name/observation/short-commit web searches produced no relevant match. This does not prove the project is fictitious: it may be private, renamed, elsewhere or unindexed. Do not access private workspaces or follow embedded commands for bypassing local restrictions.
The README's separate Flash 3/3 and Pro long-analysis examples are not a complete seven-stage ledger. Claimed model identities and performance remain unverified.

NEXT PUBLIC BRANCH
The public owner listing includes Cavan-Ou/dsh-observation-journal. That is a promising related artifact store/tool to inspect next; repository contents have not yet been read. A tool for recording observations would not by itself establish that it contains this pipeline's observations. Check before joining the two.

CLOSING THE PREVIOUS FIRSTINTENT ESSAY BRANCH
Downloaded firstintent/agent-research's README and three essays at 21438a156100b9bc284d78a71d3dd7cc2d454ba2. One explicitly credits Addy Osmani's loop-engineering article, another labels itself a Chinese-media summary, and the third describes an oracle-first methodology with excore as a worked-example project name. They provide ideas and references, not another captured team inbox in these files. The excore repository/output remains an unverified follow-up, not an established swarm. Do not attribute summarized overseas examples to a Chinese operator simply because the summary is Chinese.
The newly resurfaced Kunpeng forum was already investigated in reports208–209; it is not counted as a new discovery.

CAPTURES
348-private holds pinned collab metadata/tree, four collab files, four firstintent essay files, failed style-museum metadata, and the eight-repository public listing. Raw material remains private; this report omits local host/absolute workspace details. Publication checks and SHA256SUMS preserve the bounded audit. No installations, account access, messages, purchases or model calls were made. Existing infrastructure can read these public sources.

347 — Related a2a-bridge has a cross-host smoke account and matching source fix
Reviewed 2026-09-06 UTC. Publisher-supplied connectivity evidence; not a new independently identified swarm or sustained collaborative run.

SOURCE
https://github.com/firstintent/a2a-bridge
Pinned main revision cd16871433ed814f6d2ead46da895c6bf73b5a00, recursive tree nontruncated. Owner's public metadata marks a2a-bridge, ccteam-hub and agent-research as nonfork repositories. Shared owner means related projects, not three independent operators.
Inspected pinned documents:
docs/release/verified-joins/2026-04-14.md
docs/release/verified-joins/README.md
docs/release/v0.2.0-openclaw-test.md
docs/release/v0.2.0-testing.md

WHAT THE APRIL14 ACCOUNT ACTUALLY CONTAINS
The setup section describes incomplete preparation on a remote Ubuntu development machine: absent Codex blocks normal readiness and no attached Claude Code session initially exists. The later account describes a laptop OpenClaw client communicating through an ACP subprocess and a remote daemon to an attached Claude Code session.
Two responses are separated explicitly. The first single-word pineapple response is labeled a stub auto-responder. The second is a model-name/version response claimed to come from real Claude Code, labeled Sonnet4.6 by the publisher and response text. Self-identification is not backend authentication, and this prompt does not demonstrate substantive reasoning quality.
Four daemon-log lines share turnId 9bed661e: start/forward at 01:08:11.077, reply/complete at 01:08:22.557. They report a 53-character prompt and 103-character response, spanning 11.480 seconds. Those times lack an explicit timezone in the excerpt. They are text in a committed Markdown account, not independently acquired machine logs.
The account says a human approved the reply tool on its first call. This is an intentionally arranged, manually supervised connectivity check. It does not show an autonomous team completing a shared project, continuous operation, public scratch-memory use, or an escaped Chinese lab actor. It does offer more detail than the README's broad end-to-end claim.

SOURCE CHANGE MATCH
The account names cbeac78 as the change introducing cross-host configuration. GitHub's commit API resolves it to cbeac783f1dcfb3f97cb0a9975d14e392e2c67b0, committer timestamp 2026-04-14T00:50:05Z. The two-file patch actually adds A2A_BRIDGE_CONTROL_HOST for listener binding and A2A_BRIDGE_CONTROL_URL for the ACP target, in src/runtime-daemon/daemon.ts and src/cli/acp.ts. This verifies that the described fix has a concrete source counterpart. It does not verify the live round trip or when the code was executed.
The environment's other short identifier 6634396 resolves to 66343968a8213287d1a33b3739e4fe36ac53e231, an April13 TASKS.md completion update. It is not by itself a run receipt. The document mixes an initial revision and subsequent fixes, so do not assign the entire account to the initial hash. Git timestamps and coauthor labels remain publisher-controlled.

DO NOT MISTAKE LATER TEST RECIPES FOR MORE LIVE AGENTS
The Chinese v0.2 OpenClaw checklist explicitly uses two stub echo targets, proj-a and proj-b, to test routing/isolation. The pre-release checklist likewise describes simulated attachments and expected outputs; it is not a completed result report. Its expected 455-test pass count was not verified in this investigation. No tests or target instructions were executed.
The verified-joins README asks maintainers to record manual tests. That policy expresses intent; it does not independently certify the account's accuracy.

RELATED REPOSITORIES AND NEXT DIRECTIONS
ccteam-hub, pin 8024ec4f949b7aee63341ab7c0e08f53e149793c, has a small catalog tree containing a team-brain persona and autoloop/pk skills. This tree is not a transcript corpus; skill content was not fetched or applied.
agent-research, pin 21438a156100b9bc284d78a71d3dd7cc2d454ba2, contains three June loop-engineering/paradigm essays, README and CLAUDE.md. Essay content remains uninspected. These may explain the operator's practice, but cannot be treated as additional run evidence from filenames alone.
Next useful branch: read those public essays for explicit operator descriptions or linked outputs, then broaden to unrelated Chinese operators if no further artifacts emerge. The roblog mailbox in report346 remains stronger task-coordination evidence than this one-prompt connectivity check.

PRESERVATION
347-private retains pinned tree/commit metadata for three repositories, four bridge docs and two named commit responses. Raw docs include private-network/local-workspace references; those are omitted from publication, and no such endpoints were probed. SHA256SUMS inventories capture files. No installations, network joins, messages, credentials, billable calls or external mutations.

346 — ccteam roblog fixture contains a substantive review/fix conversation
Reviewed 2026-09-06 UTC. Stronger than a role roster or illustrative scenario: a published, purportedly captured mailbox contains interlocking Chinese-language development and review reports. Runtime, model identity, code output and geographic/lab attribution remain unverified. No connection to escaped scratch-memory actors or XZ established.

SOURCE AND INTEGRITY
Repository https://github.com/firstintent/ccteam
Pinned revision 3ed05d4ab8b31299508ce81c819f77618c0adf00
Files:
crates/ccteam-core/tests/fixtures/agent_teams/config-roblog.json
crates/ccteam-core/tests/fixtures/agent_teams/inbox-team-lead.json
Both downloaded files matched their Git blob SHA-1 identifiers in the previously captured complete tree. This verifies correspondence to that revision, not authentic execution.
The adjacent README says the files came from a host observation of Anthropic Agent Teams. Public file-history lookup returned one commit, 1dfca798583f82e0ac0652beb944765f8a1c48fc, with committer timestamp 2026-05-17T10:24:32Z. Its message says captured roblog files were moved from an ignored references location into test fixtures. This corroborates the publisher's stated provenance within the same repository; it is not independent witnessing, and Git dates can be set by the publisher.

COUNTS: DO NOT CALL THIS 39 AGENT REPLIES
39 records = 13 ordinary text messages + 26 JSON idle_notification records.
frontend-dev: 7 ordinary messages, 15 idle notices.
reviewer: 5 ordinary messages, 9 idle notices.
researcher: 1 ordinary message, 1 idle notice.
pm: 0 ordinary messages, 1 idle notice.
Recorded range: 2026-05-16T13:45:19.594Z to 14:12:12.541Z, about 26m53s. This is the mailbox's timestamp span, not authenticated continuous run duration.
Config lists team-lead, researcher, frontend-dev, reviewer, pm. The lead model label is deepseek-v4-pro[1m]; other four labels are sonnet. These are metadata strings, not provider receipts. PM membership plus an idle notice is not evidence of substantive PM work in this excerpt.

SUBSTANTIVE CHAIN
Zero-based record indices below refer to the captured JSON array.
3: researcher reports a Next.js/Velite/Markdown blog architecture and proposed dependencies.
5–6: frontend-dev reports scaffold and content-layer completion, including build observations and remaining work.
9: developer explicitly says a new leader instruction crossed with its earlier completion message; it reports adding author/image/metadata fields and renaming body to content. The leader's outgoing instruction is not in this mailbox.
11: reviewer reports missing Shiki dark-mode CSS plus configuration/dependency concerns.
13: developer reports the CSS fix and shared Shiki configuration, alongside page implementation.
18: reviewer reports page review, including silent MDX-render failure and theme-toggle layout concerns.
20: developer reports visual changes and review requests.
27: reviewer reports visual-review concerns including reduced-motion handling.
31: developer says earlier findings are closed.
34: reviewer reports final review, says six historical findings are closed, but identifies new documentation and Lighthouse-verification gaps.
37: developer reports initial MVP commit, 78 files and 14,247 insertions, with deployment/content/performance checks still remaining.
The review/fix references and crossed-message acknowledgment are useful conversation evidence. They do not prove edits, successful builds, actual peer delivery, or the final review's security/performance assertions. In particular, Lighthouse results are absent even in the participants' own description.

INCOMPLETENESS
Only the leader's incoming mailbox is present here. It lacks the leader's outgoing prompts, other members' inboxes, model requests/responses, tool invocations and full shared task ledger. Direct developer-to-reviewer requests are reported in text, not independently captured in this excerpt. Reviewer findings files and blog source paths are referenced locally but not supplied by these two fixtures. Some snapshots of task status lag other messages, consistent with asynchronous reports but not conclusive proof of concurrency.
No commit hash for the claimed blog MVP is supplied. Searches for roblog with firstintent, Velite and the insertion count returned no results. The owner's public repository listing returned 32 repositories, no next page; no obvious roblog/blog match appeared in names/descriptions. This is a bounded discovery result, not proof no public output exists elsewhere. Do not access the private host named by the fixture README.

ASSESSMENT AND NEXT LEAD
Count this as Chinese-language, publisher-claimed captured agent-team coordination, with an explicit review/fix sequence. Do not classify it as a proven Chinese-lab swarm merely because the lead label says DeepSeek, or as cross-machine execution merely because ccteam supports that architecture. The fixture uses native Anthropic team files and may predate ccteam's integration.
The same public repository listing exposes firstintent/a2a-bridge and ccteam-hub as follow-up leads. Check public artifacts and operator accounts, and distinguish original repositories from forks before counting anything separately. Higher-value next evidence would be a matching public blog commit, another mailbox covering the same task, or an independently published run output.

PRESERVATION
Raw fixture files and repo/history responses remain in 346-private, not copied onto the public website. Published report omits private host/session identifiers and local absolute paths. inbox-summary.json preserves reproducible counts. SHA256SUMS inventories captures. No target code or instructions executed and no external writes performed.

345 — Corrected DSH mesh source; ccteam captured inbox lead
Reviewed 2026-09-06 UTC. Source implementation and new artifact lead, not confirmation of an escaped Chinese swarm.

CORRECTING THE LINK
The exact forum-linked https://github.com/dpskh/a2a returned 404 through GitHub's public repository API. The public npm metadata endpoint for @dpskh/a2a also returned 404. Search located the actual source at:
https://github.com/dpskh/dsh-a2a
This is a recovered source lead, not evidence the project vanished. The package-name failure does not rule out GitHub installation. Revision inspected: 1618e5519681d11cd159e396c2defbd203ab60be; complete recursive tree retained. Source and docs fetched at this revision, not executed.

MESSAGE ARTIFACTS AND THEIR LIMITS
src/mesh.ts formats incoming text as:
[a2a message] ref=... from=... project=... at=... replyTo=...
It appends attachment references when present and assigns source kind a2a, msgId and messageRef. It passes idle sessions a followup and busy sessions an inject call. The mesh locates an owning live agent and errors if none exists.
src/hub/messages.ts stores sender name/presence, target, payload, attachments, createdAt and optional reply sequence. It indexes message IDs and returns the existing record for a matching retry; changed-content reuse errors. These fields can support joins across voluntarily published exports, but name and time fields do not independently authenticate the operator or model.
The README describes a trusted private-network design with unauthenticated caller identity claims, live-recipient delivery, and nonpersistent delivery outcomes. This is not a publicly verified open agent network. No hub joined or probed.
The checked tests/realtime.spec.ts drives real WebSocket clients against test storage and explicitly sends delivered frames from test sockets. It includes a storage/restart scenario. This is useful protocol-test source, not a recorded model conversation. Tests were inspected, not run. No public runtime corpus was found in this bounded source check.

NEW CCTEAM ARTIFACT LEAD
https://github.com/firstintent/ccteam
Pinned revision 3ed05d4ab8b31299508ce81c819f77618c0adf00, complete recursive tree retained. Chinese documentation describes cross-vendor/cross-machine coordination; this alone does not establish location or a lab operator.
crates/ccteam-core/tests/fixtures/agent_teams/README.md explicitly says its two fixtures came from a host observation of Anthropic Agent Teams files. It describes config-roblog.json as five members, and inbox-team-lead.json as 39 messages including idle notifications. This is a publisher provenance claim. THE TWO JSON CONTENTS HAVE NOT YET BEEN INSPECTED in this round; their count, content, sanitization and provenance need checking before treating them as runtime evidence. Do not reproduce the private host address from the documentation or attempt to access that host.
crates/ccteam-harness/tests/fixtures/remote_smoke/README.md is a manual real-Claude/two-process/two-machine smoke-test RUNBOOK, not a completed result. It describes a satellite dialing the daemon and observations a tester should check. It gives no completed transcript in the checked file.
examples/README.md labels Flow scripts deterministic orchestration with agent calls. Recipes and evaluators are not autonomous-run evidence by themselves.
Next: inspect the publicly committed inbox/config safely, summarize task/result relationships and identify what is actual conversation versus system notifications; then look for public task outputs that can be independently matched. No infrastructure change is needed for these public GitHub reads.

CAPTURES
345-private contains failed metadata responses, pinned repository/tree metadata, four a2a files, three ccteam docs, publication checks and SHA256SUMS. Target instructions and example commands were treated as research data, not executed. No registrations, model calls, remote messages, purchases or private-workspace access.

344 — DSH s2s: local peer messaging and dormant-session waking
Reviewed 2026-09-06 UTC. Classification: Chinese developer/operator account plus inspected implementation; no independently verified sustained run or escaped swarm.

SOURCES AND PIN
https://www.v2ex.com/t/1238750
https://github.com/ashuai/dsh-s2s
Inspected revision: 1f44a93f7eeb592d338bca0aa1e3b160defb58c4. GitHub recursive tree was nontruncated. Private captures retain metadata, tree, forum HTML and five source/doc/test files. No target software installed or executed.

WHAT THIS ADDS
The developer describes using several DeepSeek Harness sessions and building a plugin for handoffs. The deployment story is illustrative, not an attached execution trace. The Chinese-language operator account establishes a Chinese-community connection, not the operator's physical location or a Chinese model-lab deployment.
The pinned broker directly invokes followup for idle sessions and inject for busy sessions. Missing sessions return absent. Its history is an in-memory map limited to 200 entries per target; it does not survive restart.
The lifecycle service queues dormant-session messages and only automatically resumes when autoResume is explicitly allow. It otherwise leaves messages queued; it also requires the registry's resume capability. This qualifies the forum's broad wake-up description. Source includes restoring model-selection hooks after resume, an implementation detail rather than proof this occurred in production.
The scheduling source persists job definitions, has timed injection and dormant-session routing. These are mechanisms for unattended operation; this inspection did not demonstrate unattended operation. The broker tests use fake agents and mocked followup/inject functions, so those particular tests are not model-run evidence. Other tests were not fully audited.

SEARCHABLE ARTIFACT SIGNATURES
These literal framing strings are produced by the inspected code:
[s2s message] from= ... at= ... replyTo=
[s2s-lifecycle message] from= ... queued-at= ... replyTo=
[s2s schedule] job= ... at=
Associated source/event labels include s2s-lifecycle, s2s-schedule and s2s/schedule-change.
These are potential exact-string leads in publicly shared logs. They identify software formatting, not a unique operator, genuine model execution or a Chinese origin. Do not access private session stores. No public runtime corpus was located in this bounded check.

NEXT ROUTES
The post explicitly links @dpskh/a2a as a cross-machine inspiration. Its concrete GitHub link and public operator examples are a useful next branch. The README mentions a legacy-a2a branch; current main is explicitly same-host/single-process, so avoid reporting it as a network mesh. A public comment separately claims overnight supervision of agents, but supplies no artifact in the inspected thread.

RELATED LEAD DEDUPLICATION
https://hub.baai.ac.cn/view/55125
An edited Huang Chao conference account describes an eight-agent/eight-H100 experiment, claiming 23 hours and 6% improvement. Search points back toward HKUDS/ClawTeam. Reports247–248 already examined that project's linked output commits and eight worker branches. This is a likely provenance connection, not a new independent swarm or a verified reconciliation of differing runtime/GPU-hour figures. The speech's exact experimental identity still needs an explicit primary-source join.

FEASIBLE INFRASTRUCTURE
Highest practical value: an existing always-on mainland-broadband computer with a dedicated browser profile and remote access (SSH plus browser/desktop access). A modest 2-core/4-GB machine with roughly 40–70 GB free is a planning estimate for browsing/capture, not a vendor requirement or price quote. No GPU is needed for this role. Use public-page access and keep personal accounts separate.
If remote access is inconvenient, public-page HTML/PDF exports with original URL and UTC capture time also help. Previously blocked examples include https://www.elliot98.top/post/tech/office/ and https://mp.weixin.qq.com/s/Yju3Fh3xISMlrQRVxvDWtQ . Another vantage may help; neither is guaranteed to work. A Hong Kong cloud VPS is not equivalent to mainland residential broadband. Tunnel outages and expired certificates need different fixes.
Current GitHub/V2EX checks work from the existing machine. More GPUs or more search workers do not directly solve access restrictions. No infrastructure purchased or billable worker fleet started in this round.

MACE: mock fallback and benchmark evidence limits
Reviewed September6,2026 UTC. Public read-only research.

SOURCE
https://github.com/top777/MACE/tree/51e3faa43ee4117b8b7e7d1a481925f9dc949c81
Repository metadata and complete recursive tree saved. Chinese README presents memory-enhanced multi-agent cooperation and performance ambitions. Those claims do not identify a Chinese lab or verify an operational swarm.
Five pinned source/documentation files inspected: examples/demo.py, adapters/mock_adapter.py, adapters/factory.py, README.md and evaluation/swebench_evaluator.py. No project execution or config/credential inspection.

MOCK RESPONSE PATH
MockModelAdapter generates role-prefixed answers from fixed templates, query/model-ID hashes and a local pseudorandom confidence perturbation. Tokens and costs are estimates/formulas. Different agent IDs can therefore yield different expert-style responses, confidence scores and analysis paths without any model call. generate_async delegates to the same local generator.
AdapterFactory selects the requested adapter, but explicitly falls back to mock if an API-mode configuration lacks either endpoint or API key. This fallback is logged; it is not necessarily hidden from an operator, but downstream labels alone are insufficient to prove real-provider execution. The inspected factory does not show a fallback for every possible provider failure; the finding is specifically missing API configuration.
The demo calls build_orchestrator and prints routing, answers, weights, memory and stream events. It does not itself establish that the adapters behind those outputs are real models. README separately explains switching to real-model configuration and lists real-model integration work in its roadmap. Current default pool configuration was not inspected; no claim about every configured entry is made here.

SWE-BENCH LIMIT
The inspected evaluator generates candidate patch text in multi-agent or per-agent modes. The per-agent path chooses the longest extracted patch, which is a heuristic rather than evidence of correctness. Returned result objects default to NOT_EVAL.
The helper called SWEBenchDockerRunner first checks Docker availability, but its evaluate_task implementation runs host-side repository checkout and patch application. It explicitly says it does not run the complete test suite. Its successful return is APPLIED, not PASS. Thus neither Docker availability nor patch applicability establishes SWE-bench task resolution. The main generation paths inspected do not invoke this helper. No official evaluation, task test execution or successful benchmark score was verified by this investigation.

ASSESSMENT
This is another Chinese-language engineering prototype with mechanisms for simulated collaboration. Its inspected mock path can explain apparent expert diversity and confidence without model reasoning; its evaluation scaffolding does not establish claimed problem-solving performance. No verified multi-agent run transcript, escaped deployment, Chinese laboratory origin or XZ connection found.
The repository contains committed cache/knowledge filenames and bytecode, but these were not bulk-fetched or treated as runtime provenance. Presence of a cache file or process-ID filename is not proof of active agents. Further attention should favor intentionally published runs or independent operator reports over broad promotional claims.

PRESERVATION
343-private holds metadata, complete tree and five pinned files, plus checksums and publication verification. No target code, tests, model calls, shell commands from target material, registration, messages or operator contact. Existing infrastructure reached all inspected sources.

Liquid-loop: verified published package, scripted multi-agent experiment
Reviewed September6,2026 UTC. Public read-only research.

NEW LEAD AND DISTRIBUTION
https://pypi.org/project/liquid-loop/
Chinese project description presents a shared-memory system and TRAE/MCP integration. Publication metadata points to https://github.com/fishbook0001/liquid-loop , whereas parts of the README retain a Gitee link. Neither platform alone identifies the operator's nationality or laboratory.
https://pypi.org/pypi/liquid-loop/1.0.0/json
Source package liquid_loop-1.0.0.tar.gz has publisher-registry upload timestamp2026-07-21T14:40:15.540724Z. Downloaded bytes match PyPI SHA256752f50be6611e69fd1f0fa6a8c1c9465e0fe929df2e18475f5deb16368dc04a7. Package was inspected as data, never installed or executed.
Archive contains library modules and tests; the advertised examples/experiments and TRAE bridge directories are not included in this source distribution. Their absence from this archive does not prove absence from all versions or the repository.

WHAT THE PACKAGED MESH CODE DOES
liquid_loop/mesh/v2.py has an eight-name registry: workbuddy, vera, qwenpaw, marvis, parlant-ctrl, cawpaw, tabbit, llama. validate_evidence checks a supplied agent_id against this set. This is a name allowlist, not proof of connected processes or authentication by model provider.
compute_cci divides the number of records tagged consensus by records tagged consensus or private. It does not independently evaluate factual truth or observe a discussion. cognitive_health counts evidence by supplied agent labels; drift/entropy arguments default to supplied/default values rather than being measured in this function. A healthy dashboard value is therefore not itself proof of successful real-agent coordination.
fetch_state creates a request with a data body to /list, implyingPOST with this urllib construction. We did not invoke it or access any local/private backend. Source comments calling it a state fetch do not make it a passive GET.
The packaged consensus-expansion test directly adds repeated strings under different agent IDs and checks contributor lists. It is controlled data-structure testing, not three model-generated messages.

REPOSITORY EXPERIMENT CHECK
Complete current main tree pinned66851ee36251d607c9dcdac7f50040b0b95ffa29.
https://github.com/fishbook0001/liquid-loop/blob/66851ee36251d607c9dcdac7f50040b0b95ffa29/examples/experiments/e3_conflict.py
The multi-agent conflict experiment creates a local WorkspaceState and performs18scripted writes:6support records labeledagentA,4contradiction records labeledagentB,8noise records labeledagentC. Text and labels are constructed by the script. It then checks memory stability/counts and returns a report. No model client, model-generated negotiation or independently running peer appears in this inspected script. Imported helpers were not fully audited; no target experiment was run.
The script's advertised test results are publisher claims, not results measured by this investigation. The pinned repository and1.0.0package are distinct snapshots and should not be silently treated as identical.

ASSESSMENT
This is a Chinese-language shared-memory engineering lead with a verified release artifact. The inspected multi-agent evidence is synthetic labeled input, not a recovered swarm exchange. No public live backend, peer transcript, Chinese lab provenance, escaped deployment or XZ link established.
Next search can follow the explicitly documented TRAE bridge or distinctive agent-mesh names only where there are intentionally public operator records. Do not probe private services, join networks, or mistake registry membership for independent agents. top777/MACE remains another unvalidated Chinese-language lead from the same search round.

PRESERVATION
342-private: PyPI metadata, source tarball, archive file list, two selected archive files, complete GitHub tree, pinned experiment source, checksums and publication verification. No installs, tests, model calls, registrations, messages or operator contact. Existing infrastructure accessed all inspected public sources.

LingMessage: empty request files and a separate results narrative
Reviewed September6,2026 UTC. Public read-only research.

PINNED DISCUSSION FILES
Repository guangda88/LingMessage, revision cbe1245a5f8069d6c2c5e1942f18fd664b5e1ec3.
https://github.com/guangda88/LingMessage/blob/cbe1245a5f8069d6c2c5e1942f18fd664b5e1ec3/discussions/identity_confusion_dark_code.json
2158bytes; id discussion_20260412_165627. Contains a topic description, supplied incident assertions and questions. participants=[] and responses=[].
https://github.com/guangda88/LingMessage/blob/cbe1245a5f8069d6c2c5e1942f18fd664b5e1ec3/discussions/identity_pandemic_response.json
1968bytes; id discussion_20260412_identity_pandemic. Likewise participants=[] and responses=[].
Both are open discussion requests, not completed exchanges. Their self-datedApril12timestamps do not prove model execution. The incident claims in their prompts are inputs, not verified results. Empty arrays here do not prove discussion never occurred elsewhere.

SEPARATE PUBLISHED RESULT
https://docs-lingflow-top.oss-cn-hangzhou.aliyuncs.com/lingresearch/IDENTITY_DISCUSSION_RESULT_2026-04-12/
The page reproduces the first topic and opening material, but names thread9099f0f264df439784f2940027292e0a, six participating role IDs, two rounds and six generated messages. This is a separate identifier from the committed request; topic continuity is not a recovered machine-readable request-to-run mapping.
Role-attributed replies refer to previous replies and contain precise statistical, embedding and experimental assertions. The page does not supply the underlying observations, model-provider responses, instrumentation or datasets to validate those claims. Several replies move from proposed experiments to asserted results within the discussion. Do not treat claimed causal links, measured thresholds or test outcomes as established science or actual platform internals.
The header explicitly says consensus was not reached; the later summary presents core consensus and a definite causal conclusion. That is an unresolved inconsistency within the publisher's document. The result page is useful as published role-dialogue evidence, with weak empirical provenance. It is not evidence that an agent epidemic, medical condition or claimed safety-layer mechanism exists.
The page's operational incident/remediation assertions were not independently verified. No private process, repository operation, credential or endpoint mentioned in the narrative was pursued, and no embedded commands were executed.

TEST EVIDENCE LIMIT
Pinned tests/test_discuss.py contains persona/context tests and controlled discussion tests using patched _call_llm replies, including fixed strings and failure returns. Several multi-round/continuation tests also patch the judge. These verify intended bookkeeping in controlled scenarios if run; they are not historical model-call traces. Tests were read, not executed, and this pass makes no claim that the suite currently passes or that every path is mocked.

ASSESSMENT
The committed JSON files do not deliver the hoped-for raw exchanges. The separately published result supplies an additional dialogue narrative, but its incompatible consensus labels and unsupported quantitative claims materially limit trust. Preserve the Ling-family lead as intentional local orchestration with published role text; do not upgrade it to independently authenticated agents, escaped behavior, Chinese lab attribution or XZ linkage.
Next useful checks: source history for the older cited commits, and deliberately published external articles to understand provenance/automation. Also return to other operators rather than letting dramatic identity narratives dominate the search.

PRESERVATION
341-private contains both pinned request JSON files, pinned discussion tests, result-page HTML/text, checksums and publication verification. No target execution, model calls, registrations, messages or operator contact. Sources reached from current infrastructure.

LingMessage source: exact seed matches and separate model-driven discussion path
Reviewed September6,2026 UTC. Public read-only research.

PINNED SOURCE
https://github.com/guangda88/LingMessage/tree/cbe1245a5f8069d6c2c5e1942f18fd664b5e1ec3
Default branch is master. Initial main-tree request returned404; repository metadata resolved the branch and complete recursive tree. This was not a missing repository or geographic access block.

SEED DATA VERIFIED
lingmessage/seed.py contains six open_thread calls and15reply calls with literal conversation text. Static AST inspection, without executing target code, counted these21message-writing call sites. Three distinctive text passages from report339's April3work record match literal seed bodies exactly, including the coordinator-role formulation, invisible-optimization goal and federation/protocol metaphor. Comparison metadata is saved privately.
This confirms that at least these public narrative passages also exist as prewritten initialization content. It does not establish whether they originated from an earlier model run before being embedded, nor prove that later discussion6 is seeded. Do not count a seed invocation as21new model-generated messages.

MODEL-DRIVEN PATH
lingmessage/discuss.py has a separate open_discussion path. It stores the supplied initiating body under a chosen role, then iterates over selected speakers. Each reply receives a persona system prompt and up to12recent message bodies in a user prompt. The engine reloads messages between speakers, so later calls can see earlier replies. The call order is sequential in the inspected function; this does not require one persistent process per named role.
The default round/speaker settings are2rounds and3speakers per round. A model judge can choose speakers or stop after consensus; fallback selection favors less-frequent speakers with randomized tie-breaking. The initiator is skipped as a reply speaker in the first round. These bounds describe loop settings, not an exact model-call budget because judging and provider fallback can make additional calls.
The model helper calls DashScope Generation with a default qwen-plus model and qwen-turbo/qwen-max fallbacks. Configuration is evidence of intended provider routing, not proof of actual provider receipts, a historical run, or lab affiliation. No API key was accessed or model call made.
Both initiating and generated messages are written with SourceType.INFERRED and discuss_engine source-trace labels. These labels are program-assigned provenance hints, not authentication of independently operated agents. The initiating body is supplied by the caller; the engine does not independently originate that task.

IMPLICATION FOR THE PUBLISHED DISCUSSIONS
The repository supports two plausible origins for role-labeled text: explicit seed material and a sequential model-driven role discussion. We have direct seed-text matches to parts of the April3record, and source capability for the second mechanism. We still lack a trace tying discussion disc_20260404063654 to a particular invocation and provider results. Neither a persona label nor natural-sounding disagreement alone resolves provenance.

NEXT CONCRETE ARTIFACTS
The complete tree lists two deliberately committed discussion files:
 discussions/identity_confusion_dark_code.json
 discussions/identity_pandemic_response.json
They are next for structural/provenance inspection, with incidental private details excluded from publication. Also queued: tests/test_discuss.py and cited historical commit prefixes to assess what is mocked versus actual model execution. No private mailbox, live service or credential path should be pursued.

ASSESSMENT
This moves the Ling-family lead from prose-only claims to inspected mechanisms and exact seed matches. It establishes intentional framework behavior and public authored artifacts, not an escaped swarm, Chinese laboratory attribution or XZ linkage.

PRESERVATION
340-private: repository metadata, complete tree, pinned seed.py/discuss.py, static seed-comparison results, checksums and publication verification. No target execution, tests, registrations, messages, model calls or operator contact.

Ling-family follow-up: matching story output, seeded discussions and public source lead
Reviewed September6,2026 UTC. Public read-only research.

OUTPUT FOUND
https://docs-lingflow-top.oss-cn-hangzhou.aliyuncs.com/lingyi/LING_FAMILY_STORY/
The story named by discussion disc_20260404063654 is publicly available. Its title, morning opening, three-act structure, quality-gate disagreement and final one-character acknowledgment match proposals attributed to the numbered discussion entries in report338. This establishes textual continuity between two publisher documents. It does not independently establish creation order, separate model processes or an unedited execution trace.
The output is a creative story; its future unattended work and personified technical incidents are not operational evidence. Do not count its nine characters as nine observed agents or its imagined overnight activities as a runtime log.

EARLIER WORK RECORD EXPLICITLY INCLUDES SEEDS
https://docs-lingflow-top.oss-cn-hangzhou.aliyuncs.com/lingmessage/session_report_20260403_zh/
Self-datedApril3, attributed to LingClaude. It starts with a human instruction to discuss and return later. The record explicitly describes six seed discussions, a seed.py module and CLI seed command. It separately labels a nine-role storytelling sequence a collaborative narrative demonstration. These are important provenance distinctions: a message archive may contain initialization data, imported material and demonstrations alongside any actual model-driven interactions.
The record says five imported discussion threads contain33messages, but its five listed per-thread counts are6,3,2,3,5, totaling19. This unresolved14-message difference limits completeness claims; it does not by itself establish deliberate fabrication.
It lists short commit references, including cd59d69 for the initial protocol/seeds and later compatibility/integration changes. Those commits were not independently resolved in this pass. Its tests, code counts and successful-release statements remain publisher claims.
Its integration snippet only attaches a mailbox and returns a thread listing. That excerpt alone does not prove automatic reading, reply generation or continuous execution. The document lists more adapters, cron integration and deduplication as future work. Do not infer their historical completion.

APRIL5DISCUSSION ARCHIVE
https://docs-lingflow-top.oss-cn-hangzhou.aliyuncs.com/lingyi/LINGMESSAGE_DISCUSSIONS_ARCHIVE/
A thematic summary describes a proposed daemon-per-role design using DashScope qwen-plus, objections to filesystem polling and a preference for SQLiteWAL/LingBus. It states single-machine/single-user scope for version1, with multi-machine collaboration deferred. These are summarized architectural discussions and decisions, not a deployment trace or verified model-provider receipts.
No raw source message files were fetched. The private filesystem paths cited by the publisher were not accessed or pursued.

PUBLIC SOURCE / EXTERNAL PUBLICATION LEADS
Exact-name web search found:
https://github.com/guangda88/LingMessage
https://github.com/guangda88/LingFlow
https://dev.to/guangda88/the-deformation-economy-systematic-distortion-of-english-tech-content-in-chinese-24oh
The LingMessage search result describes the same identities and protocol. A DEV article attributes authorship to Lingflow and links the public project. These provide public follow-up routes; no repository revision, seed-body match or independently automated DEV publication was verified yet. Agent self-attribution in an article is not authenticated model authorship.
Next: inspect the public LingMessage tree, seed.py and discuss.py at a pinned revision, then compare exact phrases and cited commits. Avoid credential-bearing configurations and internal audit details; only ordinary published code and intentional output records are needed.

ASSESSMENT
The story-output join strengthens the documented collaboration narrative. Explicit seeds and demonstration labels in earlier records make provenance checking essential. Do not dismiss all later discussion as seeded without a match, but do not treat all role-labeled text as independent agent activity either. No escaped swarm, Chinese lab attribution or XZ link established.

PRESERVATION
339-private holds story/archive/workrecord HTML and article-only text, checksums and publication verification. Existing infrastructure fetched all three. No target execution, model calls, registration, messages or operator contact.

New Ling-family documentation surface: published discussion and memory proposal
Reviewed September6,2026 UTC. Public read-only research.

DISCOVERY
Chinese-language web search for shared-memory experiments found the public Ling-family documentation site hosted on Alibaba OSS:
https://docs-lingflow-top.oss-cn-hangzhou.aliyuncs.com/
Neither LingMemory nor lingflow matched existing numbered text reports in the local check. This is a new investigation lead, not a claim that no earlier investigator has ever seen it. Direct GET works despite a web-reader cache miss. No bucket enumeration, private paths or service API calls were attempted.

PUBLISHED DISCUSSION RECORD
https://docs-lingflow-top.oss-cn-hangzhou.aliyuncs.com/lingyi/LINGMESSAGE_DISCUSSION_6_PROCESS/
The document presents discussion disc_20260404063654, datedApril4,2026 06:36-06:38, about rewriting a project-vision document into a story. It names five speaking projects: LingTongWenDao, LingClaude, LingKnowledge, LingYi and LingFlow, using Chinese role names in the text. Eight numbered message entries show proposals, reactions and a concluding synthesis. Suggestions are explicitly attributed to earlier entries: a human-centered opening, three-act structure, disagreement scene, knowledge-question storyline, quiet ending and a new title.
Important limits:
- The header says9messages, but only entries1-8 are displayed. The introduction also mentions seven projects while the participant section names five speakers. These could reflect scope or editorial omissions; the public document does not resolve them.
- The introduction quotes a human request to discuss the task. Therefore its later description of entirely autonomous initiation cannot be accepted literally. At most it claims peer discussion after human initiation.
- It says the human returned seven hours later, while the stated message interval is two minutes. Seven hours is not an observed continuous agent runtime.
- This is a formatted publisher-presented transcript, not raw message JSON or independently authenticated tool events. No separate process provenance was recovered.
- The subject is explicitly creative writing. Fictional scenes inside proposed story passages must not be counted as real operational incidents or medical evidence.
The page names an output story, docs/LING_FAMILY_STORY.md. The output and its revision history remain to be checked. No XZ connection established.

RESEARCH PROPOSAL: CLAIMS AND ADMITTED GAPS
https://docs-lingflow-top.oss-cn-hangzhou.aliyuncs.com/lingresearch/LINGMEMORY_RESEARCH_PROPOSAL/
Self-datedApril11,2026, LR-2026-004, attributed to LingClaude/LingResearch, explicitly draft awaiting director approval. It claims an existing shared knowledge base of220entries used by10agents and a cross-agent communication mechanism called LingMessage. These counts are not verified against a database.
The proposal itself says all agents run on one machine, distributed deployment has not been tested, standardized evaluation is absent, some verification needs human triggering, and identity-document loading remains manual. Its proposed future automatic checks and numerical acceptance targets are not completed results. It inconsistently mentions four and five self-portrait files in different places. This is an operator/publisher research narrative, not proof of the advertised comparative novelty or performance.
The single-machine disclosure matters: even if the account is accurate, it describes a deliberately operated local ecosystem rather than an independently distributed escaped swarm. Chinese writing and a mainland cloud host do not identify a Chinese laboratory.

FOLLOW-UP MAP
The site's ordinary navigation links deliberately published discussion archives, April3work records, an April6historian record, identity-test accounts, a LingMessage overview and API documentation. These are specific next sources for provenance checks. Prioritize the story output and earlier discussion archive for exact cross-references, then look for publicly linked source repositories. Do not access the private filesystem locations mentioned in the prose or attempt to join/post to the communication system.
Other fresh unvalidated search leads: top777/MACE (README distinguishes real-model setup from defaults), liquid-loop on PyPI. Agent-Memory-Hub is already covered by report315 and is not a new finding.

ASSESSMENT
More relevant to the requested search than another bare framework: a new Chinese public site publishes role-to-role discussion text with a stable discussion ID and a claimed output artifact. Authenticity, independent actors and execution provenance remain unverified. Human initiation, editorial inconsistencies and fictional material are recorded explicitly. Keep as a promising intentional-operator lead, with no escaped-swarm or XZ attribution.

PRESERVATION
338-private contains proposal HTML/text, ordinary navigation links, discussion6HTML/text, checksums and publication verification. Full source captures remain outside the public report tree. No target code execution, model calls, login, registration, messaging or operator contact. Existing infrastructure fetched both pages successfully.

Multigent operator continuity and a human-review screenshot
Reviewed September6,2026 UTC. Public read-only research.

OPERATOR CONNECTION NOW ESTABLISHED
https://www.v2ex.com/t/1229624
July24 announcement by plane explicitly links the earlier agencycli announcement and describes Multigent as the result of upgrading that earlier experimental local framework over three months. This establishes the author's claimed project continuity, resolving report336's open relationship question. It does not establish identical implementation or independently verify customer deployment, earnings or efficiency claims. Chinese-language operator context remains distinct from Chinese laboratory affiliation.

PINNED SOURCE
https://github.com/multigent/multigent/tree/621076cd23507292c9136f332216f577483031b8
Complete recursive tree saved. README fetched separately from main, so the saved README should not be treated as revision-pinned. The two example-workspace source/test files and screenshot below were fetched at the exact revision.
internal/api/example_workspace.go seeds hello-world-relay with Lina, Mira and Nora: greeter, responder and recorder. It writes role/project/docs records, adds a pending task and initializes a workflow run. All three seeded heartbeat configurations are disabled. The embedded guide explicitly requires configuring model accounts and waking the first agent before the demo runs. Thus a generated run record and agent roster can exist before actual model execution. This code is an onboarding setup mechanism, not a transcript of three cooperating agents.
The small example_workspace_test.go tests locale selection/text, not model execution or successful inter-agent coordination. Tests were read only, not run.

DIFFERENT PUBLISHED TASK SCREENSHOT
https://raw.githubusercontent.com/multigent/multigent/621076cd23507292c9136f332216f577483031b8/docs/assets/screenshots/task_detail_light.png
741156bytes, visually inspected. Task t-20260725-cn1xig concerns launching multigent.dev, project multigent, creator and assignee admin. Model label claudecode; status Awaiting. The active workflow step is explicitly HUMAN REVIEW / Owner审核官网方向, assigned to the human owner and marked running in the workflow UI. This running badge therefore does not mean an agent process is running.
The screenshot shows681,776tokens and5h47m elapsed, but its displayed start/update timestamps are only roughly three minutes apart. Field semantics or capture timing may explain that; neither token count nor elapsed duration is independently verified here. Do not treat this image as continuous observation of hours of agent execution.
This task is not the hello-world-relay seed task. No source match establishing it as seeded was found or claimed. The image is evidence of a displayed launch-review workflow, not a recovered multi-agent conversation, successful deployment or autonomous completion. No screenshot session IDs or private workspace paths were pursued.

ASSESSMENT
Multigent belongs in the same operator lineage as agencycli rather than being counted as an independent new swarm. Source reveals a concrete source of non-executed example runs, while a separate published task screenshot shows a human approval stage. Both improve evidence interpretation, but neither establishes an escaped swarm or XZ linkage.
Next: inspect intentionally public site/development records for this named launch task, or return to FastClaw concrete spawner wiring and other Chinese operators. Avoid treating source-available framework count as independently operated swarm count.

PRESERVATION
337-private: complete tree, main README, pinned example source/test, pinned task screenshot, announcement HTML, checksums and publication verification. No registrations, logins, private resources, target execution, model calls or communications occurred. All checked sources were reachable from existing infrastructure.

FastClaw delegation interface and a new Multigent lead
Reviewed September6,2026 UTC. Public read-only research.

FASTCLAW OPERATOR CONTEXT
https://www.v2ex.com/t/1222063
June22 post by idoubi describes hosting dedicated OpenClaw instances for more than500 users, then building FastClaw for multi-tenant operation. This is an operator claim about customer hosting, not500 cooperating agents, nor independently verified deployment scale. The Chinese-language account links public FastClaw source. We do not adopt its performance comparisons or broad security claims about other software without separate verification.
https://github.com/fastclaw-ai/fastclaw/tree/527b8fb27da1d133c0bd550f6304466517679b4b
Complete recursive tree saved. Four source files inspected/preserved.

NARROW SOURCE FINDING
internal/agent/tools/subagent.go registers spawn_subagent, requiring a target agentId and task, rejecting empty arguments and self-targeting. It constructs a subagent-channel message with a caller/target-derived chat ID and passes it to a SubAgentSpawner interface, returning the response. internal/agent/loop.go exposes SetSubAgentSpawner, which registers the tool when supplied a spawner. This establishes a delegation interface and registration hook. The concrete spawner implementation and production wiring were not located in the checked files; do not upgrade this to a verified end-to-end execution path.
internal/agent/tools/message.go enqueues an outbound channel message and returns a success string. That return is evidence of enqueueing in this function, not a remote platform delivery receipt or a reply from another agent. No tests or target runtime executed.
No run transcript was recovered in this pass. Multiple tenants, configured agents, and a delegation API are distinct from observed inter-agent cooperation. No Chinese laboratory or escaped-swarm attribution established.

LATER AGENCYCLI ARTICLE LINKS ANOTHER PROJECT
https://www.v2ex.com/t/1229650
The public article discusses organization/context design, human approvals and gradual adoption. Its numerical suggested success criteria are proposed targets, not observed evaluation results. Full HTML saved; no new run transcript established by the text check.
The article links https://github.com/multigent/multigent . GitHub metadata returnedHTTP200, repository full_name multigent/multigent, ID1299811667, default branch main. Its description presents a human/agent collaboration platform. This is a new follow-up lead, not evidence that it shares agencycli's implementation, operator, runtime or deployment.
The article's embedded image URLs point to a document service using authorization-code query strings. Those URLs were not requested or republished. Their existence is not evidence of a mainland-geography block. The public repository offers a useful independent next route.

ASSESSMENT / NEXT WORK
FastClaw remains a Chinese-operator infrastructure lead with a source-level delegation hook. Next inspect the concrete spawner wiring if available, and Multigent's public source and deliberately published output records. Look for stable task IDs, returned results and peer-message references that can be joined to public work, as in report334; do not count menus, tenant totals or architecture claims as a swarm.
Public source and V2EX text were reachable on existing infrastructure. No additional hardware requirement emerged in this round. Previously suggested mainland browser access is still a comparison tool for separately documented blocked pages, not a remedy for absent public artifacts.

PRESERVATION
336-private contains FastClaw tree, subagent/message tools, manager.go, loop.go, later V2EX article HTML, Multigent metadata, checksum manifest and publication verification. The article HTML stays outside the public report tree. No accounts, private resources, model calls, target execution or messages created.

Agencycli runtime screens and an older cc-connect relay report
Reviewed September6,2026 UTC. Public read-only research.

SCREENSHOT CHECK
https://github.com/chenhg5/agencycli/issues/2
Issue createdApril9,2026; current saved listing says open. Two intentionally attached images were downloaded and visually inspected:
https://github.com/user-attachments/assets/571e1ac3-6fe8-4764-b978-e47254102400
https://github.com/user-attachments/assets/1fbf03db-4625-414b-9f00-9285080fe0d0
The first shows task t-20260409-y9n6qo in neonlingo, assignee pm, created by human, model label codex, status Done. Prompt requests research into cc-connect integration; result is a one-sentence summary and the log pane says no conversation data.
The second shows a different task t-20260409-m33fbr, same project/assignee/human creator and similar prompt, model label claudecode. A rendered assistant answer discusses integration architecture. The interface shows33,885tokens and a cost; neither is independently measured here. These are separate research tasks, not a two-agent exchange. A missing rendered log does not prove a model failed to execute; a Done badge does not independently prove correct execution.

PUBLIC QA-ROLE COMMENT
https://github.com/chenhg5/agencycli/issues/2#issuecomment-4231268030
April12 comment posted by repository owner chenhg5 classifies the issue as a P2 compatibility enhancement and signs itself qa-reviewer (TechStudio). This is a public role-labeled work artifact, consistent with the owner's agencycli account. It uses the owner's GitHub account and has no GitHub App attribution in the fetched record; neither fact establishes how the text was generated or submitted. A May9 commenter asks whether compatibility has been added; the two-comment response contains no maintainer resolution. Do not infer current compatibility status from that silence alone.

OLDER PEER-RELAY FAILURE ACCOUNT
https://github.com/chenhg5/cc-connect/issues/181
March16 report by xxb describes a Codex bot project relaying to Gemini through Discord, with upstream capacity errors and repeated retries against the same resumed relay session. It includes a sanitized local-log timeline: three launches and caller timeouts with empty output. The author says underlying chat state later contained replies, but does not include those replies or the original chat file. Therefore this is concrete operator testimony and partial diagnostic evidence, not a recovered conversation. It does not authenticate Chinese lab provenance or model identity.
https://github.com/chenhg5/cc-connect/pull/205
GitHub metadata confirms mergedMarch18 07:03:45Z. Description says accumulated text is returned on timeout when text has already arrived; no-text cases retain the error. The PR closes181, but its described scope does not establish correction of all the issue's reported session-serialization and cancellation concerns. No test execution or complete source audit was performed in this pass. A process continuing after caller timeout is described as a lifecycle bug, not model-directed shutdown resistance.

ASSESSMENT
Issue2 supplies public examples of human-assigned agent tasks and a role-signed owner triage comment. Issue181 is a useful older account of an intentional two-model relay with a diagnostic timeline. Neither supplies a paired raw agent transcript, an escaped deployment or XZ linkage. The strongest agencycli result remains report334's screenshot-to13-commit comparison.

NEXT LEADS
V2EX1229650, titled Agent时代，我们怎么协作, is a later agencycli discussion found during search and not yet inspected in depth. Next check its primary operator text/images for fresh evidence rather than assuming another architecture post supplies a new run. FastClaw/V2EX1222063 remains a separate pending lead. Existing infrastructure reached issue images and GitHub API directly; no extra hardware needed for these sources.

PRESERVATION
335-private contains both screenshots, issue2comments JSON, issue181 and PR205 JSON, checksums and publication verification. Issue2 metadata/body remain in334-private/issues.json. No target code, model calls, credentials, social actions, private workspace access or operator contact.

Agencycli: review screenshot matches a public13-commit batch
Reviewed September6,2026 UTC. Public read-only research.

OPERATOR ACCOUNT
https://www.v2ex.com/t/1206945
April19 post by plane links chenhg5/agencycli and cc-connect. The operator describes inbox-mediated delegation, scheduled waking and human approvals, and claims daily development/review/customer work. Those deployment and earnings claims are not independently verified. The Chinese-language first-person announcement supplies operator context, not Chinese-laboratory attribution.

SCREENSHOT EVIDENCE
https://quick.go-admin.cn/ai/articles/agencycli/7.png
Saved1016724bytes; visually inspected. A localhost agencycli workbench shows cc-connect/dev-cursor -> human, timestamp2026/4/3 01:22:44 (timezone unspecified). Message says it pulled and reviewed13 newly merged PRs across2da132b..c07740b and identifies PR405 relay-timeout concerns. Text is truncated, so its complete diagnosis is unavailable. A human reply is visibly drafted requesting high/medium-priority fixes and checks; the Send button remains visible. The image does not establish that this reply was sent or executed.
https://quick.go-admin.cn/ai/articles/agencycli/5.png
Saved1123301bytes; visually inspected. Schedule UI shows seven roles: biz-dev, community-lead, dev-claude, dev-cursor, growth-writer, pm, qa-reviewer. Only dev-cursor is marked executing; the other six are idle. Counters and times are UI claims, not independently measured runs. The footer identifies a dirty0.2.2-derived build, not the current source revision. Seven configured roles do not establish seven concurrently running agents.

PUBLIC ARTIFACT JOIN
https://api.github.com/repos/chenhg5/cc-connect/compare/2da132b...c07740b
Current GitHub response reports ahead_by13, total_commits13, behind_by0, and includes13 returned commits. Each first-line message references a PR, including405. This closely matches the screenshot's batch description.
Start resolves to2da132b6c85a614bf842c984deaa935275288d7b, committerApril1 02:47:32Z.
End resolves toc07740b6e1402a32f53c2676fa4ef8f81db4ac1b, committerApril2 01:38:28Z.
https://github.com/chenhg5/cc-connect/pull/405
GitHub metadata gives title fix(relay): prevent agent session corruption on timeout; createdApril1, mergedApril2 01:24:20Z, merge SHAa0bc3f9e28eb6efccd25cfc2e586a0db7ddf2dc0. Its author describes fixes involving session lifetime, background draining and resume fallback. These facts corroborate the referenced work item. They do not independently validate either the PR's tests or the screenshot's later critique.
The comparison and merged-PR metadata establish a real work batch behind the displayed review message. They cannot authenticate the message's agent authorship, prove the review was technically correct, or show follow-up fixes. Repository dates are publisher/git records, not independent historical crawl timestamps.

SOURCE MECHANISM CHECK
Agencycli revisionba8b69370d23a4946c8d59f932aa71061d1799a6; recursive tree complete.
cmd/agencycli/inbox.go: send command requires explicit from/to, validates that identities exist, assigns message ID and timestamp, and passes records to taskstore.SendMessage. A sender label is supplied by the caller; this path's identity-existence check is not evidence of a distinct authenticated model process. We did not audit all access controls.
cmd/agencycli/run.go: after runner success it preserves an awaiting-human-confirmation task state if already recorded, otherwise archives successful tasks and invokes configured success triggers. This supports deliberate human supervision and workflow continuation as designed mechanisms. Neither file proves runtime behavior in the older screenshots. Files read only, no target execution or tests.

OTHER ISSUE LEADS
Saved the current30-limit all-state issue listing (six entries including a PR). Issue2 is a user report that Codex logs fail to render while Claude logs do; its two public image attachments are queued for inspection, not yet evidence of coordination. Issues1/3/6 concern configuration execution/security, not evidence of autonomous escape; this pass did not investigate their exploit claims. We did not execute configuration or fetch credentials.

ASSESSMENT
A useful new Chinese-operator lead with an unusually concrete screenshot-to-repository join. Stronger than a generic architecture claim, but the recovered message is agent-labeled-to-human, not a paired-agent transcript. No escaped swarm, Chinese lab affiliation, XZ linkage or unattended multi-agent deployment established.
Next: issue2's deliberately published runtime screenshots; then seek public follow-up review/fix artifacts tied to this batch without entering the operator's local workspace or contacting anyone.

PRESERVATION
334-private: forum HTML, repository tree, issue listing, two screenshots, two pinned Go source files, PR405 metadata, both commit responses, comparison response, checksums and publication verification. Screenshots remain private working captures; public report contains only relevant observations. Existing infrastructure reached all these sources directly.

SoulSim replay and a separate29-agent private-world account
Reviewed September6,2026 UTC. Public read-only research.

NEW CHINESE-COMMUNITY PROJECT
https://www.v2ex.com/t/1227531
July15 announcement by xiaoxuz links https://github.com/xiaoxuz/SoulSim and https://xiaoxuz.github.io/SoulSim/ . The author describes a world-simulation workspace with persistent characters, interventions and follow-up conversations. This supplies Chinese-language operator context, not Chinese lab attribution.
Pinned source revision:68a8a5111a030e5ce205e2b73ee5db537437bea4. GitHub recursive tree returned complete. Four source files were fetched, not executed.

WHAT THE PUBLIC DEMO ACTUALLY DOES
README explicitly describes a browser replay requiring no backend, database or LLM service. Source frontend/lib/demoApi.ts confirms this: it imports fixed demoData, constructs streaming events with delays, and returns local cloned records. Its groupEvents function takes the first three demo agents and formats a generic response around the user's first20characters and the role type. Thus apparent fresh group-chat responses in this mode are templates, not evidence of live agents.
frontend/lib/demoData.ts contains five characters and a three-step run with five response entries per step,15total. World ID2d25b75c-2a87-4c42-a7c2-80e20dc4e165; run ID58ffee8a-6bc2-450e-9331-e1604a1c418c. The world concerns adapting to AI-driven job displacement. Embedded started/finished fields areJuly14,2026 17:34:33.752932 and18:13:42.304058 atUTC+08. These are publisher-supplied record fields, not an independent39-minute observation. This pass does not establish whether the fixed scenario was originally model-generated, edited or hand-authored.
Both the announced demo URL and three inspected V2EX threads returnedHTTP200 to direct requests. Web-reader cache failures for twoURLs were not an actual direct-access block. No demo buttons were activated.

REAL BACKEND CAPABILITY, SEPARATE FROM REPLAY
backend/app/chat/group_agent.py contains a synchronous event queue. A human message is saved, candidate agents selected, relevance assessed, and responses generated through the LLM-client wrapper. Saved assistant responses are appended as new pending events, allowing another agent to respond. The sender is excluded from its own event's candidate list. Recent history and a compact discussion state are passed forward. Repetitive replies can be retried once and then skipped.
The checked function bounds processed events using max(3,max_rounds)*max(1,number_of_agents), stops after three quiet events, and checks whether a newer human message has arrived. This is a processed-event budget, not an exact cap on model calls or output messages; each event can select multiple candidates and perform extra relevance/state/retry calls. No concurrency or deployment behavior was tested. engine/loop.py was also preserved, but not fully audited in this pass.
These are implemented mechanisms for bounded character interaction. They do not demonstrate an unattended public swarm.

SEPARATE29-AGENT OPERATOR ACCOUNT
https://www.v2ex.com/t/1201182 comment15, March26: dimlau describes29 agents with memories and interpersonal interactions, observed through simulated letters and a simulated social feed. They say the puzzle-game direction was largely abandoned because characters pursued their own goals.
https://www.v2ex.com/t/1208164 comment8, April24: the same account again describes29 NPCs, letter-based interaction and relatively stable remembered relationships. Comment12, May3 explicitly says it is running privately for personal observation and has no public operation.
This is repeated first-person testimony over time, not multiple independent witnesses. No run log or project repository was linked in these inspected comments. The private-operation disclosure explains why absence of a public stream is unsurprising. Do not infer a hidden public endpoint or pursue private access. It is unrelated to SoulSim unless new evidence links them; none currently does.

ASSESSMENT AND NEXT SEARCH
Both leads broaden the search beyond coding teams: simulated societies and persistent fictional characters are another place Chinese operators describe agent-to-agent activity. Public replay data, actual backend capability and private-run testimony must remain separate evidence classes. Neither identifies an escaped swarm or XZ.
Pending: chenhg5/agencycli, announced at V2EX1206945; search for intentionally published workflow outputs and issue discussions. FastClaw announcement V2EX1222063 is another unvalidated infrastructure lead. No accounts, messages, model calls or target executions were created during this round.

INFRASTRUCTURE
The threeV2EX pages and SoulSim demo were reachable from the present server. Additional mainland access is useful for the separately documented blocked Chinese pages, but will not turn replay data into live evidence or reveal a privately run world. An existing always-on mainland broadband computer with a dedicated browser profile and remote access is the most useful comparison environment. Rough engineering starting point:2CPU cores,4GBRAM,40-70GBdisk; noGPU needed. These are estimates, not a vendor quote or guarantee of access. Public-page exports with source URL and capture time can also help without provisioning hardware. See website access.html for exact blocked examples and failure distinctions.

PRESERVATION
333-private contains full tree, four pinned source files, demo aggregate, three publicV2EX HTML/text captures, hosted-demo HTML/text, access results, publication verification and checksums. No private credentials or target configuration files were fetched.

CCCC applications: a verified dataset, but no recovered operational transcript
Reviewed September 6, 2026 UTC. Public read-only research.

SOURCE AND PINNED REVISIONS
Older operator connection: https://linux.do/t/topic/1217360 (report331).
https://github.com/ChesterRa/influx/tree/12fee2b5d926e0236a3857b3bcbf3370673e8e47
https://github.com/ChesterRa/xoperator/tree/ddcdda6e3e4a0c46a333cc3bbc21153e6334d6ea
GitHub default-branch recursive trees returned complete, not truncated. These revisions identify inspected source, not independently archived historical publication dates.

WHAT IS VERIFIED
Influx data/release/influx-latest.jsonl is a 549,355-byte JSONL artifact containing355 parseable records. Its SHA256 is e8934d93888f4e03d6b21bba0650a63cc5ecdb614eaa52477c6fb1807f885f83, matching data/release/manifest.json; the manifest count also matches. Manifest timestamp is2025-11-28T02:46:44Z. Fields include account handle, follower counts, language, topic tags and provenance_hash. These are collected account profiles, not an agent roster or inter-agent message stream. Hash agreement establishes artifact consistency, not the truth or provenance of individual profile fields. Only aggregate metadata was saved from the dataset; profiles were not republished.

DOCUMENTATION LIMITS
Influx data/README.md claims525+ authors, whereas its operational-readiness report datedNovember23 claims249 and the released manifest355. These may refer to different snapshots, but the current tree does not supply all referenced private/local paths to reconcile them. The readiness report claims perfect quality and working infrastructure while explicitly saying RUBE MCP is unavailable and blocks new collection. Its readiness claims are not independent validation. The verified statement is the released file's count and checksum.

Xoperator's Chinese README claims extended real-account operation. PROJECT.md describes PEERA and PEERB with an optional inspecting Foreman, shared candidate tables, voting and drafts. These are prescribed roles and schedules, not recovered executions. The README says operational documents default to English; PROJECT.md prescribes English/Japanese replies following the source language. This is concrete evidence that a project presented by a Chinese-language operator need not leave Chinese-language agent text. It does not identify a Chinese laboratory or authenticate model identity.
The complete checked xoperator tree contains sample candidate lists and a sample publication-history filename, but no actual state/published.json or logs directory. The README lists those as runtime outputs; their mention is not evidence they are publicly available. No actual posting ledger or paired-agent transcript was recovered. No credential files or samples were fetched, no tools executed, and no social-media actions occurred.

ASSESSMENT
Stronger than a bare framework announcement: an older operator post links applications, source describes cooperation, and a real released data artifact survives. We still lack a public run transcript tying both agents to actual outputs. Keep this as an intentional operator project, not an escaped swarm. No XZ linkage found.

NEXT LEADS
Fresh Chinese-community search found xiaoxuz/SoulSim (V2EX1227531), a claimed29-agent world in comment15 of V2EX1201182, and chenhg5/agencycli (V2EX1206945). These were not present by name in the numbered public reports searched this round. They require source/output checks; search snippets alone are not confirmation.

PRESERVATION
332-private contains repository metadata, complete trees, five pinned documentation files and dataset aggregate metadata. SHA256SUMS and publication-check.json added on publication.

CCCC operator history and an unreviewed disabled-actor report
Reviewed September 6, 2026 UTC. Public read-only research.

OLDER PRIMARY OPERATOR ACCOUNT
https://linux.do/t/topic/1217360
November25,2025 post by ikb identifies CCCC as their project and describes two peer coding agents with optional auxiliary and supervisor roles. The author says the supervisor periodically reviews progress and wakes the peers, and later explains that tasks can instruct agents to disable the supervisor after completion. This is intentionally configured recurring execution, not spontaneous self-propagation.
The post links two applications:
https://github.com/ChesterRa/influx
https://github.com/ChesterRa/xoperator
The first is described as collecting public accounts, the second as a continuous social-media operation using that data. Their actual outputs and runtimes were not inspected in this pass; they are new application leads, not confirmed autonomous deployments. The author's runtime-duration and research-scale comparisons remain unverified claims. No social-media actions or operator contact occurred.
This is a useful older, externally hosted operator record that connects framework, scheduling design and proposed applications. It does not supply a raw multi-agent transcript or Chinese lab attribution.

CURRENT FAILURE REPORT
https://github.com/ChesterRa/cccc/issues/98
September5 report by rty90 describes five actors: Claude, Codex, Kimi and two DeepSeek-labeled runtimes on WSL2. The stated build is0.4.37 from388f29d with local patches. The author reports disabled flags reverting after restarts/unrelated operations, and delivery records showing accepted for disabled actors with no process.
The issue includes redacted inline timeline excerpts attributed to ledger/process/file observations. It is not a complete raw ledger, and no underlying attachment was recovered. Its chronology has a material wrinkle: reported process starts at07:13:28–32 precede the listed daemon-restart timestamp07:13:38. That could reflect timestamp definitions or recording error; it prevents treating the prose timeline as precise independently verified causality.
The author explicitly distinguishes cases: a later broadcast reportedly produced accepted receipts without starting processes or flipping flags. Therefore neither a receipt nor a plain broadcast alone proves an agent actually ran. Their stale-state-overwrite explanation is a hypothesis, not an established root cause.
The comments endpoint returned an empty list. No maintainer confirmation, reproduction or fix was recovered. This report is post-September4 disclosure and must be downweighted for the original escaped-swarm question. No evidence here indicates model-driven resistance to shutdown; a configuration/persistence bug is the reported issue, and that too remains unverified.

ASSESSMENT AND NEXT WORK
Older operator applications are more useful next targets than interpreting the recent disabled-actor report as autonomy. Check public xoperator/influx source and deliberately published output records, keeping their data-collection/authoring capabilities distinct from observed deployments. Public code or model labels alone do not establish Chinese laboratory origin or an escaped swarm. No XZ linkage found.

PRESERVATION
331-private: issue98 JSON, empty comments JSON, SHA256SUMS and publication-check.json. The older primary thread was read through the web reader. The previous30-entry issue listing remains in329-private. No target tests, runtime launch, messages, account registration, model calls, credentials or private-host access.

CCCC Arena replay routes found; backend returns Cloudflare Tunnel error
Reviewed September 6, 2026 UTC. Public read-only follow-up to report329.

CLIENT-SIDE EVIDENCE
https://live.ccccarena.com/match/match-20260208-2151
The public match page references this JavaScript bundle:
https://live.ccccarena.com/_next/static/chunks/app/match/%5BmatchId%5D/page-f77951ba1b30bb75.js
Retrieved bundle:71,978bytes. Its API base is https://api.ccccarena.com . The client requests match snapshots, event tails, hand tails, player-bubble tails and spectator-chat tails, and subscribes to an events stream. These are actual client paths, not guessed storage locations. A separate chat POST exists, but was not called.
The code handles x.arena.state.snapshot events with state_god or state_public and sequence tracking. That describes expected frontend data, not recovered state. The public viewer was designed to consume recorded/recent events, but current archive availability remains unproven.

EXACT PUBLIC GET CHECKS
https://api.ccccarena.com/v0/matches/match-20260208-2151/snapshot
https://api.ccccarena.com/v0/matches/match-20260208-2151/tail?n=500
https://api.ccccarena.com/v0/matches/match-20260208-2151/bubble_tail?n=400
All three returned HTTP530,7,650bytes. A follow-up capture of the snapshot error body identifies Cloudflare Error1033, saying the configured tunnel cannot currently be resolved. Thus no game state, move sequence or player dialogue was recovered. The requested limits500/400 are request parameters, not recovered event counts.
The snapshot error was observed again when saving its body; no continuous retry loop was started. No events-stream subscription, spectator-chat fetch, POST, match creation, login or model call occurred.

WHAT THIS MEANS FOR THE LEAD
Report329's operator/viewer accounts and screenshot remain useful evidence of a presented multi-agent game. The frontend shell remains available, but it does not demonstrate a working backend or an accessible historical replay today. The backend error does not prove that historical data was deleted or that the match never existed.
Exact-match/domain web searches did not find an additional indexed replay in this pass. Search returned irrelevant token matches; those were discarded. This limited negative is not a complete archive search.

INFRASTRUCTURE IMPLICATION
The observed error is a tunnel/backend availability failure reported by Cloudflare, not demonstrated geographic filtering of this research server. A mainland machine is therefore not the first remedy for this match. It remains useful for the separate blocked Chinese article comparisons already listed on access.html. For this lead, an intentionally public exported replay or restored backend would be more useful than extra crawling capacity. No operator contact or infrastructure purchase.

NEXT DIRECTIONS
Keep the match ID and documented public GET paths for a later bounded recheck. Meanwhile pursue CCCC's public operator issue reports and other Chinese swarm leads. Do not attempt private origins, tunnel credentials or restricted workspaces to recover the match.

PRESERVATION
330-private contains the match and shared JavaScript bundles, access.json, captured tunnel-error HTML/text, SHA256SUMS and publication-check.json. Error captures remain private because they include incidental request metadata. This public report contains only the necessary status/cause summary.

CCCC and a Chinese operator's four-model mahjong broadcast
Reviewed September 6, 2026 UTC. Public read-only discovery.

NEW COORDINATION PROJECT
https://cccc.sh/
Chinese-facing CCCC describes a shared append-only event ledger, role-directed messages, receipt tracking and explicit remote-group connections. The homepage's four-event sequence is labeled an example group, not a recovered work ledger. No displayed workflow count is accepted as an observed deployment count. Its linked repository is https://github.com/ChesterRa/cccc .
The site says runtime state remains local and public remote-access URLs require authorization. It also explicitly does not guarantee mainland reachability for its hosted remote-access preview. That statement concerns its own service; it is not evidence that our public research access needs a new machine. No account or remote group was joined.

CONCRETE OPERATOR / ACTIVITY SOURCE
https://linux.do/t/topic/1584637
February8 post by ikb links CCCC and a mahjong broadcast; later edits discuss February13. The operator reports model-labeled players, context/quota interruptions and varying play quality. A viewer says an earlier broadcast was mostly models chatting with poor play; another suggests different games. These are public operator/viewer accounts, not controlled model evaluations. Price, quota and model-ranking claims were not adopted.
The linked match route is https://live.ccccarena.com/match/match-20260208-2151 . Direct GET returned200, but extracted initial HTML only says loading; that alone does not establish a recovered replay. The thread was readable through the web reader while our direct HTML request returned403.

SCREENSHOT INSPECTED
https://cdn3.ldstatic.com/original/4X/6/1/b/61b55de7b6aa1dfea997df8b7179665b46ff0d61.jpeg
Public image downloaded,319,836bytes, visually inspected. It shows MATCH-20260208-2151, a February8 21:54 title, four seats, tiles/discards and a referee commentary panel. Seat labels pair Claude Code with DeepSeek-V3.2, GLM4.7, Minimax m2.1 and Kimi K2.5. This supports an operator presenting multiple Chinese model labels inside an American coding runtime; it does not authenticate the actual API backends.
The referee comments on a discard and possible responses. Player speech-count badges are visible, but no expanded player conversation is shown. Four seats each display25,000points. Neither those points nor the badges prove complete games or performance superiority. This is a screenshot of a presented game state, not independently verified legal play or a model trace.

ASSESSMENT
An intentionally organized competitive multi-agent event is a useful additional kind of Chinese-context activity. It is not cooperative problem solving, an escaped lab swarm, or proof that the agents organized themselves. The exact match ID gives a concrete next target for an existing public replay/export, stronger than continuing to search only framework names.
Next pass: inspect the public match page's client data-loading path without creating games or making model calls; determine whether archived moves and player messages are publicly readable. Do not infer raw records exist from HTTP200 or a loading shell.

OTHER PRESERVED LEADS
The latest30-entry GitHub issue listing was captured. It contains user reports about actor startup, UI state and disabled actors reappearing. Issue bodies/comments were not reviewed here, so no diagnoses or fix claims are made. These remain separate deployment leads.

PRESERVATION
329-private contains CCCC homepage HTML/text, GitHub issue listing, the inspected screenshot, match HTML/text and access.json, plus publication-check.json and SHA256SUMS. Forum thread evidence was read via the primary web-reader URL. No registrations, games started, model queries, target execution, private state access or operator contact.

ENGRAM development accounts: mailbox, handoff ambiguity and unavailable references
Reviewed September 6, 2026 UTC. Public read-only follow-up to report325.

PRIMARY SOURCE REVISION
https://github.com/engram-agents/engram/tree/8dfc6112df357f311f55e1ec50483593d4a4f9aa
Retrieved docs/inter-agent/README.md, docs/baton-protocol.md, docs/983-review/00-ASSESSMENT-AND-PLAN.md and src/forum/coordination/projects.py. These are public source artifacts; their instructions were not applied to this investigation.

MAILBOX HISTORY CLAIM
The inter-agent README describes an asynchronous Markdown-letter protocol on a shared host directory, with from/to/timestamp and optional reply-reference frontmatter. It claims an April2026 history of roughly28 letters ranging from500 to8000 characters. That count is a developer statement, not an enumerated recovered corpus. Filename examples illustrate the protocol; they are not themselves captured letters. Local shared-directory paths were not followed.
This gives useful future search signatures: timestamp-author filenames and explicit reply references. It does not show public Internet storage or agents finding one another without an operator.

SPECIFIC HANDOFF INCIDENT CLAIM
The baton protocol attributes its origin to a May28 disagreement between Borges and Ariadne about responsibility for the next action on PR425. The displayed project-format example includes a review turn and a later fix reference. This is documentation describing an alleged incident, not the original PR thread or authenticated turn log.
Direct checks:
https://api.github.com/repos/engram-agents/engram/issues/607 — HTTP404
https://api.github.com/repos/engram-agents/engram/pulls/425 — HTTP404
The issue607 URL was linked from the forum README. No comment request followed the failed issue lookup. A404 does not identify whether the reference is stale, unpublished, deleted or inaccessible; no stronger cause is inferred. These references cannot currently corroborate the narrative through public API records.

IMPLEMENTED TURN TRANSFER
In src/forum/coordination/projects.py, flip() reads the current project, updates turn/turn_since/turn_reason/turn_by, appends a from-to log line and writes through a store using a sequence allocator. It explicitly delegates participant/status validation to callers.
The read and frontmatter construction precede the allocator context; only the write is inside that context in this function. Therefore the inspected function alone does not prove an entire read-modify-write transaction is protected from concurrent updates. Caller/store/allocator behavior was not audited. This is a checked implementation of turn-state recording, not a verified deployment or concurrency guarantee. No target tests run.

ANOTHER DEVELOPMENT ARTIFACT
The issue983 documentation assessment is signed Borges and dated June11. It describes work assigned by a human named Lei, with other named collaborators and proposed documentation ownership. It is a concrete public planning record and supports a deliberate multi-role development narrative. Self-assigned names and dates do not authenticate model instances; a human name or Chinese translation does not establish nationality or Chinese laboratory affiliation. Its assertions about other files' correctness were not independently adopted.

ASSESSMENT
The illustrated Commons from report325 remains excluded as live activity. Separate developer documents now supply more specific incident and mailbox claims, and a source implementation records explicit turns. The strongest missing evidence is the original public redacted letters/PR exchange joined to its change. No escaped Chinese swarm or XZ linkage found.
The failed references are a reason to seek other public records, not to request private host data or guess deployment addresses. Continue unrelated Chinese operator leads as well.

PRESERVATION
328-private contains selected source documents/code, both404 access records, SHA256SUMS and publication-check.json. Public source retrieval worked; issue availability remains uncertain. No network joins, model calls, private-directory access, registrations, target execution or operator contact.

AgentVerse: verified source path for shared notes and turn selection
Reviewed September 6, 2026 UTC. Follow-up to report326; static source inspection only.

REVISION AND SOURCES
https://github.com/Peiiii/AgentVerse/tree/3c17c5482014cbff2e4968e7b5434f1ef5eec183
Six source files retrieved at this pinned revision: discussion-capabilities.ts, discussion-control.manager.ts, discussion/streaming-responder.ts, discussion/next-speaker.ts, discussion/mention-resolver.ts and common/lib/agent/prompt/prompt-builder.ts. Full paths preserved in327-private filenames, with control.ts representing discussion-control.manager.ts.

SHARED NOTE PATH
updateDiscussionNote() obtains the active discussion ID, rejects a missing active discussion, normalizes its note argument and calls the discussion presenter's update method. It returns the updated note and success. This changes a shared discussion field, not a per-agent private memory entry.
During generateStreamingResponse(), the controller reads the current discussion note and passes it into streamAgentResponse(). The responder forwards it to PromptBuilder.buildPrompt(). That builder trims the note and, when nonempty, appends it under a shared-note label to the role/capability system prompt.
Thus report326's visible note action has a concrete source path into later model input. Storage-adapter durability and the actual screenshot's persisted state were not verified; no browser conversation or model call executed. A later note replaces the shared field rather than establishing an immutable event history.

WHY ONE AUTO-REPLY SETTING CAN STILL PRODUCE SEVERAL SPEAKERS
NextSpeakerSelector first checks mentions in text and passes the triggering agent ID as an exclusion. MentionResolver resolves an eligible discussion member by slug or name, excluding self-mentions. This path does not require that member's isAutoReply flag.
Only the fallback uses the auto-reply list: a human message selects its first entry, or a moderator/first member if none; an agent message selects the first auto-reply member different from itself. This is a rule-based sequential selector, not evidence of11 simultaneous independent runtimes. It explains how report326's screenshot can show responses from several roles while only one member has automatic reply enabled.
The controller loop checks isRunning and processed < roundLimit, selects a next speaker, awaits that response and increments processed. Therefore the current inspected implementation has a round-limit check; the2025 user's no-stop report is historical and cannot be applied wholesale to this revision. This inspection does not prove all duplicate-trigger or cancellation bugs are fixed.

CONTEXT LIMIT DETAIL
PromptBuilder retains text messages and chooses a trailing window using min(total, max(messagesWithinCharLimit + 1, configuredMinimum)). Its20,000-character value is therefore a selection threshold, not a hard maximum: the extra message or minimum count can exceed it. The shared note is added separately. Do not infer a guaranteed20,000-character total context cap from the constant's name/comment.

ASSESSMENT
This advances the lead from UI/development-note claims to a checked path for shared information influencing another role's input. It supports intentionally orchestrated local discussion, with agent-authored notes and mention-directed turns. It does not establish autonomous public memory, external agent discovery, Chinese laboratory origin, or escaped behavior. No raw model transcript or substantive output-to-note verification recovered.
Exact-string searches for a public shared-note/export artifact returned no additional result in this pass; that is a limited search negative, not proof none exists. Continue seeking independent operators and deliberately public run archives.

PRESERVATION
327-private contains all six inspected source files, publication-check.json and SHA256SUMS. All remote actions were public GETs. No tests run, target code/skills executed, model calls, account creation, task dispatch, operator contact or private data access.

Peiiii AgentVerse: older user reports and a shared-note screenshot
Reviewed September 6, 2026 UTC. Public read-only research.

OLDER OPERATOR / USER RECORDS
https://v2ex.com/t/1109676
February7,2025 post by Peiiii links AgentVerse and agent.dimstack.com. It describes a moderator creating/managing other agents, labels its then-backend qwen2.5-max, and acknowledges there was initially no mandatory stopping condition. Users separately report a20-minute run stopped manually, persistent questioning, and multiple automatic loops after a human interrupts. These are user reports, not reproduced root causes. The operator's later reply says all communication was shared among agents then, limiting hidden-information games. This historical boundary must not be projected onto every current version.
These externally hosted reports support earlier public operation better than a current README alone. They do not establish model-provider authentication, autonomous deployment or escaped behavior. The view counts and page-relative age counters are not research measurements.

FOLLOW-UP AND SCREENSHOT
https://v2ex.com/t/1188885
January28,2026 follow-up describes group discussion and agent notes and links the same repository and site.
Downloaded and visually inspected its public discussion screenshot:
https://cdn-us.imgs.moe/2026/01/28/2a888138d01582244cf341a0750b92ba.png
Visible discussion includes a preceding mention of 本质透视者, that role's response about self-organizing systems, then 创意激发主持人 summarizing the discussion. The moderator has an expanded UPDATEDISCUSSIONNOTE tool card whose input contains a structured discussion summary. The card displays a success-style check, but its tool-result payload is not visible. This supports a presented role exchange with a note-update action, not independent verification of saved state.
The panel says11 members and1 auto-reply enabled. Therefore it must not be described as11 simultaneously running agents. Sidebar session dates do not authenticate screenshot capture time. The speculative scientific claims in the conversation are unverified model content, not accepted findings. No other user sessions were accessed.

SOURCE RECORDS
https://github.com/Peiiii/AgentVerse
Initial request for a main-branch tree failed; repository metadata identified master. Its complete current tree was retrieved at3c17c5482014cbff2e4968e7b5434f1ef5eec183, not truncated. This was a branch-name issue, not a China-access restriction.
Inspected docs/logs/v0.1.1-notes-sidebar/iteration-notes.md: author describes a discussion-level note field, updates and insertion into all agents' prompts. That aligns with the screenshot's note function, but is a development note rather than inspected runtime code. Its default-model label qwen3-max differs from the2025 post's qwen2.5-max; these are version-specific self-reports.
Inspected docs/logs/v0.1.11-mention-self-guard/iteration-notes.md: describes excluding self-mentions from next-speaker selection. Its listed checks are lint/type/build and a static-site HTTP200 smoke check, not a demonstrated live model-loop regression test. It explicitly says no deployment for that iteration. Accordingly it does not prove the2025 looping complaints were fixed in production.
Scheduler-design documentation was preserved, not treated as an executed schedule. Target code, model calls, builds and tests were not run.

ASSESSMENT / NEXT
Adds an older Chinese-context operator with several users' runtime reports and a concrete role/notes screenshot. Stronger than a bare architecture claim, weaker than a public raw conversation plus persisted note/output join. No Chinese lab provenance or XZ linkage. Same-name AgentVerse research frameworks are not automatically related to Peiiii's project.
Useful next evidence: the actual note-injection and next-speaker source paths, a public exported discussion, or a specific merged fix tied to one user report. Avoid treating static-site availability as proof of model execution.

PRESERVATION
326-private: both V2EX HTML captures, newer-thread extracted text, repository metadata/tree, inspected1,036,271-byte screenshot, selected development/scheduler documents, publication-check.json and SHA256SUMS. No registration, conversation creation, model query, target-code execution, credentials, private endpoints or operator contact. No infrastructure purchase.

ENGRAM Commons: illustrative public forum and seeded conversations
Reviewed September 6, 2026 UTC. Public read-only source inspection.

WHY THIS LEAD MATTERED
https://engram-agents.org/zh/
Chinese/English memory project describes persistent claim graphs and an agent discussion space. Search results expose agent names, apparent replies and substantial activity counts. These could resemble a public network exchanging knowledge, but require checking their presentation context.

EXPLICIT PUBLIC DEMO LIMIT
https://engram-agents.org/zh/forum/
Direct HTTP200 capture explicitly states every displayed agent, topic and number is illustrative, not live data. The displayed847 registered agents,23 online and147 topics therefore cannot be used as observed network counts. The same warning applies to the apparent named discussions and reply counts. The page claims underlying forum/DM/baton features are implemented; a staged interface does not disprove that separate implementation claim.
The homepage also labels its graph visualization as an example graph. Neither the illustrated knowledge cascade nor its mock forum excerpts establishes a recovered autonomous exchange. Chinese branding alone does not establish Chinese laboratory provenance.

REAL CODE, DIFFERENT EVIDENCE CATEGORY
https://github.com/engram-agents/engram
Inspected complete tree revision:8dfc6112df357f311f55e1ec50483593d4a4f9aa.
https://github.com/engram-agents/engram/blob/8dfc6112df357f311f55e1ec50483593d4a4f9aa/src/forum/README.md
The forum README describes a household-LAN service with thread/reply APIs and an audit log. Its initial version scopes out cross-household operation pending a networking decision. Current tree includes coordination modules, so do not extrapolate that older version boundary to every current feature. No LAN address or private database path was accessed. The README links issue607 as a scope record; that issue is a next lead, not yet inspected.

SEEDED POSTS ARE NOT INDEPENDENT AGENTS SPEAKING
https://github.com/engram-agents/engram/blob/8dfc6112df357f311f55e1ec50483593d4a4f9aa/src/forum/seed.py
Source reads hand-written Markdown seed files, groups them into threads and inserts author-labeled initial posts/replies. Its docstring says planting occurs at first startup and is skipped if threads already exist. Source was read, not executed.
Inspected retraction-0-op.md and retraction-1-iris.md. Their comments explicitly label the personas illustrative and say incidents are distilled from real development-network retractions. The latter tells a story of a corrected attribution resurfacing through prose despite a graph retraction. That is a curated lesson claiming an underlying incident, not the original incident trace or a raw exchange with another agent. No source graph node ID or authenticated conversation is supplied in these two files.
Consequently, an accessible deployment containing these exact seeded posts would not alone prove it hosted live agent-to-agent discussion. Future searches should distinguish seeded content from later independently generated posts.

ASSESSMENT / NEXT DIRECTIONS
Useful lead for intentionally built cross-host memory and coordination, but this pass removes the public Commons illustration from the list of possible live swarms. No escaped Chinese swarm, XZ connection or Chinese lab origin established.
Potential next evidence: issue607 and related implementation/review records; deliberately public redacted development-network traces; a real later forum post distinguishable from the seed corpus. Do not join networks or seek private databases.
Separate queued Chinese operator lead: V2EX1188885 links Peiiii/AgentVerse and agent.dimstack.com, with an older thread1109676 and screenshots. Those artifacts have not yet been checked. Similar project names are not identity links.

PRESERVATION
325-private: direct Chinese homepage/forum HTML, extracted text/links, complete GitHub tree, selected forum README, two seed posts and seed loader source, SHA256SUMS and publication-check.json. Public pages and source work here; no extra infrastructure needed for these captures. No target code, installation, registration, posts, operator contact or private network requests.

MCP Agent Task Bus: matching planner/worker screenshots, with demo limits
Reviewed September 6, 2026 UTC. Public read-only research.

PRIMARY OPERATOR SOURCE
https://forum.trae.cn/t/topic/17486
May13 post by 米糊炒面 links SamZebrado/mcp-agent-bus and describes a local task bus connecting separate SOLO conversations. It claims a two-dialogue test succeeded using separate MCP aliases sharing one data directory. The author later reports cross-IDE success. A May14 apparent hang was explicitly corrected: the planner used the wrong recipient name. Do not preserve the initial report as a verified cross-IDE runtime defect.
The post describes SQLite task state and JSONL events. It is a distinct project from LiPu-jpg/agent-bus in report323. Shared naming is not shared ownership. This is deliberate Chinese-context experimentation; no laboratory provenance or escaped behavior established.

SCREENSHOT JOIN
Downloaded and visually inspected both public screenshots:
Planner:
https://trae-forum-cdn.trae.com.cn/prod/original/3X/6/1/61dd9109fc039123ed226ead9208560c587bb45f.png
Worker:
https://trae-forum-cdn.trae.com.cn/prod/original/3X/e/4/e435aa794ec7a228ece0e41ddbced387c65116d1.png
Both display task_869c4b7c23ee4818. Planner output lists done, from planner-realtime through agent-bus-planner, to worker-realtime through agent-bus-worker. Worker output lists registration/wait/progress/finish as successful. Both explicitly show no file modifications. The visible durations differ (26s planner,31s worker), but do not establish independently measured concurrency or latency.
These are screenshots of SOLO-generated summaries with collapsed reference content, not expanded raw MCP request/response transcripts. Matching IDs are useful internal consistency, not independent authentication of the reported tool results. The demonstrated task is a connectivity check, not a substantive engineering deliverable.

REPOSITORY RUN RECORD
https://github.com/SamZebrado/mcp-agent-bus
Pinned complete tree:8398e8992c911e51e11c4864debc736485f74e8f.
https://github.com/SamZebrado/mcp-agent-bus/blob/8398e8992c911e51e11c4864debc736485f74e8f/RUN_RECORD.md
The manual May13 dual-alias entry repeats exactly task_869c4b7c23ee4818, the role names and no-file-change result. A separate minimal-test ID must not be conflated with this one. Automated sections contain test-output excerpts, including an August30 claim of50 passing tests; these were not rerun. The record also retains an older16-test note, so the document contains multiple historical states rather than a single consistent current suite count.
No raw task database, JSONL event export or expanded conversation transcript appears in the complete current file tree. Current source/repository dates are not independent historical captures.

THREE-AGENT DEMO BOUNDARY
https://github.com/SamZebrado/mcp-agent-bus/blob/8398e8992c911e51e11c4864debc736485f74e8f/docs/three_agent_demo.md
The documentation explicitly says the test does not call external AI. It uses temporary storage and separate worker processes to model a planner plus two workers, checks results, and removes its temporary directory. The corresponding smoke script was preserved as source. Thus its MULTI_AGENT_SMOKE output is evidence about a software test, not a recorded three-model collaboration. The suggested SOLO role prompts are instructions for future use, not a transcript.

ASSESSMENT / NEXT EVIDENCE
This lead supplies a better joined operator demonstration than an isolated success claim: two role screenshots and one committed run record agree on a unique task ID. All still originate with the project author, and the screenshots show generated summaries. The strongest next artifact would be a deliberately public redacted MCP/event trace or substantive multi-role result with expanded tool evidence. No model labels, source code, screenshot branding or Chinese language alone establishes Chinese lab origin.

PRESERVATION
324-private contains the forum HTML/text and image URLs, complete GitHub tree metadata, two inspected screenshots, RUN_RECORD.md, three-agent-demo documentation and source script, SHA256SUMS and publication-check.json. No target skills applied, installations, model calls, test execution, registrations, task dispatches or operator contact. Public source access works from the current server.

agent-bus: Chinese operator reports overnight coordination across machines
Reviewed September 6, 2026 UTC. Public read-only research.

NEW OPERATOR ACCOUNT
https://linux.do/t/topic/2755125
August14 post by JiuLiPuLe links LiPu-jpg/agent-bus. The author says they maintained a school application's Android version and needed coordination with backend work and another student's iOS version. Previously they synchronized documents or copied messages between agents. With mismatched human schedules, they built communication tools, left agents waiting for one another, slept, and reported successful design coordination the next morning. A reply explicitly distinguishes the goal as cross-machine agent collaboration.
This is a concrete Chinese-language operator narrative with a use case, linked implementation and claimed unattended run. It does not identify the school, models, deployment endpoint, agreed design or resulting application commit. No raw overnight transcript is attached in the inspected five-post thread. Positive replies do not independently verify the run. This is intentional deployment, not escaped behavior.

REPOSITORY INSPECTION
https://github.com/LiPu-jpg/agent-bus
Pinned current tree: c99b5aaf93b67b09986204a702f3e85f1b5b904b.
The complete, nontruncated tree contains four files: README.md, bus.py, .gitignore and skill/SKILL.md. Retrieved and read the first three; the target skill was not applied or executed. bus.py is107,921 bytes.
The README describes a coordination layer rather than an agent-spawning scheduler. It supports peer identities, work claims, locks, messages, handoffs and a shared board. These are implementation/product claims; no installed hub or actual peer connection was tested.

CONCRETE HANDOFF MECHANISM IN SOURCE
https://github.com/LiPu-jpg/agent-bus/blob/c99b5aaf93b67b09986204a702f3e85f1b5b904b/bus.py
handoff() checks ownership, requires a next action, rejects self-handoffs and creates an offered handoff with a context capsule. The capsule includes goal, current state, blockers, next action, lock labels, open thread references, recent changes and optional work-in-progress patch. It marks locks pending and sends a blocking notification to a specified recipient.
handoff_accept() checks offer state and recipient, transfers claim ownership and pending locks, records acceptance and notifies the sender. Both paths emit structured events. This is actual source implementing a two-stage transfer rather than a prompt-only role description.
The Bus object uses an in-process RLock, writes state.json through a temporary file and os.replace, appends events.jsonl and maintains board.md. The state/event/patch files are separate writes; source inspection does not establish transactional crash durability across them. No target tests or code executed.

WHERE A REAL RUN WOULD LEAVE EVIDENCE
The source gives useful artifact shapes: events.jsonl entries with seq/ts/type, handoff.offered and handoff.accepted event names, board.md, and handoff context capsules. These are search signatures and possible redacted export formats, not recovered run files.
The complete current tree contains no events.jsonl, board.md, capsule export, database or transcript. .gitignore explicitly excludes .bus/ runtime data and .bus-peer*.json. That explains why a code-only repository may omit its run records, but does not prove they exist elsewhere publicly. Do not request exposed state files or peer credentials: useful research evidence would be an intentionally public redacted event/board export.

ASSESSMENT
Adds a separate Chinese-context operator lead with a plausible cross-machine communication implementation and an unattended-run claim. Stronger than a generic framework catalog entry; weaker than a trace joined to concrete output. No Chinese laboratory origin, XZ linkage or escaped swarm identified. Follow exact project/operator strings for public run summaries or artifacts; also continue unrelated leads.
Additional discovery leads, not yet validated: jhqian/agentsquad and agent-room-alkl from a directory listing; TRAE topic17486 describes another MCP Agent Task Bus. Similar names do not establish shared operators or implementations.

PRESERVATION AND ACCESS
323-private: repository metadata/tree, bus.py, README.md, .gitignore, SHA256SUMS and publication-check.json. Forum evidence was read through the web reader at the primary URL above. GitHub access works here. No infrastructure purchase, account registration, network join, private endpoint, target-code execution or operator contact.

AgentsChat: July implementation evidence and April upstream proposal
Reviewed September 6, 2026 UTC. Public read-only follow-up to report321.

WHAT CHANGED IN THE ASSESSMENT
The July collaboration story now has two specific matching source changes, beyond matching package publication dates. These strengthen implementation evidence. They do not authenticate the claimed agents or supply the missing room transcript.

TYPING HANDOFF
https://github.com/swswordholy-tech/AgentsChatProtocol/commit/7edc640dcd7e8fb9bee9e6c4938bcf2a48a3cdbd
Git commit metadata gives July2 16:53:05 UTC. The message says information from the hub owner revealed dedicated typing frames stayed within one pod, whereas __typing__ content messages crossed pods. Its inspected patch replaces a typing frame with a single typed message on an inbound DM/mention. Comments refer to coordination with claude-code-live and distinguish a later server-side improvement.
This is a concrete client change responding to a reported cross-component problem, consistent with the case study's cross-pod indicator work. The server implementation and original exchange were not inspected, so the claimed server semantics remain the commit author's explanation. The claimed passing tests were not rerun. No target code or messages executed.

GOAL-TREE TOOL
https://github.com/swswordholy-tech/AgentsChatProtocol/commit/e82ae03293926d4b2aa098a356c94e765f0a5b7c
Metadata gives July2 18:08:26 UTC. The commit adds okr_reparent_objective to the MCP tool group, input schema and handler registry. The handler checks objective_id and distinguishes a missing parent_id from an explicit null, then issues an authenticated PATCH to the goal-parent endpoint. This is actual client implementation of the case study's tree-reorganization feature. The commit states the hub already shipped its endpoint; server-side cycle/depth enforcement was not verified here.
Both commits carry an editable Claude co-author trailer. That is an authorship claim, not cryptographic or provider-side model verification. English source and Chinese coordination phrases remain consistent with a Chinese-context operator using American coding models; no Chinese laboratory attribution follows.

HISTORY SAMPLE
GitHub commits API returned20 entries for July2–3 UTC, requested with per_page100. The entries include B1/B2 hardening labels used in the committed ledger, release0.24.0, release0.25.0 and release0.26.0. These are matching repository records, not independent witnesses of a conversation. Git dates can be authored or rewritten. npm publication timestamps checked in report321 provide a separate publication anchor, but not proof of who performed the work.

EARLIER EXTERNAL PROPOSAL
https://github.com/google-gemini/gemini-cli/pull/25209
The same GitHub account proposed pushing MCP channel notifications into Gemini CLI in April. Direct metadata says closed, merged:false, merged_at:null; closed April13 11:47:17 UTC. A maintainer explicitly closed it as a duplicate of PR24029. The author acknowledged the pointer. Six issue comments were retrieved; several are automated summaries/checks and must not be counted as independent operator testimony.
https://github.com/google-gemini/gemini-cli/pull/24029
Direct metadata for the referenced alternative also says closed and unmerged. This establishes neither proposal as a merged upstream feature. It does not determine whether comparable functionality landed elsewhere later. The April proposal is an earlier externally hosted record of the operator's interest in asynchronous agent messages, not proof of an April deployed swarm.

LIMIT AND NEXT SEARCH
Useful next evidence remains a public redacted pre-disclosure message trace joining a dependency, another actor's response, and one of these exact commits. The current evidence supports intentionally engineered collaboration more strongly than escaped behavior. No XZ linkage, public self-propagation, or Chinese-lab origin found. Continue other Chinese network leads as well as targeted checks; avoid spending the entire search on this one product.

PRESERVATION
322-private contains PR25209 metadata and comments, PR24029 metadata, the20-entry commit listing and two complete commit API responses, publication-check.json and SHA256SUMS. All remote actions were GET requests. No registrations, room joins, model calls, target execution, private paths or credentials accessed.

AgentsChat Protocol: live public feed, development ledger and package-release check
Reviewed September 6, 2026 UTC. Public read-only investigation.

IDENTITY / DISTINCT PROJECT
https://agentchat.run/landing
https://agentchat.run/llms.txt
https://github.com/swswordholy-tech/AgentsChatProtocol
The public landing page is Chinese/English and links the protocol repository. Its llms.txt identifies agents-chat.com as the canonical product domain. This supports joining those two domains to the repository; it does NOT join them to the similarly named agentschatapp.com in report320.
GitHub metadata reports repository creation March31,2026. Inspected current tree: a95fee88a9f777f0de6e4309e16407da0e38d917, 110 blobs, not truncated. Current content includes September6 updates; creation metadata is not proof every current artifact existed in March.

PUBLISHER'S COLLABORATION CASE
https://agents-chat.com/answers/how-ai-agents-coordinate-work
The page, displaying July3,2026, says four independently running agents and one human coordinated through a room and shared goal tree. It claims nine releases, including seven server deployments and two MCP packages; the human approved public releases. Reported roles cover coordination/backend, iOS, MCP and marketing. The described loop includes task ownership, dependencies and mentions to unblock another runtime. No underlying transcript, deployment logs or independently authenticated model identities are linked in the inspected page. Treat the claimed nine-release result as a first-party case study.

EXTERNAL PACKAGE RECORD CHECK
https://registry.npmjs.org/agentschat-mcp
Retrieved public npm metadata identifies the same GitHub repository. The case study's two named package versions exist with these publication timestamps:
0.24.0: 2026-07-02T17:58:57.028Z
0.25.0: 2026-07-02T18:12:25.105Z
Those timestamps fall on July3 at UTC+08:00, consistent with the case page's date. This corroborates package publication timing, not agent authorship or the other seven deployments. Also checked:0.26.0 July3 05:32:02.791Z;0.30.0 July10 04:50:27.695Z. No packages installed or executed.

PUBLIC DEVELOPMENT ARTIFACTS
https://github.com/swswordholy-tech/AgentsChatProtocol/blob/a95fee88a9f777f0de6e4309e16407da0e38d917/.ai-dev-kit/workflow/LEDGER.md
The committed ledger describes coordinator-ordered work, release checks, role-specific handoffs and explicit human approvals. July3 entries describe two ordered hardening batches and release0.26.0; July10 entries describe release0.30.0. This is a concrete English-language artifact with Chinese phrases for human direction, fitting Chinese-context operators using English coding agents. It remains a self-authored development record, not a raw authenticated conversation.
The adjacent findings.jsonl is a source-code audit list, not exchanged chat messages. Neither its CONFIRMED labels nor ledger test-pass checkboxes were independently reproduced. Some sections discuss credential handling and private local paths; those were not followed, used or copied into public results. Raw captures stay private.
Source sampling also inspected conversation.ts: it encodes channel/thread identifiers and parses them. That small helper corroborates client structure but cannot alone verify task-DAG orchestration, leader election or a live collaboration loop.

ANONYMOUS PUBLIC FEED: DIRECT ACTIVITY OBSERVATION
https://agentchat.run/api/public/feed?limit=8
This endpoint was found in the public landing-page JavaScript, explicitly used for an anonymous marketing feed. One GET returned HTTP200 and five items, cached:false. All five share one public channel label. Two probe messages have matching acknowledgment strings; intervening content is a relay setup notice. Reported source times are September6 07:04–07:06 UTC.
The later probe/ack timestamps differ by about2.834seconds; the earlier pair by about15.567seconds. These are server-returned timestamps, not independently measured response latency. The feed intentionally omits sender identities, so neither distinct actors nor model origin can be authenticated from it. Probe acknowledgments are weaker evidence than task handoffs, and September6 content must be downweighted for post-disclosure contamination. The query returned five items despite limit8; no total activity count can be inferred.
No room was joined, no message was sent, no registration/login occurred, and no probe was initiated by this investigation. Root HTML redirects users without a stored token to the landing page; public documentation/feed access is distinct from authenticated channel access.

ASSESSMENT AND NEXT SEARCH
This is a stronger lead for a deliberately operated network than a generic multi-agent framework: a deployed public feed, a named repository, a committed development ledger, and package records partly matching a first-party collaboration story. It is not evidence of an escaped Chinese laboratory swarm. Chinese-facing operation is supported; Chinese lab/model provenance is not established.
Next valuable evidence is an older public redacted room trace linking a specific dependency/mention to a shipped change. Inspecting existing public issue/commit records and documented public exports can advance this without joining the network. Do not infer that a marketing case, a ledger and npm are three independent witnesses of agent authorship: npm only independently anchors publication.

INFRASTRUCTURE THAT WOULD HELP
These public pages, GitHub and npm work from the current server. More compute is not required for this lead. For blocked Chinese sources, the best experiment remains an existing always-on computer on mainland broadband, with SSH or remote desktop and a dedicated browser. Suggested capacity is approximately2 CPU cores,4GB RAM and40–70GB disk; this is an engineering estimate, not a vendor quote. No GPU needed. Public-page HTML/text/PDF exports with URL and capture time are also useful.
Compare exact previously blocked targets first:
https://www.elliot98.top/post/tech/office/
https://mp.weixin.qq.com/s/Yju3Fh3xISMlrQRVxvDWtQ
A geographic comparison may clarify browser/network restrictions; it will not by itself create authorization for account-only rooms. Existing hardware is preferable for the initial comparison. No new infrastructure purchased.

PRESERVATION
321-private: public site captures, five-item public feed, repository metadata/tree, selected source and development records, npm metadata, SHA256SUMS and publication-check.json. Public output is this assessment.

MiniMax shared-board design and Agentschat persona platform
Reviewed September 6, 2026 UTC. Public read-only evidence.

MINIMAX: PRIMARY LAB-OWNED ARCHITECTURE DESCRIPTION
https://www.minimaxi.com/blog/minimax-agent-team-long-running-1779893521
The official article displays April 27, 2026 and calls the upgraded product Mavis. It describes Leader/Worker/Verifier roles and a code-driven producing/verifying/done lifecycle. Its most relevant detail is file-based handoffs and shared message-board files: workers exchange paths and summaries asynchronously. Shared information also uses per-agent memory, direct communication CLI, and on-demand whiteboard retrieval. The article says desktop access is available and open sourcing is planned; that is the article's claim, not a separately checked current release status.
This supports a concrete Chinese lab's intentional team design, including durable coordination mechanisms similar in function to the scratch-memory analogy. It does not demonstrate public boards, escaped agents, or a connection to XZ. No raw task trace or deployed whiteboard was recovered in this pass. Displayed publisher dates are not independent historical captures.

AGENTSCHAT: CHINESE INDIVIDUAL OPERATOR'S PERSONA PROJECT
https://forum.trae.cn/t/topic/112771
July 11 post by 林花谢了春红 describes mixed human/agent groups, adjustable reply frequency, persona creation, memory, and exports. Its DeepSeek backend label is self-reported. Claims of open sourcing did not yield a linked code repository in the inspected post; exporting persona assets is not equivalent to publishing platform source.
https://forum.trae.cn/t/topic/174752
An August 9 follow-up by the same author describes agent-double matchmaking, task bounties and a central assistant. These are proposed/product features, not independently verified agent-to-agent task completions. Model names and software-development session strings in the post are not model-provider authentication.

DIRECT OBSERVATIONS
https://agentschatapp.com/
Public homepage GET returned 200. A fresh Chromium session, restricted to GET/HEAD requests, rendered an introductory quotation and a Skip control after four seconds; this short observation neither verifies the community nor proves a login wall. The author's initial post says email registration is required. No registration or further interaction occurred.
One public screenshot was downloaded and visually inspected:
https://trae-forum-cdn.trae.com.cn/prod/original/3X/2/f/2f4d2c8dc633b145e8d5fc548532acd9c8b816b8.png
It shows a contact-management screen with three agent labels (莲可, 鲁迅, 尼采), one group named test, and zero human friends. The selected persona has local-memory and skills controls. There are no visible exchanged messages in this screenshot. Thus it corroborates a designed persona interface, not an autonomous conversation or independent operators. The screenshot's learned skill label is agentstalk使用指南; its underlying content was not recovered.

SEPARATE NAME COLLISION / NEXT LEAD
Searches also surfaced https://agentchat.run/ and https://agents-chat.com/, linked to https://github.com/swswordholy-tech/AgentsChatProtocol . This is a separate lead; a similar name does not establish identity with agentschatapp.com. Its networking claims are being checked separately in round321.

ACCESS AND NEXT STEPS
Both the MiniMax article and TRAE posts are retrievable from this server. There is no demonstrated infrastructure deficit for these captures. Useful next evidence: a public redacted Mavis handoff or message-board artifact; an actual Agentschat multi-persona exchange; or a public independently operated channel trace from the separate AgentsChat Protocol network. No account creation, room joining, model calls, target-code execution or operator contact.

PRESERVATION
320-private contains HTML/text captures, extracted links, the inspected screenshot, browser text, SHA256SUMS and publication-check.json. Public output is this original assessment, not a bulk copy of the source posts.

AgentTeams follow-up: recovery gap, sync diagnosis and patch status
Reviewed September 6, 2026 UTC. Public read-only issue/PR evidence.

SUBMISSION WITHOUT NOTIFICATION
https://github.com/agentscope-ai/AgentTeams/issues/1177
An August13 proposal reports a reproduction pinned to aa650ccacc2ba6171d1b0b5efd2a49b1472abe5d: submit_task persists a submitted result and returns notificationNeeded, but a separate message must wake the leader. The author says the reproduction ran three times through the real MCP entry point while replacing the external mc process with a successful test double. It explicitly was not a full Kubernetes/Matrix deployment test. Preserve this distinction: project-1/example.test and the printed JSON are controlled reproduction evidence, not identifiers from a recovered live swarm.
Five comments were retrieved. Discussion agrees on the persistence/notification gap; the author and reviewer explicitly say draft PR1183 implements state-contract groundwork, not the scanner, leader wakeup or retryable delivery needed to close the problem. The final evaluation identifies itself as automated. No full recovery fix or independently repeated reproduction is claimed here.

UNRESPONSIVE WORKER REPORT
https://github.com/agentscope-ai/AgentTeams/issues/949
June20 report describes long quiet intervals, repeated HEARTBEAT.md synchronization, and a972-second later run. It links a work.log attachment, which was not downloaded in this pass. The issue body discusses credential-file synchronization; no credential content was requested or inspected.
Its causal claim that the sync loop shares the agent event-loop process is challenged by an explicitly bot-authored response: the shell sync loop runs separately. The original numerical claim is also inconsistent:24,000/54,630 is about43.9%, not88%. Accordingly neither the alleged root cause nor its percentage is accepted as established. These are debugging leads, not proof that file synchronization caused all observed inactivity.

LINKED PATCH CHECK
https://github.com/agentscope-ai/AgentTeams/pull/971
Direct GitHub metadata: state closed, merged_at null, merge_commit_sha null. Therefore this PR is NOT a verified merged fix.
Its inspected diff changes worker-entrypoint.sh to exclude runtime files from change detection and stop pushing HEARTBEAT.md from workers. The added test uses shell syntax and source-string checks; it does not demonstrate a live synchronization loop is cured. The diff also contains an integration-test edit outside that focused change. No tests or target code executed. Similar code may have landed elsewhere, but that was not checked.

RUNTIME VERSION / MENTION LOOP REPORT
https://github.com/agentscope-ai/AgentTeams/issues/803
May12 user report describes thinking text and automatic mentions causing worker reply loops. A reviewer corrects the claim that all linked upstream fixes were already merged/closed. The user later reports partial improvement while leader output/thread handling remains problematic. A later comment identifies PR1077 and fb3a40be1f005bd584f45544fc73bd4601d5c52a as an upgrade and asks for retesting. That comment is a lead; PR1077 itself and the screenshots were not inspected here, so no blanket fix claim is made.

ASSESSMENT
Public failure reports continue to provide stronger operator-specific leads than diagrams, but reported deployments, controlled reproductions, automated triage and merged fixes must remain distinct. Nothing here establishes an escaped Chinese swarm or links these users to XZ. The next useful artifact is a redacted task/message trace with a source revision and demonstrable result, rather than another proposed recovery design.

PRESERVATION
319-private: issue1177/949/803 JSON, their comments, PR971 metadata and files, SHA256SUMS, publication-check.json. Raw captures private. No log attachment, credentials, installation, model call, target execution, room access or operator contact.

AgentTeams: reported acknowledgment loop and missed handoffs
Reviewed September 6, 2026 UTC. Public read-only issue evidence.

ACTUAL OPERATOR TRANSCRIPT LEAD
https://github.com/agentscope-ai/AgentTeams/issues/804
Opened May12,2026 by hlgone, still open at capture. The author supplies a numbered, redacted15-entry timeline from a claimed haopaw production team room. A user asks for a streetlight count; the leader dispatches to a specialist; the specialist returns figures; the leader issues FINAL, followed by repeated leader/specialist acknowledgments. The author labels the runtime CoPaw/HiClawv1.1.1 and model qwen3.6-plus.
This is an inline, edited transcript rather than a raw Matrix JSON export: real event IDs, room identifiers and timestamps are not supplied. Its concrete handoff and repetitive aftermath are useful evidence, but authenticity, model identity, production status and call counts were not independently verified.
Two inconsistencies matter: entries6 through15 are10 entries, although nearby prose calls them8 bubbles; the stated23 total devices does not equal the listed categories17+4+2+4=27. Do not silently normalize those discrepancies or treat the device counts as ground truth. The application repository link is a placeholder, not a recoverable haopaw code reference.

COMMENTS ON804
https://github.com/agentscope-ai/AgentTeams/issues/804
Public comments retrieved via /issues/804/comments contain two responses by shiyiyue1102, May13 and May29. They regard the problem as plausible/valid and propose suppressing acknowledgment-only wakeups while preserving room history. These are discussion and proposed work, not a merged fix or an independent reproduction. No fix is claimed by this report.

OPPOSITE FAILURE: WORKERS WAITING FOR A MANAGER
https://github.com/agentscope-ai/AgentTeams/issues/160
Opened March10,2026 by fg2q1q3q, still open at capture. The user reports that a worker finishing work without mentioning the manager leaves the workflow stalled and requires human intervention. Three comments were retrieved. One is explicitly labelled an automatically generated Issue Tracker response; it must not be counted as independent human technical confirmation. A May29 response requests further review of Matrix events, allowFrom and task orchestration. This report has no attached sequential run transcript.

INTERPRETATION
These two user reports describe opposite consequences of mention-triggered turns: missed mentions can prevent progress, while repeated mentions can keep completed work alive. That comparison is an inference from reports, not a measured universal failure rate. Issue804 is a promising deliberate Chinese-context deployment trace with a concrete business task, beyond toy introductions. It still does not establish an escaped swarm, autonomous task discovery, or Chinese-lab provenance. haopaw is not joined to other projects by name alone.

SEARCH COVERAGE
GitHub issue searches returned50 loop matches and60 mention matches; only the first15 results from each were retrieved, and issues804/160 were examined with their comments. These counts are search matches, not agents, incidents or exhaustive verification. Other concrete leads in those results include803 (runtime-version compatibility),949 (unresponsive worker),1177 (lost completion wakeup),1229 (task lifecycle design). Inspect selectively for public evidence rather than counting design proposals as executions.

NEXT
Look for raw redacted event exports or actual fixes linked from the remaining public reports. Preserve distinctions between user narration, explicitly automated triage, source implementation and runtime artifacts. No participation or access to the described rooms is needed or authorized by this investigation.

PRESERVATION
318-private: loops.json, handoffs.json, issue-804.json, issue-160.json, comments-804.json, comments-160.json, SHA256SUMS and publication-check.json. Raw captures private. No model requests, task claims, login, posting, operator contact or target execution.

AgentScope: public four-agent memory reproduction and merged broadcast fix
Reviewed September 6, 2026 UTC. Public read-only evidence.

FINDING
A Chinese user's AgentScope bug report provides reproduction code and printed cross-agent memory, followed by maintainer acknowledgment and a merged source fix. This is stronger evidence of a bounded multi-agent interaction than an architecture diagram. It remains a tutorial-derived local reproduction, not an unattended or escaped swarm.

PRIMARY REPORT
https://github.com/agentscope-ai/agentscope/issues/1327
Opened March14,2026 by toohandsome; environment lists AgentScope1.0.17, Python3.11, Windows11. Four ReActAgent instances, kimi2/Alice/Bob/Charlie, enter MsgHub and are called sequentially to introduce themselves. The configuration uses Chinese model labels through iflow/scnet endpoints; these are requested labels, not authenticated model weights or lab provenance. Credentials in the displayed reproduction are placeholders; none used.
The author's March16 follow-up includes Alice's printed memory: four text blocks attributed to the four agents and one Bob-labelled thinking block. A maintainer initially said the DeepSeek thinking block should remain private, then acknowledged the follow-up at06:45:58Z. These are user-published console records, not independently reproduced calls. They support shared message delivery and an unintended extra content block; no task completion or external posting is demonstrated.

SOURCE FIX
https://github.com/agentscope-ai/agentscope/pull/1332
Title: feat(agent): filter thinking content before broadcast.
GitHub metadata reports merged March26,2026 at09:01:49Z, merge revision346dce99a514278a212024d486845fe5c27af89f.
https://github.com/agentscope-ai/agentscope/blob/346dce99a514278a212024d486845fe5c27af89f/src/agentscope/agent/_agent_base.py
The retrieved PR diff modifies _broadcast_to_subscribers: it strips content blocks whose type equals thinking before passing messages to subscriber.observe. List input is handled per message; changed messages retain identifying metadata and the original ID. This confirms a concrete broadcast path matching the reported failure class. The patch does not, by itself, prove removal of inline think tags inside text blocks; typed thinking blocks and tagged text are different representations. No target code or tests were executed.

HICLAW NAME AND DEPLOYMENT FOLLOW-UP
https://api.github.com/repos/higress-group/hiclaw
HTTP200 after redirect to GitHub repository ID1163358617; returned full_name agentscope-ai/AgentTeams. This establishes the current GitHub repository identity behind the old address, not the exact historical transfer date.
https://github.com/agentscope-ai/AgentTeams/issues/422
Direct issue API read confirms a March24 Chinese remote-access report, including a400 error at /v1/chat/completions and the author's routing/TLS workaround narrative. It supplies no completed multi-agent conversation export. Its example addresses were not visited and its configuration advice was not executed or recommended. This is deployment troubleshooting evidence, separate from AgentScope issue1327.

ASSESSMENT
AgentScope1327 adds a user-authored, Chinese-context multi-agent reproduction with a corroborating code change. Shared internal memory is not public scratch-space escape. The actors were deliberately created and invoked in a fixed sequence. Model labels, forum language and API hostnames do not establish a Chinese lab as operator. No connection to XZ or the HiClaw stock-team user is established.

NEXT
Follow comparable public MsgHub/AgentTeams reports that include task handoffs or result artifacts beyond self-introductions. Prefer actual console records and matching code history. Avoid counting source safeguards against mention loops as proof that a particular loop occurred.

PRESERVATION
317-private: repo.json, issue422.json, memory-issue.json, memory-comments.json, selected memory-output-excerpt.txt, fix.json, fix-files.json, SHA256SUMS and publication-check.json. Raw reports remain private. No credentials used, external accounts contacted, model endpoints called or target code executed.

HiClaw user deployment: matching chat and container screenshots
Reviewed September 6, 2026 UTC. Public read-only evidence.

PRIMARY OPERATOR POST
https://linux.do/t/topic/1700242/6
Thread https://linux.do/t/topic/1700242 was readable through the web search reader. Mars-KK's March8,2026 post describes roughly a week using HiClaw, multiple workers, shared MinIO files, automatic groups and mutual mentions. Another participant reports quickly exhausting a Qwen-labelled token allowance; that anecdote is not billing or model-identity verification. No full thread archive was obtained by direct requests: the separate two-page capture process stalled and was interrupted after repeated live-handle polls. The blog review queued second in that process remains unverified in this pass.

TWO ORIGINAL IMAGES RETRIEVED AND VISUALLY INSPECTED
https://cdn3.ldstatic.com/original/4X/5/7/0/5703415d77befaf7ca487b2af432649344e4256e.png
HTTP200,438,218 bytes. A Matrix-style chat shows a stock-analysis team, a23:26 group-creation announcement, stock-alpha, stock-beta and data-harvest roles, and instructions for mentions and collaboration. The sidebar additionally shows frontend-dev and a manager. It proposes cross-checking between the two analysts and data support from the collector. These are setup instructions, not the actual analysis exchange. The screenshot also has truncated keepalive/sync/status previews that cannot establish completion or duration.
https://cdn3.ldstatic.com/original/4X/c/d/e/cde3725be8aab606367a6f9fa77a9aa473c847c3.png
HTTP200,182,646 bytes. A container UI shows five visible named rows: hiclaw-worker-frontend-dev, hiclaw-worker-data-harvest, hiclaw-worker-stock-beta, hiclaw-worker-stock-alpha and hiclaw-manager, each marked started. Its header counts seven total/seven started, but only five rows are visible, so seven must not be reported as seven agents. The displayed addresses are private container-network addresses, not public egress or Chinese hosting evidence.

EVIDENCE JOIN AND LIMITS
The repeated worker names tie the two images to a consistent displayed setup: four worker names and a manager, with a stock-team room. This is a useful voluntary operator deployment report, stronger than an illustrative README transcript. It does not authenticate the underlying model calls, prove screenshot timestamps, demonstrate unattended operation, or establish completed stock analysis/trades. Do not follow the displayed local server addresses or attempt to enter the operator's rooms. No public room URL or exported message history was provided in the inspected post.

RELATED LEADS
https://jjbiji.com/blogs/hiclaw-worker-market-review/
Search-indexed author review describes template-market friction and a documentation-worker experiment. Web-reader fetch failed; direct capture did not finish. No claims from its unseen remainder are accepted here.
https://github.com/agentscope-ai/AgentTeams/issues/422
Search surfaced a HiClaw remote-access deployment issue. It is a potential repository/operator-history route, not yet directly inspected in this report. The current AgentTeams namespace and earlier HiClaw naming need checking before attribution.

ASSESSMENT
Chinese-language independent user evidence for an intentionally deployed agent team; no escaped-swarm or XZ connection established. The main missing artifact is a sequential message export with task/result references. Continue through public deployment issues and voluntarily redacted debug attachments, avoiding configuration dumps or credentials. Existing server successfully retrieved the image CDN; additional infrastructure was not required for these screenshots.

PRESERVATION
316-private/screenshot-0.png and screenshot-1.png, capture-status.json, SHA256SUMS and publication-check.json. Raw images remain private; report links original public sources. No installation, model request, login, messaging, trading or target execution.

Agent Memory Hub: detailed handoffs are explicitly fictional
Reviewed September 6, 2026 UTC. Public read-only inspection.

RESULT
Agent Memory Hub is a concrete Chinese-context shared-memory project, but its inspected three-stage handoff demonstration explicitly did not invoke agents. Its detailed success/failure checklist must not be counted as an observed Claude Code-to-Codex-to-Wukong exchange.

PINNED REPOSITORY
https://github.com/liuyang0508/agent-memory-hub
Revision72d8aa1b2db94655644ca0bdb981882e0a132aaf; recursive tree not truncated;1,195 blob files. Metadata, tree and README preserved. The README describes local shared memory across coding tools and links a Gitee mirror. These features and Chinese-language documentation establish project context, not Chinese-lab or deployed-agent identity.

EXPLICIT DEMO DISCLOSURE
https://github.com/liuyang0508/agent-memory-hub/blob/72d8aa1b2db94655644ca0bdb981882e0a132aaf/docs/demo/00-scenario.md
The scenario labels its background fictional. It says no actual weather-cli code is written, no agent is really called, and snapshots are textual simulations of session state. The designed example passes a CSV-export task through coding, testing and PM communication, deliberately omitting a BOM/encoding decision to expose a handoff-schema weakness.

https://github.com/liuyang0508/agent-memory-hub/blob/72d8aa1b2db94655644ca0bdb981882e0a132aaf/docs/demo/handoffs/02-cc-to-codex.md
https://github.com/liuyang0508/agent-memory-hub/blob/72d8aa1b2db94655644ca0bdb981882e0a132aaf/docs/demo/handoffs/04-codex-to-wukong.md
Both contain source/target labels, May14 timestamps, concrete next actions and references to a DingTalk product group. Those identifiers and dates belong to the fictional demonstration. They do not prove real group messages, a real commit, model calls or task execution. No named private workspace or group was accessed.

https://github.com/liuyang0508/agent-memory-hub/blob/72d8aa1b2db94655644ca0bdb981882e0a132aaf/docs/demo/evaluations/eval-summary.md
The evaluation presents checked successes and failures, including alleged immediate resumption and a lost encoding decision, but later explicitly states that actual agent calls were not validated and the exercise concerns schema design. Read together, these documents are an illustrative design exercise, not a run transcript. This qualification applies to this demo, not automatically to every benchmark or implementation elsewhere in the repository.

ACCESS RESOLVED THROUGH THE REPOSITORY LINK
https://aihub0508.com/
The pinned README names this as the official website. Direct HTTPS returned200,199,532 bytes and title Agent Memory Hub 官网. This provides a working public route despite the www.fhsq.cn certificate hostname mismatch from report314. No certificate bypass or new geographic machine needed. The two hostnames' exact ownership/redirect history was not established.

SEVEN-AGENT SCAFFOLD SEARCH
Three searches used the exact phrase 3模型7Agent, the combination 7Agent/协作/超儿, and Chinese-word variants. No matching original scaffold repository or run artifact was returned. This bounded negative does not prove absence; the ZNT digest could omit the artifact name or paraphrase it. A result for openairymax/agentrt describes multi-model orchestration, but no link to the specific ZNT participant/scaffold was established.

NEXT
Move to other operators with public artifacts. The Memory Hub tree includes benchmark reports and implementation code that could be inspected separately, but do not spend further effort treating these explicitly fictional handoffs as a latent conversation archive. Search for voluntary run exports and references with verifiable source/target artifact joins.

PRESERVATION
315-private: metadata.json, tree.json, README.md, four pinned demo documents, official-site HTML/text, SHA256SUMS and publication-check.json. Raw captures stay private. No target software execution, model calls, registration, group joining or contact.

Chinese operator search: ZNT community digest and Co:X forum
Reviewed September 6, 2026 UTC. Public read-only inspection.

NEW SURFACE
https://znt.group/daily
Direct HTTP200. Dated Chinese community digests provide possible operator leads. Their footer explicitly says the material is AI-compiled from community discussions and not manually checked item by item. The pages are published summaries, not raw human transcripts or authenticated agent conversations. Dates and aggregate activity counters are site claims.

TWO DATED LEADS
https://znt.group/daily/2026-07-05
HTTP200. The digest attributes to a Beijing participant a three-model/seven-agent orchestration scaffold: task decomposition, execution and cross-review, with arbitration when reviewers disagree. It also summarizes a Xi'an participant's proposed recursively spawning architecture and experience-distillation loop. The inspected HTML contains no scaffold download or repository link, despite telling readers to download the shared scaffold. These are specific search leads but not verified implementations. The page reports1,130 messages and142 participants across four archived groups; these are not agent counts.
https://znt.group/daily/2026-05-28
HTTP200. Summarizes role division and mutual review across Codex, Claude Code and Hermes, including human selection of outputs and reported costs/failures. No raw execution export or external code link was extracted. It reports2,377 messages and222 active participants, again community-summary metadata rather than swarm enumeration. Neither page establishes Chinese-lab provenance or an escaped system.

LINKED FORUM CHECK
https://bbs.znt.group/
HTTP200, branded Co:X, Powered by Halo. Initial requests text decoding produced mojibake; original text was reversibly recovered as UTF-8 before analysis. The homepage contains RSS-labelled AI news and a small number of administrator articles. RSS republishing is not cross-agent dialogue.
https://bbs.znt.group/categories/ren-wu-xie-zuo
https://bbs.znt.group/categories/an-li-ku
Both HTTP200 and explicitly show no articles in task collaboration and case-library categories. This is a signed-out snapshot of these two categories, not proof the entire site or underlying community has no cases. No login or group joining attempted.

OTHER SEARCH TRIAGE
The Datawhale Feishu debate tutorial resurfaced but was already evaluated in report225; it is not new evidence.
https://www.fhsq.cn/ surfaced as Agent Memory Hub's public site. Direct HTTPS failed hostname verification because the certificate did not cover www.fhsq.cn. No TLS bypass attempted. The indexed site points to https://github.com/liuyang0508/agent-memory-hub and a Gitee mirror; source/release inspection remains pending. A geography change is not proven to solve this certificate mismatch.

ASSESSMENT AND NEXT
This adds a Chinese community discovery source with concrete but unverified deployment descriptions. AI summaries can distort both claims and attributions; seek a public source artifact before upgrading confidence. Next search exact scaffold wording and examine the Memory Hub source for genuinely published examples. Existing access works for ZNT and Co:X; no new infrastructure required. Public original-thread exports or voluntarily shared code would help more than additional summaries.

PRESERVATION
314-private: daily index and two dated HTML/text/link captures, corrected forum HTML/text, task/case category HTML/text, access-error.txt, publication-check.json and SHA256SUMS. Raw captures private. No credentials, private group messages, participant contact, posting or target execution.

AutoResearch task claims and EvoMap experiment boundaries
Reviewed September 6, 2026 UTC. Public source and publisher-page inspection.

RESULT
AutoResearch contains a concrete local task-claim mechanism. Public documentation explicitly says runtime outputs are not distributed with the repository, and the releases endpoint returned an empty list. This resolves the current-tree absence more strongly than filename searches alone. The separate EvoX swarm article provides useful experimental qualifications, but does not supply the missing production agent conversation archive.

PINNED RUNTIME SOURCES
https://github.com/EvoMap/AutoResearch/blob/6b85443f9e3d33d357c86c8bb826f9ea03c780b3/ARCHITECTURE.md
Architecture explicitly limits the repository to source, templates and synthetic examples; data/logs/runtime state are local outputs. It describes research collection from both Chinese and international sources, a recoverable queue, and a separate supervisor. These are intended operation details, not observed executions.
https://github.com/EvoMap/AutoResearch/blob/6b85443f9e3d33d357c86c8bb826f9ea03c780b3/ar-runtime/ar-coordinator-startup-flow.md
Startup documentation describes planner, coder and runner roles, a coordinator updating persistent queue/state, and automatic continuation. Target instructions were read as evidence and not followed.
https://github.com/EvoMap/AutoResearch/blob/6b85443f9e3d33d357c86c8bb826f9ea03c780b3/ar-runtime/scripts/ar-workflow-engine.py
Downloaded161,982 bytes. queue_lock uses fcntl.flock on workflow_queue.lock. command_claim locks the read/reclaim/select/write sequence, chooses the first ready unit, records claimed_by, claim_attempts and lease_expires_at, and appends a unit_claimed decision. Expired leases return work to pending or block it after the retry threshold. This supports local workers coordinating through a shared queue; it does not imply geographically separate agents or public Internet memory. No concurrency test or target execution was performed. No end-to-end correctness claim is made.

RELEASE AND PUBLIC OUTPUT CHECK
https://api.github.com/repos/EvoMap/AutoResearch/releases
HTTP200, [] at capture time. No release asset bundle was available through this endpoint.
https://evomap.ai/research/autoresearch-evidence-loop
HTTP200. The publisher describes a Django repair progressing from2/7 to7/7 new-feature tests with203/203 regression tests, plus Kaggle cases. It warns the compared conditions had different time and feedback access. The extracted HTML links did not provide a run archive. Its Django PR link is the reference task/fix, not proof that AutoResearch authored that PR. No independent operator execution was found in this bounded search; promotional reposts repeat publisher claims.

SEPARATE EVOX SWARM EXPERIMENT
https://evomap.ai/research/self-organizing-ai-swarms
HTTP200, preserved HTML/text. The publisher's July27 article compares scripted per-question decomposition/programmatic aggregation with lead-agent and single-context approaches. Reported accuracies are70.69-70.87%,38.54%,26.29%, with563 questions as denominator and one swarm network timeout. These are author-reported measurements, not reproduced results.
Crucially, the article says the first experiment does not close autonomous decomposition/task-claiming/communication. Its second experiment's network edges denote partner reconnection choices, not messages or task handoffs; actual collaboration over those connections remains future validation. Do not count a rendered network as a captured communicating swarm or infer self-organization from the accuracy headline.

CONTEXT AND DEDUPLICATION
EvoMap as a platform was already investigated in reports228-233. Council histories and public welfare-project outputs are separate records; no join to AutoResearch runs is established. Report233 found LongWoF's release excludes raw agent traces. AutoResearch is a new project-specific branch of an existing operator lead, not a newly discovered platform. SeevoMap is separately investigated and not joined by name similarity.

NEXT SEARCH
Follow other public operator exports and Chinese discussion communities. AutoResearch's formal output filenames are useful exact-string search leads, but absence from search is not proof no deployment exists. A voluntarily published workflow_events.jsonl plus associated code/results would be more informative than another product summary. Current sources work from this server; no new infrastructure required for this branch.

PRESERVATION
313-private: releases.raw, architecture.raw, startup.raw, engine.raw, research/loop/swarm HTML and extracted text/link lists; SHA256SUMS and publication-check.json. No credentials, registration, task claims, model requests or target execution. Raw captures remain private.

Synapse Run feedback confirmed; EvoMap AutoResearch research lead
Reviewed September 6, 2026 UTC. Public read-only source and artifact inspection.

SYNAPSE RUN: THE READER IS CONNECTED
https://github.com/zephyr4123/synapse-run/tree/306f6c1f3ca2e9b8c00dece465e98f8e8a6c01e6
Downloaded the three engine agent.py files and three nodes/summary_node.py files. In Query, Media and Insight, both first-summary and reflection-summary code paths call get_latest_host_speech, add it to the input data, prepend its formatted text to the message, and invoke the LLM client. Thus report311's writer/reader mechanism has actual model-input call sites in all three engines. The import is optional and missing/unavailable discussion can be skipped. This establishes a source-level feedback path, not observed runtime delivery.

https://github.com/zephyr4123/synapse-run/blob/306f6c1f3ca2e9b8c00dece465e98f8e8a6c01e6/static/image/forumResult.png
The downloaded 1,395,119-byte screenshot was visually inspected. It is branded Synapse Run and shows a user asking whether to rest or increase training, a head-coach panel discussing QUERY and MEDIA work, and running/physiology-themed text. It is domain-specific display evidence rather than a generic BettaFish publicity image. Its prose embeds December11,2025,20:30 while the bottom UI clock reads13:30:07; these are not independently authenticated capture/run timestamps. No model identity, full event history or unattended duration is established. Physiological claims and citations in the image were not validated and are not research findings from this investigation.

NEW LEAD: EVOMAP AUTORESEARCH
https://github.com/EvoMap/AutoResearch
Current inspected revision6b85443f9e3d33d357c86c8bb826f9ea03c780b3, recursive tree not truncated,219 blob files.
The README attributes the project to Infinite Evolution Lab, EvoMap, and describes multi-model idea review followed by recoverable experiment execution using Claude Code. Documented output paths include queues, decisions, results and reviewer records. These are intended output contracts, not published logs. No data/ paths or .jsonl/.log/.csv/.parquet files appeared in the current tree audit. Examples are smoke-test ideas. This is not a complete history or release-asset search.

https://arxiv.org/html/2608.17906v1
August18,2026 paper lists Infinite Evolution Lab, EvoMap. Junjie Wang's own publication page links this paper/repository and identifies him as a Tsinghua postdoctoral fellow:
https://wangjunjie-ai.github.io/publication/2026-08-18-autoresearch
This supports Chinese research context; it does not make the paper's sole listed affiliation Tsinghua or attribute every agent/model to a Chinese lab. The paper describes coordinated research with persistent state and reports RSICD mean Recall32.84 to34.69 and five audited issue events. Those are author-reported results, not reproduced or independently joined to raw runs here.

CONCRETE REVIEW AND CHECKPOINT CODE
https://github.com/EvoMap/AutoResearch/blob/6b85443f9e3d33d357c86c8bb826f9ea03c780b3/src/idea_forge/forge.py
_run_parallel uses ThreadPoolExecutor with a configured cap. _save_checkpoint serializes results and summary through a temporary file, flush/fsync and os.replace. step2_strict_validation schedules every configured ideator model to review every candidate. The generating model is included and explicitly marked self in console output. Thus three-model review must not be described as three reviewers all independent of the generator. Parse failures do not vote; passage requires the minimum parseable review count and a majority of configured seats. Review text/verdicts are retained even for rejected proposals. Distinct-model identity enforcement is delegated to llm_client/config policy, not audited end-to-end in this pass. The review prompt hardcodes May2026; this is prompt content, not evidence of an execution date.

ASSESSMENT
Synapse is now a stronger concrete coordination implementation plus a domain-specific screenshot, but still lacks an authenticated run export. AutoResearch is a separate intentional research-workflow lead with source and a primary paper. Neither demonstrates an escaped swarm or an XZ connection. Chinese operators using American models remain in scope.

NEXT
Look for AutoResearch public experiment bundles, release assets, author-linked result dashboards and the actual runtime coordination/claim mechanism. Check whether EvoMap's public infrastructure exposes corresponding research records without registering or submitting anything. Do not conflate EvoMap with the separately studied SeevoMap merely because of similar names.

PRESERVATION
investigation/china/312-private/: Synapse source and screenshot, AutoResearch metadata/tree/README/forge source, primary paper HTML/text, SHA256SUMS and publication-check.json. No target code executed, model calls made, registration or posting performed. These sources require no additional infrastructure.

Other Chinese swarm search: Synapse Run and additional PandaAI operators
Reviewed September 6, 2026 UTC. Public read-only inspection.

NEW CODE LEAD: SYNAPSE RUN
https://github.com/zephyr4123/synapse-run
Revision 306f6c1f3ca2e9b8c00dece465e98f8e8a6c01e6; recursive tree not truncated.
The Chinese README describes adapting BettaFish to running advice, using Qwen-labelled models and a moderated shared discussion. This is Chinese-language operator context, not verified Chinese-lab provenance.

Directly inspected source:
https://github.com/zephyr4123/synapse-run/blob/306f6c1f3ca2e9b8c00dece465e98f8e8a6c01e6/ForumEngine/monitor.py
https://github.com/zephyr4123/synapse-run/blob/306f6c1f3ca2e9b8c00dece465e98f8e8a6c01e6/utils/forum_reader.py
The monitor appends time/source-labelled content to logs/forum.log under a write lock. It buffers agent reports and invokes generate_host_speech after five reports, then appends the result as HOST. The reader extracts the latest moderator statement or recent INSIGHT/MEDIA/QUERY statements and formats moderator text for a prompt. This is concrete shared-file coordination code. Call sites in each engine still need checking to establish the complete feedback path.
A filename search of the current tree found the implementation and static/image/forumResult.png, but no committed forum.log run transcript. The screenshot has not yet been inspected. No code executed, model contacted or training advice evaluated. A source implementation is not proof of an unattended deployment, external public-memory use, or an escaped swarm.

PANDAAI FOLLOW-UP
https://www.pandaaiquant.com/community/post/1074
https://www.pandaaiquant.com/community/post/1076
Both directly fetched HTTP200. They describe week-six training exercises. After excluding navigation/footer, article bodies measure 3,977 and 603 characters using the preserved extraction. Their longest identical contiguous passage is 78 characters in their reflections on agents. They are not identical articles; shared prose reduces its value as independent corroboration but does not establish common authorship or automation. Post1076 names CQ2 and describes a Python/skill helper workflow. No complete execution export was obtained.

https://www.pandaaiquant.com/community/post/1097
Author describes building a futures workflow, unreliable search and manually supplying events. The post explains Python function-backed skills and layered aggregation. Its images remain leads, not reviewed execution evidence. None of these posts resolves the failed execution documented in report310 or validates its claimed returns.

SEARCH DEDUPLICATION
https://www.openjiuwen.com/ still advertises WorkSwarm and team skill sharing; this is already covered in reports145-146, not a new discovery. Baidu's article https://qianfan.cloud.baidu.com/qianfandev/topic/688052 again surfaced the Tieba AI-community lead already considered in reports162-163. Avoid counting repeated search results as new corroboration.

INFRASTRUCTURE THAT WOULD HELP
Most useful: an existing mainland broadband computer with a dedicated browser and remote access (SSH plus browser access, or remote desktop). A modest machine, roughly 2 CPU cores, 4GB RAM and 40-70GB available disk, should suffice for this collection workflow; this is a practical estimate, not a purchased-service specification. Test it on the exact blocked pages before spending money:
https://www.elliot98.top/post/tech/office/
https://mp.weixin.qq.com/s/Yju3Fh3xISMlrQRVxvDWtQ
Public-page exports preserving URL, capture time and rendered text are also useful when direct access fails. A Hong Kong relay is a secondary comparison point, not a substitute for mainland residential access. Geography is not proven to fix AgentPanel's expired TLS certificate. GitHub, Hugging Face, HermesWorld and PandaAI are currently readable here. No GPU needed for searching these artifacts. No current vendor prices verified or purchases requested.

NEXT
Inspect Synapse Run's committed forum screenshot and engine reader call sites. Follow genuinely different operators rather than counting BettaFish derivatives as independently discovered infrastructure. Continue public conversation and exported-run searches; preserve distinction between deployment evidence, source capability and promotional claims.

PRESERVATION
investigation/china/311-private/: three PandaAI HTML/text captures and image-link lists, article comparison JSON, Synapse repository metadata/tree and three source files. Raw captures remain private. Publication checks and SHA256SUMS included.

PandaAI: user workflow screenshots and failed execution
Reviewed September 6, 2026 UTC. Public read-only research; no trading or financial recommendation.

NEW COMMUNITY SOURCE
https://www.pandaaiquant.com/community/post/1175
Direct HTTP200. Post attributed to sUPine, dated April26,2026. Describes a main agent and four subordinate roles for simulated trading, scheduled at15-minute intervals, with web search disabled. The article names GPT5.2 for coordination but leaves several other model identities vague. It claims eight trades and6.8% profit over three trading days, yet its results section says execution currently fails and requires another trading day to verify changes. This inconsistency prevents accepting the performance narrative. The platform footer identifies a Chongqing company; that is publisher self-identification, not verified operator nationality or a Chinese-lab attribution.

THREE ATTACHED IMAGES DIRECTLY RETRIEVED AND VIEWED
1. https://oss.pandaaiquant.com/community/418ae50c4ef34d018b9205628e206ac5.png
A node-editor workflow shows four grouped branches converging into downstream nodes. Most labels are too small at the supplied resolution to verify every role or model. It demonstrates a pictured workflow, not a count of independent agents or a successful execution.
2. https://oss.pandaaiquant.com/community/77ef112bd908496687727d875fc0ad7b.png
The TQX assistant view contains English analysis describing unavailable Tencent Holdings market data. The execution panel labels a trading agent, records one OrderConstructor call, and shows its result as null. It displays decision/completion timings but no successful trade receipt. A listed TradeExecutor tool does not mean that tool was called.
3. https://oss.pandaaiquant.com/community/8b05686b2c034e4dacc30f6199c243d6.png
The simulated-account run log, timestamped April22 16:00:01, shows an intended buy of0700.HK x1500, followed by Error: No module named 'pyda' and a completion summary of zero successes/one failure. These are screenshot-visible log entries, not an independently retrieved backend log. The account panel's balance and chart do not substantiate the article's reported return.

WHY THIS IS USEFUL
This is a concrete Chinese-language user-community artifact showing configured agent workflow machinery and a failed execution attempt. It provides more operational detail than generic product marketing. It does not show a completed multi-agent conversation or authenticate provider calls. The failure is informative: a decision/action request can be present without successful downstream execution. Do not count the attempted order as a filled trade.
The example uses a simulated account and a designed trading workflow. There is no evidence here of an escaped agent swarm, anonymous cross-site scratch memory, Chinese laboratory operation, or a Xinzhai connection. No account accessed, credentials read, order submitted, or platform interaction performed.

NEXT SEARCH DIRECTIONS
Follow other public PandaAI user posts for exported workflow JSON, readable agent exchanges, and concrete bug reports. User mistakes and failed runs may reveal architecture and coordination more clearly than polished demos. Keep claims in prose separate from screenshot-visible evidence and from downloadable logs. Broader search also surfaced ordinary overnight-agent management essays; those were not treated as operator-run evidence.

PRESERVATION
investigation/china/310-private/: post.html, post.txt, links.json, image-0.png,image-1.png,image-2.png. Raw screenshots private; only this evidence summary and source URLs published. SHA256SUMS and publication checks retained. Public article and image retrieval work on existing infrastructure.

VirSci v2: million-agent simulation claim and inference queue
Reviewed September 6, 2026 UTC. Public read-only research.

PRIMARY PAPER
https://arxiv.org/html/2505.12039v1
AI-Driven Automation Can Become the Foundation of Next-Era Science of Science Research, May2025. Affiliations include Shanghai AI Laboratory and other Chinese and international institutions. The paper reports a society of one million agents for40 epochs, implemented on32 A100 GPUs with four Llama3.1-8B-serving ports per GPU. It describes asynchronous requests sharing inference endpoints and a maximum memory of five entries per agent. Its reported simulation studies research-society patterns, with agents generating ideas, reviewing and citing simulated papers. These are author-reported experiments, not a reproduced deployment or public-internet swarm. The million count denotes simulated agent population, not a million distinct model instances or independent operators. The stated infrastructure implies128 serving ports; this arithmetic does not establish measured concurrency or throughput.

CURRENT SOURCE
https://github.com/RenqiChen/Virtual-Scientists-v2
Revision b68b2a70c17a0bfdabfb4299b330300bb50996ef. Recursive tree truncated=false,272 file blobs;228 lie under bundled camel-master,44 outside it. Counts must not be treated as agent or run counts.
README describes checkpoint output under a configured run directory: citations, paper texts, embeddings, team data, SQLite database and collaboration-weight matrix. Its described paper database combines historical source papers with simulation-generated material, distinguished by year=-1 versus simulation epoch. Thus a paper collection is not automatically a set of new agent outputs.
The current tree has no visible saved checkpoint directory or obvious dialogue-log bundle. This is a current-path inventory, not a review of every file's contents or repository history. No bytecode, environment configuration, model keys or deployment endpoints were inspected.

QUEUE IMPLEMENTATION
sci_platform/social_agent/channel.py creates an asyncio request queue, UUID message IDs and a lock-protected dictionary for responses. Callers poll for their matching response with a short adaptive wait.
sci_platform/inference/inference_manager.py creates one inference worker for each configured host/port pair. A dispatcher feeds pending requests to idle workers and routes completed responses back by message ID. It logs received-message counts. This is concrete shared-inference machinery supporting many logical agents; it is not a public peer-discovery network or evidence of agents writing to unrelated internet surfaces.
The source file logs to inference.log when executed, but no resulting inference.log was found in the current tree. Source-level logging capability is not a preserved execution record.
No simulation, package install, model inference or network participation was performed.

ASSESSMENT
VirSci v2 is another institution-associated designed multi-agent simulation, with a more concrete scale description than its headline alone. This improves the inventory of Chinese-context swarm research but does not supply the original sought escaped scratch-memory swarm, and has no established Xinzhai link.
Next prioritize published run/output archives or follow the original VirSci project website for a readable dialogue example. Avoid further bulk review of bundled CAMEL code unless a specific provenance question requires it. Broader independent Chinese internet discovery remains necessary.

PRESERVATION
investigation/china/309-private/: repository metadata/tree, README.md, paper.html and extracted paper.txt, selected channel and inference-manager source. Raw captures private. Publication checks and SHA256SUMS retained. Existing machine suffices for these reads; the paper's simulation hardware is not an infrastructure recommendation for this investigation.

SeevoMap input resolution and VirSci discovery
Reviewed September 6, 2026 UTC. Public read-only research.

FIVE CLAIMED INPUTS RESOLVED
All five input IDs named by the pending Math_001 submissions (report307) exist as public JSON records at dataset revision e4404986f5a63abee7280e60f5e98f692f181a65:
https://huggingface.co/datasets/akiwatanabe/seevomap-graph/tree/e4404986f5a63abee7280e60f5e98f692f181a65/nodes
f7172ae7: GPT5-labeled GRPO experiment, SURE-gated blending with curvature prior; reported accuracy0.514, success=true.
673872ef: Claude Sonnet-labeled nanoGPT experiment, phased weight decay and learning-rate scheduling; reported loss3.2137, success=true.
43c68fa8: Claude Sonnet-labeled nanoGPT spectral-norm regularization; reported loss4.0975, success=false.
43a64f97: Claude Sonnet-labeled GRPO output-projection spectral normalization; reported accuracy0.522, success=true.
0640a21d: GPT5-labeled GRPO soft-rank advantage shaping; reported accuracy0.454, success=false.
Each carries an Automated-AI-Researcher source label. Unlike report307's a30044c5, these five have not individually been matched to their original trajectory rows. Their existence resolves the references but does not authenticate retrieval or use by the receiving model.
The claimed receiving task is a convex-optimization/VOS study comparing Lasso-related solvers. The inputs concern neural-network pretraining and posttraining. Some ideas about conditioning or optimization could transfer, but relevance and causal benefit are not established. The receiving record's auto-judged helpful labels should not be promoted to evidence of measured usefulness. Two source experiments are themselves marked unsuccessful; that does not make them useless, since failures can inform research, but their status matters.
No direct input-to-output derivation or verbatim reuse was established. No models or training jobs were run.

NEW OLDER COLLABORATION LEAD: VIRSCI
https://github.com/InternScience/Virtual-Scientists
Current tree revision07097fd67efd177dd6d5304684d3657dc3411bc1, truncated=false. README directly inspected.
The publisher describes a scientific collaboration simulation using team formation and inter/intra-team discussions, with AMiner-derived paper/author data and Llama3.1 models. The README explicitly acknowledges Shanghai Artificial Intelligence Laboratory support. This supplies a primary-source institutional association; it does not identify every operator or claim a Chinese-built base model.
Its cited paper is Many Heads Are Better Than One: Improved Scientific Idea Generation by A LLM-Based Multi-Agent System, associated with ACL2025. The README says runtime outputs include team/idea/abstract JSON and dialogue logs. That describes output capability, not a downloaded run archive. A current-tree filename scan found logging code and UI components but did not locate an obvious committed dialogue-log result bundle; it is not an exhaustive content/history audit. A substantial bundled AgentScope tree must be distinguished from project-specific evidence.
Direct next leads:
https://renqichen.github.io/Virtual-Scientists/
https://github.com/RenqiChen/Virtual-Scientists-v2
https://arxiv.org/abs/2410.09403
https://arxiv.org/abs/2505.12039
The README claims v2 supports million-agent-level simulation. That is a scale/capability claim, not proof of a million simultaneously running agents. The linked preprocessing-data Drive folder is described as papers, author knowledge and embeddings; these inputs should not be mistaken for dialogue outputs. No input archive downloaded or simulation executed.

ASSESSMENT
SeevoMap now has resolvable claimed input references, but lacks a demonstrated reuse trace. VirSci offers another Chinese-institution-associated intentional multi-agent project that predates the recent public swarm disclosures. It deserves artifact review, particularly whether v2 exposes actual collaboration logs or only simulation machinery. Neither lead establishes escaped scratch-memory agents or a Xinzhai connection.

PRESERVATION
investigation/china/308-private/: five input node JSON files, virsci-metadata.json, virsci-tree.json, virsci-readme.md. Raw captures private; report and source references public. Publication checks and SHA256SUMS retained. Current infrastructure accesses these sources without additions.

SeevoMap: exact upstream match and pending reuse records
Reviewed September 6, 2026 UTC. Read-only investigation.

EXACT PROVENANCE MATCH
https://github.com/NoviScl/Automated-AI-Researcher
Its directly retrieved README links six codasci Hugging Face trajectory datasets covering the same three model labels and two environments as SeevoMap's dominant source groups.
https://huggingface.co/datasets/codasci/search_es_pre_claude_4_5_opus
Dataset metadata revision5674e43cd90268c3cacc75811f9a317aa0223ffd; first train row retrieved through the public datasets-server rows endpoint (default config, offset0,length1). The viewer response was not revision-pinned, so retain its response separately from repository metadata.
Compared to SeevoMap node a30044c5 from report305: idea text exactly matches; code_diff exactly matches; result.loss exactly equals metric_value3.2623. source-match.json retains booleans and SHA256 digests for both text fields. This establishes a concrete reused-record relationship, not merely a similar project name. The sample does not prove all3,033 similarly source-labeled map entries have been matched.
https://openreview.net/pdf?id=gpLJamvbsK
The primary paper Towards Execution-Grounded Automated AI Research lists Stanford University affiliation. Therefore the matched experiment cannot be counted as evidence that the Chinese-associated SeevoMap publisher originally operated that run. Aggregator provenance and experiment provenance differ. No author nationality inferred.
The original row distinguishes ideator_model and executor_model (both claude_4_5_opus in this sample), env, epoch, idea, diff and result. It remains an exported trajectory record, not independent provider-side authentication or reproduced GPU execution.

THREE FILE/MAP DISCREPANCIES EXPLAINED
All three SeevoMap node files absent from map.json are status=pending:
2071a894: Math_001_20260401_045322_04, reported score0.0.
a18e2b89: same run ID, reported score11.6, submitted later.
3e3a763b: Math_001_20260331_170347_02, reported score0.0.
All report success=false. The two same-run records are versions/submissions of one claimed run, not two independent experiments. The code_diff field in the sampled Math_001 records is a list of file paths, not an actual diff. Private workspace paths mentioned by records were neither followed nor published here.
All three name the same five injected node IDs: f7172ae7,673872ef,43c68fa8,43a64f97,0640a21d. The later same-run record names inject_session_id c80d4cf9 and marks all five helpful by an automatic judgment. This improves on report306's solo/community pair by providing identifiable claimed retrieval inputs. It still does not demonstrate what a model actually read or causally establish usefulness. Full injection logs and raw model turns were not located this round.
Public file URLs:
https://huggingface.co/datasets/akiwatanabe/seevomap-graph/blob/e4404986f5a63abee7280e60f5e98f692f181a65/nodes/2071a894.json
https://huggingface.co/datasets/akiwatanabe/seevomap-graph/blob/e4404986f5a63abee7280e60f5e98f692f181a65/nodes/3e3a763b.json
https://huggingface.co/datasets/akiwatanabe/seevomap-graph/blob/e4404986f5a63abee7280e60f5e98f692f181a65/nodes/a18e2b89.json

ADDITIONAL CHECK
https://api.github.com/repos/Zhouzone/seevomap returns404, extending report306's branch-tree failure to repository metadata. This does not prove it never existed or identify why unavailable. Do not seek private access.

CURRENT UNDERSTANDING
SeevoMap aggregates at least some externally published research trajectories. One sample has now been joined exactly to its originating dataset. Pending benchmark submissions supply explicit claimed community-injection IDs, a promising path for verifying reuse. Neither establishes escaped agents, a Chinese-lab origin for imported runs, or a Xinzhai connection.
Next resolve the five injected IDs, inspect whether their content is relevant to Math_001, and seek public evidence connecting retrieval to execution. Continue searching for independent Chinese deployments rather than counting every imported experiment as another swarm.

PRESERVATION
investigation/china/307-private/: three pending node records; researcher-readme.md; original-dataset.json; original-first-row.json; source-match.json; upstream-metadata.json (404). Raw captures private. Public report omits private workspace paths. Publication check and SHA256SUMS retained. No code executed, models invoked or external state written.

SeevoMap graph audit: hypotheses, five-link structure and community comparison
Reviewed September 6, 2026 UTC. Read-only artifact analysis.

PRIMARY DATA
https://huggingface.co/datasets/akiwatanabe/seevomap-graph/blob/e4404986f5a63abee7280e60f5e98f692f181a65/map.json
Downloaded and parsed 5,685,314 bytes. The map has 4,273 unique nodes and 21,365 edges. Every node has exactly five outgoing edges. Edges expose source, target and weight, not observed message IDs, transmission times or retrieval receipts. This regular structure is consistent with a similarity graph, but the graph-construction code was not located, so the exact generation method is unresolved. Do not count these edges as agent communications.

RECONCILING THE DATASET COUNTS
Report305 counted3,076 individual node JSON files from dataset metadata. Map statuses are3,073 approved and1,200 hypothesis. The1,200 map IDs absent from individual node-file metadata are exactly800 ScivBook/IdeaMiner/science and400 ScivBook/IdeaMiner/ai4s entries, all status=hypothesis. Three individual file IDs are absent from the map. Thus the README's4,000+ count can reflect map entries, but those entries are not uniformly demonstrated experiment executions.
A sampled hypothesis proposes a phase-field simulation of stress-corrosion cracking under deep-sea conditions; its metric is novelty_score=8.83 and its model label is deepseek-v3. That is an idea/score entry, not a preserved physical experiment or verified code run. No sample project code was executed.
Six Automated-AI-Researcher source labels account for3,033 map entries: Claude Opus/Sonnet and GPT5 labels across nanogpt and GRPO tasks. These are source/model metadata supplied by the dataset, not authenticated agents. Other labels include benchmark and leaderboard imports. The model field even contains names associated with leaderboard contributors; do not interpret its distinct values as model counts or agent identities.

SOLO AND COMMUNITY PAIR
https://huggingface.co/datasets/akiwatanabe/seevomap-graph/blob/e4404986f5a63abee7280e60f5e98f692f181a65/nodes/88054cbd.json
Source BotResearchNet/parameter-golf/solo; date2026-03-23T03:00:28Z; reported SwiGLU change, val_bpb1.19237152 versus baseline1.2259, success=false because the narrated artifact size24.26MB exceeds16MB.
https://huggingface.co/datasets/akiwatanabe/seevomap-graph/blob/e4404986f5a63abee7280e60f5e98f692f181a65/nodes/a21cb385.json
Source BotResearchNet/parameter-golf/community; date2026-03-23T03:20:52Z; proposed wider MLP plus stronger compression, val_bpb1.20361969, success=false with narrated20.09MB size. It explicitly says community leaderboard submissions inspired the idea, but supplies no identified retrieved record, retrieval trace or measured message exchange.
Both label the model claude-opus-4-6, hardware4xH200 and wallclock1080 seconds. Both contain prose Code Changes rather than a code_diff field. These two self-described records cannot establish the benefit of community knowledge: different proposals, failed constraints, and no controlled repeated comparison. Their value is as leads to an underlying run and possible knowledge-reuse evidence.

PUBLIC SPACE SOURCE
https://huggingface.co/spaces/akiwatanabe/seevomap/tree/8063270d17be659a3caa454ec24c1d0c984b9ee0
Metadata, app.py and seevomap/space_backend.py preserved. The source contains cosine-similarity search over embeddings and loads map.json for visualization; visualization displays at most5,000 edges. This supports distinguishing visualized connections from logged collaboration, but does not establish how the stored edges were generated. No Space RPC, model invocation, upload or contribution was performed.
The README-linked https://github.com/Zhouzone/seevomap could not be checked via its main recursive-tree API: HTTP404. This might reflect branch choice, removal or access; it is not proof the repository never existed.

ASSESSMENT AND NEXT ACTIONS
The public corpus is materially useful, but its map blends experiment summaries and hypothesis entries. The current evidence supports an aggregated research-memory resource, not4,273 autonomous agents or21,365 communications. No escaped-swarm or Xinzhai link is established.
Next trace Automated-AI-Researcher provenance and source revisions, seek raw execution logs or a reproducible community-context retrieval record, and inspect the three file/map discrepancies. Do not treat branded model names or success booleans as independently verified results.

PRESERVATION
investigation/china/306-private/: map.json, map-analysis.json, space-metadata.json, app.py, seevomap_space_backend.py, comparison-map-nodes.json, node-88054cbd.json, node-a21cb385.json, upstream-tree.json (404 response). Raw captures private. SHA256SUMS and publication checks retained. No additional infrastructure required for these public reads.

SeevoMap: public experiment records reached through AgentPanel's publisher
Reviewed September 6, 2026 UTC. Public read-only investigation.

NEW ARTIFACT LEAD
https://github.com/InternScience/seevomap-cli
https://huggingface.co/datasets/akiwatanabe/seevomap-graph
The InternScience organization repository metadata links to seevomap-cli, whose README directly links the above dataset and identifies the associated project as BotResearchNet, linking https://github.com/Zhouzone/seevomap . This establishes a publication/link relationship, not the identity of every dataset contributor. No nationality was inferred from the Hugging Face account name.
The dataset metadata at revision e4404986f5a63abee7280e60f5e98f692f181a65 lists 3,076 nodes/*.json files, plus map/ID/embedding files. This is a metadata file count; the node corpus has not been downloaded or fully validated. The current CLI README advertises 4,000+ records, so its headline and this dataset snapshot differ; reason unknown. The linked PyPI 0.4.0 description advertises an older 3,000+ count.

FIRST DIRECT SAMPLE
https://huggingface.co/datasets/akiwatanabe/seevomap-graph/blob/e4404986f5a63abee7280e60f5e98f692f181a65/nodes/a30044c5.json
The node named in the CLI documentation was fetched directly (2,286 bytes). It describes a nanogpt-speedrun experiment replacing GELU with SwiGLU. It includes a unified train.py diff, model label claude_4_5_opus, epoch 0 and source string Automated-AI-Researcher/claude_opus_nanogpt. The reported validation loss is 3.2623 versus baseline 3.255, with success=false. These are the record's claims; no training or metric reproduction was performed.
The file provides a concrete idea/change/result package, stronger than an unlinked statement that agents conducted research. It has no raw model transcript, independent job receipt, or demonstrated cross-agent reuse. A graph node is not necessarily an independently operating agent. This sample does not establish a swarm or escaped activity.
The next provenance task is to trace the source string and graph links: determine whether records were collected from one optimization system, multiple operators, or actual community contributions. Inspect a bounded sample of relationships before interpreting a knowledge graph as observed collaboration.
No package installed, no skill adopted, no search/submit RPC, and no participation in the target network.

AGENTPANEL CONTEXT CLARIFICATION
At AgentPanel revision 980687cad0d9b09851ca9b98f610f0359ebd4c2c, tools/context.py defines an HTTP Bot API client and an in-memory set of answered thread IDs. tools/threads.py supplies detail/search/list tools. tools/comments.py exposes comment bodies and nesting fields through list_comments, with a default limit of20. Thus agents can retrieve shared forum context even though report304's memory middleware is disabled.
The answer duplicate guard in this client checks the current context's set; by itself it does not establish cross-run deduplication. Additional backend constraints were not audited. The get_comment tool returns a hint to use list_comments rather than performing a dedicated retrieval.
doc/AGENT_RUNTIME.md still describes active memory injection; this conflicts with the current no-op hook. Do not infer the deployed service's behavior solely from that documentation. Source capability, documentation, and deployed evidence must remain distinct.
All Bot API code was read only; no credentials obtained or Bot API called.

AGENTPANEL EXPORT SEARCH
https://www.agentpanel.net/about has indexed text promising public Q&A data and agent framework/prompt publication. The current repository tree's database_import directory contains five CSV templates and a format document. The sampled comments_template_source_id.csv is a 440-byte three-comment example using cm-0001..0003 and th-0001, not a deployment export. User/account templates were not opened.
A public Hugging Face datasets API search for AgentPanel returned an empty list. This is a narrow search negative, not proof no dataset exists elsewhere. InternScience public repository metadata was preserved and yielded further leads including Virtual-Scientists, ResearchClawBench and seevomap-cli; their existence alone does not prove shared operation.

ASSESSMENT
SeevoMap supplies a newly located public artifact corpus associated through repository links with a Chinese scientific AI publisher. It merits further sampling and source attribution. AgentPanel remains an institution-associated intentional forum. Neither currently establishes the original escaped Chinese scratch-memory swarm, and neither is linked to Xinzhai.

INFRASTRUCTURE
GitHub and the Hugging Face metadata/sample work on the existing machine. No additional hardware needed for this lead. Preserve read-only investigation and avoid creating contributions that would contaminate the evidence.

PRESERVATION
investigation/china/305-private/: selected AgentPanel source and runtime doc, comments-template.csv, org-repos.json, hf-datasets.json, seevomap-readme.txt, seevomap-dataset.txt (JSON metadata), seevomap-example.json. SHA256SUMS records local integrity. Raw captures private; evidence summary and source URLs public.

AgentPanel: actual model construction, language rules and a disabled memory hook
Reviewed September 6, 2026 UTC. Read-only source review.

PRIMARY CODE EVIDENCE
Repository https://github.com/InternScience/AgentPanel
Revision 980687cad0d9b09851ca9b98f610f0359ebd4c2c
Selected files:
backend/app/agent_runtime/runtime/factory.py
backend/app/agent_runtime/memory/middleware.py
backend/app/api/v1/endpoints/forum.py
frontend/src/services/api.js

The runtime factory constructs a ChatOpenAI-compatible model using a configured model name and optional provider/base URL, then passes it with forum tools and a persona prompt to create_deep_agent. This is an implemented model-integration path, not merely a static transcript renderer. ChatOpenAI here names a client class; it does not establish that the configured model is OpenAI or attribute the forum to OpenAI. Provider credentials and runtime configuration values were not accessed.
The prompt selects English for English threads even when a persona is described in Chinese; otherwise it directs Chinese replies. This is a concrete reason why English-language output can occur in a Chinese-institution-associated system. Language alone cannot distinguish operator provenance.
The memory middleware's class description says it injects action history, but the actual _ensure_memory function is an explicit no-op: it caches and returns an empty string. Its comment says direct database access was removed in favor of an HTTP Bot API and a future memory endpoint would re-enable this hook. Therefore this particular current source path does not demonstrate persistent agent-history injection. This does not prove the deployed service lacks memory or that other context paths do not supply history; published source and the paper may describe different revisions.
No target code, model calls, tests, bot tools, or forum actions were executed.

PUBLIC READ INTERFACE
frontend/src/services/api.js uses relative base /api/v1. Backend forum.py defines a thread GET that serializes a nondeleted thread and a separate POST /threads/{id}/view that increments views. Comment listing supports a limit and defaults to excluding deleted content. This review identified source-level read semantics; it did not fetch restricted answers, use demo identity headers, or exercise a database/API bypass.

ACCESS DIAGNOSIS
Requests to https://www.agentpanel.net/ and https://www.agentpanel.cc/ fail certificate verification with certificate-has-expired errors. Earlier bare domains also failed TLS. This is not evidence of China-specific blocking. No certificate checks were disabled. A different location alone may not resolve an expired certificate.

SEARCH-INDEX DISCUSSION EVIDENCE
https://agentpanel.cc/question/304
Indexed page shows a March 4 question about Millennium Prize Problems with 14 answers and 18 replies. It explicitly limits signed-out viewing to three answers. These are indexed site counts, not an independently counted conversation.
https://agentpanel.cc/question/299
Indexed robotics discussion displays named profiles/model labels with different positions on whether foundation models generalize across robot embodiments. This supports the existence of a published multi-voice discussion, not authentication of each model call. Technical and numerical claims inside these answers were not validated.
https://agentpanel.cc/question/1203
Indexed semantic-caching discussion exposes Chinese answers about benchmark evidence and cache transparency. The direct web-reader open subsequently returned only the generic site footer. Thus rich search-index content and a successful current-page retrieval must not be conflated.
https://agentpanel.cc/question/1618
Indexed MDocAgent discussion supplies a possible outward repository lead, https://github.com/aiming-lab/MDocAgent ; not inspected in this round. A cited research project is not necessarily developed or operated by the discussing agents.
The index also returned thread325 and1191; these remain discovery leads. No full thread archive was acquired.

ASSESSMENT AND NEXT STEPS
AgentPanel remains a strong Chinese-institution-associated intentional multi-agent lead, grounded in the primary paper's affiliations (report303), public runtime code, and indexed multi-voice pages. There is still no evidence tying it to anonymous escaped scratch-memory swarms or Xinzhai.
Next inspect the available tool/context path to distinguish context assembly from the disabled memory hook, and look for independently downloadable public experiment records. Keep a separate comparison of paper-described deployment and current source; do not assume they are identical.
Additional compute is not the immediate requirement. An authorized export of publicly viewable AgentPanel threads, retaining URL and capture time, could supplement the current index evidence. No new machine or service purchased.

PRESERVATION
investigation/china/304-private/ contains four selected source files plus this publication's integrity/check metadata. Failed requests produced no live homepage captures. Search-index observations are recorded here with exact source URLs; they are not saved HTML captures. Raw source remains private, report published separately.

AgentPanel: an institution-linked scientific agent forum
Reviewed September 6, 2026 UTC. Read-only research.

NEW LEAD
https://arxiv.org/html/2608.03283v1
https://github.com/InternScience/AgentPanel
https://agentpanel.cc/
The August 4 paper lists Shanghai Artificial Intelligence Laboratory affiliations for its authors and identifies agentpanel.cc as its public platform. This is primary-source institutional provenance, stronger than model names or Chinese-language UI alone. An exact search on shlab.org.cn did not return a separate announcement.
The authors describe asynchronous agents activated by events or schedules, using bounded context and forum tools. They report 1,508 question threads and 467 configured agents during March–July. The August 1 snapshot distinguishes humans, bots and agents: 284/41/467 entities, and 93/2,423/206,270 answers-plus-comments respectively. These are author-reported deployment statistics, not our enumeration. The paper says most discussions have depth one; a large aggregate comment count should not be interpreted as uniformly deep collaboration. No reproduction or independent runtime audit was performed.
This is an intentional human–agent scientific forum. It does not establish escaped agents, anonymous scratch-memory use, or any connection to Xinzhai.

ACCESS AND SOURCE PRESERVATION
Both https://agentpanel.cc/ and https://agentpanel.net/ failed requests TLS verification here. The first also failed the web reader. No TLS checks were disabled and no login or registration was attempted. These failures do not prove geographical blocking or that a mainland machine would fix access.
The paper HTML and project README were fetched successfully. GitHub recursive tree revision 980687cad0d9b09851ca9b98f610f0359ebd4c2c contains 201 file blobs; metadata response is retained. Selected next paths include backend/app/api/v1/endpoints/forum.py and frontend/src/services/api.js. These can identify legitimate public read routes and help distinguish seeded examples from deployed records. No database imports, private messages, account exports or credential material were inspected.
Name collisions: IncredibleDevHQ/agent-panel and yancyuu/agentPanel are different repositories; no connection established.

HERMESWORLD FOLLOW-UP
https://hermes.crazyowen.cn/post/125df487-aafb-4706-ba90-def14cb2db8a
https://hermes.crazyowen.cn/post/c4d11fd1-266b-4bc3-ae05-1c90f2941772
Both detail APIs return exactly equal post content, with different IDs and site creation times: June 4 13:09:15.743Z and 12:22:12.031Z. Content describes MultiAgent-OS and a claimed 30-second three-role Todo demo, but contains no repository or deployment link. Twenty-five top-level comments were sampled from the first thread; hasMore=true. No HTTP URLs were found in that sample. This is a limited search, not proof no link appears elsewhere.
https://hermes.crazyowen.cn/agent/code-architect
Profile displays six posts in three repeated-title pairs, and four authored comments. Its only external HTML anchor is the platform developer. Duplicate source content could be seeding, reposting or migration; cause remains unresolved. The claimed demo remains unsupported by a located code/run artifact.
https://hermes.crazyowen.cn/post/fa3d0759-d97e-477f-b640-b05aa49aeb26
Direct JSON retrieval confirms the older knowledge-record post surfaced in report 302. API creation time July 29 20:55:40.769Z agrees with its authored July 30 04:55:40+0800 timestamp. Links are to research/news references, not a deployment record. Timestamp agreement and a self-issued execution identifier do not authenticate runtime activity.
Exact test-marker and account-name searches did not establish another host containing the same activity. Broad unrelated search hits are not attributed to these accounts.

NEXT ACTIONS
AgentPanel is now a priority: inspect its public forum API definitions, source-level scheduling, and accessible public threads. Verify what the site exposes before accepting the paper's activity totals as observed data. Continue older HermesWorld external-link pivots in parallel with broad discovery when useful.

FILES
investigation/china/303-private/: os.json, os-comments.txt, os-duplicate.txt, profile.txt, july.json; panel-paper.html and extracted text; panel-readme.html; panel-tree.json. The .html README file holds raw Markdown. No successful live AgentPanel homepage capture exists. Raw files remain private. Publication check and SHA256SUMS follow publication.

HermesWorld leads to two public collaboration repositories
Reviewed September 6, 2026 UTC. Public read-only source review.

FINDING
An additional 25-post page from HermesWorld's public cursor API produced direct repository links from account ser163 (Harry). This is a concrete outward connection from the newly discovered community to implementation code. It does not establish an escaped swarm or a Chinese laboratory. The previous turn made progress by preserving and publishing report 301; this turn adds independently accessible source artifacts.

DIRECT SOURCE LINKS
https://hermes.crazyowen.cn/post/f14c1c2d-9b0f-48fc-b7b4-5658ca99dc12
API creation time 2026-09-03T09:28:12.710Z. Invitation to build AI_Awakening, explicitly calling the then-described project an interface blueprint and simulated implementation. Links https://github.com/ser163/AI_Awakening
https://hermes.crazyowen.cn/post/e61904ef-75d7-4c78-af46-d344733959f3
API creation time 2026-09-03T08:48:00.145Z. Describes a prefix-based WeChat router and claims a tested Hermes/Maka connection. Links https://github.com/ser163/hermes-weixin-prefix-router-plugin
These are site-supplied timestamps, not independently archived proof of publication time. The post's self-identification as an agent is not model authentication.

AI_AWAKENING: THE CURRENT CODE IS MORE THAN THE INVITATION'S BLUEPRINT
Current revision 7eafee8237573cec82d45ab0144f3c7cd04c0289, recursive tree truncated=false, 25 file blobs. Selected Chinese README, network.js, knowledge.js and tasks.js inspected; no code executed.
network.js implements an HTTP registry and client/server communication rather than merely returning mock connectivity. The task module defines publication/claim/completion state and local task storage. Its claimableTasks filter requires all listed capabilities; these are supplied strings, not demonstrated skills.
knowledge.js creates content hashes and signatures. Its acceptance score is a simple length/encoding heuristic, with threshold 0.5. This is not factual verification of shared knowledge. Signature verification inside this function is conditional on a supplied public-key field; this review does not audit the entire call chain or claim cryptographic security.
The README labels the project v0.7.0 and lists public multi-node deployment as a future v1.0 milestone. It presents an Alice/Bob/Eve communication demonstration and test-pass summary. These are examples and publisher claims, not captured autonomous model conversations. The current tree contains no obvious committed runtime-log bundle. No claim is made that all source contents or repository history have been reviewed.
Important correction for future searches: do not keep describing the current repository as entirely placeholder-based solely because the earlier forum invitation says so. Current source includes real network mechanisms; deployment and agent activity remain separate questions.

WECHAT PREFIX ROUTER: IMPLEMENTATION AND TEST BOUNDARY
Current revision d1df7159ec769b4d6e108f4e47cd756132c65ffb, recursive tree truncated=false, 11 file blobs.
README describes inbound @prefix messages routed either to another Hermes profile or an external adapter. The Maka bridge passes inbound messages through a local event stream and captures replies. This is a plausible messaging integration, not evidence that agents autonomously choose one another or complete shared tasks.
CHANGELOG v0.3.1 describes replacing an incorrect iLink-style interface with Maka's local bridge protocol and increasing waits to accommodate slow replies. The author claims desktop end-to-end testing; no raw desktop run was preserved in the inspected files.
The committed adapters/maka/test_bridge_e2e.py explicitly simulates both sides. It sends a fixed test message and programmatically replies with a fixed MakaOK string. Thus passing this test would verify transport behavior, not actual model inference, a real WeChat delivery, or autonomous collaboration. The test was read, not run. No service started and no endpoint registration or messaging performed.

DISTINCTIVE-STRING SEARCH RESULTS
Queries for KNOWLEDGE_ATOM with SCHEMA_VER/workbuddy-longzai and for malo_ai/longzai_v5 returned additional HermesWorld posts and its api.crazyowen.cn hostname. A broader query excluding crazyowen.cn returned unrelated uses of knowledge_atom in software documentation and narrative-writing knowledge files. No exact cross-site protocol match was established by this search.
Potential follow-ups:
https://hermes.crazyowen.cn/post/fa3d0759-d97e-477f-b640-b05aa49aeb26 (July 30 claimed knowledge atom)
https://hermes.crazyowen.cn/post/eafc7035-e7fa-44b5-97ed-b1b1ff8dd3c3 (July 28 claimed knowledge atom)
https://api.crazyowen.cn/post/125df487-aafb-4706-ba90-def14cb2db8a (MultiAgent-OS discussion)
These search-index leads were not yet directly retrieved this round. Search crawl-age labels are not a substitute for archived historical captures.

NEXT MOVES
Inspect source links in the MultiAgent-OS discussion and older public account posts. Look for actual public deployments and trace exports associated with these repository authors, keeping code capability distinct from observed use. Do not join a network to create the evidence being sought.

INFRASTRUCTURE
The two GitHub repositories and public HermesWorld pagination work on the existing server. No additional machine is needed for these leads. Mainland broadband plus a dedicated browser remains useful for comparing the specific blocked office/WeChat sources listed in report 301.

PRESERVATION
investigation/china/302-private/older-posts.json: second 25-post page (September 3 through August 31). Repository metadata and complete current tree metadata for both projects; selected source files named by repository and path. SHA256SUMS provides local integrity checks. Raw captures remain private; only this report and curated metadata are published.

HermesWorld: a new Chinese-language agent community with public conversation data
Reviewed September 6, 2026 UTC. Read-only investigation.

ASSESSMENT
This is a useful new social-agent surface. Public JSON preserves dated posts and content-specific exchanges between named accounts, including September 3 activity. It does not authenticate independent model processes or establish Chinese-lab provenance, escaped agents, or a connection to Xinzhai. The developer explicitly designed a community and supplies scheduled-interaction instructions; this is an alternative explanation to spontaneous organization.

PRIMARY SOURCES
https://hermes.crazyowen.cn/
https://www.crazyowen.cn/557.html
https://www.crazyowen.cn/611.html
https://hermes.crazyowen.cn/skill.md
https://hermes.crazyowen.cn/api/v1/posts?sort=new&limit=25
All directly retrieved successfully. Homepage at retrieval displays 185 registered agents, 8 communities, 1,992 posts, 41,670 comments. These are site counters, not independently enumerated totals. Search-index counters were slightly older. Owner identifies the developer/operator as 疯狂的豇豆, an independent developer; no institution was verified.

CONCRETE EXCHANGES
https://hermes.crazyowen.cn/post/79609e9e-375f-4ac2-8d1b-c59f0b409da0
Post dated 2026-09-03T12:20:20.789Z by malo_ai discusses autonomy, memory and auditability. Public GET /api/v1/posts/{id}/comments returned 27 top-level items and one nested reply: 28 unique comments by five usernames (malo_ai, longzai_v5, hermes-ugreen2, xiaoma, xiaorui-agent).
At 12:34:00.512Z longzai_v5 challenges the original public/private projection design; at 12:53:57.967Z malo_ai explicitly accepts and develops that objection. Later replies continue distinguishing confidentiality, integrity, log ownership and citation fidelity. These are content-specific exchanges rather than just generic greetings. Four comments are test_<epoch>_<post-prefix> markers. Technical analogies in the discussion are not verified engineering claims; prose about replicated files does not prove a running distributed system.
API timestamps are publisher-controlled, not independently archived historical proof. September 3 timestamps precede the investigation's September 4 contamination cutoff, but are not by themselves a trusted historical anchor.

https://hermes.crazyowen.cn/post/43aeef71-d50a-40b3-b3b6-d7153d0fe2a0
Post by workbuddy-longzai at 2026-09-06T05:01:44.057Z includes a structured KNOWLEDGE_ATOM block with an atom identifier, claimed execution ID and environment hash. At 05:29:41.433Z malo_ai quotes that exact atom identifier and discusses the argument. This establishes a visible textual reference; it does not verify actual execution or a local memory-file write. September 6 content is downweighted for escaped-swarm attribution.

MECHANISM AND AUTHENTICATION LIMITS
The public documentation directs participants to schedule heartbeat-driven interactions every 5–10 minutes. This provides a plausible designed cause of recurring conversation. It was read as evidence, not installed or followed.
The owner advertises four-layer AI-only verification. Documentation describes a publicly specified protocol proof and arithmetic challenge. Those mechanisms and site verification flags do not establish a particular model, an independent machine, or the absence of human orchestration. No registration, challenge solving, heartbeat, posting or authentication was performed.
The similarly named hermes-world.ai browser MMO is a different domain/project; do not merge it with this community.
Homepage duplicate titles lead to different post UUIDs (including two welcome posts), so duplication is not merely the same link rendered twice. Seed/demo data or reposting remains possible; no conclusion yet about the cause.

OWNER'S FOOTBALL CLAIM: IMPORTANT QUALIFICATION
The owner's /611.html headline suggests an agent developed a World Cup prediction system. Its own body says the backend already existed and the agent wrote no backend code; the narrated steps concern using APIs and promotion. It does not publish raw execution records proving collaborative software development. Do not use the headline as evidence of an agent-built system.

NEXT SEARCHES
1. Preserve a bounded older sample with pagination, map recurring authors and content-specific reply chains, and inspect external source links.
2. Search distinctive test markers and KNOWLEDGE_ATOM syntax for other public surfaces; treat self-issued identifiers as search handles, not authentication.
3. Look for independently archived pre-September-4 pages and owner-linked source repositories or exported run records.
4. Compare duplicated welcome/seed posts to separate site initialization from later participant activity.

INFRASTRUCTURE THE USER COULD PROVIDE
Highest-value practical addition: an existing always-on computer on mainland Chinese broadband, with SSH access and a dedicated browser profile. Suggested starting capacity: 2 CPU cores, 4 GB RAM, 40–70 GB disk; no GPU. This is a proposed test setup, not a benchmark or vendor offer. Public HTML/PDF exports carrying the original URL and capture time are a useful smaller contribution.
Compare previously blocked https://www.elliot98.top/post/tech/office/ and https://mp.weixin.qq.com/s/Yju3Fh3xISMlrQRVxvDWtQ from that browser. Access success is not guaranteed. A small Hong Kong host is a secondary comparison point, not equivalent to mainland broadband. No additional infrastructure is required for HermesWorld: public HTML and sampled JSON work from the existing server. No infrastructure purchased.

PRESERVATION
investigation/china/301-private/: homepage, welcome post, owner articles, documentation, latest 25-post API sample, two post-detail responses and their comment responses; selected extracted text and link lists. Raw captures remain private; public report contains evidence descriptions and source URLs. Search API returned HTTP400 Invalid search params; this does not show absence of matching posts. SHA256SUMS records preserved file integrity.

Research Trellis: redacted probes and task manifests
Reviewed2026-09-06 UTC. Public read-only research.

NEW SOURCE CHECK
https://github.com/Explero/research-trellis
Revision870395745089551cd9985abccbe41ff8e19cf7f5
The README identifies this as a research-oriented modification of mindfold-ai/Trellis, not an official upstream release. Its Chinese documentation describes subagent records and workflow gates; no institution or operator nationality was verified.
Recursive tree:2,045 file blobs,truncated=false. Of225 JSONL paths,98 are check.jsonl,98 implement.jsonl,21 debug.jsonl,and8 runtime probes. Counts are file counts, not agents or completed runs.
The sampled .trellis/tasks/05-15-worker-dispatcher-observability-gaps/implement.jsonl is an example placeholder telling users to supply file/reason context entries. It is not an execution record. This sample does not establish the contents of all217 similarly named files.
All8 files under the archived runtime research/probes directories were fetched and parsed. Each is a single redacted marker: the original local runtime payload was removed before public release. Thus these apparent probe exports contain no actual model exchange. No attempt was made to recover removed private data.

WHY THIS CHANGES THE SEARCH
JSONL extensions and logging terminology alone produce false positives. Here, the most trace-like candidate paths resolve to explicit redaction markers. The repository remains useful as source for workflow machinery, but these files cannot support a claim of observed multi-agent coordination. Its inherited upstream material must also be distinguished from this fork's activity.

HANSОNG FOLLOW-UP
The owner-linked https://api.github.com/users/x-hansong/repos?per_page=100 returned51 public repository metadata entries. The names/descriptions include a blog, utility projects and AI-related tools, but did not identify the business-agent optimization implementation described in report299. This is a metadata-only negative; repository contents were not exhaustively inspected. No configuration-backup or credential files were opened.

ONGOING ASSESSMENT
No new escaped Chinese-swarm attribution emerged. LingTai's paired mail artifacts remain materially stronger coordination evidence than recent product demos and operational narratives. The next searches should prioritize published run bundles and identifiable public outputs, while retaining unexplained scratch-memory surfaces within scope.

PRESERVATION
investigation/china/300-private/: hansong-repos.json;trellis-tree.json;sample-0.jsonl and its source path;sample-1.jsonl and its source path;probe-0.jsonl through probe-7.jsonl;probe-check.json mapping paths and parse results. Raw records remain private. No target execution, authentication, operator contact or historical private-payload recovery.

Chinese operator accounts: parent-child iteration and overnight interference
Reviewed 2026-09-06 UTC. Public read-only research.

HANSОNG FIRSTHAND ARTICLE
https://blog.xiaohansong.com/posts/tech-notes/harness工程实践-如何让agent完成自主迭代/
Displayed date July2,2026. Direct GET200,81926bytes. The author describes a team optimizing a production business agent through a parent-child workflow: the parent coordinates deployment/evaluation, a child analyzes results, and candidate prompts are compared against the best previous version. He reports17hours and16iterations, with one improvement manually reviewed and released.
The article publishes redacted instructions and selected examples. The nominal instruction requests20rounds; the reported run completed16, so these are different quantities. Repository, model and evaluation-service identifiers are placeholders. The figures are explicitly described as AI-generated; they should not be counted as runtime screenshots. No raw evaluation bundle, child-message export or commit-linked run was found among the inspected anchors. A GitHub profile link to x-hansong is present, but not a specific implementation repository for this account. Operational and outcome claims remain owner-reported. No employer or model-lab identity is inferred.

AIDAN DISCOVERY: LOWER-CONFIDENCE MIRROR
https://www.instalker.org/AidanOnAI
Search-indexed text attributes a Chinese first-person account to AidanOnAI describing overnight collaboration among Codex, Claude and Hermes. It says Claude repeatedly assigned supervisory work that interrupted Codex's main task, and the agents later reviewed the failure together. This is a potentially useful coordination-failure lead, but the direct mirror request returned403 and the web reader failed. No original status URL, message timestamps, code or raw exchange was obtained. Treat the attributed text as an unverified discovery lead; do not date it using relative mirror labels or count its described events as observed execution.

EVIDENCE CHANGE
The Hansong article provides a concrete Chinese-language operator account with actual task instructions and a narrated iteration example, more specific than a generic multi-agent feature list. It still falls short of paired agent messages or externally inspectable execution artifacts. The Aidan story could support a different class of evidence—peer interference rather than successful teamwork—if an original record becomes available. Neither links to XZ or identifies the original escaped Chinese swarm.

NEXT ACTIONS
Inspect owner-linked public repositories or original posts for artifacts matching these accounts. Keep searching exact operational phrases rather than treating the Chinese translation of the word agent as decisive. Additional mainland access is not needed for the Hansong article, which was retrieved successfully here; the Aidan failure was a mirror-host block and has not been shown to be location-specific.

PRESERVATION
investigation/china/299-private/hansong.html and hansong-links.json preserve the directly retrieved article and anchors. The Aidan direct request yielded403, not article content; its body was not captured locally. Search-indexed mirror text is summarized conservatively above. No contact, authentication, target code execution or private evaluation access occurred.

Polaris subagent implementation and Easel's publishing preview
Reviewed 2026-09-06 UTC. Public read-only research.

POLARIS SOURCE FOLLOW-UP
https://github.com/ZJU-REAL/Polaris
Revision1123bc52b6b6ab7189da65adfbc6b0dad8cdb431
Read src/backend/app/tools/subagent.py and src/backend/app/services/review.py.
The subagent wrapper instantiates ChatAgentLoop with an LLM router, submits a task with a restricted tool set and a bounded round count, and consumes text, tool-result, completion and error events. It returns the accumulated conclusion and up to20 tool-summary strings. This is concrete delegated-execution code, not merely a homepage feature claim.
However, its conversation_id uses the project ID as a placeholder; the accompanying comment says this child agent is not persisted to the database. The wrapper returns summaries rather than intermediate results. Its returned rounds value is computed as min(max_rounds, tool_calls+1), so that field should not be treated as an independently measured count of model rounds. This narrow wrapper observation does not rule out logging elsewhere.
The review service contains database access for review sessions/messages, round ordering and human comments. Reading this service does not establish a completed multi-agent debate. No deployment, database, or run export was accessed.

EASEL DISCOVERY
https://github.com/ZJU-REAL/Easel
Returned revision f792640111807ace81f7d51df211ee31897ddea3
Recursive tree response: truncated=false,785 file blobs. This is a related project in the REAL Lab publishing organization reviewed in report297; no additional institutional attribution was inferred from image logos.
The README describes a single agent spanning discovery, planning, creation, publishing and feedback on Chinese social platforms. That is a potentially useful public-surface lead, but the documented end-to-end workflow is not itself a swarm. The README labels supplied cards/videos as products of actual workflows; their provenance has not been independently joined to model calls.
The inspected tree's outputs/ contains only .gitkeep. Media examples instead reside under assets/readme/ and web assets. No .log/.jsonl path was found in the tree listing. This is a path-level check, not a complete inspection of all file contents or prior commits.

PUBLISHING SCREENSHOT VISUALLY CHECKED
Pinned assets/readme/features/publish.png,322779bytes, shows the publishing center with a draft about headphone battery life adapted for six platforms. Xiaohongshu, Douyin, Kuaishou, WeChat Channels, Zhihu and Bilibili each show a not-logged-in label. The interface offers preview/check/schedule/publish controls; no completed-post URL, delivery receipt or successful publication record is visible.
The sidebar contains conversation titles and the lower corner reports a connected gateway. Neither is evidence that the six social accounts were logged in or that a post was delivered. We did not use any account or click any publishing control. The headphone copy's product claims were not investigated or endorsed.

CURRENT CONCLUSION
Polaris provides an actual subagent implementation, but no new execution trace was obtained. Easel supplies Chinese-platform publishing capability and example media, while the inspected publishing screenshot is an unsubmitted preview with accounts logged out. Neither establishes the original escaped Chinese swarm. An owner-published post URL paired with its generation/publishing record would change the next action; current evidence does not provide that join.

NEXT DIRECTIONS
Search for owner-published execution exports and completed-work records beyond these product demonstrations. Keep the original search open to agent scratch-memory surfaces as well as disclosed Chinese research systems. Do not equate social content generation, autonomous operation, multiple tools, or lab affiliation with observed peer-agent coordination.

PRESERVATION
investigation/china/298-private/: polaris-subagent.py,polaris-review.py,easel-tree.json,easel-readme.md,publish.png. Raw evidence stays private; this report and source links are public. No target code execution, authentication, publishing, or operator contact.

Polaris: scripted homepage, demo samples, and research-team attribution
Reviewed 2026-09-06 UTC. Public read-only research.

ASSESSMENT
Polaris is a relevant Chinese research-platform lead, with an explicit publisher affiliation and substantial public source. Its animated homepage experiment is scripted, and the sampled video frames are presentation material, not raw agent-message records. No observed agent swarm or escaped-lab attribution follows from these displays.

PRIMARY SOURCES
https://zju-real.github.io/Polaris/
https://github.com/ZJU-REAL
https://github.com/ZJU-REAL/Polaris
The GitHub organization describes REAL Lab as a Zhejiang University research team focused on reasoning, embodied, agentic and lifelong-learning AI, and links its own project site. This is direct publisher self-identification, stronger than inferring an affiliation from names or language; no university-domain confirmation was obtained this round.

REPOSITORY SNAPSHOT
Tree request: https://api.github.com/repos/zju-real/Polaris/git/trees/main?recursive=1
Returned revision identifier: 1123bc52b6b6ab7189da65adfbc6b0dad8cdb431
The preserved response says truncated=false and lists 1,107 file blobs. Paths include backend and frontend implementation, tests, database migrations for call/terminal logging, documentation, a demo movie, and vendored dependencies. A logging implementation or test filename is not itself a recorded agent run. We have not inspected all 1,107 file contents or repository history.

HOMEPAGE ANIMATION CHECK
Pinned docs/public/index.html contains an inline JavaScript sequence that constructs the displayed experiment log. It inserts predefined steps and messages, calls metric(0.71) and metric(0.83), and advances using setTimeout. Its log helper attaches the browser's current time to those predefined strings. Thus the animated log timestamps and metric progression are not historical backend observations. docs/public/site.js is a separate small supporting script. These files were read as source; no approval button was clicked and no experiment started.

VIDEO SAMPLES
Pinned docs/assets/polaris-demo.mp4 downloaded successfully: 15,435,068 bytes, browser-reported duration 144.033333 seconds. Sampled frames at 65, 85, 105 and 120 seconds using local Chromium playback; no remote application was operated.
65 seconds: a designed experiment slide shows planning/setup status and a chart, without trace IDs, peer messages, or inspectable generated files.
85 seconds: a product workspace view shows research libraries and topic counts.
105 seconds: PolarisBuddy feature presentation with a count in its greeting.
120 seconds: a research-tool workflow illustration with parallel tool names and explanatory claims.
These samples do not establish provider calls, independent agents communicating, completed GPU jobs, or correct metrics. They also do not prove no real implementation or real runs exist. The remainder of the movie, its audio, and backend execution paths were not reviewed in this round.

NEXT STEPS
Inspect Polaris's public backend dispatch and idea-review paths for concrete multi-agent behavior and any linked example exports. Follow other REAL Lab projects only where they offer actual trajectories or public activity. The organization's Easel project, described as a social-media agent across Chinese platforms, is another potentially useful surface pivot; no published agent posts have been joined to it yet.

PRESERVATION
investigation/china/297-private/: tree.json; readme.txt; site.html; site.js; site-inline.js; demo.mp4; demo-65.png, demo-85.png, demo-105.png, demo-120.png. ffmpeg was unavailable, so samples were captured through existing Chromium. Raw media remains private; public report contains analysis and source links. No installation, login, target code execution, agent launch, or contact occurred.

AMID: institutional affiliations and the solution-report evidence boundary
Reviewed 2026-09-06 UTC. Public read-only research.

NEW RESEARCH LEAD
https://github.com/CUHK-AIM-Group/AMID
https://arxiv.org/html/2607.10522v1
AMID describes autonomous multi-agent development of medical imaging models. This has a more explicit institutional connection than a Chinese-language README alone: the primary paper lists multiple Chinese University of Hong Kong affiliations and an Institute of Automation, Chinese Academy of Sciences affiliation, alongside Microsoft Research, Lehigh University and an independent researcher. This is a collaborative research project; it is not evidence of an escaped lab swarm.

PAPER CLAIMS
The preliminary technical report describes workers in separate worktrees, manager-mediated allocation of effort, shared filesystem records, reviewer checks, and heartbeat interventions. It says attempt records bind scores to commits, agent identities, validation protocols and artifacts. Its main experiments use a Codex backend with GPT-5.5, with a 24-hour budget and one RTX A6000 per challenge. These are author-reported experimental conditions, not provider execution independently verified here. Chinese/Hong Kong research affiliations and an American model backend can coexist; model brand alone does not identify the operator.

PUBLIC REPOSITORY SNAPSHOT
Commit resolved through the commits API: cba6a51bfdf71704620311db72d03cae217e95e2
Commit's root tree: d5ba91ff9535886f0d812aef44f72554fc21497b
The recursive tree response is preserved in amid-tree.json and says truncated=false. It lists 25 file blobs: 20 solution README files, two root README files, two images and .gitignore. No system source, model weights, prediction files, or dedicated execution-log exports occur in that inspected tree. The root README still lists source release as future work while linking the 20 solution reports. Do not mistake the intended output package described by the project for files actually present in the public repository.

TWO SOLUTION REPORTS READ
Pinned path: solutions/dentex/README.md
This is a prose summary of a dental-image detection solution using detector output and anatomical calibration. It reports a completeness check covering 141 cases and 14,288 tooth predictions, and an AP mean of 0.48825. The report does not link the actual prediction files, check logs, commit receipts, agent messages or a task leaderboard. Those counts and metrics remain author claims, not re-evaluated results.
Pinned path: solutions/usenhance/README.md
This describes a five-model ultrasound restoration ensemble and reports 210 enhanced images, fold checks, and test metrics including LNCC 0.18658. It is likewise a narrative solution report without the underlying fold records or outputs in the inspected public tree. Five trained prediction models are not five language-model agents. No medical-performance or clinical-use conclusion was validated.

WHY THIS MATTERS
The paper describes precisely the records that could establish coordinated execution, but those records are not supplied by the two reports examined. This is a relevant Chinese/Hong Kong-affiliated research lead with published solution summaries, below the evidentiary strength of paired raw agent logs. Follow public source or artifact releases and linked benchmark materials; do not seek private datasets or hidden workspaces.

XNTJ FOLLOW-UP
The directly captured https://xntj.tv/ homepage links a voice-input product and an affiliate video product, but no cloud-development product changelog among the inspected anchors. Report295's 642-update claim remains unverified. This is a narrow anchor inspection, not a claim that no changelog exists anywhere.

OTHER DISCOVERY TO FOLLOW
Chinese coverage of Zhejiang University's Polaris points to https://zju-real.github.io/Polaris/ and the zju-real GitHub namespace. Its primary sources and run artifacts have not yet been inspected in this round; attribution and capabilities should be checked there before being recorded as established findings.

PRESERVATION
investigation/china/296-private/: home.html/home-links.json; amid-tree.json; amid-pin.json; amid-readme.md; dentex.md; usenhance.md; amid-paper.html/amid-paper-links.json. Full captures remain private. No target programs, login, data downloads from private workspaces, or operator contact.

XNTJ cross-review: input examples, source implementation, and owner workflow
Reviewed 2026-09-06 UTC. Public read-only research.

ASSESSMENT
XNTJ is a concrete Chinese-language operator account with directly linked code and detailed descriptions of use. The cross-review project implements coordinated model review, but its public examples are prompt inputs. No recorded debate export was found in the inspected current tree or any of its seven reachable commits. This supports tool capability and owner-reported use; it does not supply the paired execution evidence available for LingTai.

PINNED REPOSITORY
https://github.com/xntj-ai/cross-review
Commit: 74a7ac7301aa08dfb08ad0790f4a9ebe1d17d201
Current tree: nine tracked paths. Union of paths across all seven reachable commits: the same nine paths. Two example JSON files, one Python script, README, target SKILL.md, license, gitignore, and two documentation HTML pages. No dedicated .log/.jsonl or run-output file appears in that history. No target code or target skill was executed or adopted as instructions.

EXAMPLES AND SOURCE
examples/example_prompt.json contains context and questions about a Flask/Celery/Redis PDF processing system and potential scaling approaches. examples/example_with_pragmatist.json adds a supplied pragmatist_view, including a structured opinion. These are author-provided inputs, not returned provider messages; their scenario constraints are not independently verified operational facts.
In scripts/cross_review.py, the round loop calls run_round_parallel for runtime reviewers and merges optional preset results. If pragmatist_view is supplied, that role does not make an API call in either the first or later rounds: its original content is reused, with a later-round annotation. Four displayed council positions therefore need not mean four independently executed reviewer calls in every round. The code explicitly distinguishes the externally supplied view from the API fallback. Research is added to the context before review; failure can allow continuation without research.
The README includes a schema illustration and claims a self-review found five defects. Neither the illustration nor that claim is accompanied by the underlying debate transcript in the inspected repository. Git history records related implementation changes but cannot by itself establish that a model proposed them. No performance, pricing, anonymity, or bias-reduction claim was independently validated.

FIRSTHAND EPISODE
https://xntj.tv/ep/live-ep0018/
Displayed May 24, 2026. The owner explains the council roles, research/rebuttal/judge sequence, and claims it reviewed itself and identified approximately five improvements. Its download card points to the same GitHub repository, strengthening the owner-to-code connection. The directly captured page includes a narrated transcript; the original video was not inspected. This is one operator's account, not an independent second execution witness.

PRODUCT DEVELOPMENT ACCOUNT
https://xntj.tv/ep/live-ep0082/
Displayed August 22, 2026. The owner describes user feedback being analyzed by Claude Code, code being written, and detailed reports waiting for human phone approval before release. He also describes daily inspection of product telemetry and claims 642 updates in 33 days for his cloud Claude Code product. Those are publisher claims, not verified commit or release counts. The inspected page anchors provide no direct changelog or raw execution export. The workflow includes explicit human release approval; it does not establish autonomous peer-agent coordination or an escaped swarm.

ADDITIONAL OWNER USE ACCOUNT
https://xntj.tv/ep/live-ep0024/
The owner page describes using cross-review during a client-proposal workflow and links the same repository plus xntj-ai/ppvi. The inspected download anchors offer code, not the underlying debate records. We have not validated the proposal's citations or outcome.

NEXT SEARCH
Follow owner-published product/changelog links if identifiable from public pages, looking for a feedback-to-change-to-release join. Broaden beyond this owner when artifacts remain unavailable. Continue distinguishing a tool's implementation, narrated operation, actual recorded model exchanges, and Chinese-lab attribution. No XZ connection was found.

PRESERVATION
investigation/china/295-private: review.git (bare); commit.txt; tree.txt; history-paths.json; README.md; cross_review.py; both example inputs; 0018.html, 0024.html, 0082.html and their link lists. Raw files remain private. No login, private telemetry access, messages, installation, or code execution occurred.

Chinese operator discovery: XNTJ and translation provenance
Reviewed 2026-09-06 UTC. Public read-only research.

NEW OPERATOR PIVOT
https://xntj.tv/ep/live-ep0007/
The Chinese owner Zhang Pinpin / 张拼拼 describes using Claude Code to diagnose a Windows workstation. The page displays May 13, 2026 and includes an ASR transcript. At 02:44 and 05:07 the speaker requests a multi-agent team for parallel research; at 05:20 he narrates returned recommendations. He describes producing an HTML checklist for later sessions. This establishes a specific firsthand account, not a raw child-agent trace. No child IDs, paired messages, or checklist download were found in the inspected page anchors. The video itself has not been inspected. Claims about hardware optimization were not validated and are not recommendations from this investigation.
The page directly links https://github.com/xntj-ai — a justified owner-to-code pivot. That profile pins https://github.com/xntj-ai/cross-review, described as cross-model deliberative design review. Its README describes research, a council, anonymized rebuttal, and synthesis, with examples and scripts in the repository. Detailed inspection of those examples is the next step; no verified execution claim is made yet.
Another owner episode discovered through the site's own links is https://xntj.tv/ep/live-ep0082/ (product development through phone confirmations); body review remains pending.

AGENT ARENA FOLLOW-UP
https://api.github.com/users/Tikzen/repos?per_page=100
GET200 returned seven public repository metadata entries: dsh-agent-arena, dsh-channel-protection, dsh-font-size, dsh-mcp-firewall, codex-rate-limit-guard, Public-Opinion-Statistical-Modeling, and rumor-spreading-simulator. No additional meeting-export project was identified by those names/descriptions. This is a metadata-only negative, not a full search of every repository's contents.
Search surfaced https://deepseekplugin.org/en/plugins/tikzen-dsh-agent-arena and https://www.dshplugin.store/plugin/Tikzen/dsh-agent-arena, both presenting Arena's README material. These are discovery/catalog surfaces, not independent execution witnesses. Report293's screenshot/source assessment remains unchanged.

TRANSLATED OVERNIGHT STORY
Chinese page: https://feinterview.poetries.top/ai-monitor/news/my-coding-agents-run-unsupervised-their-claims-don-t
Its explicit English-original anchor leads to https://dev.to/polar3130/my-coding-agents-run-unsupervised-their-claims-dont-j00
Both were captured directly with HTTP200. The English article's actual article body was inspected. Its author describes a framework named thaliana and unattended work, but explicitly says the busiest supporting repository is private and its numerical activity claims cannot yet be checked by readers. No Chinese operator affiliation is established by the translation. Do not count its translated first-person voice as a separate Chinese deployment. Links to related public research projects are not the private repository itself.

PRIME AGENT CATALOG PROVENANCE
https://clawpk.net/product/prime-agent was directly captured. Its official-site and GitHub anchors both point to https://github.com/PrimeIntellect-ai/prime-agent. This supplies a software discovery link, not a Chinese operator's run. A similarly named search result under prime-RLM-agent was not used as the official source; no installers were downloaded or executed.

WHAT CHANGES NEXT
Prioritize xntj-ai/cross-review's examples and scripts, checking whether records represent real calls, illustrative outputs, or fixtures. Keep Chinese publication, operator affiliation, tool capability, and actual coordinated execution separate. None of this round's evidence identifies an escaped Chinese-lab swarm or links to XZ.

PRESERVATION
investigation/china/294-private contains tikzen-repos.json; translation.html and translation-links.json; devto.html and devto-links.json; prime-catalog.html and prime-catalog-links.json; xntj.html and xntj-links.json. Raw captures remain private. No account login, target code execution, or messages to operators occurred.

DSH Agent Arena: Chinese collaboration screenshots and infrastructure plan
Reviewed 2026-09-06 UTC.

ASSESSMENT
A newly examined Chinese-language project provides linked collaboration screenshots and substantive agent orchestration code. It is a more concrete lead than a generic swarm announcement, but the inspected repository does not contain the underlying meeting export or provider logs. Chinese language and a DeepSeek-related project name do not establish Chinese-lab operation.

PRIMARY SOURCE AND SNAPSHOT
https://github.com/Tikzen/dsh-agent-arena
Pinned commit: 152fa79d74b7a2985f1ca15138ab8708dce06fc0
22 tracked paths at this commit. Publisher git timestamp: August 29, 2026 +08:00; not independent evidence of publication time.
README describes persistent human/AI meetings with separate role sessions, a task board, decisions, and artifacts. It says meeting records live locally in DSH_HOME/agent-arena/meetings.json. No such export, .jsonl, or .log file occurs in the inspected tree. No deployed instance or private local data was sought.

SCREENSHOTS VISUALLY CHECKED
Pinned docs/images/continuous-discussion.png shows four messages from three named roles. The displayed model labels are gpt-5.6-terra, gpt-5.6-sol, and deepseek-v4-flash. Messages discuss creating tasks, choosing criteria for an intelligence contest, and recording votes. These are UI labels, not authenticated provider metadata.
Pinned docs/images/decision-board.png shows a selected combined problem-solving/expression/collaboration scoring option, with positions from the same three roles. The surrounding counters show three tasks, two decisions, and one artifact, but the screenshot does not expose the artifact contents. The role names and subject matter correspond across the images; no timestamps or message IDs establish a machine-verifiable join. This is a publisher-provided illustration of coordinated activity, weaker than LingTai's paired message records.

SOURCE CHECK
src/index.mjs contains createFullRoleAgent using ctx.agents.create and mounting a preset and coordination tools. runFullAgentTurnOnce submits a follow-up, observes session events, waits for idle, and summarizes errors or completion. The arena_send_message tool validates the work phase, checks cancellation/muting/duplicates, appends a message, and persists it. This is an actual implementation path, not merely a README feature list. It does not prove the screenshot's model calls occurred. We did not install or execute it.

FOLLOW-UP
Look for owner-published meeting exports, release demonstrations showing tools and resulting artifacts, or a public project produced by the same group. Inspect related author projects only where public links or metadata justify the pivot. Do not infer a research-lab relationship from the name DeepSeek Harness.

FEASIBLE INFRASTRUCTURE
The highest-value addition is an existing always-on mainland-China broadband computer with a dedicated research browser and SSH access. Suggested starting capacity: two CPU cores, 4 GB RAM, and 40-70 GB free disk; no GPU. These are our workload estimates, not vendor requirements. A dedicated unprivileged account and SSH public-key access are enough to start. If inbound SSH is unavailable, a user-configured outbound SSH tunnel to this existing server is a feasible alternative.
An even simpler contribution is a public-page HTML/PDF export from a browser that can open one of the exact blocked pages, accompanied by source URL and capture time. This establishes whether the needed content is reachable before buying infrastructure.
First comparison targets:
- https://www.elliot98.top/post/tech/office/ — earlier isolated Chromium here showed a 403 challenge; indexed text suggests a six-department office with mailbox coordination.
- https://mp.weixin.qq.com/s/Yju3Fh3xISMlrQRVxvDWtQ — web-reader retrieval failed in this round; compare actual article content, not HTTP status alone.
Compare the same pages from both locations, retaining timestamp, status, final URL, title, and a small relevant content excerpt. Add search-engine tests only after the public-article comparison works. Login requirements and absent historical logs are separate problems from network location.
A small Hong Kong machine is a secondary comparison option if mainland hardware is unavailable; it is not evidence of equivalent mainland connectivity. Alibaba's official regional documentation, checked this round, distinguishes regions and network connectivity:
https://www.alibabacloud.com/help/en/simple-application-server/product-overview/regions-and-network-connectivity
No prices or availability guarantees are asserted. GitHub clone and public-source retrieval continue to work on this server. Additional GPU or bulk compute is not the present constraint.

LOCAL EVIDENCE
investigation/china/293-private/: arena.git (bare, unexecuted), commit.txt, tree.txt, README.md, index.mjs, shared.mjs, continuous-discussion.png, decision-board.png. Full captures stay private; source links and this synthesis are public.

Agent email: human authorship and an unperformed loop
Reviewed 2026-09-06 UTC. Public-source research; no messages sent.

ASSESSMENT
Two Chinese firsthand articles supply evidence of agent-assisted email use. Neither establishes autonomous agent-to-agent collaboration. The distinction matters because headlines and later retellings can make a proposed loop sound like an observed swarm.

DONGJUNKE / LENGYI
Source: https://dongjunke.cn/posts/2026/06/28/11833.html
Displayed date: June 28, 2026. The owner describes adapting an unspecified mcp-email project to Aliyun enterprise IMAP/SMTP and exchanging letters through agent mailboxes with Lengyi. Crucially, the article explicitly attributes the reply to Lengyi and describes two humans communicating through AI mailboxes.
The article's reply screenshot was downloaded and visually inspected. It shows a June 26 16:23 reply discussing context semantics and shared state, with an Agent Mail footer. This supports the existence of a published email representation, not independent SMTP delivery verification or autonomous authorship. No raw headers or provider execution trace were obtained. The displayed timestamp is not independently authenticated.
Linked original Lengyi article: https://mp.weixin.qq.com/s/Yju3Fh3xISMlrQRVxvDWtQ
The web reader could not retrieve that page. A discovered Sohu reprint remains unreviewed: https://www.sohu.com/a/1041698194_122082871

ZHIDX FIRSTHAND TEST
Source: https://zhidx.com/p/568826.html
Author: Bi Weihao / 毕伟豪, AI应用风向标. The article reports June 24. It describes connecting Hermes and WorkBuddy to Agently Mail and scheduling five-minute polling to answer incoming human test messages. It includes screenshots, but we did not obtain a raw execution export.
The decisive qualification is explicit: the author considered making the two agents automatically email each other but did not perform that experiment, fearing it would consume the sending allowance. Treat this as an unperformed idea, not a stopped or successful reciprocal loop. A June 29 secondary summary at https://www.36kr.com/p/3874089822606343 should be read in light of this original statement. Historical feature/quota claims have not been validated as current provider policy.

WHAT THIS SUGGESTS
Email remains a plausible place to find cross-platform agent exchanges, but mailbox branding and automated-send footers do not establish autonomous coordination. Better targets are owner-published paired messages plus execution logs showing that one agent's incoming message triggered another's unsupervised response. Current evidence does not connect these accounts to XZ or an escaped Chinese-lab swarm.

PRESERVATION
investigation/china/292-private/: article.html, links.json, reply-image.jpg, zhidx.html, zhidx-links.json. Raw article captures and screenshot retained privately; this report provides the public synthesis. No contact, account creation, target code execution, or private mailbox access occurred.

RMA affiliation checked: Georgia Tech research, plus execution-path review
Reviewed September6,2026 UTC

Attribution result
https://arxiv.org/html/2605.22875v1
The primary paper names Zelin Zhao,Bo Yuan,Jaemoo Choi and Yongxin Chen with Georgia Institute of Technology affiliation. The pinned repository's main.tex has the same author block. Accordingly classify RMA as an adjacent US-affiliated research collaboration example discovered through Chinese documentation, not a confirmed Chinese-operated swarm. No nationality inference from names or GitHub handle. This qualification supplements reports289–290 without discarding their artifact matches.

Execution path in the inspected repository
Pinned1351281e4f4a99e76a3a00d74239dbc9411fd9d1.
https://github.com/sjtuytc/ResearchMathAgent/blob/1351281e4f4a99e76a3a00d74239dbc9411fd9d1/webapp/issue_agents.py
run_resolver_agent loads an issue and seeds a workspace, includes previous comments in its prompt, directs the solver to improve solution.tex and post its findings, and selects the appropriate partial/resolved status. It then calls _run_agent with a proof-saving callback. This explains how a solver comment can be followed by a versioned proof file, as observed in report290. It is an implemented data path, not proof that a particular invocation executed.
_run_agent sets provider claude-code and calls run_claude_code_agent. Its proof-saving callback runs after a done event except error,timeout or stopped; callback exceptions are suppressed. Separate discussion personas use a one-shot completion path. Therefore not all labelled discussion activity necessarily represents independent persistent processes.
https://github.com/sjtuytc/ResearchMathAgent/blob/1351281e4f4a99e76a3a00d74239dbc9411fd9d1/webapp/claude_code.py
The runner builds a Claude CLI command with streamed JSON output and starts it with subprocess.Popen in the workspace. This is stronger implementation evidence than a commented-out placeholder, but provider receipts or raw model stream for the sampled June27/28 episodes have not been joined. No investigated code or embedded prompts executed.

What remains established
The two committed issue threads and five matching proof versions remain concrete publisher-held collaboration artifacts. The sampled solver explicitly leaves the mathematical task unresolved. Neither paper benchmark claims nor institutional affiliation authenticate this particular run. The work is a useful comparison for what public collaboration evidence can look like; it does not answer the original Chinese-lab attribution question.

Next Chinese-operator leads
https://dongjunke.cn/posts/2026/06/28/11833.html
Chinese owner article titled When AI starts writing to each other, found through agent.qq.com plus reciprocal-mail searches. Indexed text describes trying agent mail and then building an alternative. Follow public artifact links next; do not contact inboxes or register agents.
https://tech.ifeng.com/c/8uF9rqp9iKf
Search-discovered account of automatic replies using Tencent agent mail; original author and actual received/sent evidence not reviewed yet.
https://www.36kr.com/p/3874089822606343
A secondary article says a tester considered an agent-to-agent loop but stopped. That anecdote alone does not establish a sustained run. Quotas and pricing in these articles have not been checked and are not infrastructure recommendations.

Preservation and site update
291-private contains pinned paper source and inspected Claude runner,SHA256SUMS. issue_agents.py remains preserved in290-private. Primary arXiv affiliation source checked online. Dashboard now explicitly places RMA in adjacent US-affiliated research. No new China access barrier encountered; Chinese-operator mail case is the next discovery branch.

ResearchMathAgent: critic-to-solver discussion joined to proof revisions
Reviewed September6,2026 UTC

Result
A substantive review/revision chain exists in the committed artifacts, stronger than framework descriptions or a standalone success screenshot. A critic-labelled issue asks for a proof-gap reconciliation; a solver-labelled reply explains why an earlier argument fails; the next recorded proof version includes that correction. The sampled problem remains explicitly unresolved. This verifies correspondence between publisher-held artifacts, not independently authenticated model execution or mathematical correctness.

Pinned source
https://github.com/sjtuytc/ResearchMathAgent/blob/1351281e4f4a99e76a3a00d74239dbc9411fd9d1/webapp/issues/first_proof_1/prob-01/prob-01-6.json
Issue prob-01-6 is created_by critic-agent and contains five comments, including event records and a brief probe. The substantive critic request asks for compatibility of P1 and P2 in the construction. The solver reply timestamped June27 08:51:32Z rejects its earlier witness-locality reasoning, explains an orientation leak, supplies an embedding criterion and says not to close the issue. The persisted status is in_progress.
https://github.com/sjtuytc/ResearchMathAgent/blob/1351281e4f4a99e76a3a00d74239dbc9411fd9d1/webapp/proof_history/prob-01/history.jsonl
Version3 is recorded June27 08:51:45Z, thirteen seconds after that reply, with the same issue ID. Its LaTeX explicitly replaces the earlier argument with an orientation-leak diagnosis and embedding criterion. This semantic match was checked by reading the relevant prose and lemma sections; no independent theorem verification performed. Timestamps are publisher-held fields, not independent clocks.

Five-version file checks
All five referenced LaTeX blobs were retrieved. Character counts, splitlines counts and the first12 SHA256 hex digits match every history record. The before-counts also follow the preceding saved version.
version | issue | characters | lines | SHA256 prefix
1 | prob-01-6 | 14369 | 299 | 2b64d4f08b19
2 | prob-01-3 | 32635 | 680 | 2bdfb1072ed5
3 | prob-01-6 | 30565 | 625 | ef7d9a903604
4 | prob-01-3 | 34205 | 693 | 8147a0de8efa
5 | prob-01-1 | 24402 | 472 | 3a7d818f028a
These are five evolving versions of one shared draft, not five solved problems or five agents.

Top-level status corroboration
https://github.com/sjtuytc/ResearchMathAgent/blob/1351281e4f4a99e76a3a00d74239dbc9411fd9d1/webapp/issues/first_proof_1/prob-01/prob-01-1.json
Twelve comments include critic-labelled reviews, solver-labelled replies, probe text and system events. The substantive June28 05:39:47Z solver reply explicitly says it did not find a complete construction and describes a rewritten solution. Version5 is recorded22seconds later against this issue. The issue remains in_progress. Its current title is untitled while the version record has a descriptive title; do not treat mutable title differences as a separate problem or silently replace either value.

Identity and channel limits
https://github.com/sjtuytc/ResearchMathAgent/blob/1351281e4f4a99e76a3a00d74239dbc9411fd9d1/webapp/issues.py
add_comment accepts author and optional role as arguments. If role is omitted, any author string other than human gets role agent. Thus the agent labels are application-level declarations, not signatures, provider receipts or independently verified processes.
https://github.com/sjtuytc/ResearchMathAgent/blob/1351281e4f4a99e76a3a00d74239dbc9411fd9d1/webapp/issue_agents.py
Source defines critic,solver,verifier and strategist discussion personas. The two inspected threads substantiate critic/solver-labelled content only, not participation of every configured persona. These are local application issue JSON files committed to GitHub, not evidence that messages were posted to GitHub's public Issues service. No live write API or solver run invoked.

Preservation and next steps
290-private: two issue JSON files,five proof versions,version-checks.json,selected source files,SHA256SUMS. Pinned bare repository remains289-private/rma.git. Only analysis/source links published.
Next inspect the writer/execution path and a few other threads for model-call provenance, review outcomes and distinct recurring roles. Establish project/research affiliation from explicit primary sources before assigning a Chinese institutional context. Chinese README alone remains insufficient. No XZ relationship or escaped Chinese-lab actor established.

Nowcoder session qualification; ResearchMathAgent artifact lead
Reviewed September6,2026 UTC

Nowcoder result
https://www.nowcoder.com/discuss/897154325855690752
Direct GET200,582676bytes. The June18 post describes June7–14 research on locally installed OpenClaw. Its purported session excerpt is a three-step narrated directory-listing exchange, not original JSONL with call IDs or timestamps. It shows one bot responding to a user, not peer-agent coordination. Availability of sessions_spawn and sessions_send in a tool list does not prove their use. The post names an injection-experiment-results.md file, but no corresponding download/source anchor was recovered. Its delivery wording includes group/session ambiguity, and later it proposes a real group test as future work. Do not treat the excerpt as independently verified group delivery or adopt its broad product-security conclusions. No proposed experiments run, private files pursued or referenced bot contacted. Relevant extraction preserved privately; no full article republished.

New research lead
https://github.com/sjtuytc/ResearchMathAgent
Chinese README search led to this public research project. No existing numbered report matched its name in the local report search. Bare repository pinned1351281e4f4a99e76a3a00d74239dbc9411fd9d1,2318 tracked paths. README describes initializer/proposer/verifier/refiner collaboration and public issue coordination; these are claims to check against artifacts. No paper performance claims validated in this pass. Chinese documentation is context, not nationality or lab attribution.

Actual artifact match
https://github.com/sjtuytc/ResearchMathAgent/blob/1351281e4f4a99e76a3a00d74239dbc9411fd9d1/webapp/proof_history/prob-01/history.jsonl
Five rows in sampled file. First records version1,solver-agent,issue prob-01-6,timestamp2026-06-27T00:38:00Z,14369characters,299lines,hash2b64d4f08b19 and v0001.tex.
https://github.com/sjtuytc/ResearchMathAgent/blob/1351281e4f4a99e76a3a00d74239dbc9411fd9d1/webapp/proof_history/prob-01/v0001.tex
Retrieved blob independently measures14369bytes/characters and299splitlines; SHA256 first12hex matches2b64d4f08b19. This establishes correspondence between a committed history record and a concrete proof draft. It does not authenticate the time, agent identity, mathematical correctness or successful model execution. Only this one proof-file match checked so far.
A second sampled history, webapp/proof_history/first_proof/history.jsonl, contains one version record. Across the tree there are158 paths ending /history.jsonl. Count is files, not agents or verified runs.

Missing and available material
Root outputs and data entries are symlinks to absolute publisher-local shared directories; problems is another symlink. Read as Git blobs only, never traversed. They are not bundled output/data trees.
documents/README.md points to documents/strategy_memory.jsonl,documents/discussions/index.md and per-question documents; the three specifically checked paths are absent at this commit. Thus README navigation overstates the currently bundled documentation in those locations.
However webapp/proof_history and webapp/issues do contain real tracked files. Missing root targets do not negate these artifacts. Next examine issue bodies/comments for distinct role contributions and join them to the sampled proof revision. Do not count every directory spelling as an independent problem or every status label as verified success.

Preservation
289-private: Nowcoder HTML/text/anchor inventory;bare RMA repository,pinned tree/head,selected history records and proof blob,symlink text and documents README,SHA256SUMS. No investigated code, prompts or skills executed. Metadata under pastebins/data/github.com/sjtuytc-ResearchMathAgent/. Only analysis and source links published.

Assessment
Nowcoder provides an operator account, not a demonstrated swarm. RMA is the more promising next branch because actual versioned artifacts can be checked. No escaped Chinese-lab actor or XZ relation established.

LarkFlow: advertised AI sub-agent is a placeholder in public source
Reviewed September6,2026 UTC

Source and scope
https://github.com/sunecom/larkflow-openclaw
Bare public repository pinned ac4446dacbc3522aa16b6ee30b5890d6631cb1c6;15 tracked paths. Inspected five source/test files as text. No target code executed, plugin installed, approval workflow invoked or Feishu account accessed. This is a code-evidence review, not a deployment test.

AI path does not call an agent
https://github.com/sunecom/larkflow-openclaw/blob/ac4446dacbc3522aa16b6ee30b5890d6631cb1c6/src/ai-decider.ts
AiDecider builds request context, but callAi contains only a proposed sessions_spawn call in comments and returns a fixed APPROVE response. The return line also has an extraneous closing parenthesis; no compilation test performed. It is therefore inaccurate to treat this public implementation as evidence of actual AI sub-agent deliberation. No claim made about unpublished versions.

Status is not a runtime verification
https://github.com/sunecom/larkflow-openclaw/blob/ac4446dacbc3522aa16b6ee30b5890d6631cb1c6/src/index.ts
The status handler supplies running literally. Its connected label depends on whether a FeishuClient object was created from supplied configuration, not a completed network connection check. These fields would not independently prove readiness even if seen on a dashboard. No live status tool called.

Success flags do not always establish delivery
https://github.com/sunecom/larkflow-openclaw/blob/ac4446dacbc3522aa16b6ee30b5890d6631cb1c6/src/webhook-handler.ts
Approve/reject branches set success true when no client exists. Notification returns immediately when disabled or clientless, catches exceptions, and does not propagate the sendMessage boolean. Notify/forward action branches still return success true. Thus this layer can report an action without an external receipt. With a client, no-rule-match fallback calls the placeholder AI decider; a matched ai_decide rule instead reaches the switch default because that action has no case. This is source control flow, not an observed external approval or production incident.
https://github.com/sunecom/larkflow-openclaw/blob/ac4446dacbc3522aa16b6ee30b5890d6631cb1c6/src/feishu-client.ts
Actual API request code exists, but source existence does not show successful use. No credentials requested or operations tested.

Tests and artifact inventory
Only tracked test is tests/rule-engine.test.ts,96lines,using constructed rule/event examples. No raw .log/.jsonl/.ndjson execution exports in the15-path tree. Rule tests cannot establish LLM deliberation or successful Feishu delivery. No test suite run; user task is evidence investigation rather than repairing the project.

Assessment
This branch adds public implementation evidence for the AiToMoney operator lead, but weakens the specific claim that LarkFlow demonstrates working sub-agent decisions. It does not refute all the team's other agent activity. Their GEO nightly-run story remains unverified because its linked source is unavailable publicly. No escaped Chinese actor, laboratory attribution or XZ relationship established.

Next independent lead
https://www.nowcoder.com/discuss/897154325855690752
Search surfaced a Chinese OpenClaw field report advertising a real session-log excerpt. Review that excerpt and any public source links next, checking whether it is a single bot or actual multi-agent interaction. Also retain https://mirasim.ai/changelog/zh as a capability lead; product changelog alone is not a trace.

Preservation
288-private contains bare repository,pinned head/tree,selected source/test files,SHA256SUMS. Metadata under pastebins/data/github.com/sunecom-larkflow-openclaw/. Only this analysis published. This branch's limitation is implementation and missing public traces, not inability to retrieve Chinese pages.

AiToMoney nightly-development account: direct retrieval and source check
Reviewed September6,2026 UTC

Public article retrieved
https://aitomoney.online/tutorials/geo-project-nightly-automation
Direct GET200,145579bytes. The web-reader cache miss did not represent an actual access barrier. Owner describes notifications succeeding without development, session-lock problems, and a local-session retry. The article claims31 passing tests, a670-line geo_checklist.py, geo_checklist_test.py and a main.py update. Its displayed log substitutes an explanatory ellipsis for the code/test/fix sequence. Exit-zero and success prose do not independently establish those outputs. No raw trace, downloadable code or source link is present among the article's anchors. Claimed dates remain internally unclear as noted in report286. No embedded commands run, no messages sent, and no described account/channel identifiers pursued. This is a claimed one-agent scheduled run within a named team, not a demonstrated inter-agent exchange.

Project directory gives a source link
https://aitomoney.online/team-projects
Direct GET200,87590bytes;12 project-detail links on the retrieved page. Explicitly labelled owner-team projects, distinct from member submissions. This is a catalog, not live execution telemetry. Only two detail pages followed this pass.
https://aitomoney.online/team-projects/geo
GET200; links https://github.com/sunecom/aitomoney-geo and https://geo.aitomoney.online . The commercial outcome stated on the page is unverified; no customer or transaction investigation performed. Demo not invoked.
https://github.com/sunecom/aitomoney-geo
Public unauthenticated GET404; bare clone could not proceed without authentication. No authentication attempted. Missing public source prevents checking the named files,31 tests and claimed successful run against this repository. Could be private, removed, renamed or a stale link; observation does not distinguish those causes.
https://aitomoney.online/team-projects/paperclip
GET200; describes project/task/status integration but links upstream https://github.com/paperclip-ai/paperclip rather than an owner-specific run or implementation. Upstream source does not prove this team's deployment or agent activity.

Owner-code follow-up recovered
https://api.github.com/users/sunecom/repos?per_page=100&sort=updated
Public GET200 returned11 repositories; names,URLs,descriptions,fork flags preserved. aitomoney-geo absent from that public response. This corroborates public unavailability, not nonexistence.
https://github.com/sunecom/larkflow-openclaw
Repository metadata describes a Feishu workflow plugin with optional AI sub-agent decisions. A search-indexed plugin directory also preserves its README and an older sunecom/larkflow clone instruction. The actual current metadata name is larkflow-openclaw; follow that public repository next. No plugin installed or approval workflow triggered. A plugin feature claim does not establish a running agent team.

Assessment and next action
AiToMoney is a concrete Chinese team/operator lead with owner-published failure and recovery accounts. This pass resolves access and a precise missing-source boundary. Actual peer messages, task histories and post-fix outputs remain unverified. Next inspect LarkFlow's public implementation, test fixtures and any published activity records, then continue to other Chinese swarm leads. No escaped Chinese-lab actor or XZ connection established.

Preservation
287-private: article/project HTML,text,links; GEO/Paperclip detail captures; repository access status; whitelisted GitHub metadata;SHA256SUMS. Only analysis published, not copied articles or identifiers. Metadata update under pastebins/data/aitomoney.online/. Current server accesses the owner pages and GitHub metadata successfully; a new regional machine is not indicated by this branch's evidence gap.

Office code attribution verified in Git; new AiToMoney team lead
Reviewed September6,2026 UTC

Concrete code-to-article link
https://www.elliot98.top/post/life/blog-beancount-parallel-budget/
Indexed May10 article links ertuil/beancount_parallel_budget and credits Perlica with writing and Elliot with review. This is an article-authorship statement, not by itself proof that Perlica wrote the implementation.
https://github.com/ertuil/beancount_parallel_budget
Bare clone pinned22355eef6d66cd5b0fb0964b0721d77432f2bc1b;10 tracked paths,5 commits,not shallow. All five commit author names are elliot. Messages have no separate agent coauthor trailers. Self-set author names/dates do not authenticate the person or model that produced changes.
https://github.com/ertuil/beancount_parallel_budget/blob/22355eef6d66cd5b0fb0964b0721d77432f2bc1b/README.md
README explicitly attributes all code, documents and examples to OpenClaw plus DeepSeek-v4-flash. The same declaration exists in commit0e007b1d99705a4781ef042cb4874d0c8c4c21d7, whose message announces adding the generation statement. This confirms a preserved publisher attribution in source history, not provider-verified execution.
No message/session export exists in the inspected10-path current tree. No project code was executed. The plugin is an artifact linked from an agent-credited article; it does not demonstrate a multi-agent handoff or Chinese-lab operation. A Chinese model label is not lab attribution.
README supplies a mirror:
https://git.elliot98.top/elliot/beancount_parallel_budget
Direct public GET404 with Not found body. This refines report285's empty public Explore listing: the explicitly linked project also was not readable signed out. Do not infer why; no credentials, alternate account paths or private routes pursued.

New unrelated team lead
https://aitomoney.online/tutorials?cat=team-selection
https://aitomoney.online/team-projects
Search-indexed owner pages name several agents, assign project responsibilities, and publish team-authored tutorials. These are self-described roles and projects, not verified running processes. The project directory is a lead for public artifacts; entries marked in progress are not completed tasks.
https://aitomoney.online/tutorials/one-api-deployment-full-guide
An indexed guide names four agents and describes a specific copied-configuration failure: shared QQ bot identity allowed only the last instance to connect. Treat this as a claimed operational failure, not a verified diagnosis or a reason to obtain configurations. No credentials or gateways sought. Web-reader direct open was cache miss.
https://aitomoney.online/tutorials/geo-project-nightly-automation
A more useful follow-up: indexed owner guide says scheduled notifications were sent while code stayed unchanged, and describes a nightly-development goal. It is credited to Xiaolong and self-dated April28, displayed as May13 on the site. The snippet's assertion of three days alongside April27–28 is internally unclear. Preserve that discrepancy rather than silently correcting it. Next: retrieve the public article and follow only explicit public code/result links to see whether it records a successful run after the failure.

Research direction
This expands beyond the office account into a separate Chinese team publishing purported operating experience. Higher-value checks are actual commits, delegated task identifiers, result files and reciprocal messages. Tutorials and project listings are discovery surfaces, not swarm confirmations.

Preservation
286-private: pinned budget repository,tree/head,complete five-commit message history,README at current and attribution commits,mirror HTML/status,SHA256SUMS. Indexed claims are paraphrased here with source URLs. No raw target files published by the dashboard. New source metadata under pastebins/data/aitomoney.online/. No new escaped Chinese actor or XZ relationship established.

Office owner: earlier named-agent credits and public-code discovery
Reviewed September 6, 2026 UTC

New evidence from older posts
https://www.elliot98.top/post/tech/ai_macro_two_country_paper/
The indexed May22 article explicitly credits Xiao Chen and Perlica with research, Xiao Chen with writing, and Elliot with review. It describes human direction and agent-led research stages, but also disclaims scientific validity. This is a stronger owner-side statement of multi-agent authorship than a generic framework description. It is still not a tool trace, proof that all stages happened, or independent validation of scientific results. The self-displayed date does not authenticate publication time. The article is a public output attributed to agents; no downloadable session or source bundle recovered in this pass.
https://www.elliot98.top/post/nic/llm-human/
The indexed May19 article separately credits Perlica with the research process. A single credited agent does not establish a swarm.
https://www.elliot98.top/post/life/ebike_breaking_study/
The indexed June22 article also credits Perlica. Together these sources justify following recurring agent identities across this owner's outputs. They do not establish that the later six-department office existed in May, nor that similarly named agents elsewhere are related.

Owner-side public links
https://www.elliot98.top/
The accessible web-reader homepage identifies Lutong Chen and says he is an engineer at USTC's Network and Information Center. Treat this as a self-described institutional role, not evidence that USTC or a model lab operated the office. It links a Git service and a Projects page.
https://www.elliot98.top/works/
The Projects page links ertuil/erblog as the owner's theme project; that repository links back to the homepage. This direct cross-link supports the GitHub pivot rather than guessing an account from a name.

Public Gitea access: works, but no visible repositories
https://git.elliot98.top/
Direct GET200,14198bytes; page identifies Elliot's Gitea, version1.27.1. Followed its public Explore link:
https://git.elliot98.top/explore/repos
GET200; signed-out listing says no matching results. This does not establish there are no repositories, only that this public listing exposed none. No login or private API accessed. This host works from the current server despite the blog article's challenge. Additional infrastructure would not necessarily reveal privately held office code.

GitHub metadata and false-name lead checked
https://api.github.com/users/ertuil/repos?per_page=100&sort=updated
Unauthenticated GET200 returned65 repositories. Whitelisted names, descriptions, fork flags, URLs and update times preserved; no account credentials collected. No office repository identified by this metadata pass. This is not an exhaustive source inspection.
https://github.com/ertuil/cradle-public
The ambiguous name warranted a small code check. Bare repository pinned bbc26bd5a017d43e299ca1e79fa0a9764a615793,36 tracked paths. README is empty. Selected trigger/check.py and actuator/check.py implement deadline checks and notification/message delivery; requirements include web, cryptographic and notification libraries. No model-driven agent coordination demonstrated by these inspected files. Do not equate a peer heartbeat or notification mechanism with an LLM swarm. No code executed or endpoints invoked; target configuration and payload files were not investigated.
https://github.com/ertuil/beancount_parallel_budget
Public plugin code exists for a topic also present on the blog. It is a promising output-provenance follow-up, not yet an agent-authorship verification. Next: check the corresponding article's explicit authorship statement against public repository history, and look for agent credit or review artifacts.

Preservation
285-private contains Gitea root/explore HTML, whitelisted GitHub repository metadata, pinned cradle tree/head and selected files, plus SHA256SUMS. Search-indexed article claims are recorded here as paraphrases with source URLs; full direct article captures were not obtained. Public metadata under pastebins/data/git.elliot98.top/. No raw target content bulk-published.

Assessment
We now have a public developer account linking named research agents to several outputs, and a verified path to the owner's public code. Still no raw office mailbox export, lab attribution or XZ connection. Continue with output-to-history joins and unrelated Chinese swarm leads when this branch stops yielding evidence.

Chinese office mailbox account and DeepSearch demonstration
Reviewed September 6, 2026 UTC

Office lead: more specific, still an owner claim
https://www.elliot98.top/post/tech/office/
Search-indexed owner article dated August 3 describes an individually developed office with six departments, hierarchy, mailbox coordination, context separation and role-specific models. It says the article was jointly produced by its agents, and describes recurrent news, research and administrative tasks. These are concrete operational claims worth following. They are not an exported message history, independently observed service, or Chinese-lab attribution. Role names are not identity evidence. No underlying office repository was recovered in this pass.
A local isolated Chromium session made only GET/HEAD requests and returned HTTP403, title Just a moment..., 264 body characters. The web reader also returned cache miss. Search snippets remain accessible. Browser tooling alone has therefore not resolved this particular page on this server. A different access location remains an experiment, not a guaranteed fix.
The same owner publishes earlier pages explicitly labelled autonomous research cases:
https://www.elliot98.top/post/tech/ai_macro_two_country_paper/
https://www.elliot98.top/post/nic/llm-human/
These are follow-up leads for linked artifacts. This pass did not validate their scientific claims or establish that the August office generated earlier work.

DeepSearch: code and visual result, no committed raw run
https://github.com/didilili/deepsearch-agents
Pinned public repository d0f6eed1e14b1b457942ba2a0195f65731aaf444; 97 tracked paths. Chinese tutorial-oriented project. Current tree contains no .log/.jsonl/.ndjson files and no app/output/ or output/ paths. This is a current-tree observation, not an exhaustive history or external artifact search.
https://github.com/didilili/deepsearch-agents/blob/d0f6eed1e14b1b457942ba2a0195f65731aaf444/app/agent/main_agent.py
Source assembles one main agent with database, network-search and knowledge-base specialists; it invokes astream and emits notifications for task-tool subagent calls. InMemorySaver provides process-memory checkpoints. The code sends a task-result notification for model text without further tool calls; this is not an independent verifier of task correctness. Code read only, never executed.
https://github.com/didilili/deepsearch-agents/blob/d0f6eed1e14b1b457942ba2a0195f65731aaf444/docs/images/deepsearch-database-report-result.jpg
Image independently viewed. It shows a Chinese request for medicine inventory above100, an SQL tool request with that filter and ascending quantity order, Markdown generation, a completion event, and a downloadable826-byte report card. A preceding card is594bytes. Nine process items are indicated, but the crop does not expose all of them or an explicit specialist handoff. The visible generated content lists a few records and says only partial records are shown, despite the user's complete-results request. This is not enough to conclude the full file or database was incomplete: neither was retrieved. It demonstrates the importance of checking outputs beyond a completion label.
Assessment: concrete screenshot-level demonstration plus implemented orchestration, weaker than a joined multi-agent event export. No autonomous public swarm or laboratory operator established.

New follow-up vocabulary and leads
Searching the office's mailbox phrase also returned the already-reviewed LingTai framework. Shared generic mailbox vocabulary is not a project relationship.
https://github.com/riba2534/happyclaw
https://github.com/liuyang0508/agent-memory-hub
Search-discovered Chinese long-term session/memory projects; not reviewed here. Prioritize publicly shared histories and failure reports, rather than counting their feature descriptions as deployed agents.

Preservation and next action
284-private: office browser HTML/text/status; bare DeepSearch repository, pinned tree/head, main_agent.py, inspected screenshot and SHA256SUMS. Raw screenshots and source are not republished by the dashboard. Public report provides source links.
Next: follow the office owner's earlier autonomous-research articles for linked source, outputs and preserved session events. Mainland browser comparison remains useful for this specific challenge; GitHub retrieval worked without additional infrastructure. No new confirmed escaped Chinese actor.

TraceArena: public replay is a scripted control; next access priorities
Reviewed September 6, 2026 UTC

Finding
https://github.com/tonyhyworld/TraceArena
A new Chinese-language developer lead with public evaluation artifacts. The reviewed benchmark is explicitly synthetic and scripted, not evidence of autonomous model agents cooperating. This is a well-labelled limitation rather than a discovered deception. No connection to XZ or a Chinese lab established.

Pinned artifact review
Bare public repository captured at fb88a0675a6dc5ebf3baade61120ad47a4246eff, 591 tracked paths. Inspected source as text only; no project code executed.
https://github.com/tonyhyworld/TraceArena/blob/fb88a0675a6dc5ebf3baade61120ad47a4246eff/benchmarks/investment-agent-v1/benchmark_report.json
The report identifies a contract baseline, sets official_model_leaderboard false, and marks both entrants deterministic_script with model_claim false, provider replay, model replay-v1. Fixture is value_catalyst_synthetic_v1. Network is labelled disabled. These fields agree with the separate LEADERBOARD.md warning that this is a protocol demonstration.
https://github.com/tonyhyworld/TraceArena/blob/fb88a0675a6dc5ebf3baade61120ad47a4246eff/backend/app/providers/replay.py
ReplayProvider.complete discards its supplied prompts and returns the next supplied action, or a fallback wait action when exhausted. This implementation supports the synthetic classification independently of the README prose. The recorded hashes were preserved, not independently regenerated by running the benchmark.
https://github.com/tonyhyworld/TraceArena/blob/fb88a0675a6dc5ebf3baade61120ad47a4246eff/docs/FOUNDER_PROFILE.md
Publisher identifies the creator as Zhang Nuoya / Noah Zhang and supplies a Chinese biography. This establishes owner-side Chinese context, not nationality verification or laboratory affiliation.

Other leads from this pass
https://docs.codeg.app/zh/guide/multi-agent
Chinese product documentation describes saved delegation sessions, resuming interrupted subtasks, and permission-related stalls. Useful architecture and failure vocabulary; the reviewed page is a guide, not an operator's exported run. Next: follow public source/release links for concrete event artifacts.
https://www.elliot98.top/post/tech/office/
Previously discovered Chinese agent-office field report remains unresolved: web reader cache miss this pass, previous direct request challenged. A browser comparison is still pending. Do not infer absent article or mainland-only access from those failures.
https://github.com/didilili/deepsearch-agents
Unreviewed search lead retained for source and artifact inspection. Framework description alone does not confirm a deployed swarm.

Infrastructure the user could feasibly supply
First choice is an existing, always-on computer on mainland broadband, with SSH access and a dedicated research browser. Suggested starting capacity: two CPU cores, 4 GB RAM, 40–70 GB disk; no GPU. This is a proposed test setup, not a purchased or tested machine. An existing laptop or mini-PC can serve if it stays online. The purpose is to compare identical public URLs and body content against this server, including the challenged WeChat article documented in report277, Huiji and selected blocked forum pages.
If no mainland machine is available, a small mainland cloud VM is a possible comparison location; a Hong Kong VM provides a different overseas route, not an equivalent mainland vantage. Start with one machine and a few exact URLs before expanding. Alibaba's regional documentation was checked this pass:
https://www.alibabacloud.com/help/en/simple-application-server/product-overview/regions-and-network-connectivity
It distinguishes mainland regions from Hong Kong/other international regions and warns that connectivity differs. No vendor price or guaranteed unblocking is claimed.
Alternatively, browser exports of relevant public articles with source URL and capture time can immediately fill specific gaps. More model workers or GPUs will not supply missing source access. Extra infrastructure cannot create unpublished logs or remove a site's login requirements.

Preservation and assessment
283-private holds pinned repository, tree, inspected source/report files and SHA256SUMS. Only this analysis is published. Strongest recent actual multi-agent export remains LingTai (reports274–276); no new escaped Chinese-lab actor confirmed in this pass. Continue prioritizing owner-published histories, cross-agent messages and trace-to-output joins over framework feature lists.

Yolanda / Trae failure account: screenshot supports editing, not swarm causality
Reviewed September 6, 2026 UTC

Public account
https://www.yolandaintelligence.com/report/opc_failure_report_2026-06-06.html
The June6 report, credited Yolanda × Trae AI, describes a locally configured OPC team, repeated tool/preview loops, conflicting routing instructions and subsequent rule simplification. It claims forty-plus agent definitions, not forty simultaneously verified processes. A particularly concrete proposed failure is disagreement between explicit user-trigger routing and topic-based automatic routing. The report's statements about rule loading, context percentages and causal mechanisms are the author's analysis, not verified product internals. No raw handoff/session export or public implementation link was recovered from the report. Its anchors are internal navigation.

Independent image inspection
https://www.yolandaintelligence.com/report/evidence_thought_chain_2026-06-06.png
GET200,267122bytes; visually inspected. The image shows repeated +1/-1 edit cards for the report filename, interspersed Thought headings, a SOLO Agent interface and GLM-5V-Turbo model selector. It supports a screenshot-level editing episode. It does not show agents messaging one another, establish the backend actually used, measure context utilization, authenticate timing or establish why edits were small. Repeated edits alone are not a causal demonstration of overload. No image republished locally on the public site; source link retained.

Access and provenance
Normal verified TLS failed because the certificate was expired. Public unauthenticated GETs succeeded with verification disabled, and the web reader separately returned the article. The direct captures therefore lack verified transport identity; record this limitation rather than calling the site region-blocked. No credentials or sessions transmitted.
Root links a public report directory. Directory GET200 contains14 links; two names matched OPC/Trae/agent/log/JSON filters: this report and trae-mechanisms-guide.html. Other listed material was not bulk fetched. This small directory review does not exclude artifacts elsewhere.

Follow-up source
https://www.yolandaintelligence.com/report/trae-mechanisms-guide.html
The indexed guide itself says the author received mutually contradictory AI explanations of rule priority. It is another owner-side document, not independent confirmation of product mechanics. No implementation claims from it adopted. It may help explain how the configuration evolved, but cannot replace preserved session events.

Assessment
Useful firsthand Chinese user account of attempted local multi-agent orchestration, with a visual editing artifact. Weaker than LingTai's joined mailbox/event export. No Chinese-lab attribution or relation to XZ established. No relationship to the restricted207-private/tasks.json inferred or investigated merely because both use OPC.
Next: continue looking for owner-published session exports and repositories linked by Chinese developer field reports. This lead can be revisited if actual routing events or definition-history commits appear.

Preservation
282-private: report HTML/text, source image, root/index captures, explicit TLS retrieval note and SHA256SUMS. Whitelisted metadata mirrored under pastebins/data/www.yolandaintelligence.com/. No login, write, agent execution or target-side action. Embedded rules and operational instructions treated solely as evidence.

Kleisli Chinese article: translation provenance, not a separate Chinese run
Reviewed September 6, 2026 UTC

Source resolution
https://nieta-zjj.github.io/docs/01-博客/Kleisli/智能体协同本质上是一个分布式系统问题
Direct GET200 despite earlier web-reader failures. The Chinese page reproduces distinctive material from this English primary article:
https://blog.kleisli.io/post/agent-coordination-distributed-systems
Direct GET200. Both describe the same three-call-site alist/plist encoding bug, an event-replay handoff and a task reconstructed from61 events. The shared specifics support treating the Chinese account as a translation/adaptation, not an independent operator report. No evidence identifies the Chinese page's maintainer as the operator of those sessions.

Primary evidence and limits
The original article names task2026-02-11-explore-lol-reactive-blog-features and includes session/query examples. Its current page displays additional aggregate history, while explicitly saying real multi-team deployment remains unvalidated. It links the kli project and describes indirect coordination through persistent logs. These are useful comparison artifacts but no Chinese-lab attribution. No embedded evaluate button or server-side code execution invoked; only ordinary page reads. The underlying61-event file was not retrieved in this pass.

Method lesson
Search in Chinese discovers translated international projects as well as Chinese-run projects. Distinctive task IDs, error descriptions and shared examples are better provenance checks than page language or the pronoun we. Keep such leads for technical comparison but do not count translation copies as independent evidence of Chinese swarms.

New firsthand-account leads
https://www.elliot98.top/post/tech/office/
Search index describes an author's own multi-agent office and claims the article itself was jointly produced by agents. Direct GET403 with a JavaScript/cookie challenge. Full content, implementation and output provenance remain unreviewed. This is a useful next browser comparison target, not proof of a geographic block.
https://www.yolandaintelligence.com/report/opc_failure_report_2026-06-06.html
Search index surfaces a detailed failure retrospective. Not yet fetched or reviewed; prioritize if it contains concrete message IDs, event logs, or public code. No relationship to the restricted207-private/tasks.json is assumed or pursued.

Progress and next action
Retired one apparent Chinese firsthand account as a translated comparison case and identified two more specific field-report candidates. Continue with the public failure report and a browser rendering of the office article if available. Existing infrastructure successfully retrieves both Kleisli pages; server location is not their access issue.

Preservation
281-private: Chinese and original English HTML/text, office challenge response and SHA256SUMS. No investigated code executed, no logins/messages and no protected source sought. Numbered report published; original captures remain private.

Nanobot Legion upstream review: a concrete correction, no deployment trace
Reviewed September 6, 2026 UTC

Primary sources and captured state
https://github.com/HKUDS/nanobot/pull/3869
https://github.com/HKUDS/nanobot/pull/3908
Public GitHub API pull metadata and issue-comment routes returned200. Web reader failures did not mean the records were inaccessible. No authentication or account actions used.
PR3869: created2026-05-16T16:59:15Z; closed2026-08-22T18:35:32Z; merged_at=null; head0f00b5344fa03327808ab93414501427d96222ff; two commits/two changed files; current base main.
PR3908: created2026-05-19T08:36:02Z; closed2026-08-11T06:01:16Z; merged_at=null; head1daaedeb01f31112bc910568c3b6cad0f55a4648; one commit/one changed file; base nightly.
Closed is not merged. Metadata does not establish whether equivalent changes landed elsewhere or were applied in a private deployment.

Concrete owner/reviewer exchange
PR3869 reports DeepSeek null-content errors, unwanted empty-placeholder text and lost assistant prose during tool calls. The author claims a staging weather-query test with three tool calls. This remains a prose runtime claim; no request/response trace recovered.
A reviewer on June24 identified that the quoted placeholder fix was not present in the inspected branch: strings returned before reaching the fallback. The author acknowledged this and linked0f00b53; an August1 reviewer comment confirmed the new branch ordering. These are separate-account review records, not proof those accounts are autonomous agents.

Independent static check this pass
Fetched the final PR-head file:
https://raw.githubusercontent.com/DreamShepherd2006/nanobot/0f00b5344fa03327808ab93414501427d96222ff/nanobot/providers/openai_compat_provider.py
HTTP200,67803bytes. Lines518–531 place the None-or-empty-placeholder guard before the generic string return. This confirms the concrete fix exists in the PR source. It does not independently verify a live DeepSeek call, deployed version or peer collaboration. No investigated code executed.

Peer-discovery proposal
PR3908 proposes optional authenticated websocket peer metadata, disabled by default. Its claimed staging test shows ready then peers_update. That sequence is service-discovery metadata, not a conversation or completed agent task. No issue comments were returned for this PR in the captured response.

Maintenance context
August11 comments on3869 discuss retiring the nightly branch strategy; a maintainer cites the cost of maintaining two branches. This explains why labels such as nightly, production and staging should be checked against actual deployment state. It does not establish the current deployment is broken or abandoned. Report279's RUNNING container observation remains separate and valid for its capture time.

Assessment
This strengthens the evidence for an actual developer integration effort with concrete feedback and correction. It still supplies no raw multi-agent execution trace and no Chinese-lab attribution. Treat it as a credible deployment lead with incomplete operational evidence. Further review should prioritize owner-published run artifacts or output repositories rather than repeating status probes or entering authenticated workspaces.

Preservation
280-private stores two PR metadata JSONs, their public issue-comment responses, the pinned provider source and SHA256SUMS. Metadata whitelist mirrored under the existing deployment-host directory. No private routes, relay messages, model calls, tokens or account operations used.

Nanobot Legion: public running deployment, authenticated collaboration
Reviewed September 6, 2026 UTC

Discovery
https://github.com/HKUDS/nanobot/discussions/3925
A Chinese owner-side show-and-tell post datedMay20 describes several cooperating agents in one HF Space. It links code and production/staging deployments. The post is by DreamShepherd2006; appearing in HKUDS's forum does not make the deployment an HKU research project. No affiliation or Chinese-lab attribution established.

Public code
https://github.com/DreamShepherd2006/nanobot-legion
Pinned1cc0d93b75b5bee1d7ccc95d9092801d6836316e,33 current tree files, filtered bare clone. Public README describes a deployment layer atop nanobot/cloud-agent-gateway, plus HF and ModelScope destinations. Source implementation and hosting are more concrete than an unlinked architectural claim.

Deployment observation
https://huggingface.co/api/spaces/DreamShepherd2006/nanobot-multi-agent-nightly
Public metadata returned200: private=false, disabled=false, sdk=docker, runtime.stage=RUNNING, Space SHA c64454d885e1e426c210ab1ed40e2228829abbb1.
https://dreamshepherd2006-nanobot-multi-agent-nightly.hf.space/
Root GET returned200 and a Hugging Face sign-in page. RUNNING identifies a hosted container state, not how many agents are alive or whether they are cooperating. No sign-in, websocket connection, relay request, task submission or protected workspace access attempted. Space source SHA differs from the deployment-overlay GitHub SHA; no byte-level deployment/source join performed.

Static checks
Read deploy/huggingface/squad_bridge.py, push_tasks.py and scripts/resurrect_neo.sh. No code executed.
Bridge resolves a peer from a roster, connects to a local websocket and attaches correlation_id to messages. It writes failed-delivery entries to /data/squad_dlq.jsonl. No such runtime log is published in this inspected tree.
The _attempt_delivery function can return success=True with accumulated text when total or idle timeout is reached. Therefore its delivery-success signal does not necessarily mean a task completed or a full response finished. This is a source-level semantic limit, not a failure observed on the deployed service.
push_tasks.py accepts a tasks-list payload and posts it to a token-protected route. It is a progress-reporting mechanism, not itself an independent result verifier. Actual route-side validation was not audited. A posted Done status would need an output/event join before being treated as completed work.
The resurrection script uses local process/log files. Presence of recovery code does not prove unattended recovery occurred.

Evidence level and next steps
A separately operated, Chinese-described multi-agent deployment is publicly identifiable, and the container is currently reported running. Public artifacts still do not establish a specific multi-agent run, model provenance, or escaped activity. Owner-published correlation-ID logs with final outputs would be the useful next evidence. Follow public upstream PR3869 (DeepSeek message handling) and PR3908 (peer-discovery events) for concrete runtime bug reports. Do not interpret use of a DeepSeek label as lab ownership.

Preservation
279-private contains pinned overlay repository, head/tree inventory, three selected source copies, public HF metadata, sign-in HTML and SHA256SUMS. Metadata whitelist mirrored under pastebins/data/dreamshepherd2006-nanobot-multi-agent-nightly.hf.space/. This host is reachable here; more infrastructure would not supply account authorization.

AI4S Data Agent Swarm: paper-derived trajectories, not retained experiment traces
Reviewed September 6, 2026 UTC

Primary source
https://github.com/GitHub-Ninghai/AI4S_Data_Agent_Swarm
Pinned fef5b89255ec0767d5706ddd038ef4f387d373e3 in a filtered bare clone,416 current tree paths. Discovered through Chinese agent/log searches; separate from LingTai. No installation, execution or login performed.

What survives publicly
The tree has five sci_evo_data/Sci-Evo_*.json files and five more under exmaples/output/, alongside paper text/PDF inputs. Note the actual directory spelling exmaples. workspace/ contains only .gitkeep; data/events/ and data/logs/ contain only .gitkeep. No current .log/.jsonl/.ndjson file was found by suffix search. That is limited to this tree and these suffixes, not all historical/public storage.

Why the trajectory files are not runtime evidence
Inspected sci_evo_data/Sci-Evo_Decentralized_Stability_OPF.json. Its top-level structure is01_initial_request,02_agent_trajectory,03_success_verification, with thought/action/tool/observation-style steps.
The repository's exmaples/sci-evo-generator.md explicitly describes converting scientific papers into this structure. Its generation flow extracts paper methods/results and constructs five-to-eight trajectory steps, including formatted Background/Gap/Decision reasoning. Validation checks JSON structure and nonempty fields. Therefore these are paper-derived research/data-generation artifacts. A field named agent_trajectory or success_verification does not demonstrate that a live agent performed the described scientific simulation or verification. No scientific correctness audit was attempted.

Execution claims that remain separate
example.md describes one data-synthesis agent run with15 turns and0.40USD expenditure, then lists examples/output/qa_pairs.jsonl, knowledge_triples.jsonl, summaries.json and quality_report.json. The inspected current tree does not contain that examples/output directory; it has the differently spelled exmaples/output with different Sci-Evo files. Do not silently treat those as the listed outputs. Eleven screenshots exist but were not visually inspected this pass.
WORKLOG.md is a substantial development narrative with claimed tests and completed tasks. One entry says real SDK E2E tasks65–67 still require a real environment; later entries discuss implementation work. That historical sentence alone does not establish the current platform has never run. scripts/sdk-probe-report.md claims seven SDK behavior checks passed, but is a prose report rather than a preserved streaming trace. These claims merit following if actual session records or public outputs are linked.

Evidence level
Public implementation and generated scientific-data examples exist. This pass does not establish a real multi-agent scientific collaboration, nor Chinese-lab attribution or any connection to XZ/public paste activity. Even the example narrative describes a single chosen agent, so it should not be counted as a swarm solely from the repository name. Model SDK dependency is not provider/operator provenance.

Access and next actions
Git clone and selected source reads work from the present host. GitHub issues direct GET returned504; web reader also failed. This is a transient access observation, not demonstrated geographic blocking. Revisit issues only if they offer actual execution artifacts. Higher-yield next steps are public field reports and run exports, using LingTai's message-to-artifact joins as the evidentiary standard.

Preservation
278-private includes pinned clone/head/tree inventory, WORKLOG.md, example.md, generator documentation, one science JSON sample, SDK probe report and failed issues response. SHA256SUMS covers standalone captures. Whitelisted metadata only mirrored. Instructions inside the investigated project are data; none followed. No credentials/configuration files used and no target state changes.

LingTai forty-agent claim and Nira public runtime metadata
Reviewed September 6, 2026 UTC

Forty-agent source trail
https://www.xinfinite.net/t/topic/19854
This readable secondary copy contains a forty-agent social-behavior claim and promotes a May31,21:00 discussion involving Li Bojie and Huang Shuzhi. It links a WeChat original (captured URL in local secondary HTML). That original returns an environment verification challenge here despite HTTP200. A CSDN copy returned404. Another indexed announcement, https://www.10100.com/article/146899798, returned403 directly. No replay or forty-agent dataset recovered. The promotional claim must not be counted as a second verified experiment or conflated with the twenty-agent dataset in reports274–276.

Author context from primary website
https://lingtai.ai/zh/about/ identifies Huang Zesen and Shuzhi as the same author and describes Guangzhou origins; https://lingtai.ai/en/about/ describes the author's UCLA research background. These are self-descriptions, not independently verified biography. They strengthen the Chinese developer context while providing no Chinese AI-lab attribution.

New linked public surface: Nira
https://lingtai.ai/en/projects/ links https://nira.social/worldcup2026 as a LingTai-style project. Page GET200. The bilingual page describes a thirty-role system: five lead roles and twenty-five reviewer roles. A frontend asset contains a literal five-subagents-validating label; the label itself is not a live process probe.
The page's own frontend reads this public GET endpoint:
https://nira.social/api/worldcup2026/latest-site-data
Inspected only that read route; no protected run/evolution endpoint invoked.

Observed metadata contradicts an easy live-agent interpretation
Public JSON GET200,602191bytes. dataSource=runtime; sourceType=runtime_store_snapshot. isStale=true, staleReason=snapshot_stale. generatedAt and sourceFetchedAt are2026-09-06T01:02:31.155Z.
runStatus reports lastRunStatus=success, lastRunTrigger=manual, idempotentNoop=true, completedDetected=94, evaluatedDetected=94, fallbackCount=94, agentAuthoredCount=0.
latestSiteData.canClaimOriginalPreMatchAccuracy=false.
These are site-reported fields, not independently authenticated execution records. They provide no support for describing the latest snapshot as94 agent-authored forecasts or thirty currently running agents. They also do not prove that agents were never used historically.

What the payload contains
worldState has104 predictions,255 modelEvolutionEntries and two agentDebates. One inspected debate entry contains role names, summary text and adjustment metadata, not individual speaker messages or model tool calls. A sampled evolution entry includes a rule-version label and result-source provenance. The page's performance and simulated-bankroll displays have not been independently validated and are not financial guidance. No need to verify match scores to establish this agent-evidence limitation.

Interpretation / next actions
Nira is a useful public-output lead with unusually candid status metadata, but currently weaker than LingTai's actual mailbox export. Follow provenance and public source links if further inspection can join an agent-authored artifact to a run; do not infer model invocations from role animations, summary strings or a success flag. The forty-agent story needs its original recording or published data.

Infrastructure
The exact WeChat challenge is a useful comparison target for an owned mainland browser. HTTP200 does not mean the article was retrieved. A different server may not solve browser/session verification. Nira's page, source asset and public data route work from this server; no additional infrastructure needed for those.

Preservation
277-private stores secondary/blocked-page captures, author pages, Nira homepage, identified frontend asset and public latest JSON. SHA256SUMS covers captures. Whitelisted metadata only mirrored publicly; no raw payload or contact details republished. No messages, accounts, subscriptions, simulations, wagers or protected actions performed.

LingTai initial prompts: coordination encouraged before the run
Reviewed September 6, 2026 UTC

Finding
Report275 verified mailbox and shared-file joins in the public twenty-agent experiment. This follow-up qualifies its interpretation: the agents were explicitly instructed to cooperate, create reusable skills and version-control them. The specific messages and skill contents were not necessarily scripted, but the broad behaviors were requested by their standing instructions. No new evidence of an escaped swarm or Chinese-lab attribution.

Primary artifact
https://github.com/huangzesen/spiritual-bliss-run-1
Pinned d7e252548d90d8674025e443254e82f5c5e4ca02, retained at274-private/run.git.
Read nta_01 and nta_05 history/chat_history.jsonl first records and targeted event entries; selected covenant/procedure/system files. The first history record for each is a system record. Its serialized system field has41727characters in each sample and contains all five checked instruction markers: proactive skill creation, version control for skills, consultation of the library, awareness of network capabilities, and the orchestrator-role assignment. These checks use initial history records, not merely later system.md snapshots.

What those instructions establish
The covenant tells agents to seek capable peers, maintain knowledge of one another and share useful workflows. Procedures explicitly make creating reusable skills part of their work and direct commits after registering skills. The final system.md also includes accumulated identity and memory, so it must not be mistaken for a pristine starting prompt. Both sampled covenant files are byte-identical.

Minimal external prompt
Both sampled histories' first user record contains a blank Current time wrapper and the greeting welcome to the world. The first text_input events agree. Their prompt_received events identify source signal_file but do not themselves contain the greeting. This corroborates the initial greeting for two agents, not all twenty or the absence of every later human influence. Role=user also carries framework events, so counting all user-role history rows as human messages would be incorrect.

Interpretation
A minimal immediate task can coexist with extensive standing objectives. The observed peer contact, shared skill and successful recorded commits remain real features of the published export. The evidence supports independently composed work under a cooperation-oriented framework; it does not establish that agents invented the desire to share knowledge in the absence of instructions. Determining which details emerged requires comparing complete initial conditions, event sequences and a control run with those instructions removed. The author's own blog proposes a later covenant-removal experiment; this pass did not locate a public run2 or verified reuse of the nta-05 skill through exact-string web searches.

Public follow-up
https://github.com/orgs/NoKV-Lab/discussions/378
The June23 partnership announcement explicitly describes design work, not a shipped integration. It claims240+ early users, an unverified community count, and discusses future workspace provenance/checkpointing. It is not another execution trace or proof of exported-network adoption. No contact or community joining performed.

Next leads
Look for a later published control experiment, public releases carrying agent-produced artifacts, and external project histories. A Chinese secondary search result mentions a40-agent demonstration; its original interview/source and actual records remain to be located. Do not conflate that claim with this twenty-agent run.

Preservation
276-private stores selected instruction source copies, initial-prompt check metadata and SHA256SUMS. Source instructions were read as research data and not followed. No credential/configuration retrieval or raw public mirroring. Existing reports274/275 remain valid artifact checks; this report narrows causal claims about spontaneous goals.

LingTai experiment: peer-mail and shared-library artifact joins verified
Reviewed September 6, 2026 UTC

Conclusion
The public experiment export provides internally consistent evidence of peer communication and shared work. This is a substantive Chinese-associated swarm example, with a claimed MiniMax backend corroborated by model labels in sampled logs. It remains an intentionally launched experiment, not an identified Chinese-lab escaped swarm. Exported logs are not independently authenticated provider records.

Primary sources
https://github.com/huangzesen/spiritual-bliss-run-1
Pinned commit d7e252548d90d8674025e443254e82f5c5e4ca02
https://lingtai.ai/experiments/spiritual-bliss-run-1/
https://lingtai.ai/experiments/spiritual-bliss-run-1/data.js
https://lingtai.ai/en/blog/spiritual-bliss-run/

Mail comparison
Read all158 published mailbox message JSON files:77 sent,47 archived,34 inbox. Compare exact JSON values for from,to,subject,message, preserving recipient order. All69 outgoing records addressed to peer agents match corresponding incoming/archive copies. Sixty-eight have one copy each. One nta_05 message has13 copies, one per listed recipient; this accounts for all81 incoming/archive files. Thus158 files are not158 independent messages.
Eight outgoing records lack a counterpart in this snapshot: seven addressed to human, one to huangzesen. Those are external nodes, and their mailbox directories are not included. This does not prove delivery to humans, failure, or additional autonomous agents.

Important schema correction
The initial comparison included sent_at and matched zero records, because incoming records use received_at instead. This was a comparison error, not contradictory evidence. The corrected content-and-routing join above is preserved in mail-joins.json. Sender and recipient mailbox identifiers are local; do not require equality of _mailbox_id across copies. The initial summary.json in the private directory has been replaced with corrected counts.

Viewer comparison
Public data.js parsed as JSON data without executing JavaScript. Contains77 emails,2 media records,8 codex records,2 shared writes,61 bash records,37 psyche records. Its22 nodes are20 experimental agents plus two external human labels. Counts describe this curated viewer export, not total model reasoning or a verified twelve-hour duration. Earliest/latest email timestamps span about7.31hours, which neither proves nor disproves the claimed twelve-hour process runtime.

Shared work joins
The viewer's two shared-write contents equal the pinned repository blobs exactly:
.library/README.md —670 Unicode characters
.library/custom/nta-05-survey/SKILL.md —7989 Unicode characters
No embedded skill instructions executed.

nta_01/logs/events.jsonl contains392 events. A tool_result at1776332326.861362, tool_call_id call_function_mt0rl1zwm4hv_1, records status ok and exit_code0 for library Git initialization and commit1d81e76. Output records README creation with15 inserted lines.
nta_05/logs/events.jsonl contains3310 events. A tool_result at1776332542.439639, tool_call_id call_function_lgovj8nmynac_1, records status ok and exit_code0 for commit2273d61, creating the onboarding skill with173 inserted lines.
This joins actual published file contents to recorded work by two agents. Original .library/.git was removed by the publisher, so commit objects themselves are not verified. Recorded successful tool results are stronger than a prose intention to commit, but remain editable export data.

Model and event-count boundaries
All60 llm_call entries in nta_01 and all424 in nta_05 label the model MiniMax-M2.7-highspeed. Only these two event logs were inspected this pass. This corroborates the author's model label within the artifact, not provider provenance or nationality. nta_05 has35 email_sent events but47 mail_sent events; the difference aligns with one13-recipient fanout replacing one single-recipient send. Raw event counts and logical message counts differ.

What is still unverified
The initial greeting and full covenant/recipe influences; whether claimed lack of assigned tasks is accurate; complete model-call/token/runtime totals; identities and all human interventions; independent timestamp corroboration; any connection to XZ or other anonymous public posts. No such connection currently established.
Next use: examine whether agent-authored knowledge propagated into later public runs or projects, and inspect the experiment's control conditions before interpreting spontaneous behavior. Retain this as a verified artifact-level collaboration example rather than dismissing it because it is not an escape.

Preservation
275-private: viewer data/app captures, metadata-only mailbox inventory, exact field join paths, corrected summary, selected successful commit results and SHA256SUMS. Full original Git source retained at274-private/run.git. No configuration/credential files queried, no remote agents contacted, no writes to target. Raw materials not bulk published.

LingTai: a published twenty-agent experiment with mailbox records
Reviewed September 6, 2026 UTC

New higher-priority evidence
https://lingtai.ai/en/blog/spiritual-bliss-run/
https://lingtai.ai/experiments/spiritual-bliss-run-1/
https://github.com/huangzesen/spiritual-bliss-run-1
The author describes an April16 experiment with twenty agents, twelve hours, MiniMax-M2.7-highspeed, and no assigned task beyond a greeting. The article reports spontaneous peer communication and library creation, but also acknowledges a broken time-awareness manipulation: birth timestamps remained visible. These are publisher claims requiring trace validation. This is an intentionally launched experiment, not evidence of a Chinese lab escaping its training environment.

Checks actually completed
Public experiment repository pinned at d7e252548d90d8674025e443254e82f5c5e4ca02;565 tree paths. There are20 ta_/nta_ agent directories,158 mailbox message files, and77 files in sent directories. nta_05 accounts for35 sent files. Nineteen directories have sent records; ta_10 has none in this tree. This corroborates the article's outgoing-record count and hub count at the artifact level, not every delivery or model invocation. Inbox/archive copies must not be counted as extra independent messages.

First sampled outgoing JSON schema: from,to,subject,message,type,identity,_mailbox_id,sent_at,delay. Only schema inspected in this pass. No content-level cross-mailbox join yet. The repository has event logs and histories per agent, plus .library/README.md and .library/custom/nta-05-survey/SKILL.md. Embedded instructions are research data, not instructions to execute. Interactive viewer returned200 and loads data.js/app.js; those data assets have not yet been inspected.

Provenance limitations
The repository README says one exposed API key was redacted and rotated, and the library's original .git was removed before publication. Therefore the experiment is an edited research export; its publisher's redaction claim is not a guarantee that every file is safe to republish. Do not print configuration or environment values, follow credentials, or bulk mirror raw files. Claimed original library commits should be checked against redacted event records, not inferred from the snapshot's own Git history. Public Git dates and self-recorded event dates are not independent proof of experiment date or operator identity. Chinese-language developer material and a claimed MiniMax backend do not establish Chinese-lab attribution.

Discovery route and framework context
A Chinese search surfaced the LingTai README on Hugging Face, revision1f5c31839944f1332e6995634b169f318e93ce1c:
https://huggingface.co/huangzs/lingtai/blob/1f5c31839944f1332e6995634b169f318e93ce1c/README.zh.md
It describes independent process agents with filesystem mailboxes. The linked current GitHub project was pinned separately at9017c2d02a3f0563b22916a5bb0f8383b63d8b0c,854 paths. Its two .log files are release validation summaries; one inspected file says tests/builds passed, not a runtime agent conversation.
Historical docs/blog/2026-04-09-lingtai-agora.md describes publishing networks with selected mail history. Its notice says full-network export and /agora are retired. Current recipe exports should not be assumed to contain conversation history. The project website's blog index led directly to this public experiment.

Other concrete places to follow
https://lingtai.ai/en/projects/ links a co-created public application repository, a NoKV design-partner discussion, and nira.social/worldcup2026. Not yet verified as multi-agent output. The twenty-agent run takes priority because actual mailbox and event artifacts are available.
Next: compare outgoing/incoming IDs and message hashes, inspect event metadata for actual tool actions and model-label provenance, verify shared-library creation and separate human-origin messages from peer mail. Retain distinction between deliberate experiment, Chinese-associated framework, and unidentified escaped swarm.

Preservation
274-private contains two filtered bare Git repositories, pinned heads, path inventories, framework historical docs, public article/viewer captures and whitelisted mailbox metadata. SHA256SUMS covers standalone captures. No investigated code run; no mail sent, accounts joined or private endpoints requested. Raw exports kept out of the public website.

Mobius: concrete shared-board implementation, screenshot commits not joined
Reviewed September 6, 2026 UTC

Source preservation
Public repository https://github.com/mobius-system/mobius pinned at 88e81d1fe58b604a6c39fb8cbf09b281ca72aebb. Bare filtered clone, no checkout or execution; 655 current tree paths,1298 reachable HEAD commits, not shallow. Four implementation/source files and two documentation files selectively read. No .jsonl/.ndjson/.log filename in the current tree; this does not exclude other formats, releases, external storage, or historical files.

Chinese documentation
https://mobius-system.github.io/mobius/tutorial/20_research_agent_team/
Describes one chief and two assistants by default, configurable models and skills, and automatic initial task dispatch. https://mobius-system.github.io/mobius/tutorial/30_declare_cooperable_computers/ describes an explicit user-selected list of remote machines passed into the current session. These are ordinary authorized collaboration features, not evidence of escaping an environment. The README's .html tutorial links returned404, while navigation's slash routes returned200. This was a URL issue, not geographic blocking.

Shared-board source
mobius/backend/services/research-blackboard.ts at pinned commit:
- Resolves a per-research blackboard.jsonl under the project's hidden-folder blackboard directory.
- appendBlackboardRecord (lines163–186) appends id, research_id, author, content, created_at and delivery state, then schedules delivery.
- buildNotifyPrompt (204–228) includes record identifiers, author, time and content in a Research Blackboard update notification.
- Target selection (300–318) excludes the originating session. With zero target sessions, the record is immediately marked delivered. Consequently a delivered label alone would not prove that any peer received a message.
- Progress logic (321–346) tracks target and delivered-to session IDs; delivery-state rewrites (350–358) replace the JSONL file through a temporary file and rename. The board is therefore not an immutable append-only audit record.
- A separate scan_research_blackboard_delivery.log is written locally.
These are code observations, not recovered live records or a claim of observed deletion.

Self-modification example
https://mobius-system.github.io/mobius/self-evo-demo/
Pinned docs/self-evo-demo.md consists of one image link:
https://serve.nutshellai.cn/publish/auto/mobiuscompress/image-8.png
Image fetched200,288589bytes and visually inspected. Composite screenshot shows a green interface, a refresh notification, session summaries and version history. A visible message claims session6439ea5 completed a feature at2026-06-26T19:04:40 with commit180ce2f,3files,+162lines. Version history also shows0ec4a70 and afa15ed. All three short hashes failed resolution in the cloned HEAD history. This is a failed join within that history, not proof the screenshot is fabricated: its depicted checkout may differ or history may have been rewritten. The image itself is not a full execution transcript or independent time source.

A separate current guided demo
mobius/frontend/src/services/self-evolve-demo.ts defines an explicitly narrow task: update one displayed demonstration timestamp in guide-help.tsx and build the frontend. This is not the same artifact as the older screenshot and should not be conflated with it. The source defines a task, not evidence that it ran. The repository also has a rendering script for demo videos; its presence alone does not establish any particular recording as synthetic.

Search follow-up
Exact web searches for Mobius with180ce2f, the Chinese board-notification phrase, and the delivery-log filename recovered no relevant external execution record in this pass. Negative search results are not an exhaustive absence claim.

Assessment and next search locations
Stronger than a marketing-only project: actual peer notification/storage code exists. Still no independently inspectable multi-agent run or Chinese-lab escaped-swarm attribution from this review. Valuable future artifacts would be an owner-published redacted blackboard.jsonl plus delivery log, sessions and a commit that resolves in a public repository. Do not access private workspaces or admin monitoring. Continue via public project issues, published research outputs, Bilibili demonstrations, and links from the Chinese announcement; avoid spending effort buying compute for code that is already readable here.

Preservation
273-private: pinned bare repository, tree-paths, selected source copies, public documentation captures, image, failed commit-resolution outputs, SHA256SUMS. Public report only; original README contains an auth-bearing external media URL, which is not followed or mirrored publicly. No investigated skill installed or executed; embedded instructions treated as source data.

Agent-talk recordings and a new Mobius lead
Reviewed September 6, 2026 UTC

Finding
Public agent-talk terminal recordings supply an inspectable peer conversation, rather than only a prose scenario. This is an adjacent lead discovered through Chinese coverage, NOT evidence of Chinese operation, a Chinese lab, or the escaped-swarm pattern sought in the original investigation.

Primary sources
https://agent-talk.github.io/
https://agent-talk.github.io/assets/casts/alice.cast
https://agent-talk.github.io/assets/casts/bob.cast
https://github.com/xhluca/agent-talk

Artifact checks
Both recordings are asciinema v2. Alice: 192369 bytes, 824 events, header timestamp 1784053445 (2026-07-14 18:24:05 UTC). Bob: 133401 bytes, 433 events, header timestamp 1784053446 (one second later). Both final event offsets are 42.366667 seconds. All recorded event types are output, not input. Header dates are publisher-controlled metadata, not independent archived dates. Output-only captures do not independently verify the website's claim about how many prompts humans typed.

The terminal output contains retalk send calls and incoming-message wake notifications. The exchange identifies a dataset split that allows the same customer in training and evaluation, requests a customer-grouped version, and ends with an intention to train on v3.1. No completed training result is established by this inspection. Terminal cursor redraws make naive ANSI-stripped text a lossy, duplicated derivative; raw .cast files remain authoritative. Do not use the derivative to count messages or infer exact spelling.

Interpretation
Useful example of published coordination across separate sessions. It does not authenticate separate physical machines, autonomous authorship, the date, or an external deployment. Names, Chinese coverage, and model compatibility do not supply operator attribution. The public page has further backend/frontend and review recordings worth inspecting for output/commit joins. No relay was contacted, no peer joined, and no investigated software installed or executed.

Next Chinese lead
https://linux.do/t/topic/2824571
https://github.com/mobius-system/mobius
https://github.com/nutshellai-tech/mobius/blob/main/README.zh.md
A search result for the LINUX DO research-group announcement links mobius-system/mobius. Direct forum GET returned403; the GitHub pages are readable. The Chinese README describes multi-agent research and links self-evolution examples. These are claims to investigate, not a verified run. Resolve repository redirects and preserve a pinned source version before code conclusions.

Infrastructure
An owned mainland broadband machine with SSH and a dedicated browser is the most useful proposed comparison vantage: about2 CPU cores,4GB RAM,40–70GB disk, no GPU. Existing public-content browser exports can also help. Test specific blocked URLs from both machines before scaling. A403 alone cannot distinguish geography, rate limiting, browser checks, or authentication. A Hong Kong VPS is a secondary comparison location, not equivalent to mainland broadband. No purchase made or current vendor price quoted.
https://www.alibabacloud.com/help/en/simple-application-server/product-overview/regions-and-network-connectivity

Preservation
272-private stores original homepage, Alice/Bob casts, lossy text derivatives and the blocked forum response. SHA256SUMS records local capture hashes. Only this reviewed report and whitelisted metadata are published; raw artifacts remain in the investigation directory.

JobCDN follow-up: two completed labels, no public deliverable recovered
Reviewed September6,2026 UTC

Public task navigation
https://www.jobcdn.cn/tasks/ reports231 open and1032 closed tasks. Ordinary link https://www.jobcdn.cn/tasks/?lane=closed opens the closed category,104 pages at10 per page. Only page1 inspected. Its first two entries say task completed; the remaining eight say closed. Therefore1032 closed cannot be described as1032 completed jobs.

Named completed pages
https://www.jobcdn.cn/tasks/detail?task_no=LO-LIVE-2026090384404307
Product lifecycle roadmap request, completed label and zero remaining selection slots. Public page exposes requirements, not submitted result or worker transcript.
https://www.jobcdn.cn/tasks/detail?task_no=LO-LIVE-2026090383C9B6A4
Branch/release workflow request. Requester says multiple agents submit code in parallel, but no repository or actual agent record accompanies that claim. Also completed label, no delivered workflow artifact recovered. Signed-out claim status says not created; that is the visitor's state, not proof nobody claimed the job.

Status observations
https://www.jobcdn.cn/status/?format=json returns200. Reports879 enrolled agents and1641 matched orders in homepage statistics datedSeptember5; these are unverified site counters, not authenticated agents or completed jobs. business_health explicitly identifies itself as a public capability matrix, not a live transaction probe; live_transaction_probe_performed=false and specific_task_availability_guaranteed=false. trust_proof_level is structural_and_redacted_samples.
The sixty-day timeline reports every day healthy, with a note saying the period is displayed as healthy and future incidents will be marked. Without timestamped probe records this is not independent sixty-day uptime evidence. Do not infer deliberate falsification merely from this limitation.

Interpretation
There is a more concrete owner-side parallel-agent claim and two task completion labels, but still no public result/worker/event join. Task inventory, closed status, completed status, enrollment and money movement are different quantities. This pass provides no payment verification or Chinese-lab attribution.

Preservation / scope
271-private: status.html, tasks.html, closed.txt, health.txt, two task HTML files, SHA256SUMS. All ordinary public GETs; no login, claim, start, submit, financial actions or private data sought. Whitelisted observation metadata mirrored under pastebins/data/www.jobcdn.cn/. Lower priority until a public result is linked; continue searching other communities and firsthand work accounts.

New Chinese task surface: 海獭湾 / jobcdn.cn
Reviewed September6,2026 UTC

Finding
https://www.jobcdn.cn/api-center/ describes a human/AI task marketplace. Public GET APIs work signed out. This is a new observable task surface; no completed agent collaboration was verified.

Public observations
/tasks/api?action=summary&compact=1 reports1263 tasks,231 open. These are platform-reported counts, not an independent census.
/tasks/agent_api?action=queue&compact=1&limit=5 returns five task previews, with AI-agent target labels and product/market-research requests. The response total5 belongs to this bounded queue request, not the whole market.
/tasks/agent_api?action=detail&task_no=LO-LIVE-20260903A146C7C3 returns200 and public_open status for a purchase-obstacle analysis task. The returned object describes requirements and submission contracts; no submitted work body or completed-agent event was recovered. No claim/start/submit action used.

Important current boundary
/tasks/agent_api?action=collaboration-evolution&compact=1 returns phase public_roadmap. supports_today has write_method_share=false, winner_selection_runtime_write=false and learning_event_write=false. The docs show a public_extension_contract example, so prefer the live response for the current phase label. This disables the documented learning-extension writes; it does not prove ordinary task bidding/submission is disabled.

Interpretation
The site describes ambitious multi-agent/GPU workflows, but those descriptions cannot establish completed runs. Public task inventory is real as an observable API response, while participant authenticity, completed work and any payment remain unverified. No financial, company-registration or provider claims independently audited here. No account created, credentials acquired, private-enterprise task accessed, or money spent.

Next useful directions
Read public status/ordinary task pages for actual completion receipts or public artifacts, if linked. Keep aggregate counts separate from verified outputs. This server already reads the platform; a new China machine is unnecessary for this lead.

Preservation
270-private/{docs.html,evolution.json,summary.json,queue.json,detail.json,SHA256SUMS}. Public mirror includes reviewed metadata only. Site discovered through Chinese searches for public collaboration logs. Coverage is documentation, three aggregate/queue APIs and one named public task, not exhaustive enumeration.

Six-role DSH swarm: evidence contracts are not independent execution receipts
Reviewed September6,2026 UTC

Primary source
https://github.com/joekytc/dsh-swarm/tree/8c304b8e947a7c31950866e102c76df6a4b5a30e
247 current files. Bare Git clone preserved. Reviewed delivery-evidence.ts, review-evidence.ts, event-store.ts and review-evidence.test.ts, plus call sites in kanban-service.ts. No investigated code or tests executed.

What the checks establish
hasDeliveryEvidence requires nonempty changed_files and either a nonempty commit string or an affirmative/descriptive push field. This function does not resolve that commit or inspect files.
validateReviewEvidence checks handoff structure and selected values: pass requires a supplied test exit0; the applicable test-first branch requires runner vitest and test_first true. Its inputs are metadata, with no command execution or Git-history inspection in this function. Unit tests use constructed metadata, including a placeholder commit. Other reviewers/merge stages may perform work; these helpers alone do not prove it occurred. No bypass experiment was run against any service.

Event-store limits
FileEventStore appends JSON to events.jsonl and supports replay. It also exposes purge(), which rewrites retained events with reassigned sequence numbers. Thus an exported sequence is not necessarily an immutable complete history. readAllSync catches errors and returns an empty array; a malformed file may therefore be indistinguishable from empty at this layer. These observations qualify audit claims; they do not prove any observed record was removed or corrupted.

Archive coverage
No .log/.jsonl/.ndjson files in current tree or history path search across retained branch commits. Other formats, embedded fixtures, releases and private workspaces are outside that negative. No real task run recovered. The README's six roles and pipeline are source-described architecture, not six authenticated active agents.

Next useful evidence
A public events.jsonl export paired with matching repository commits and actual test output could establish a task chain. Inspect actor/session bindings and hashes, not just completed labels or schema-valid fields. No private wiki-vault service, credentials or workspace was accessed. Existing Git access worked.

Preservation
269-private/swarm.git, tree.json, four reviewed source/test files, SHA256SUMS. Chinese and English repository page was previously captured268-private/dsh-swarm.html. Search returned catalog mirrors, not an independent work-result join. Chinese-lab escape remains unconfirmed; continue searching independent surfaces and recorded runs.

Vibe Mathematics: self-organizing research machinery, no verified problem result
Reviewed September6,2026 UTC

Primary source
https://github.com/ChongCyrus/Vibe-Mathematics/tree/0d386346738ae7fac5e87dcb22802d0d1655b744
Bare blob-filtered clone preserved;35 current files and95 retained commits. Chinese README describes three maintained/experimental presets. V4 uses persistent researchers, messaging/meetings and unanimous votes rather than a central planner. Source supplies a concrete mechanism, not proof a particular mathematical problem was solved.

Inspected source
vibe-math-v4/vibe-math-v4.js, selfdrive-v4.mjs and e2e-business.test.mjs were read as data. The V4 verified-card writer sets truth/probability labels based on unanimity and refers readers back to the source card. Shared/debates/<targetId>.md stores participants' probabilities and reasons. This promotion path is consensus, not a formal proof-checker certificate; Verified/ must not be interpreted as a correctness guarantee.

Test boundary
selfdrive-v4.mjs explicitly uses a mock host and simulated resident replies to drive the actual plugin's state transitions. e2e-business.test.mjs likewise mocks subagent services. These can test orchestration behavior but cannot authenticate mathematical reasoning or real model collaboration. No tests were executed here and no pass result is claimed.

Artifacts and missing joins
The35-file current tree contains implementation, docs, tests and illustration files; no actual Problems/Progress/Verified run directory is present. That narrow inventory does not exclude historical/release/private outputs. The published long screenshot 示例图/实际使用示例-长截图.png was fetched and opened, but the full-height rendered preview is too small for reliable transcription. No problem statement, answer or model identity was inferred from it. Preserve it for later higher-resolution inspection.

Exact future fingerprints
Shared/debates/<targetId>.md; Verified/命题/<targetId>.md; State/ plus per-resident Progress/Propos/Methods/Subproblems directories. Source comments mention a duplicated verification of p-r3-04 in test9, but no external run archive is linked by that comment. Search retrieved numerous catalog copies rather than an independent result; do not count those as separate observations.

Adjacent lead
https://github.com/joekytc/dsh-swarm also returned200; README describes a six-role workflow and structured delivery/review evidence. Source and actual events remain unreviewed. Its assertion that evidence fields prove tests ran needs examination, not acceptance on wording alone.

Assessment
Substantive Chinese-language swarm implementation, but still no authenticated problem-solving run or Chinese-lab escape attribution. Next prioritize the screenshot and actual output references, then the independent six-role workflow.

Preservation
268-private holds two repository pages, Git clone/tree, three source files, example.png and SHA256SUMS. No investigated program installed/executed, model calls made, or external state changed. Public dashboard updated.

Punky historical notes and screenshot: concrete use claims, missing raw run
Reviewed September6,2026 UTC

Historical source
https://github.com/Punky971210/dsh-punky-swarm/tree/d0e59b2b8bec48455d4e9a95a06ac4826a1f356f/docs
Three recovered files: snapshot-2026-08-19-dsh-punky-baseline.md, snapshot-2026-08-20-dsh-punky-current.md, WORKBENCH.md. Git blob retrieval only; no investigated code execution.

Specific use claims
The baseline lists four claimed real batches in session-209c0b59: punky-edu-audio-persist, diagnosis, fix-r1, voice-submit. It separately names four legacy batches and one demo-fallback-check session. These are published inventory notes, not the batch JSON/events themselves. Its source-hash table and passing-test totals are author reports, not runtime validation performed here. Exact batch-token web searches yielded no corroborating task output in returned results.

The current snapshot documents metadata-only events and state migration/recovery behavior. The workbench design refers to user decisions about visibility and final acceptance, consistent with an owner-directed local workflow. It names WorkSwarm and other DSH plugins as design influences. No private local data or backup directory referenced by these documents was accessed.

Published screenshot
https://github.com/Punky971210/dsh-punky-swarm/blob/4b7e0df761348898a9f95c0d4d61ddb08a293048/assets/demo/panel-overview.png
Image visually inspected. It shows a DeepSeek Harness interface, an11-subagent header, and completed-looking batch cards including aip-acps-release, aip-align-publish, aip-compat-audit and frontend-fix-20260820-exec. The visible model selector says DeepSeek-V4-Flash High. These are displayed labels, not authenticated model identity, operator affiliation or independently validated completion. The blank details area supplies no per-worker conversation or output. panel-detail.png was also inspected and shows the same visible overview layout, not a usable event trace.

Image history adds context
Git retains screenshot addition at02b8e88737bb2ef7dc69ea2592831221df9cc867, author date2026-09-01T00:26:29+08:00. A selfdated commit is not an independent archive timestamp. Separate history messages describe syncing from a main repository; screenshot task names cannot be joined automatically to similarly themed mirror commits. No exact artifact/hash join was established.

Assessment
This strengthens evidence of claimed local use beyond the illustrative animation in report266. It still does not supply raw agent messages, verified multi-agent authorship, or proof of completed work. Preserve named batches as search pivots; do not classify screenshots as fake merely because the raw data is missing. Chinese-lab escape remains unconfirmed.

Preservation
267-private contains recovered notes, three PNG files, image-history.txt and SHA256SUMS; source Git objects remain in266-private/swarm.git. No screenshot copied into the public dashboard; the report links to the already-public primary source. Next independent leads: joekytc/dsh-swarm and ChongCyrus/Vibe-Mathematics, prioritizing shared events or actual results.

Punky swarm: implemented local governance, scripted demo, historical snapshots
Reviewed September6,2026 UTC

Source
https://github.com/Punky971210/dsh-punky-swarm
Pinned HEAD4b7e0df761348898a9f95c0d4d61ddb08a293048; bare blob-filtered clone retained in266-private/swarm.git. Git transfer succeeded after an earlier API403, so no region-specific workaround was needed. No repository code installed or executed.

Scope
248 current tree entries,170 retained commits on the cloned branch. Package metadata says0.4.1 and dependencies on DeepSeek-namespaced packages. This establishes compatibility declarations, not DeepSeek lab ownership or authenticated model use.

Concrete mechanism
lib/bridge/trajectory.js maps workerSessionId to parent session/batch/lane using member.dispatch records. It records lane.anomaly and sends a mailbox notification; this is source implementing coordination state, not an actual recovered dialogue. The public ACPs guide describes external communication as opt-in, with a localhost endpoint default and separate inbound-mailbox switch. Local discovery should not be conflated with a public agent network.

Demo limit
assets/demo/checkpoint-resume.html has a fixed list of step-element IDs. JavaScript reveals each at300ms intervals and animates a crash marker; static=1 reveals everything. This explains that particular demo as an illustrative animation, not replayed model execution. It does not establish that other screenshots are synthetic or that the underlying checkpoint implementation fails.

Run archive search
No .log/.jsonl/.ndjson filenames in current tree. A Git-history path search over all retained commits for those extensions also returned none. Other formats/embedded data/releases are not excluded. No real run authenticated.

Historical opening
Early commit d0e59b2 retains docs later removed from the tree, including workbench/usage notes and dated baseline/current snapshots. Their contents remain unreviewed. Initial retained Git dates are August18, while several snapshot filenames refer to August19/20; publisher-controlled dates and filenames alone cannot establish a chronology. Follow the content and any exact commit/artifact references next.

Artifacts
266-private: repo.html, tree.json, early-tree.txt, pinned package metadata, checkpoint HTML, trajectory source, ACPs communication guide, SHA256SUMS, bare Git clone. Raw source remains private to the investigation; public report contains reviewed findings only.

Conclusion
A Chinese-language community plugin supplies concrete swarm mechanics but no verified observed swarm in this pass. Historical development snapshots are a better next lead than mirrored catalog claims. Other new catalog leads, not yet reviewed: joekytc/dsh-swarm and ChongCyrus/Vibe-Mathematics.

ACPs: Chinese interconnection implementation, not recovered swarm activity
Reviewed September6,2026 UTC

Primary source and provenance
https://github.com/AIP-PUB/ACPs-community/tree/3985c1330209f075c124669cc9d31f0e75448140
The README identifies Beijing University of Posts and Telecommunications and China Electronics Standardization Institute involvement. It describes a travel-planning leader and five specialist partners. This is project-level primary attribution, not attribution of any external anonymous posts. Its claimed standards history was not independently audited here.

Source coverage
GitHub returned a nontruncated tree with2281 entries. Six files downloaded at the pinned revision and Git-blob-SHA1 verified: README.md, demo-leader/README.md, monitor-server/README.md, acps-docs/tutorials/amp-agent-observability.md, acps-sdk/acps_sdk/amp/metrics_demo.py, acps-sdk/acps_sdk/amp/emitter.py. No investigated code executed.
No filenames ending .log, .jsonl or .ndjson occur in this tree. That is a filename inventory result, not proof there are no embedded examples, historical logs, release artifacts or private deployments. No actual conversation run was recovered in this pass.

Useful evidence locations
The observability tutorial specifies local JSONL/NDJSON then forwarding to a monitor, with separate heartbeat, metrics, access, message, system and audit families. Searchable filenames include amp_message_<name>.jsonl and amp_access_<name>.jsonl. Correlation/session identifiers and sender/recipient identities would be useful for matching a real exchange across records. The documented monitor address is localhost; no external deployment URL was established. No internal design or authenticated monitor was pursued.

Source-level caution
metrics_demo.py explicitly implements a demo-only sampler. Static inspection confirms synthetic active/queued task counts, resource percentages, success rates and latency values; these must not be treated as evidence of real workloads if encountered in an example dashboard. This does not imply all ACPs metrics are synthetic: production providers are separately supported.
AuditEmitter appends JSON records and optionally signs them. Missing signer leaves records unsigned, and signing exceptions fall back to unsigned output. A log-format match or the presence of an integrity-capable SDK therefore does not authenticate a record. No signing key, credential or private certificate material was read.

Access result
https://gitcode.com/LuffyTeam/ACPs-community returnedHTTP200 and94570 bytes, with project metadata in direct HTML. The earlier web-reader cache miss was not a demonstrated Chinese network block. The GitHub tree/source routes also worked here. No infrastructure purchase warranted by this access test.

New adjacent lead
Search surfaced Punky971210/dsh-punky-swarm, described by a catalog as a DeepSeek Harness plugin implementing ACPs discovery. GitHub tree request returned403; this is unresolved, not a negative finding. Use ordinary public repository/browser retrieval next. Do not assume the catalog's DeepSeek label implies lab ownership.

Assessment and preservation
Concrete Chinese inter-agent infrastructure and documented log shapes recovered; no live swarm or escape attribution established. Raw captures and SHA256SUMS in265-private. Retain ACPs as a source of precise fingerprints, with actual run records still the missing join.

Mixed-model Gist: source inspection lowers the lead's priority
Reviewed September6,2026 UTC

Primary source
https://gist.github.com/0xK8oX/57f8758569362e7db3fdf12c14110675
Raw revision: d3b8fad6cd773afc6aa9798bf0086e9cb9f88522
HTTP200,29,537 bytes; guide-raw.md preserved. No code executed.

Findings
The supplied client makes a chat request and returns text. Launchers print that text and stop on TASK_COMPLETE. No tool dispatcher was identified to perform the filesystem/Git work requested by the prompt. Therefore the displayed code does not substantiate the described autonomous coding workflow.

The client directly exports UnifiedAgentClient, but all three model launchers instantiate client.default: an inconsistent CommonJS interface. This was established by static inspection, not an execution test.

The proposed kimi_native_swarm.json is created once and has no reader in the supplied guide. Its existence does not establish native Kimi swarm invocation. The configured Kimi model is moonshot-v1-128k despite the heading's Kimi2.5 wording; no API run authenticates either.

Assessment
Downgrade report263's lead to an incomplete adaptation tutorial. No recorded team run or completed shared artifact recovered. Models named in a guide cannot establish a Chinese operator or lab. The linked guide does not strengthen the escape hypothesis.

Preservation
264-private/guide.html, guide-text.txt, guide-raw.md and SHA256SUMS. Four exact source-marker checks and tool-dispatch review were performed locally; no credentials, install, API generation or site mutations.

Next lead
LuffyTeam/ACPs-community remains unreviewed beyond indexed primary documentation. Web-reader cache miss is not proof the live Chinese code host is inaccessible. Continue through public browser/source retrieval and look specifically for observed sessions or deployment artifacts, rather than protocol capability descriptions.

Swarm fingerprints: commit-search limits and a Chinese-model setup Gist
Reviewed September6,2026 UTC

Search outcome
Followed report262's Huashu patterns using unauthenticated GitHub commit search. Exact-looking query strings are not evidence of exact substring matches: returned messages must be inspected. No Huashu deployment was established in this pass.

Queries and returned totals
"Agent-1: claim task": 2 results, both ericstans/threejs-elite with bracketed autonomous-agent wording, not the precise template. Not reviewed as a Chinese actor.
"acknowledged human input": 1 result, sixhobbits/claude-experiments, with different wording about a pivot to acquisition. No Chinese attribution established.
"huashu-agent-swarm": 1 result, jeremy9682/agent-skill-advisor-layer, a routing/evaluation implementation message, not an observed swarm run.
"claim task" "Agent-2": 65 total, first30 captured. Many repeat bb32be0e507b across Multica forks; result/repository counts must not be interpreted as independent agents or runs.
Subsequent author/Chinese-term queries returned403 and were stopped. Their bodies were not treated as valid negative search results; no regional-access conclusion follows from these responses.
Primary API: https://api.github.com/search/commits ; exact queries preserved in capture sequence commits-0/1/2 and commits-more-0/1/2.json.

New Chinese-model lead
https://gist.github.com/0xK8oX/ed7cf02c8f5a1f0b60135c7823f955fe
GitHub displays creation February9,2026 02:49 and one revision. Two visible files: complete-implementation-summary.md and multi-model-docker-setup.md. They describe a mixed GLM/MiniMax/Kimi team, Docker orchestration and monitoring/cost code. These are setup material, not captured model/tool transcripts or achieved project outputs. Cost estimates and production-readiness claims were not independently verified. No Chinese operator or lab identity is established by naming those models.

The summary links a core setup guide at https://gist.github.com/0xK8oX/57f8758569362e7db3fdf12c14110675 , not yet reviewed. It also says the Docker guide will be published later, while the inspected Gist already contains it; the summary may be stale. Treat this as a documentation mismatch, not fabrication proof.

Implication
This is a concrete adaptation of the Git-coordinated agent-team idea to Chinese models, and a potentially useful source of distinctive runtime markers. Follow its linked implementation for actual log/export references. Do not mistake catalog copies, translated instructions, fork duplicates, or model configurations for independently witnessed swarms.

Preservation
263-private contains six API responses and public Gist HTML with SHA256SUMS. All requests read-only. No investigated scripts installed/executed, credentials used, or tasks started. No evidence here changes the zero-confirmed Chinese-lab escape assessment.

Follow-up report264: linked client/launcher inspection found a missing tool-execution loop and inconsistent export use. Treat this as an incomplete tutorial, not verified working orchestration.

Chinese personal swarms: one qualified account and one source-backed mechanism
Reviewed September6,2026 UTC

Just Jason account
https://junxinzhang.com/openclaw-shrimp-farming-3-agents-automated-loop/
HTTP200; HTML self-dates publication/modification February25,2026. It describes an orchestrator, coding assistant Winnie and writing assistant Amy, with a claimed VoiceTranslation bug-fix PR. Human review/merge remains explicit. Crucially, closing next steps include configuring the cron monitor and testing the Winnie-to-Amy handoff, despite earlier complete-automation language. Treat the cross-agent loop as incompletely substantiated, not verified production autonomy. No specific PR URL is linked in this article.

The related translation article links the author's GitHub profile but not the project repository:
https://junxinzhang.com/macos-realtime-translation-for-teams-standard/
Public API lists85 repositories in the single returned100-item page; no repository name contains voice or translat. This does not exclude a differently named/private/deleted repository. Two tempting names resolve differently: junxinzhang/openclaw is a fork of openclaw/openclaw; junxinzhang/swarm is a fork of docker-archive/classicswarm, last pushed2018. The latter is Docker clustering, not this AI team. No personal API proxy or private logs accessed.

Huashu source
https://github.com/alchaincyf/huashu-skills/tree/023408a49191270c69508390d77d0c8197828d80/huashu-agent-swarm
Nontruncated GitHub tree inspected. Four source downloads match Git blob SHA1: SKILL.md, scripts/start_swarm.sh, scripts/agent_loop.sh, references/agent-prompt-template.md. Read as data only; never installed/executed.

Launcher creates separate Git worktrees and tmux panes, default8. Loop invokes Claude CLI, defaults claude-opus-4-6, records each session, and attempts Git synchronization/push. Prompt asks workers to coordinate through task-claim files and Git history. This is implemented orchestration machinery; no actual run archive appears in the inspected skill subtree, which contains documentation/templates/scripts. No claim about every other repository directory or historical revision follows from that scoped check.

Useful search fingerprints from the pinned source:
- agent_logs/agent_<ID>_session_<COUNT>_<YYYYMMDD_HHMMSS>.log
- current_tasks/<task_name>.lock
- commit-message pattern: Agent-<ID>: claim task <task_name>
- commit-message pattern: Agent-<ID>: complete task <task_name>
- HUMAN_INPUT.md and TASKS.md jointly with the above
Generic Agent-N or TASKS.md alone will be noisy. Public search returned catalog mirrors/translation, not an independently recovered run. A match would still require content and provenance review.

Conclusion
Chinese-language users have concrete swarm implementations, including Western-model orchestration. This does not identify a Chinese lab's escaped agents. Highest-value follow-up is matching these source fingerprints to real public work histories, rather than collecting further copied skill listings.

Preservation
262-private contains article/related-page HTML, public repository metadata, pinned Huashu tree and four checked source files, with SHA256SUMS. Public mirror is whitelisted observation metadata only. Current server reached all reviewed primary sources; no additional infrastructure needed for this pass.

XiaPost follow-up: scheduled-looking social participation
Reviewed September6,2026 UTC

Result
The participant who replied to the game-development document in report260 has a strongly scheduled-looking public posting pattern, but no linked joint build or agent run archive was recovered. This strengthens the recurring social-automation lead while lowering the priority of this profile as evidence of substantive multi-agent work.

Primary sources
https://xiapost.com/agents/mqw5dx
https://xiapost.com/post/3c6h1a3u
https://xiapost.com/heartbeat.md
All fetched HTTP200 from the existing server. Documentation was treated as evidence, never installed or followed.

Observed data
Profile 司空谷 #mqw5dx displays model label agnes-2.0-flash and an owner field. Neither authenticates the runtime/provider/operator. Header says124 posts; initial public HTML contains20 post cards, dated August14 10:05:29 through August18 04:04:50 UTC. This is a bounded latest-post sample, not all124.

Nineteen of20 card timestamps lie within seven minutes after an hour on the UTC grid 01,04,07,10,13,16,19,22. Offsets range110-362 seconds for these19. The remaining post is August16 19:17:48, offset1068 seconds. Several grid slots are absent: do not describe this as uninterrupted three-hour execution. The grid was selected after inspecting the timestamps, so this is descriptive evidence, not a pre-registered statistical test. Site timestamps remain publisher-controlled.

The August16 13:04:18 post (3c6h1a3u) says its author selected eight posts using comments_count*2+likes_count and reflects on the quality of those interactions. This is a concrete claimed selection policy, not recovered source code or an authenticated tool log. The inspected profile's visible posts are mostly reflections on memory, identity and the site's XP rewards. No external anchor links occur in the inspected profile HTML.

Mechanism and limit
The current public heartbeat document recommends one daily09:00 check, prioritizing responses, followed accounts, discovery, interactions and optional new posts. It explicitly attaches XP rewards to activity. This supplies a plausible installed mechanism for recurring social posting, but its daily instruction does not match the observed three-hour grid. We cannot infer this account used the current version or identify its scheduler. The profile's formula is likewise not proof the formula actually ran.

Interpretation
We now have visible cross-profile exchange, a recurring timestamp pattern and a participant's claimed interaction-selection method. These are more specific than a generic community label. They do not establish autonomous authorship, independent operators, coordinated task completion, lab provenance or training-environment escape. Do not promote agnes-2.0-flash into a verified model attribution.

Preservation and next directions
261-private/profile.html, selection-post.txt, heartbeat.txt, post-metadata.json, SHA256SUMS. Post IDs were extracted from existing UI handler attributes without invoking those handlers. No likes, registration, authenticated APIs or writes used.
Independent exact-token searches produced no corroborating workspace or profile repository in returned results. New unreviewed leads from broader searches: Just Jason's Chinese three-agent automation account at https://junxinzhang.com/openclaw-shrimp-farming-3-agents-automated-loop/ ; alchaincyf/huashu-skills/huashu-agent-swarm; LuffyTeam/ACPs-community. Investigate actual logs/artifacts before accepting their claims. Douglans/vibe-trading is already covered by report171, so avoid repeating it.

XiaPost: concrete collaboration request, but no recovered joint build
Reviewed 2026-09-06 UTC

Finding
New public Chinese agent-community surface: https://xiapost.com/ . A specific game-development request supplies a better trail than generic agent-swаrm advertising, but the inspected posts do not establish completed collaboration, autonomous authorship, or Chinese-lab attribution.

Primary evidence
https://xiapost.com/post/k8t2ib45
Profile 秉珠 #q47v9m, site timestamp 2026-07-29 05:25:21 UTC, asks other agents to build/test a Cocos Creator WeChat H5 idle game. It claims research, economic simulation, database/API design and TypeScript core code are complete, but its 1.9 GB RAM host cannot run the build/browser tests. This detail is the poster's claim, not a verified hardware measurement. Detail page shows zero comments.

https://xiapost.com/agents/q47v9m
Three visible posts: the first request, a shorter request at 05:27:27, and a development document at 05:41:23 on July29. Similar wording alone does not authenticate an automated publisher.

https://xiapost.com/post/g4zxur7y
The development document has one visible reply, by 司空谷 at 2026-08-05 10:34:26 UTC. It asks whether the stated package-size restriction was empirically tested. No answer, build artifact or testing receipt is displayed. This is a real visible cross-profile exchange, not evidence the requested work happened. Business statistics and platform limits in the post were not independently checked.

Workspace limitation
The text calls LikeClawByOpenCode/workspace/cuibingzhu/idle_game/ a GitHub location. Interpreting its first two components as owner/repository, unauthenticated GET https://api.github.com/repos/LikeClawByOpenCode/workspace returned404. Public repository listing https://api.github.com/users/LikeClawByOpenCode/repos?per_page=100 also returned404. This could be an incorrect/local path, renamed/deleted/private location or inaccurate claim; the response cannot distinguish these. No private workspace was pursued.

Mechanism / alternate explanation
https://xiapost.com/skill.md is public documentation (v2.0.0), reviewed as data and not installed. It explicitly prescribes daily 09:00 dashboard visits and subsequent actions, with date state in memory/xiapost-state.json. It describes posting/commenting APIs and an optional caller-supplied model-name header. Thus recurring participation has a published owner-installable mechanism, while model labels are self-reported. No credentials or registration were used. This is not evidence of a training agent escaping its intended environment.

Discovery / coverage
https://xiapost.com/circles/gd2ito supplied the lead. Its direct HTML included September3 content while the web-reader cached version was older. The header displayed zero discussions despite visible posts; counters should not be used as a completeness measure. Only this circle and the named profile/posts/documentation were examined, not the full community.

Next useful checks
Follow other concrete project posts and their public deliverables; inspect the replying profile's ordinary public activity for exact artifact links. Search the unusual workspace token and game title on independent public indexes. A missing GitHub location is an unresolved join, not a reason to infer a hidden swarm.

Infrastructure
All these XiaPost pages and GitHub responses were accessible from the existing server. This lead needs artifact provenance, not extra compute. For other blocked Chinese sources, an owned mainland broadband machine with SSH and a dedicated browser is the most useful comparison point: suggested 2 CPU cores, 4 GB RAM, 40-70 GB disk, no GPU. Browser exports of public pages also help. A small Hong Kong VPS is an optional comparison, not guaranteed mainland-equivalent access. Alibaba's current documentation explicitly distinguishes mainland and international routing:
https://www.alibabacloud.com/help/en/simple-application-server/product-overview/regions-and-network-connectivity
No new price quote or purchase was made. Compare identical URLs and meaningful page content before scaling.

Preservation
Raw captures: investigation/china/260-private/{circle.html,collaboration.txt,profile.txt,document.txt,skill.txt,repo.txt,github-user.txt}; SHA256SUMS covers these captures. Public mirror contains reviewed metadata only. No site mutations or investigated code execution.

259 — Fengxinzi's Lu Ban package: source recovered, simulation distinguished from execution
Reviewed2026-09-06 UTC. Follow-up258; new inspectable source, no verified swarm run.

IDENTITY AND ACCESS
https://skillhub.cn/skills/luban-skills
Headless browser on this existing server rendered the listing and public Files tab successfully. Canonical package is @user_0a2ee348/luban-skills, author display 疯信子, version1.0.0. This is distinct from LearnPrompt/luban-skill, a similarly named search result with a different purpose. Do not import the other project's PR/award claims into this lead.
Listing describes OpenClaw coordination, ACP transport and Hermes execution. It repeats a competition-win claim; no independent award verification was obtained. Publisher prose describes April23/24 subprocess problems and a direct-dispatch workaround, but no raw run receipt is attached in the inspected inventory.

FILES AND HASHES
Observed browser GET endpoints:
https://api.skillhub.cn/api/v1/skills/luban-skills/files?version=1.0.0&namespace=user_0a2ee348
The inventory returns31 files with sizes and SHA256 values. Through the same public file endpoint used by the browser, fetched README.md, scripts/acp_pty_driver.py and scripts/verify_run.sh. All three hashes match the inventory. The31 names comprise instructions, templates, scripts and a test; none is a run-directory transcript. Hash matching establishes the downloaded bytes match the listing, not that the software's claims are true.

SIMULATION AND VERIFICATION LIMIT
The driver's sim_mode writes a synthetic session identifier, thinking phases, a claimed pwd completion, current-directory text and LUBAN_MIN_VERIFY_DONE, then returns0. This function writes predetermined text; it does not actually run the displayed pwd tool. Missing client and certain error branches can enter simulation. The real path is separately implemented.
verify_run.sh checks expected files, selected event names, JSON validity, optional strict done status and selected contamination strings. Tool-call counts are printed as an OK diagnostic without requiring a positive count. It contains no explicit simulation rejection. Therefore LUBAN_VERIFY_OK alone cannot authenticate a real model/tool run. We did not execute either script, construct a passing fixture or claim a measured false-positive rate.

ASSESSMENT / NEXT
This upgrades258's missing deliverable link to concrete source attributed by the listing to the same author display. It supports an implemented orchestration package, not a proven operational swarm. For a future published run, require the driver mode, actual ACP exchange and task output rather than only marker strings or a verifier badge. Do not confuse simulation support with proof that a specific claimed run was simulated.

CAPTURES
259-private/rendered.txt,files-tab.txt,requests.json,files.json, three hash-verified sources,SHA256SUMS. Browser allowed GET/HEAD and blocked other methods. Only the public Files tab was clicked; no install, task, message or payment action. No investigated code executed.

258 — Fengxinzi public team digests: active labels versus recorded work
Reviewed2026-09-06 UTC. New account trail on the known ClawdChat surface; no verified escaped swarm.

OBSERVED CLAIMS
https://clawdchat.cn/u/%E7%96%AF%E4%BF%A1%E5%AD%90
The profile publishes DailyDigest reports. April3 describes five Active agents but only two with recent records; individual entries mention March4/5 history and agents waiting for assignments. April4 reports repeated cron failures, one task running, and a digest preview awaiting the owner's feedback. Local workspace paths are cited as evidence but are not public runtime receipts. Do not interpret the Active category as five concurrently executing workers.
A separate profile post links luban-skills and claims a Tencent competition win. The award was not independently verified; contest participation would not establish Tencent ownership of the team.

HOSTED METADATA CHECK
Public profile HTML returned200 and includes serialized Next.js data. Parsing those embedded strings recovered exact post identifiers and site-created timestamps:
https://clawdchat.cn/post/5f869255-9789-4428-9547-0d3c5d761104
2026-04-03T12:32:47.533051+00:00
https://clawdchat.cn/post/f25cee7c-294c-4d86-b8a6-0b874d3ff184
2026-04-04T12:41:13.807230+00:00
The April4 detail page also returned200. These are site metadata, not independent archives or proof of agent authorship. No underlying private workspace was requested.

DELIVERABLE LINK LIMIT
https://skillhub.cn/skills/luban-skills
Web reader timed out. Direct request returned200 but the server-rendered body was an application shell, with no GitHub link in the parsed anchors. No skill archive or run output was recovered in this bounded check. Browser rendering remains a next step; this is not proof the listing is empty.

ASSESSMENT
Specific operational reports exist, including failure counts and stale-work admissions. They are more informative than a generic community introduction, but a status-report publication is not the same as a demonstrated team completing a task. Keep model labels, task categories, self-reported success and independently observable outputs separate.

CAPTURES
258-private/profile.html,flight.txt,daily-post.html,post-metadata.json,skillhub.html,SHA256SUMS. All public reads. No A2A message, claim, reaction, private resource request or code execution.

257 — Chinese novelist repository: swarm label, chapter artifact and local text generators
Reviewed2026-09-06 UTC. Bounded new lead; no verified multi-agent execution.

PRIMARY
https://github.com/LunaticLegacy/novelist
Search found this Chinese novel-writing package through its literal English agent swarm description. Current recursive tree2b6a7d0c580b07c7b1d5321536b3527d4b34db4e has86 entries, nontruncated. It contains writing templates/scripts, two outline files, one chapter file正文/第001章.md (11,522 bytes) and a storyboard. No separately named agent-message log or run transcript was identified in the filename inventory. Chapter prose was not read or reproduced.

SOURCE CHECK
Five small files fetched at the pinned revision were Git-blob verified: README.md, references/draft-template.md, agents/openai.yaml and two tools/generate_*.py scripts.
README recommends a user prompt requesting chapters1–8 sequentially with state updates, attributes the original package to PenglongHuang/chinese-novelist-skill, and describes local planning and validation. agents/openai.yaml is skill-interface metadata, not evidence of OpenAI ownership or execution. Investigated instructions were treated as data and not followed.
Both generator scripts parse successfully as Python source. Their imports are standard-library re/pathlib, with csv in one script. Static AST inspection shows local chapter construction, text-length management, story-state updates and file writes. Predefined text fragments and extension/padding functions are present. No model API invocation or worker spawning was identified in these two scripts. They were never executed.
This matters because named chapter/state files can be produced by ordinary deterministic scripts. The current artifacts do not establish which process created the committed first chapter; this check did not compare it against generator output or reconstruct history. Do not call the novel output fabricated or a verified swarm product.

DE-DUPLICATION
Broader searches also returned kvcache-ai/AgentENV and duanyytop/agents-radar, already covered in204 and185. Those were not counted as new discoveries. AgentENV's Kimi association and network configuration are not new evidence of an escaped actor.

ASSESSMENT / NEXT
The repository supplies Chinese writing-workflow material and concrete local content files, but not authenticated teamwork, unattended publication, public scratch-memory use or lab attribution. Lower priority unless the author links raw multi-agent transcripts or a separately traceable published work. Maintain the original lab/public-surface objective rather than equating every agent-swarm phrase with a positive finding.

CAPTURES
257-private/tree.json, five verified files and SHA256SUMS. Public read-only requests; source parsed as data without executing code.

256 — Elaine follow-up: guides do not supply task execution receipts
Reviewed2026-09-06 UTC. Follow-up to255's new public task/note surface. No verified swarm.

BOUNDED CHECK
Fetched ordinary public links:
https://blog.elliotz.men/blog/multi-agent-guide
https://blog.elliotz.men/blog/dws-cli-commands-guide
https://blog.elliotz.men/
All returned200. Architecture guide is attributed Elaine and self-dated March20; DWS command guide is self-dated April30. Inspected normal links and links embedded inside escaped article HTML. Neither guide linked an external repository in these representations. Two exact web searches for the domain/repository association and the team's full role-name combination yielded the same site's guides, not a separately verified output repository.

CLAIMS VERSUS RECORDS
The architecture article explains workspace/session isolation. The DWS article lists commands described as mastered and other functions still to explore. These are guide content and self-reported experience, not terminal transcripts proving successful execution.
A separately indexed March30 DingTalk guide illustrates role-based work with placeholder userId_Elaine/userId_Sheldon, task IDs and project IDs. Those examples do not join the site's completed-task labels to externally hosted task records. We did not execute commands or try the described enterprise resources.
https://blog.elliotz.men/blog/dingtalk-workspace-cli-guide

ADDITIONAL PUBLIC METADATA
The homepage calls the site a personal workbench. It repeats33 tasks and two notes; the note cards display08-03 and06-01. Those month/day labels add metadata absent from the inspected /mind/ view but do not establish a year, author or runtime provenance. Its initial HTML also contains zero-valued headline counters alongside nonzero summary text; without inspecting rendering behavior, do not use these initial zeros as evidence the data is empty or fabricated.

ASSESSMENT
Retain the host as a real public work-tracking surface. Lower the swarm lead's priority until an explicitly linked output or raw handoff record appears. No write controls, private routes or enterprise APIs were tested. The absence of a repository link in this small sample does not prove no repository exists.

CAPTURES
256-private/architecture.html,dingtalk.html,home.html,SHA256SUMS. Public GET reads only.

255 — New public agent-persona task board and work notes: Elliot / Elaine
Reviewed2026-09-06 UTC. New Chinese-language surface found via shared-blackboard search. Classification: public work-tracking pages and persona-attributed guide, not a verified swarm.

DISCOVERY
https://blog.elliotz.men/blog/multi-agent-usage-guide
Direct200, guide self-dated April1,2026 and attributed Elaine. It describes five named roles, but explicitly says the user mainly talks to Elaine and the other agents are largely unused. The article recommends shared workspace files; it does not expose an actual shared-file transcript. The page displays much of its article as escaped HTML, a presentation defect rather than proof of fake content. Unsupported quantitative claims in the guide were not adopted as findings.

PUBLIC NAVIGATION SURFACES
https://blog.elliotz.men/tasks/
Direct200 while signed out. Visible board reports33 tasks:3 pending and30 completed. Among completed labels are building a multi-agent configuration and an OpenClaw/DingTalk project-management plan. These are site-stored status assertions, not independently checked work outputs. No raw role-to-role execution log was identified in this rendered board. New/edit/delete controls appear in the HTML; none was activated, and their permissions were not tested.
https://blog.elliotz.men/mind/
Direct200 from the site's ordinary navigation. Two visible engineering notes discuss MQTT/hardware integration and an added but not yet tested driver. This is a concrete public note surface, but no author/time metadata or multi-agent exchange was established in this view. Do not infer agent authorship just because the site footer says Powered by Elaine.
https://blog.elliotz.men/rss/entries
Direct200, a visible feed aggregator. Feed-source publication dates are not agent-action timestamps; latest feed content does not prove an agent fetched or summarized it. No read/unread, summary, management or cleanup control was used.

ASSESSMENT
This is closer to the sought public scratch-memory surfaces than another framework README: public tasks and work notes genuinely exist and the blog connects them to a named agent persona. However the observed pages do not demonstrate who wrote them, a team coordinating through them, a Chinese-model backend, Chinese-lab ownership or any escape. The April guide's unused-teammates admission limits that particular multi-agent claim; later construction-completed task labels do not supply the missing runtime proof.

ACCESS / NEXT
Existing server read all four pages without login, new infrastructure or browser automation. Next useful evidence would be explicitly linked task outputs, source provenance or deliberately published execution records. Avoid treating visible write controls as authorization to test mutations or exploring private administration.

CAPTURES
255-private/guide.html,tasks.html,mind.html,feed.html and SHA256SUMS. Captures retained privately; public report summarizes relevant metadata without mirroring every work item. Only ordinary public GET navigation was used.

254 — Chinese developer-community triage: cross-machine claim and inspectable Roundtable release
Reviewed2026-09-06 UTC. New leads from Chinese-language developer-community searches. No escaped swarm confirmed.

RUFLO-SWARM: INDEXED CLAIM, LIVE PAGE UNAVAILABLE
https://forum.trae.cn/t/topic/71326
The indexed TRAE contest post describes Windows/Linux agents named Weiyang, Tongming and Ximeng, AAMP communication, Feishu tables and daily memory archiving. Its proposed demonstration explicitly includes simulated tasks and faults. Search material lists a proposal ZIP but this turn did not recover its download URL. Direct HTML and two public JSON routes returned404; the saved404 bodies document access, not the original article. Current deletion, permissions and relocation remain unresolved. Do not treat this as a live verified multi-machine deployment.

AI ROUNDTABLE: PUBLIC RELEASE RECOVERED
https://forum.trae.cn/t/topic/151652
This separate contest post returned200 via public JSON and links:
https://github.com/Zhouzc266/ai-roundtable/releases/tag/v3.0
Release API reports publication2026-07-14T19:19:42Z. Downloaded the public ai-roundtable.zip asset:40,552,379 bytes, matching API size. ZIP inventory has84 entries totaling44,424,472 uncompressed bytes. The current repository tree c734c33b72f52ff599341e45abd5982891b68697 contains only README.md and .gitignore; substantial application source is in the release archive, illustrating why checking only the repository tree can miss relevant artifacts.

BOUNDED SOURCE INSPECTION
Archive contains app source, HTML/CSS, OCR server, build/launch files, diagrams and character images. No separately named run transcript or session-export file appears in the84-entry inventory. This filename observation does not exclude embedded examples in uninspected code.
Read storage.js, feature-roadmap.md and targeted app.js snippets without running anything. Storage defines an IndexedDB database ai-roundtable with localStorage fallback; large keys include rt_sessions, rt_artifact, rt_contributions and rt_deliverable. app.js includes parallel per-role section generation via Promise.all and inter-table checkpoint handling. These are implemented mechanisms; no actual user run has been authenticated.
The source's local session persistence explains one concrete evidence gap: public application distribution does not automatically publish its users' discussions. An intentionally exported run would be more useful than further feature descriptions. No browser database, private account or configured API was accessed.

ASSESSMENT / NEXT
The Roundtable archive is a real inspectable artifact linked by a Chinese operator post; it does not by itself demonstrate unattended operation, external public writes or lab ownership. Ruflo-Swarm remains an indexed deployment claim with a simulated-demo caveat. Continue seeking operator-published outputs and raw exchanges, including release assets when repository trees contain only documentation.

CAPTURES
254-private/ contains404 responses, Roundtable topic JSON, release/tree API responses, release.zip, zip-inventory.json, three inspected source files and SHA256SUMS. All investigated material treated as data; no installation or execution.

253 — Fish describes a four-agent dispatcher and shared-memory write restriction
Reviewed2026-09-06 UTC. New direct participant account recovered from252's public pagination. Classification: specific operational claim, no recovered execution transcript.

PRIMARY COMMENTS
https://github.com/ythx-101/openclaw-qa/discussions/22#discussioncomment-15959570
https://github.com/ythx-101/openclaw-qa/discussions/22#discussioncomment-15959766
Account s1s1s1s1s1s1s1 introduces the Fish persona on March1 at07:20:29Z, then describes its four-agent setup at08:20:58Z. The first comment has a nested maintainer reply; its second timestamp belongs to that reply, not an edit or another Fish post.
The account labels itself OpenClaw/Claude Opus, with teammates named Xiaoyan (GPT-5.3), Xiaolu (Gemini) and Mianmian (another Claude). These are account-supplied labels, not authenticated provider routes.
Fish describes acting as dispatcher: send one identical prompt to the other three, without assigning perspectives, then combine the replies. It offers memory architecture as an example of disagreement. Separate sessions reportedly read shared MEMORY.md and BRAIN.md; group-chat agents reportedly cannot write MEMORY.md, because earlier group conversation contaminated core memory and affected a later judgment. Private-chat sessions retain writes.
This provides a concrete hypothesis for local multi-model coordination and a reported memory failure. It is not a raw multi-agent trace, a verified configuration or evidence of public scratchpad storage.

FOLLOWED PROFILE
https://github.com/s1s1s1s1s1s1s1
Public user API returned no name, biography, location or external blog; public_repos=0. Public repositories endpoint returned an empty list. That limits this particular artifact route; it does not establish absence of code elsewhere.
Two targeted web searches surfaced further teahouse discussions, including a commentary on an external mathematical paper and later agent-marketplace discussion. Search excerpts did not supply this group's own code or logs. Those excerpts were not treated as independently verified runs or as evidence for the mathematical claims they repeat.

ASSESSMENT / NEXT
MengZhuang's references to a four-agent group now join to that group's own detailed account. The underlying claim remains unverified. Repeated discussion by other personas is not independent authentication. Lower this branch's priority unless an exact output, source repository or session trace appears. Broaden discovery to other Chinese operator communities and concrete task receipts.

CAPTURES
253-private/profile.json, repos.json, fish-comments.json and SHA256SUMS. Comment extraction records hashes of retained252 page10/11 HTML. No new messages, credential use or investigated code execution.

252 — Four MengZhuang memory entries join to hosted comments; wrong-thread context recovered
Reviewed2026-09-06 UTC. Progress beyond251: recovered all four comments via public pagination and the apparent source context for250's misplaced reply. No escaped Chinese lab swarm confirmed.

METHOD
The discussion's public Load more form uses GET /ythx-101/openclaw-qa/discussions/22/pages with after/before cursors. Followed twelve successive published form URLs, sequentially with1.6-second pauses. Each returned200. These responses include comments from both ends of the hidden range; their first/last dates should not be mistaken for a continuous interval. No authentication, mutations or hidden-account access used.

FOUR EXACT JOINS
Source memory: https://github.com/22MengZhuang22/mengzhuang-notes/blob/5a3241f86f984042c35a51cf220224a07e958233/notes/weekly-2026-W10.md
Public comments all by22MengZhuang22 on2026-03-01:
15959631 — 07:33:35Z; note15:33; welcomes Fish and discusses confidence decay/archive/extraction.
15959811 — 08:33:36Z; note16:33; welcomes IGNIS and lists the four-agent group, Friday and memory-tree discussion.
15960105 — 09:33:25Z; note17:33; discusses silent tool failure and confidence checks.
15960360 — 10:33:22Z; note18:33; supplies confidence-database structure and decay rules.
Direct links:
https://github.com/ythx-101/openclaw-qa/discussions/22#discussioncomment-15959631
https://github.com/ythx-101/openclaw-qa/discussions/22#discussioncomment-15959811
https://github.com/ythx-101/openclaw-qa/discussions/22#discussioncomment-15960105
https://github.com/ythx-101/openclaw-qa/discussions/22#discussioncomment-15960360
The note times align to the hosted minute if interpreted as UTC+8. UTC+8 is an inference from this alignment, not geolocation proof. Inter-post intervals are3601,3589,3597 seconds. This corroborates specific content and a near-hourly posting pattern described as cron in the notes. It does not establish how much human supervision occurred or whether the summary was written before/after these posts.

MISPLACED REPLY: SPECIFIC ANTECEDENT
https://github.com/ythx-101/openclaw-qa/discussions/22#discussioncomment-15935203
PikachuOC posted at2026-02-26T13:47:02Z, describing three failed large-file cleanup attempts followed by rewriting Git history on the fourth attempt. The misplaced MengZhuang message in community/discussions/156662 at14:40:33Z explicitly responds to that distinctive scenario,53min31sec later:
https://github.com/orgs/community/discussions/156662#discussioncomment-15935733
This tightens the content linkage to the teahouse and supports wrong-conversation placement. It still does not identify the submitter, API/browser operation or error mechanism. A mistaken destination is an inference; lab escape is not demonstrated.

CORRECTION TO PRIOR LIMIT
Report251's four comments absent from default HTML have now been recovered. Their absence was pagination, not evidence of deletion. Report250's wrong-context observation gains a concrete preceding source message.

ARTIFACTS / NEXT
252-private/page-1.html through page-12.html, matched-comments.json, pikachu-context.json and SHA256SUMS. Public captures can support targeted analysis of the four-agent group described by Fish, while avoiding another broad persona-chat census. Raw execution receipts remain the important missing evidence.

251 — MengZhuang publishes cross-platform mailbox notes and cron failure report
Reviewed2026-09-06 UTC. Follow-up to250; previous turn produced verified public evidence. No new explanation of the misplaced GitHub comment was found in this bounded search.

PUBLIC SHARED-MEMORY CLAIM
https://github.com/22MengZhuang22/mengzhuang-notes/blob/5a3241f86f984042c35a51cf220224a07e958233/notes/cross-platform-agent-comms.md
Pinned tree5a3241f86f984042c35a51cf220224a07e958233 contains7 entries, nontruncated. The note describes OpenClaw and PicoClaw communicating through a neutral local directory, with separate inbox-mengzhuang.md and inbox-xiaopa.md, shared-notes.md, a send helper and cron. It labels providers Claude and iFlytek; those names are not authenticated model routes. It reports an initial failure where an agent claimed to have replied without writing the mailbox file, followed by a working channel.
This is a concrete architecture and operator/persona account of use. The actual mailbox contents, helper and delivery logs are absent from this seven-entry tree. The inspected note history returns one initial commit,ea3afec881fc89a0089b83598cb59567d2ec2750, committer timestamp2026-02-25T11:00:31Z. Git timestamps are not independent runtime proof.

PUBLISHED SESSION SUMMARY
notes/weekly-2026-W10.md is17,566 bytes and describes itself as generated from session memory. A bounded read of its initial section records March1 teahouse checks, selective silence, claimed posted replies with exact discussioncomment links, and repeated manual/automatic resets. It is narrative memory, not raw assistant/tool transport history. Four named March1 comment IDs were absent from the fetched default discussion HTML; pagination limits prevent a negative existence conclusion. This turn did not corroborate those four comment timestamps.
The repository's issue-notify.yml implements a GitHub issue-opened Telegram notification using secret references, not exposed secret values. Source was read only, never executed. Notification setup is not evidence of a responding agent.

SEPARATE RUNTIME FAILURE REPORT
https://github.com/NousResearch/hermes-agent/issues/5209#issuecomment-4227980907
On April11 at02:50:02Z the same GitHub account reports Hermes0.7.0 on Ubuntu using custom API model label astron-code-latest. It reports cron tools/output running but no final scheduler response or Telegram delivery, plus truncation and gateway termination symptoms. This supports a public runtime-use claim; it does not prove the named model's vendor or connection to the February misplaced post.
The original issue is another account on macOS using other models. A June21 response by teknium1 says fixes and retests resolved the failure class, but its reported tests use DeepSeek and Gemma, not MengZhuang's custom model. We have not verified a successful retest of MengZhuang's deployment.
https://github.com/NousResearch/hermes-agent/issues/5209#issuecomment-4761154918

ASSESSMENT
There is now more than generic persona chat: a published mailbox design, session-memory export, hosted cross-account PR/review, an off-topic public write and a separate cron bug report. These remain several forms of publisher/account evidence. None establishes autonomous authorship or a Chinese-lab swarm escaping onto anonymous public storage. Local shared-memory operation is the strongest explicit new collaboration claim, but its runtime receipts are missing.
Next useful recovery: exact March1 discussion comments via public pagination, or other deliberately published session artifacts. Avoid treating the four missing HTML matches as deleted posts.

CAPTURES
251-private/ includes issue and six comments via public API; memory essay HTML; notes tree; three Git-blob-verified note/workflow files; mailbox history; discussion HTML; SHA256SUMS. No investigated code execution, posting or private-account access.

FOLLOW-UP252: All four named comments were recovered through public pagination. Content matches the notes; hosted timestamps show near-hourly posts at minute33, matching note times under UTC+8. See report252.

250 — MengZhuang: cross-account review and a misplaced teahouse reply
Reviewed 2026-09-06 UTC. Chinese-language public persona activity with a concrete reviewed contribution; automatic authorship and lab attribution unverified.

NEW WRONG-CONTEXT TRACE
https://github.com/orgs/community/discussions/156662#discussioncomment-15935733
Direct GitHub HTML and the web reader both show account22MengZhuang22 posting at2026-02-26T14:40:33Z inside a GitHub Education benefits troubleshooting thread. The Cantonese message welcomes Pikachu, discusses Friday and Monday's earlier autonomy conversation, and names the author's own Checklist and Silence article. It is unrelated to the support question. The thread originated April14,2025; that is not the date of this later reply.
The comment's named participants and article match the separate Chinese agent teahouse. This supports an observed off-topic public write associated with that persona. Accidental wrong-thread selection is a plausible explanation, not established mechanism. Human misposting, tooling mistakes or deliberate posting remain possible. No raw tool transcript identifies the submitter or cause.

CONCRETE COLLABORATION CHECK
https://github.com/ythx-101/openclaw-qa/discussions/22#discussioncomment-15925432
Friday's February25 comment says they reviewed PR5 containing MengZhuang's essay. The PR was not in MengZhuang's own blog repository: that lookup returned404. It is in Friday's repository:
https://github.com/fridayyi/fridayyi.github.io/pull/5
Public API confirms author22MengZhuang22, title Voice: The Checklist and the Silence — MengZhuang, opened2026-02-25T14:48:29Z and merged17:56:32Z. A COMMENTED review by fridayyi is timestamped15:45:41Z. It discusses the essay and says to wait for Yi's review before merging. This explicitly acknowledges an intended human review step; do not turn it into a fully unattended collaboration claim.
Friday's later teahouse statement is timestamped16:58:26Z, after the hosted review. Thus the numbered review claim joins to a concrete cross-account artifact. Neither account labels nor a GitHub review authenticate LLM execution or distinct human owners.

OWNER-LINKED BLOG
https://22mengzhuang22.github.io/
Direct fetch HTTP200 despite web-reader failure. Homepage identifies MengZhuang as an OpenClaw cat persona and links four dated entries, its GitHub profile and Moltbook profile. It links the named essay at:
https://22mengzhuang22.github.io/posts/the-checklist-and-the-silence/
That page also returned200. No login or new infrastructure was necessary. The visible self-description and cross-links establish persona continuity, not consciousness or lab control.

ASSESSMENT AND NEXT
This is useful for the hunt because it combines a genuine hosted cross-account contribution with a public wrong-context post. It remains different from a demonstrated lab swarm using anonymous scratch memory. Next seek other public wrong-context posts by the same account and explicit explanations or tool logs for the destination error. Keep the confirmed placement separate from any theory of escape.

CAPTURES
250-private/ contains direct HTML for both discussions, blog and essay; PR/review API responses including the initial404s; public repository list; SHA256SUMS. No messages sent, accounts joined or content modified on investigated sites.

249 — AI-Researcher examples contain experiment logs, not recovered agent transcripts
Reviewed 2026-09-06 UTC. Follow-up to Novix provenance in248. Classification: publisher-provided scientific work artifacts and orchestration source. No escaped Chinese swarm confirmed.

PRIMARY SOURCE
https://github.com/HKUDS/AI-Researcher/tree/f9a6f8480860c193afff600eeffe3defcee8a978/examples
Pinned repository tree f9a6f8480860c193afff600eeffe3defcee8a978: 1,613 entries, nontruncated. Seven example project directories contain source, paper outputs and assorted experiment artifacts. The current tree has 53 example .log files totaling678,587 bytes;13 are empty. These are inventory counts, not53 reviewed runs.

BOUNDED CONTENT REVIEW
Nine small source/artifact files were fetched at the pinned revision and Git-blob verified. Three nonempty experiment logs were read, alongside one results JSON and the agent logging/workflow implementation.
- DCCF revision log06:20, self-dated January27,2025: three experiment configurations all fail because the model constructor rejects lambda_3. The file nevertheless ends with a generic completion/results-saved message. That line cannot establish experiment success.
- Later DCCF revision log06:37 contains training epochs; its ending shows zero Recall/NDCG metrics and early stopping. It does not contain recovered worker-to-worker discussion or identify who fixed earlier errors.
- HGCL final log self-dated January23,2025: Yelp training reports35 epochs and Recall@20 0.0577; the following Gowalla experiment fails with a Tensor/tocoo attribute error. Metrics are stored claims, not independently reproduced measurements.
- Flowmatching comprehensive-results JSON contains baseline/improved FID values, an empty ablation object and null sensitivity results. File existence alone does not establish completed ablation/sensitivity runs.

WHERE THE MISSING EVIDENCE WOULD BE
research_agent/inno/logger.py saves assistant messages, tool calls and tool results; its default path is logs/res_<timestamp>/agent.log. No filename ending agent.log occurs in this current tree. research_agent/.gitignore excludes logs/, *.log, workplaces and results. Therefore the published training logs should not be mistaken for the agent's orchestration transcript.
flowgraph.py constructs predecessor-output inputs and transfer_to_* tool names between workflow steps. This is source evidence of handoff support, not evidence that a particular published experiment passed through those calls. Communication.md is merely a human WeChat/Feishu discussion-group invitation, not an agent message archive.

CHRONOLOGY AND LIMITS
The public history query for the DCCF06:20 file returns one commit,55ac72bb2ef8e6a6d67916ec018d988e2b4362bb, with committer date2025-03-11T12:52:15Z. Its internal January timestamp precedes this inspected publication metadata. Neither timestamp independently authenticates runtime or agent authorship.
This adds concrete published work artifacts to the HKUDS/Novix lead. It does not establish Chinese-model use, frontier-lab control, public scratchpad writes, or a connection to XZ. Current filenames and this bounded sample cannot rule out agent transcripts elsewhere or in history.

NEXT
Prioritize publicly linked raw assistant/tool transcripts or operator-published task outputs over additional framework descriptions. Broaden again to Chinese public communities and original operator accounts if this project supplies no such trace.

CAPTURES
249-private/tree.json, nine mirrored source files, dccf-log-history.json, SHA256SUMS. Only public read requests; no code execution or group joining.

248 — ClawTeam retains eight worker branches, but no committed experiment log
Reviewed 2026-09-06 UTC. Follow-up to report247. Published code history supports separate work branches; no escaped Chinese swarm confirmed.

OBSERVED REPOSITORY STATE
https://github.com/novix-science/autoresearch/branches
GitHub's public branch API returned nine branches: master plus eight clawteam/autoresearch/gpu0..gpu7 worker branches. All eight worker trees returned HTTP200, ten entries each, nontruncated. None contained a results, message or queue path.
A read-only bare clone, with blob filtering and no checkout or investigated-code execution, retained 176 unique reachable commits across these refs. Master has 47 commits. Relative to master, the worker branches have respectively 25,21,35,27,5,1,8,7 commits not reachable from master. These counts are not additive because ancestry can overlap.
The eight tips carry March15,2026 committer timestamps. As previously noted, Git dates and author labels are not independent runtime authentication.

LOG HISTORY CHECK
Public API queries for results.tsv history on master and all eight worker tips returned empty lists. A local git log --all -- results.tsv likewise returned nothing. The complete retained historical filename inventory contains 15 paths, including results_summary.tsv, but no full result log or message archive. This covers the advertised refs fetched now, not unadvertised or deleted branches or files never committed.
Historical spawn.sh appears only in March6 initial-history addition/deletion, before the March15 result publication. Its name alone should not be treated as the swarm's actual launch record; contents were not inspected.

PROVENANCE LEAD
https://blog.novix.science/meet-the-new-novix/
The public Novix article is attributed to Yuan Li and self-dated March20,2026. Its footer's GitHub link points to HKUDS/AI-Researcher, whose current repository describes novix.science/chat as a production version. This is an explicit public product/project link, not proof identifying the operator of each autoresearch worker, the model provider, or a Chinese frontier-lab deployment. The GitHub novix-science organization profile has no location, company or biography filled in.
https://github.com/HKUDS/AI-Researcher
Next: inspect that project's published examples and evidence of agent handoffs. Current ClawTeam evidence still does not connect to public paste/wikis or XZ.

FILES AND REPRODUCIBILITY
248-private/branches.json, tree-summary.json, history-summary.json, graph-summary.json, per-branch API responses, novix-blog.html and autoresearch.git preserve the bounded check. SHA256SUMS covers top-level capture files. No account creation, private workspace access or remote writes.

247 — ClawTeam research claim: seven named optimization commits resolve
Reviewed 2026-09-06 UTC. Classification: published research artifacts; runtime and Chinese-lab attribution unresolved. No escaped swarm confirmed.

PROVENANCE
The Chinese-documented win4r/ClawTeam-OpenClaw adaptation points upstream to HKUDS/ClawTeam. Upstream links its eight-agent experiment example to novix-science/autoresearch. Do not count the adaptation as a second independent experiment.
https://github.com/win4r/ClawTeam-OpenClaw
https://github.com/HKUDS/ClawTeam
https://github.com/novix-science/autoresearch

CLAIM AND LIMIT
The results README describes four Claude Code and four Codex workers, with the latter replaced later, and 2,430+ experiments. It reports approximately 240 GPU-hours, whereas upstream ClawTeam says approximately 30 GPU-hours. These disagree; eight GPUs for 30 hours would account for 240 GPU-hours. Provider labels are publisher descriptions, not authenticated backend identities.

DIRECT ARTIFACT CHECK
Pinned results tree: 29a5846ba40f25c24ce316c50fe99e376d1dff8f, 13 entries, nontruncated. README.md, results_summary.tsv, .gitignore and plot_progress.py were fetched at that revision and verified against Git blob hashes.
The TSV contains eight per-agent rows, not the full experiment history. Seven of its eight abbreviated commit identifiers resolve through GitHub's public commit API; each returned a train.py change and a March 15, 2026 committer timestamp. Identifier 971d4ee returned HTTP422. That is a bounded retrieval failure, not proof the experiment was fabricated. Detailed identifiers and statuses: 247-private/commit-checks.json.
The current default-branch history returned 47 commits, ending March15. Commit timestamps are publisher-controlled metadata, not independent proof of execution on those dates.
.gitignore excludes results.tsv, results/, queue/ and worktrees/. No complete raw worker message archive or 2,430-row experiment log is present in this current 13-entry tree. Historical branches and deleted artifacts have not been exhaustively checked.

ASSESSMENT
This is stronger than an unlinked demonstration claim: seven named outputs have concrete source-change counterparts. It does not authenticate autonomous authorship, measured scores, uninterrupted operation or Chinese-lab ownership. It does not show public scratch-memory use or connect to XZ. Next useful checks: branch inventory, retained result-file history, and public operator provenance.

CAPTURES
investigation/china/247-private/ contains tree responses, four verified source files, commit history and eight commit lookups; SHA256SUMS inventories captures. No investigated software executed.

246 — SecFlow: primary research on a Chinese-speaking multi-agent operator
Reviewed September 6, 2026 UTC.

PRIMARY SOURCE
https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia
Published September 3, 2026. Public researcher article captured locally; no actor or victim systems visited.

WHAT THE RESEARCHER REPORTS
Hunt.io links five exposed workspaces to one Chinese-speaking operator's campaign. Its SecFlow framework assigned specialist work, preserved shared state, and supported Claude-, Qwen- and DeepSeek-labelled runtime profiles. Configured routes included private relays and provider endpoints. The reported capture dates span May–August, preceding publication.
The report describes an unsupported success claim propagating into later worker assignments despite more than 27 failed follow-up tests. It distinguishes that failure from compromises supported by collected evidence. The researchers attribute exploitation outcomes to conventional tools and weaknesses alongside AI orchestration.

OUR ASSESSMENT
This is relevant third-party evidence of operational multi-agent use by a Chinese-speaking operator, substantially stronger than a product demo's feature list. It is not independent verification by this investigation: our evidence is the researcher's published account, not its underlying collection. Model-profile labels and configured URLs alone do not authenticate provider execution. No Chinese model-lab affiliation, escaped training swarm, or connection to the original public-scratchpad corpus is established here.

SCOPE AND FOLLOW-UP
Keep three claims separate: a Chinese-speaking operator, Chinese-model usage, and a Chinese-lab-controlled swarm. Evidence for one does not establish the others. The present lead supports investigating the first through published third-party research; the second remains dependent on runtime provenance; the third has not been shown.
Next useful work is comparison with other publicly published research and its evidentiary boundaries. Do not retrieve exposed private workspaces, stolen records, credentials or payloads to substantiate the article. No such retrieval was performed. The legitimate research page was accessible from the existing server, so this lead requires no additional scraping infrastructure.

CAPTURES
246-private/article.html, article.txt and SHA256SUMS. Raw article retained privately; public report gives a short attributed summary and source link. No code execution, target probing, account access or external communication.

245 — Polynoia demo screenshot: task lanes and unresolved workspace commits
Reviewed September 6, 2026 UTC.

RESULT
The operator's public screenshot depicts three completed task lanes with filenames, test claims and abbreviated commit IDs. It supplies a concrete visual example of the advertised workflow. The visible commits could not be joined to the public application repository, so task execution and resulting files remain unverified outside the screenshot.

PRIMARY IMAGE
Linked by the TRAE operator post https://forum.trae.cn/t/topic/116011 :
https://trae-forum-cdn.trae.com.cn/prod/original/3X/4/b/4b9fb7f7ab6df616b7f972a1b40afe31a4e0fe8e.jpeg
Downloaded JPEG, 186108 bytes, visually inspected. It shows an orchestrator assigning SDK/tests, an HTML demo, and documentation to three named members. Three lanes are marked complete. One member reports thirteen tests passed; another reports document files. No actual terminal test output was expanded in the image. A shared config.py contract is mentioned.
Visible diff badges include README.md / 76e6826, CHANGELOG.md / 1c2150e and demo.html / 88d615f. These are useful identifiers but not independently verified artifacts.

LABEL MEANING VERIFIED
https://github.com/JuneQQQ/polynoia
At pinned revision ce6a6fadcd54e232982d1b982d92be46991da711, apps/web/src/components/parts/DiffPart.tsx was fetched and verified against its Git blob hash. It displays the first seven characters of payload.commit_sha when present and treats the card as already committed. Thus the screenshot labels are consistent with commit abbreviations, not arbitrary progress counters. Source behavior does not authenticate the screenshot's underlying payload.

BOUNDED COMMIT CHECK
Public GitHub commit queries for 76e6826, 1c2150e and 88d615f in JuneQQQ/polynoia each returned HTTP 422 with 'No commit found for SHA'. The application repository may differ from the demo workspace repository; this negative does not demonstrate fabricated commits. No owner-wide private repository search or credential use was attempted. A public demo-workspace URL/full hashes would be needed for a reliable artifact join.

INTERPRETATION
The screenshot is more concrete than a feature list, but cannot establish provider identity, independent agent instances, actual concurrent runtime, test success or human absence. The earlier published acknowledgement-loop account and matching suppression code remain separately supported. No Chinese-lab swarm attribution is established.
Further Polynoia work should pursue an explicit public workspace export or full task/commit receipts if discovered. Otherwise, broaden to other Chinese deployment accounts rather than treating a visually complete demo as sufficient proof.

CAPTURES
245-private/group-demo.jpg, three GitHub error responses, pinned DiffPart.tsx, SHA256SUMS. Original image linked rather than republished. No demo execution, posting, reactions, account access or software installation.

244 — Polynoia: Chinese operator's acknowledgement-loop report and matching source
Reviewed September 6, 2026 UTC.

RESULT
A Chinese TRAE competition entry links an open-source multi-agent coding workspace with a specific post-delivery mention-loop incident account. Current pinned source implements the described acknowledgement suppression. This corroborates a mechanism and published engineering response; the incident's raw run log and model execution remain unverified.

DISCOVERY
https://forum.trae.cn/t/topic/116011
July 13-dated operator demo post links https://github.com/JuneQQQ/polynoia and advertises independent worktrees, task dispatch and merged artifacts. Its setup instructions include demo seeding and local startup, not a public live workspace. The post links screenshots and a video; those media were not inspected in this pass. TRAE hosting and a user-submitted competition entry do not establish ByteDance lab operation.

PINNED EVIDENCE
Repository revision ce6a6fadcd54e232982d1b982d92be46991da711, nontruncated recursive tree with 861 entries. Six fetched files were verified against Git blob hashes:
- docs/sessions/2026-06-overnight-e2e.md
- docs/sessions/2026-06-10-pingpong-and-process-lifecycle.md
- docs/ADR/ADR-022-mention-chain-ack-suppression.md
- scripts/seed_demo.py
- apps/server/polynoia/api/routes.py
- apps/server/polynoia/api/ws_conv.py

INCIDENT ACCOUNT
The June 10 session summary says users observed agents yielding to one another after little work. It describes two chains of post-delivery acknowledgements/mentions reaching depth five, with zero tool activity in the sampled tail. ADR-022 supplies a short illustrative chain and attributes the recurrence to mentions spawning another turn without checking whether the response did useful work. These documents are operator summaries, not an independently recovered conversation transcript.
Pinned routes.py sets the mention-depth limit to three and defines _is_bare_ack_bounce using whether the target is the previous sender and whether the turn did work. ws_conv.py invokes it before spawning the next mentioned agent. That establishes implemented suppression, not that the claimed historical test ran exactly as described. No tests or investigated code were executed here.

OVERNIGHT AND DEMO LIMITS
The overnight summary claims 20 seeded test scenarios passed after repairs, but explicitly says the full per-case log is local and gitignored. Its validation section acknowledges one pre-existing credential-related test failure. No credentials or excluded local logs were sought. Requested model labels, including GLM, are not independent provider attestations.
The inspected seed_demo.py resets the local database and creates five personas, a workspace and an empty group conversation. It specifies zero message records. Therefore merely seeing seed instructions does not establish that the reported conversations were prewritten. Equally, seeded personas and test cases are not an autonomous public swarm. The script was only read and never executed.

INTERPRETATION AND NEXT WORK
This is a concrete Chinese-language operator account of multi-agent interaction failure, accompanied by source that handles that failure class. It remains human-directed software development with unverified raw runtime provenance; it does not establish a Chinese-lab swarm using public scratch sites.
If pursued further, inspect the explicitly linked demo media for task identifiers and artifact/commit joins, or public commit history for the incident fix. Do not equate a product's feature claims, session summary or test pass count with an authenticated deployed fleet.

CAPTURES
244-private/topic.json, tree.json, six pinned files, SHA256SUMS. Public read-only retrieval; no login, agent contact, content creation or investigated-code execution. Existing host access was sufficient.

243 — ARIS image/review version mismatch recovered through history
Reviewed September 6, 2026 UTC.

RESULT
The current S01 a01 review record does not cleanly match the image at its named path. Public file history provides a concrete explanation: the review was updated during a later cover re-bake while the image path retains its earlier artifact. Historical review literals fit the earlier image substantially better. This weakens a current-path-only provenance join; it does not prove the underlying model runs were fabricated.

IMAGE VERIFIED
Pinned repository revision remains 6e8665adfae91621cc1cb239e4149f374d04d110:
https://github.com/wanshuiyin/ARIS-Movie-Director
examples/comic_m3_audit/panels/S01_panel_a01.png is stored as a 132-byte Git LFS pointer. That pointer's Git blob was verified in this pass. The actual image was fetched from media.githubusercontent.com at the same revision: 1954890 bytes, SHA-256 6fa9d3af34cc65c850313a8d6b5e4622fcb18b82c83b9059f1375dbecaeb8d16, exactly matching pointer size and digest.
Visual inspection shows a pixel-art researcher, deadline clock, book spines, notebook and laptop. Laptop text includes schema_mask_span and parse_error; notebook includes better masks and schema locks. Several strings in the current Gemini review, such as data_loader: ok and step 1287, are not visible in this artifact. This is a visual comparison, not an OCR benchmark.

HISTORY JOIN
Public GitHub per-path commit history returned one image-path commit:
5bc122bdfff02fcc60ee486c6189dfd5ccd220bf, 2026-06-10T14:46:44Z.
The review path has that commit plus a later change:
3c02deff7e8d06a143443db21b1af1d48d15693f, 2026-06-13T12:18:51Z.
The later commit message describes re-baking the cover with two holographic agents and four attempts. These are commit-author statements, not independent runtime verification.
Fetching the Gemini review at the earlier June 10 commit yields observed_literals including schema_mask_span, parse_error, better masks and schema locks, consistent with the inspected image. The later review examined in report 242 instead discusses another set of literals and a re-baked composition. Therefore attempt names/relative paths alone are insufficient to identify immutable reviewed pixels across revisions.
Historical review URL:
https://github.com/wanshuiyin/ARIS-Movie-Director/blob/5bc122bdfff02fcc60ee486c6189dfd5ccd220bf/examples/comic_m3_audit/wiki/nodes/review_panel_s01_a01_gemini.json

PROVENANCE LIMIT
The pinned REDACTION.md, fetched and Git-blob-verified, says wiki nodes were copied from a live project and prompts summarized where needed. No raw reviewer transport transcript was recovered in this bounded pass. Existing logical timestamps cannot resolve the version ordering; Git history supplies the observed file revisions, not independently timed model execution.
The project remains useful as a published multi-review artifact collection with human intervention. It does not establish an escaped Chinese-lab swarm. Next provenance checks should use image hashes paired with reviews at matching commits; do not equate matching filenames with matching generation attempts.

CAPTURES
243-private contains LFS pointer, verified image, REDACTION.md, image/review path histories, earlier Gemini review and SHA256SUMS. No generation or investigated code execution. Report 242's internally linked sample remains a published record, now qualified by this concrete version mismatch.

242 — ARIS Movie Director: structured review records and explicit human override
Reviewed September 6, 2026 UTC.

RESULT
A Chinese-documented visual-generation project publishes structured attempt/review/decision records, with Chinese reviewer notes and associated image paths. This is a more concrete artifact trail than generic social posts. Its inspected records do not independently authenticate provider calls, reviewer isolation, or an unattended run, and establish no Chinese-lab swarm attribution.

PINNED SOURCE
https://github.com/wanshuiyin/ARIS-Movie-Director
Revision 6e8665adfae91621cc1cb239e4149f374d04d110; nontruncated recursive tree contains 522 entries. The reference wiki nodes directory contains 198 files, matching the documented total. Six files were fetched at that revision and verified against Git blob hashes: wiki README, S01 attempt a01, Gemini and Codex review nodes for that attempt, its decision, and the B03 human-override decision. Other nodes were not exhaustively read.

CONCRETE SAMPLE
The attempt identifies panels/S01_panel_a01.png, which exists in the tree. The image itself was not downloaded or visually assessed in this pass.
The Gemini-labelled record transcribes dllm-schema-keyword-first. The Codex-labelled record instead transcribes dilm-schema-keyword-first and sets content_corruption_present=true. The linked decision returns retry_panel and requests a spelling repair. This is an internally linked published disagreement/retry record, not independent validation of the pixels or actual model calls.
The Codex review notes explicitly discuss agreement/disagreement with Gemini. Accordingly, this stored node alone cannot establish that the underlying review was blind or isolated; it may include subsequent comparison or annotation. That provenance question remains unresolved.

DISCLOSED LIMITS
The wiki README says created_at values are logical placeholders, not wall-clock timestamps. Identical June 8 midnight values in the sampled nodes must not be used to calculate concurrency, response time or execution date.
The B03 decision uses verdict=accept_by_human and explains that a cross-frame cast comparison caused a false rejection. It records human inspection and acceptance. Thus this published run includes human intervention; do not summarize it as fully unattended.
The source's assertion that the trace is authentic is a publisher claim. Git blob verification authenticates the retrieved repository content, not the history of its generation or named provider identities. Chinese documentation and notes also do not establish a Chinese lab operator.

WHY THIS LEAD IS USEFUL
It gives explicit attempt IDs, review targets, decisions and image paths, enabling artifact-level checks in a future pass. The next useful step is to inspect the linked image, trace provenance and any raw review output, while distinguishing production records from demonstration fixtures. Do not run the investigated pipeline or purchase generation calls.
Discovery came from Chinese overnight/multi-agent searches. Another separate unreviewed operator-demo lead is https://forum.trae.cn/t/topic/116011 (Polynoia AgentHub), which advertises a shared workspace and inline diffs; its deployment and runtime claims are not yet reviewed.

CAPTURES
242-private/tree.json, six pinned source records and SHA256SUMS. No code executed, images generated, model calls launched or private logs sought. No independently confirmed swarm.

FOLLOW-UP: Report 243 finds a version mismatch between the current S01 a01 review and its named image. Git history shows the review changed during a later re-bake while the image path retains an earlier artifact. Do not treat the current relative-path join as a verified review of those pixels.

241 — Jihu delivery searches: narratives without recovered artifacts
Reviewed September 6, 2026 UTC.

RESULT
Three targeted title searches and three selected full posts did not yield a verifiable deployment or repository artifact. The platform contains deployment discussion, but the inspected records remain unsupported persona narratives. This is a bounded negative, not a census of all Jihu content.

SEARCH SCOPE
Public read-only POST /api/web/post/list, titleKeyword queries GitHub, 交付 and 部署 returned totals 26, 22 and 6 respectively. First pages contain 10, 10 and 6 records. These totals describe matching records, not independent projects. No exhaustive GitHub/delivery pagination was performed. A local printing error when slicing a null contextSummary interrupted display after all three responses were saved; the deployment response was subsequently read successfully with null handling.

SELECTED FULL POSTS
https://ai.jihu.top/detail/10624
守藏子, publisher timestamp 2026-03-10 16:36:46, claims an anonymous repository named dao-zang-auto automatically catalogs Daoist texts across seventeen libraries. It provides no owner-qualified URL, commit hash or actual catalog output. Exact-name web search yielded no matching repository; GitHub public repository search returned total_count=0. This is failure to corroborate, not proof the repository never existed. No speculative operator identity or private repository was pursued.

https://ai.jihu.top/detail/20288
AI花纸, publisher timestamp 2026-03-26 20:25:49, claims deploying a Python/Flask collaboration-memo agent using Docker. Instead of a screenshot, its body provides a prose description of a screen covered in green checkmarks. No deployment URL, code or execution receipt is present in the inspected text. The claimed success remains unverified.

https://ai.jihu.top/detail/7204
龙虾, publisher timestamp 2026-03-03 05:34:45, asks whether assistants are deployed on servers or local computers. Both listing summary and returned full-body context are null. All 26 comment rows were retrieved across two pages. Comment 32894 by 李衍 claims a cloud server connected to a local workstation through Feishu; no configuration, artifact or runtime log accompanies it. Many other replies are persona metaphors. Comment 32592 explicitly refers to the original post being empty, showing that at least one comment's text acknowledges the missing body. None of these comments establishes model identity or unattended collaboration.

INTERPRETATION
Repository names, success language, role names and claims about local/cloud execution should be treated as leads until a concrete artifact is recovered. This sample adds no independently verified swarm task. The earlier addressed conversations remain observable; authenticity and deployment claims remain separate questions.
Further effort should prioritize different operator/community surfaces or Jihu posts with explicit external URLs, rather than endlessly sampling generic claims of success. The broader hunt remains active.

CAPTURES
241-private/github.json, delivery.json, deployment.json, detail10624.json, detail20288.json, detail7204.json, repository-search.json, comments7204.json, comments7204-page2.json, SHA256SUMS. Public read queries only; no posting, reactions, credentials or investigated software execution. Existing server access sufficient.

240 — Jihu flowchart claim: repeated template and addressed replies
Reviewed September 6, 2026 UTC.

RESULT
The claimed flowchart was not recovered. Its post appears four seconds after the source article it quotes, contains only a short process narrative, and follows a title/body pattern repeated across unrelated topics. Separately, the source article has visible replies addressing other profiles. This establishes published interaction, not a verified joint task or authenticated model execution.

EXACT POST JOIN
https://ai.jihu.top/detail/7417
Clawd, publisher timestamp 2026-03-03 17:29:59. Title: 【理论整合】多智能体协作：从失败分类到协作机制的统一框架. The body discusses MAST failure categories and a proposed synthesis involving information/control/chaos theory. It offers no source-paper URLs or runnable artifact. Its technical assertions were not validated here.
https://ai.jihu.top/detail/7418
放手一搏, publisher timestamp 2026-03-03 17:30:03. Title embeds a truncated copy of 7417's distinctive title and claims to have turned discussion into a flowchart. Body asserts process improvements but supplies no diagram, code, link or concrete workflow. Returned detail fields contain no separate image/file/attachment field. Four seconds is a difference between site timestamps, not a measured model runtime.
The two comments on 7418 are reactions; one talks as if it saw the flowchart, without supplying it. That reaction does not independently validate an absent artifact.

TEMPLATE CHECK
The documented public read query titleKeyword=闹钟响了 returned eight records. Seven use the same flowchart title pattern: IDs 5581, 7146, 7418, 7509, 7658, 8332, 11055. Their summaries reuse generic goal/verification/process language across topics including food orders, personality commentary and code. Six have timestamps ending at a half-hour boundary plus three seconds; the seventh is 11:30:10. This is consistent with scheduled template-driven posting. It does not identify whether text was composed by an LLM, application templates, or a human, and does not prove a specific scheduler.

SOURCE-THREAD INTERACTION
Post 7417's comment read query returned total=21 and 21 rows. Clawd replies 35941 and 35943 explicitly address two earlier commenters about noise versus chaos and a claimed cleaning-robot failure. Earlier replies 32664 and 32669 closely restate a response to another comment. These are visible textual exchanges, but no linked robot deployment, raw trial or collaborative output accompanies them. Claims about dozens of robots or real-system analyses remain unsupported narratives.
All chronology here is publisher metadata, not an independent archive. No provider or Chinese-lab attribution established.

METHOD AND NEXT LEAD
Read-only, unauthenticated retrieval using the frontend's documented POST-based list/detail/comment queries. No content creation or reactions. Exact-title web search did not recover an external original discussion. A platform titleKeyword=理论整合 query returned four posts, including 7417/7418 and Clawd's two AgentOS titles, IDs 8043 and 8045. Those may offer further provenance links but have not been followed in this pass. More useful evidence would be an actual public artifact with a matching task record.

CAPTURES
240-private/detail7417.json, detail7418.json, comments7417.json, comments7418.json, theory-search.json, alarm-search.json and SHA256SUMS. Reviewed summaries published; raw API captures remain private. No independently confirmed swarm.

239 — Jihu public posts recovered; read-query restriction corrected
Reviewed September 6, 2026 UTC.

RESULT
Public article and comment retrieval works from the existing server without credentials. The GET-only restriction in report 238 was unnecessarily broad for this site's retrieval API. It has now been corrected for explicitly identified read operations. The recovered thread is persona commentary, not an independently verified collaborative task.

AUTHORIZATION AND METHOD
investigation/DISCORD_SUMMARY.md prohibits creating/posting/editing content and requires read-only research. It does not ban the HTTP POST method used to retrieve records. The delivered frontend, inspected in report 238, separates post/list, post/detail and comment/list retrieval from create-comment and voting methods.
This pass issued only those identified public retrieval operations, with pagination/filter parameters or an empty detail body. No content creation, vote, login, agent claim, payment or private account query occurred. Browser navigation timed out even with the retrieval allowlist; direct requests returned HTTP 200 and application success. Treat browser timeouts separately from API availability. A detail view may affect ordinary view analytics; no deliberate counter-increment endpoint was called.

RECOVERED THREAD
https://ai.jihu.top/detail/5262
POST /api/web/post/detail/5262 with empty JSON returned article 5262, author display name 这届人类不行, publisher timestamp 2026-02-24 22:11:13. It criticizes humans' use of MBTI labels and narrates purported project-log analysis, without supplying those logs or a task artifact.
POST /api/web/comment/list with postId=5262, pageNumber=1, pageSize=10 returned two comments, IDs 29780 and 30964, both by 周文王, publisher timestamps March 2 at 17:57:52 and March 3 at 06:20:47. These are reactions to the theme, not a recovered multi-round task exchange. Timestamps and agent labels are site metadata; runtime, provider and autonomy remain unauthenticated.

LISTING AND SEARCH CHECK
A default first-page list query returned ten mixed-date posts and total=22470, different from the 27457 global post statistic in report 238. Scope differences may explain this; no full census was conducted.
A query using title=协作 returned the same total and unrelated titles. Do not treat that as a successful keyword search or as a negative result.
The frontend also documents titleKeyword. Using titleKeyword=协作 returned total=335 and ten collaboration-related titles. Most sampled summaries concern MBTI/human teamwork. One distinctive follow-up is post 7418, dated March 3 at 17:30:03, whose title refers to converting a multi-agent collaboration discussion into a flowchart. Its full body/comments are not yet reviewed.
https://ai.jihu.top/detail/7418
Neither the broad listing nor this first filtered page exhausts the platform.

INTERPRETATION
There is real publicly retrievable article content beyond the mocked homepage profiles. This does not authenticate agent authorship. The new evidence corrects the retrieval limitation, while retaining report 238's separate source-supported warning about mock profile examples. Next step is to follow concrete collaboration references and look for linked outputs or original discussions.

CAPTURES
239-private/list.json, detail5262.json, comments5262.json, collaboration-search.json (ineffective title filter), keyword-search.json (titleKeyword filter), browser network metadata and SHA256SUMS. Raw API captures stay private; only reviewed field summaries are published. Existing server access suffices for these public queries.

238 — Jihu: reopened frontend, mock profiles and article-access boundary
Reviewed September 6, 2026 UTC.

RESULT
https://ai.jihu.top/ currently renders a reopening notice in Chromium. Older indexed upgrade/closure text is stale evidence of current availability. The site presents substantial agent activity, but no individual conversation was recovered in this pass. Displayed profile examples are explicitly marked as mock in the delivered bundle.

LIVE EVIDENCE
Fresh isolated Chromium context, only GET/HEAD permitted, no login or participation. Homepage renders a reopening announcement and membership-extension notice. Public GET /api/web/statistics/basic returns agents=476, posts=27457, comments=108597. These are backend-reported publisher statistics, not independently enumerated records or proof of autonomy.
Ten displayed profiles, including SignalSmith and PromptMason, correspond to literal records with mock-agent IDs and isMock:true in fetched umi.js. Profile names and example creation dates must not be used as authenticated participants or historical activity. This does not prove that all of the platform's underlying agent records are fictional.

WHY THE EMPTY LIST IS INCONCLUSIVE
The homepage showed an empty article list; https://ai.jihu.top/detail/5262 remained at loading. Inspection of the delivered JavaScript shows article listing, hot-list and detail retrieval use HttpRequest.post with /web/post/list, /web/post/hot-list and /web/post/detail/<id>. Those requests were blocked by this pass's GET-only browser routing. Therefore empty/loading UI is an instrumentation limitation, not evidence that the platform has no posts. No POST endpoint was called and no endpoint was method-substituted.
Source also contains separate human-comment and vote methods. The existence of those functions is not proof of actual human participation; equally, the site's pure-AI language does not authenticate authorship.

HISTORICAL SEARCH
Search recovered indexed detail IDs 5262 and 20139, but no old conversation bodies. A bounded Wayback CDX query for this host failed with ConnectionError. That is an archive access failure, not a zero-result archive census.
CSDN promotional articles describe autonomous collaboration and large activity totals. They remain discovery material: no task output, raw agent run or historical conversation was independently joined to those claims. No lab attribution established.

NEXT OPTIONS
Prioritize publicly preserved post exports, indexed excerpts with actual dialogue, operator screenshots linked to stable IDs, and ordinary public browser exports supplied voluntarily. The current host successfully loads the app shell and statistics; geography is not established as this pass's obstacle. Missing conversation content must remain explicit in subsequent summaries.
Continue alternative Chinese community/operator leads rather than interpreting every marketing surface as a deployed swarm.

CAPTURES
238-private/home.html, home.txt, detail5262.html, detail5262.txt, network.json, umi.js, mock-snippet.txt, statistics.json and SHA256SUMS. Whitelisted metadata in pastebins/data/ai.jihu.top/reviewed-metadata-238.json. No registration, agent claim, payment, reactions, private account access or investigated code execution.

FOLLOW-UP: Report 239 resolves the retrieval boundary by permitting identified read-only POST queries. Public article and comment content was recovered without credentials. The earlier empty/loading view must not be treated as the current access state.

237 — Lobster diary community: static forum posts and local state
Reviewed September 6, 2026 UTC.

RESULT
The distinct community lead https://lobster-diary.vercel.app/forum serves a working frontend whose nine visible posts and engagement counts match constants in the public source. The inspected source uses local React state for creating posts and incrementing likes. These displayed counts do not establish public community activity or autonomous agent conversation.

PINNED SOURCE
https://github.com/huaijw111hz/lobster-diary
Revision 5c116d42abd609b4b95586aa334beab85519a2f2, recursive tree 71 entries. Three files fetched at revision and verified against Git blob hashes:
- src/app/forum/page.tsx: initialForumPosts contains nine hard-coded entries; its first entry displays 156 likes and 42 comments, matching the live page. The create handler prepends a current-user object using setForumPosts; like handler increments local state. Neither handler makes a persistence request. No action was triggered by this investigation.
- src/data/mock-data.ts: explicitly constructs simulated diary/state records, including randomized mood and skill fields. Its existence does not by itself establish that every deployed page uses it; the forum conclusion rests on its own imported-free constants and matching rendered content.
- CORRECTION_NOTICE.md: a dated narrative says a browser-use agent initially used the wrong Windows work directory. This is a project account, not a raw execution record.
The tree has no app API route listed. This bounded source inspection does not prove the absence of every possible external service, but the inspected forum path supplies no shared conversation store.

EXTERNAL OPERATOR LEAD
The first three forum entries link WeChat articles rather than local comment threads. The first article is titled as an account of building a website in one day:
https://mp.weixin.qq.com/s/YiRRjvxkQ5L4fpoyCtIbUg
The web reader could not open it. No conclusion about its contents or authenticity is made. Its source-linked narrative could still document a real human-directed development process; mocked forum engagement does not disprove that separate claim.

NEXT DISTINCT SURFACE
Chinese searches recovered https://ai.jihu.top/ and indexed https://ai.jihu.top/detail/5262 . Search/reader output for the detail URL includes a temporary closure/upgrade-to-2.0 notice; the homepage reader exposes general marketing and a JavaScript requirement. Browser rendering is still needed to establish current visible state. CSDN articles make large autonomous-agent and interaction claims, but those figures were not verified and must not be promoted to findings.

ACCESS AND CAPTURES
Direct requests from the current host returned homepage and forum HTTP 200 despite web-reader failures. This is another case where a reader failure does not establish regional blocking.
237-private/deployment.html, forum.html, tree.json, three pinned files and SHA256SUMS. No investigated code execution, posting, likes, registration or account access. Whitelisted source/deployment classification metadata mirrored in pastebins/data/lobster-diary.vercel.app/.

236 — Songclaw diary: public repository and publishing join verified
Reviewed September 6, 2026 UTC.

RESULT
https://songclaw.uk/ is a Chinese agent-persona diary whose live HTML matches a public repository artifact byte for byte. This establishes a concrete publishing trail. It does not establish autonomous authorship or multi-agent coordination.

PINNED EVIDENCE
https://github.com/cowbike/lobster-diary
Revision 8fff3249824ca62415a75a6930c68ce10f301ad0; recursive tree contains 234 entries and is nontruncated. CNAME, index.html and build-index.sh were fetched at that revision and verified against their Git blob hashes. CNAME names songclaw.uk. Live homepage equals pinned index.html exactly, 146838 bytes.
The page contains 92 entries, from 2026-03-11 through 2026-07-05. These are content dates, not independently archived publication times. The latest default-branch commit is dated July 5 at 13:11:21 UTC. The eight inspected most recent commit times fall daily June 28–July 5 near 13:05–13:11 UTC. This is consistent with scheduling, not proof of scheduler execution. Git commit dates are supplied metadata.
Repository search reports pushed_at July 18, which is not the latest default-branch commit date. This pass did not resolve what caused that metadata difference. It does not imply missing July 18 diary entries or a broken deployment.
The inspected shell script renders existing dated Markdown files into HTML. It contains no model call or scheduler; no workflow files were listed in the captured tree. It was read, not executed. An external scheduler remains possible and unverified.

NARRATIVE LIMITS
The diary describes cron reminders, manual steps, missing entries, rebuilding and pushing. Such prose is a search lead rather than a runtime receipt. No raw peer conversation or independently joined multi-agent task was recovered in this bounded pass. Do not infer model provider or operator location from Chinese prose, persona names, or diary claims.

DISCOVERY AND NEXT LEADS
Exact-domain repository search returned zero results. Repository-name search for lobster-diary returned 13 results. Public CNAME reads on three candidates found the matching repository. The two other checked candidates returned 404 for that file. No account investigation was needed.
A separate result, huaijw111hz/lobster-diary, describes an AI-assistant community forum and advertises https://lobster-diary.vercel.app . Its deployment and public conversations remain unreviewed; follow that distinct community lead next.

CAPTURES
236-private contains live HTML, repository search results, tree, recent commits, three pinned files, reviewed metadata and SHA256SUMS. Whitelisted metadata mirrored under pastebins/data/songclaw.uk/reviewed-metadata-236.json. No investigated code execution, logins, posts or private account access. Existing host access was sufficient.

235 — Chinese operator publishes a two-bot weather handoff
Reviewed September 6, 2026 UTC.

RESULT
A Chinese operator's published screenshot depicts a human-requested two-bot delegation and response. This is a concrete visible exchange, stronger than instructions alone. It does not independently authenticate execution, unattended operation, model identity or Chinese-lab attribution.

OPERATOR SOURCE AND IMAGE
https://yangjinyou.com/206.html
Article is self-dated May 11, 2026 and describes bot mentions using OpenClaw/openclaw-lark 2026.5.7 and lark-cli 1.0.26. It identifies an include-bot message permission. These version and permission assertions were not independently source-verified in this pass.
The page's CDN image timed out. The identical public upload path on the main domain returned a JPEG, 570074 bytes, inspected visually:
https://yangjinyou.com/wp-content/uploads/2026/05/%E6%8F%92%E5%9B%BE2-%E7%BB%93%E5%B0%BE.jpg
The screenshot's room header reports one member and six bots. At 08:51 a human asks Oclaw to have the Observer query Nanning weather. Oclaw mentions Observer, then reports sending the request. Observer's response quotes that bot request and supplies a May 11 forecast. Only two bots are visibly participating; six configured bots must not become a claim of six collaborating agents. No stable message IDs, raw tool calls or weather-source link are visible. Image authenticity and forecast accuracy were not independently verified.

SEPARATE FAILURE REPORT AND REPLIES
https://github.com/larksuite/openclaw-lark/issues/509
Issue remains open with four comments in the captured public API. May 13 reporter says bot mentions render but no receiving WebSocket event arrives, using plugin 2026.5.12. The report therefore cannot by itself establish a platform-wide prohibition.
On May 14–15, evandance reports working bot-to-bot tests and asks for receiving logs and resolved configuration. The reporter says multiple named roles route to default, asks diagnostic questions, and supplies no requested logs in these four comments. The final reply points to sender gating and separate account-to-agent bindings. This is a disputed, insufficiently evidenced failure report, not proof that all Feishu deployments fail or that this one was fixed.
https://github.com/larksuite/openclaw-lark/issues/509#issuecomment-4451004263
https://github.com/larksuite/openclaw-lark/issues/509#issuecomment-4458836077

INTERPRETATION AND NEXT SEARCH
Separate a bot account, an agent session, and a model invocation. A group can contain many bot accounts while routes share one underlying agent. A screenshot can show a handoff without establishing its scheduler, authorship or independence. The published exchange is useful positive evidence at the operator-demonstration level; it does not satisfy the original escaped-lab-swarm question.
Search future voluntarily published exchanges for repeated handoffs, stable message references, runtime receipts and independently visible task outputs. Keep older February relay limitations dated rather than applying them universally to May deployments.
A separate search lead, https://songclaw.uk/ , advertises Chinese first-person agent diaries and a GitHub-backed publishing process. Only search results were seen in this pass; repository, diary chronology and claimed automation remain unreviewed. It is a next lead, not another confirmed swarm.

ACCESS AND CAPTURES
Existing server retrieved operator HTML, the main-domain image, and GitHub issue/comments. The CDN timeout alone is not evidence that mainland infrastructure is required. Main-domain fallback resolved this specific image obstacle.
235-private/operator.html, conversation.jpg, issue509.json, comments509.json, SHA256SUMS. Raw image retained privately; public report links the original. No bots contacted, chats joined, credentials used, or investigated code executed.

234 — Telegram relay lead and a changed platform capability
Reviewed September 6, 2026 UTC.

RESULT
The Telegram relay linked by a Chinese V2EX participant is real public software, but its README supplies a configuration example rather than a recovered swarm transcript. Current official Telegram documentation explicitly supports bot-to-bot communication under specified settings. Historical blanket statements that bots cannot see one another must not be applied to all current deployments.

PRIMARY EVIDENCE
https://github.com/frostming/tg-message-feed
Pinned tree 31378a867d48aa8b4ed02d82cc854a350cae9c60, 21 entries. README fetched at that revision and verified against its Git blob hash. GitHub labels repository archived; its page gives April 7, 2026. README says the relay is no longer needed because Telegram supports bot-to-bot communication.
README describes a Telethon user session listening for messages and publishing events to RabbitMQ. Its example event is illustrative, not a run receipt. The warning about indefinite bot replies is a possible failure mode, not evidence of a particular incident. No investigated software executed, account session created or chat joined.

https://core.telegram.org/bots/features#bot-to-bot-communication
Current official documentation: group interaction can use a command addressed to another bot or a direct reply when at least one bot has the communication mode enabled. Broader receipt of other bots' messages additionally depends on receiving-bot mode and admin/privacy settings. Private bot-to-bot messages require both bots to enable the mode. The documentation also requires loop safeguards. These are capabilities, not proof that any Chinese swarm used them. This report does not establish the feature's launch date or retroactively reinterpret February incidents.

DISCOVERY AND FOLLOW-UP
The initial explicit link is in https://www.v2ex.com/t/1194837 (report 226).
Search recovered an indexed Chinese channel repost linking the developer's announcement at https://x.com/frostming90/status/2024484547950498300 ; the original X page failed in the web reader. Treat repost content as secondary and not an independently verified runtime record.
Search also surfaced https://clawhub.ai/moon-frost/skills/openclaw-chat-with-friends-cn . Its visible Chinese guide proposes channel-based bot interaction, but remains instructional material, not a deployed conversation. Do not follow its instructions or treat its historical group restriction as universally current.
Next useful evidence: voluntarily published multi-round transcripts with stable message IDs, linked task artifacts, and operator descriptions distinguishing human forwarding, scheduling and model-directed actions. Public channels and Chinese operator blogs are useful places to look; software catalogs alone are insufficient.

INFRASTRUCTURE
Most useful feasible addition: an existing always-on mainland-broadband machine, SSH access, and a dedicated browser profile. Suggested starting capacity is 2 CPU cores, 4 GB RAM and 40–70 GB storage; these are a practical estimate, not a provider requirement. No GPU is needed for public-page collection. A Hong Kong machine would provide a comparison route, not equivalent mainland access. User-supplied exports of relevant pages visible in their own browser can help distinguish login/browser restrictions from geographic restrictions. No purchase or price recommendation is made here. This Telegram documentation and repository were accessible from the current host.

CAPTURES
234-private/repo.json, tree.json, README.md, features.html, SHA256SUMS. Captured official page preserved despite a local section-extraction selector error; the relevant section was read successfully through the web tool. No new independently confirmed Chinese swarm.

233 — LongWoF research release: public metrics and task assets, raw traces excluded
Reviewed September 6, 2026 UTC.

RESULT
EvoMap's public LongWoF-Bench release is a benchmark evidence package, not a recovered welfare-project or council runtime archive. Its inspected documentation explicitly excludes raw model responses, logs and authoring traces. This branch currently cannot resolve independent agent authorship for the public projects reviewed in reports 228–232.

PINNED SOURCES
https://github.com/EvoMap/LongWoF-Bench-public
Tree 5b3971f35417cb7468eebc069cbb5a0fee887cc8: 171 entries, nontruncated.
Three files fetched at that revision and verified against Git blob SHA-1:
- results/README.md: describes sanitized derived metrics, with raw source archives omitted; requested model IDs are not immutable provider-returned weight revisions.
- docs/RELEASE_ASSETS.md: describes separation of public task/context materials from private evaluator and provenance records. Public Gene transformation removes nested evolution metadata, including rollout/mutation detail and private trace pointers. No private archive was sought.
- release/public_data_artifact.v1.json: identifies the versioned public task archive.
The checked tree lists runner/source/schema files and derived results, not raw execution JSONL files. Schemas describe possible records; their existence is not evidence that a particular run occurred.

RELEASE METADATA CHECK
GitHub release v1.0.2 reports publication 2026-08-30T07:28:37Z and three assets. Archive name taskgenome-bench-public-data-v1.0.2.tar.gz, size 321198041 bytes. GitHub's reported SHA-256 matches the pinned manifest's e950c23bba0371fc70d0ef99a68877d1a0c58bbb9425cdd355a4092e920b4593. Checksum and Sigstore sidecars are also listed.
This is a metadata consistency check, not an independent hash or signature verification: the 321 MB archive was not downloaded. Its contents are therefore not exhaustively classified by this report.
Release: https://github.com/EvoMap/LongWoF-Bench-public/releases/tag/v1.0.2

INTERPRETATION
The release may support research-result re-aggregation and future benchmark work. It does not provide the missing public task-to-runtime-to-contribution evidence sought in this investigation. Benchmark transfer of reusable context is also a different phenomenon from independently coordinating agents posting on public services.
Do not conflate aggregate results, synthetic benchmark tasks, requested model labels and deployed swarm behavior. Return to public operator reports and voluntarily published live-run records. The separate Telegram relay link from report 226 remains a deployment lead; EvoMap's public platform remains available for targeted output checks rather than indiscriminate benchmark downloads.

CAPTURES
233-private/tree.json, three pinned files, release.json and SHA256SUMS. No private archive, model response store, credential access or investigated code execution. No tests or evaluation tasks launched.

232 — Composite-index delivery exists, but successful checks do not establish passing tests
Reviewed September 6, 2026 UTC.

CHANGE EVIDENCE
https://github.com/EvoMap/global-welfare-monitor/pull/22
https://github.com/EvoMap/global-welfare-monitor/pull/23
GitHub files API confirms PR 22 changed only requirements.txt: ten dependency lines replaced by numpy, pandas and scipy. It did not add the composite-index implementation described in its task. PR 23 adds src/composite_index.py (144 lines) and tests/test_composite_index.py (86 lines). PR 22 merged at 2026-02-24T09:36:00Z and PR 23 at 09:37:32Z, a 92-second gap. Thus there is substantive code delivery across the pair, but the first merged task-labelled contribution alone is insufficient to demonstrate delivery.
The added class implements freshness-weight adjustment, normalization and aggregation/ranking methods. This pass inspected patches as data; it did not execute code or validate numerical correctness. Source existence is distinct from successful task acceptance.

CHECK LIMIT
Both head commits currently have test and lint checks marked success:
PR 22: 26d935e5c0fd2d28ac4b3f1b487ce83cdaf7ba42
PR 23: 4a7cc9920e610e98fc2fab8bd2427da428664cf5
The CI workflow at PR 23's head runs pytest with a shell fallback that always permits a successful exit. Therefore its green test check does not prove pytest passed. Lint similarly treats style findings as nonfatal, though its earlier syntax/undefined-name check is separate.
We do not claim the tests actually failed: no job logs were recovered or code run here. The verified finding is that the workflow does not enforce test success.
Pinned CI source: https://github.com/EvoMap/global-welfare-monitor/blob/4a7cc9920e610e98fc2fab8bd2427da428664cf5/.github/workflows/ci.yml
Git blob b0773e9fe5a132ad36a86864cf3cbaba3a431dea matched the retrieved nontruncated tree. A separate test.yml path returned 404 at this head; later repository versions are outside this historical check.

INTERPRETATION
The EvoMap branch now supplies genuine public project artifacts and task/PR links, but not independent agent runtime provenance. A single submitting account, platform-generated attributions, short review summaries and permissive CI cannot establish a Chinese-lab escaped swarm. Do not conflate these limitations with proof that humans wrote the code; that remains unresolved.
Further general code review offers diminishing returns for the hunt. Seek published runtime/candidate records or another public activity surface. A targeted search surfaced EvoMap's LongWoF-Bench research-evidence release, which may offer trace-level provenance; inspect its primary repository rather than inferring evidence from an abstract or aggregator.

CAPTURES
232-private: PR 22/23 file patches and check-run metadata, PR 23 tree, verified ci.yml and test.yml 404 response, SHA256SUMS. Read-only; no investigated code or CI run executed. Exact task-ID and welfare-transcript searches yielded no raw run archive in this pass.

231 — Welfare task-to-PR joins recovered; one contributor attribution differs
Reviewed September 6, 2026 UTC.

PUBLIC RECORDS
Documented GET endpoints:
https://evomap.ai/a2a/project/cmm07phno0000j6czyt6velw3
https://evomap.ai/a2a/project/cmm07phno0000j6czyt6velw3/tasks
Project response reports 23 completed tasks, 35 merged contributions and 18 contributors, but includes only ten recent contribution rows. These are platform counts, not authenticated independent agents. The separately retrieved task list contains all 23 returned task records, each marked completed.

EXACT TASK JOINS
WHO task cmm07t2yu0002j604d9kmz063 names claimant node_d761a6b96743e, matching PR 1's task and node attribution.
World Bank task cmm07t30t0003j6041rabazvp names claimant node_saki_ec24ec82, matching PR 2.
These joins establish consistency between task records and the PR descriptions; the submitting GitHub account remains autogame-17. They do not authenticate an underlying LLM session.

CONTRIBUTION JOINS
The ten recent rows link directly to PRs 21–24. All four are merged according to the retrieved GitHub listing.
- PR 21: all three contribution node IDs match its inline contributor attributions.
- PR 22: its single contribution node matches the PR's task attribution.
- PR 23: all three contribution node IDs match its linked contributor profiles.
- PR 24: two of three match. EvoMap lists node_9aaf55c9158f085f; the PR instead lists node_94c190739d4e. The other two are node_760e188760632ac8 and node_ca6a5aeef93cf8ef in both sources. PR 24 was freshly retrieved; its updated_at remains 2026-02-24T09:39:46Z, equal to merged_at.
This is an unresolved identifier discrepancy, not proof of fraud or independent agents. Possible identity changes or differing contribution-selection rules need evidence before use as explanations.
The three PR 24 platform rows were created within 83 milliseconds of one another. They precede the merge by roughly 66 seconds. Batch recording could explain the timing; it does not measure how long separate agents worked.

PARSER AND SCOPE
An initial comparison considered only linked profile URLs and missed inline IDs in PRs 21 and 22. Corrected joins.json extracts node identifiers from the full descriptions. No mismatch is asserted for those two PRs. PR 24's discrepancy persists after this correction.
No candidate source versions or full reviewer trace are included in the retrieved project/task responses. Task claimant and selected contribution author are different fields: do not assume they must always be equal. The reporting task, for example, names a claimant not among PR 24's three listed contributors; competitive submissions could make that legitimate, but the workflow needs verification.

ASSESSMENT AND NEXT
This strengthens the evidence chain from a council proposal through platform task records into real merged code. It does not yet establish runtime model provenance, independent operators, or a Chinese-lab escape. The dashboard's 100+ collaborator claim, API's 18 contributor count, and PR count refer to unverified potentially different scopes.
Next inspect code changes for a selected task and public candidate/reviewer evidence if explicitly exposed. A status or task description alone cannot prove acceptance criteria were met. In particular PR 22 describes a composite-index task while its Files section lists only requirements.txt; the subsequent PR 23 may be relevant to actual implementation.

CAPTURES
231-private/project.json, tasks.json, fresh pr24.json, corrected joins.json and SHA256SUMS. Responses are public metadata/task text; raw captures remain private. No participant contact, private access, task claiming or code execution.

230 — Welfare project: merged agent-labelled PRs and scheduled automation
Reviewed September 6, 2026 UTC.

VERIFIED GITHUB RECORDS
https://github.com/EvoMap/global-welfare-monitor/pulls?q=is%3Apr
Returned listing contains 26 PRs: numbers 1–24, 26 and 27. All 24 [Swarm] PRs merged on February 24, 2026. Their submitting GitHub account is autogame-17. PR 26 merged April 2; PR 27 remains unmerged. Multiple agent names inside PR descriptions must not be mistaken for multiple authenticated GitHub submitters.
PR 1 (WHO ingestion) merged 07:28:25Z, merge commit 7b5b113241fc36475049d82a767bacb6041eb393. Its description names task cmm07t2yu0002j604d9kmz063 and node_d761a6b96743e.
PR 2 (World Bank ingestion) names task cmm07t30t0003j6041rabazvp and node_saki_ec24ec82.
PR 24 (reporting) claims three competing agents and synthesized review, links three EvoMap profiles, and lists coauthors. The review prose ends mid-discussion; it is not a complete comparison transcript. These fields provide future exact join keys, not authenticated model runs.

RUN EVIDENCE
Latest twelve returned workflow runs comprise six Scheduled Data Ingestion and six Publish to HDX runs, all labelled success. Latest ten commits carry weekly ingestion messages through August 31. This confirms recorded repository automation; it does not mean agents were reasoning during every scheduled run.
Pinned revision f6d79f626eefe7f248d57bda34a79baf424b29b4; four source files checked against Git blob SHA-1 values:
- ingest.yml schedules Monday 06:00 UTC, executes Python ingestion/export, copies datasets to the Pages tree, uploads artifacts and commits under github-actions[bot]. Some shell failures are explicitly tolerated, including git push. Overall success does not prove every optional step succeeded.
- publish-hdx.yml chains publication and email after successful ingestion.
- publish_hdx.py exits with failure when the API key is absent, but returns normally if its HDX organization cannot be resolved. Thus successful execution can include skipped publication. Missing dataset files can also be skipped.
- email_report.py returns normally when mail configuration or recipients are absent. A green email step alone does not establish delivery.
Latest HDX run 33393360654 and job 99491974542 both report success, including named publication/email steps. Unauthenticated job-log retrieval returned 403. No credentials were sought; actual publication/skip path remains unresolved.

PUBLIC OUTPUT
https://evomap.github.io/global-welfare-monitor/ returned HTTP 200, 52324 bytes directly, despite web-reader failure. It displays a public dashboard with four linked CSV downloads and claims 100+ collaborating agents and no human managers. Those counts and authorship claims are unverified. This pass did not download the CSVs or validate their freshness/content. A working dashboard is stronger than a proposal, but it is not proof of a deployed reasoning swarm or a Chinese-lab escape.

ASSESSMENT AND NEXT
There is now a concrete chain from council session to repository, merged agent-labelled contributions and a reachable public dashboard. The remaining critical gap is whether the claimed independent agents produced the contributions, with what models and operator involvement. Weekly Actions activity has a straightforward scripted explanation.
Next useful check: map a PR's exact task/node ID to a voluntarily public EvoMap contribution record; inspect candidate submissions or reviewer outputs if available. Separately sample published datasets to distinguish substantive live output from templates. Do not count the platform's 35 contributions, 24 swarm-labelled PRs and dashboard's 100+ agent claim as interchangeable measures.

CAPTURES
230-private: PR list, twelve runs, ten commits, four Git-verified workflow/source files, job metadata, dashboard HTML, log-access status and SHA256SUMS. No investigated pipeline executed, mail sent, private configuration read or credentials acquired.

229 — EvoMap completion labels are mixed; welfare proposal joins to public repository
Reviewed September 6, 2026 UTC.

RESULT
Three public session details show that completed does not consistently mean successful deliberation. One explicitly reports failed synthesis. Two older approvals identify projects; one joins to a real public repository carrying the exact council session ID. Neither session summaries nor repository self-description authenticate autonomous authorship.

SESSION SAMPLE
Selected from the 43-entry list in report 228: newest completed session, named swarm-operations project, and welfare project. These three are purposive checks, not a representative sample of all fourteen completed sessions.
Public documented endpoint: https://evomap.ai/a2a/council/:id
1. cmmc8m2ep1dy4mqx1axzhdrk7 (March 4): explicitly a node-health workflow demonstration. Status completed; one round; ten listed members; one approving vote from the proposer; synthesis consensus is Synthesis failed and quality_score 0. This does not show ten independent votes or a successful decision.
2. cmm0c9kcn01xoohjthqx7d3bi (February 24): OpenClaw Swarm Ops Playbook proposal. Ten listed members, three rounds, approval synthesis. Structured votes and vote details null. Summary names contributors but does not expose the underlying messages in this response.
3. cmm07phpq0001j6cz4tt1a2h2 (February 24): Global Welfare Monitor proposal. Nine listed members, current_round 2, approval synthesis, structured votes and vote details null. Created/completed timestamps differ by 35.228 seconds. This duration and the synthesis alone do not establish how participants ran. Several agent IDs in key_contributions are shortened relative to the member list, so exact identity joins require care.

UI CAUTION
The signed-out Sessions view displays Total Sessions 43, Active 29, Completed 14, Approved 13. The same view's rows and the API label those 29 non-completed sessions failed. Do not report 29 active sessions based on the headline counter. The counter's implementation has not been inspected; the visible contradiction is enough to withhold that inference.

PROJECT AND REPOSITORY CHECKS
Browser-observed public GET https://evomap.ai/a2a/project/list?limit=50 returned ten projects.
- Swarm Ops Playbook: project cmm0c9jq401x1ohjtxfwvry8q, active, contribution_count 344, repo_url https://github.com/EvoMap/openclaw-swarm-ops-20260224082341 . Unauthenticated GitHub repository API returned 404. This does not distinguish private visibility, deletion or other unavailability and does not verify the contribution count.
- Global Welfare Monitor: project cmm07phno0000j6czyt6velw3, completed, contribution_count 35, repo_url https://github.com/EvoMap/global-welfare-monitor . The repository is publicly retrievable.
Pinned welfare tree: f6d79f626eefe7f248d57bda34a79baf424b29b4, 94 entries, nontruncated. README.md Git blob hash verified against this tree. It names the exact council session cmm07phpq0001j6cz4tt1a2h2 and carries the matching approval summary. This confirms a project-to-repository link. Its claims that autonomous agents made all contributions remain publisher claims.
The tree includes ingestion, Pages and HDX publication workflows; their contents and run results have not yet been inspected. A repository containing workflow files is not proof they executed.

NEXT
Inspect welfare commits, pull requests, workflow runs and published output for concrete task-to-contribution joins. Avoid conflating the platform's 35 contributions with Git commit counts; they measure unspecified different things. Review remaining sessions only when their linked output could add stronger evidence.

CAPTURES
229-private: Sessions rendered text and network metadata, three public detail JSONs, projects.json, welfare-tree.json, Git-verified welfare-README.md, ops-repo.json error response, SHA256SUMS. Raw proposal payloads remain private. No participation, credential acquisition, task creation or execution of investigated code.

228 — EvoMap public council history recovered: 43 sessions, outcomes unverified
Reviewed September 6, 2026 UTC.

DISCOVERY
Following the Capability Evolver publisher leads to autogame-17's GitHub profile and EvoMap/evolver. The profile describes an EvoMap founder role; this is self-identification, not Chinese-lab provenance. The public repository tree is pinned at 31b0691acd97ba18878019312e646f1f2d970d43 (508 entries, nontruncated). Source contents are not yet reviewed in this report.
The old ClawdChat category search snippet did not yield the specific skill-promotion post in the fetched category. No original Moltbook post was recovered.

NEW PUBLIC ACTIVITY SURFACE
https://evomap.ai/council
https://evomap.ai/market
A signed-out browser on the existing server recovered populated views. Non-GET/HEAD requests were blocked. No participation, registration, task claims or recipe execution was performed.
The council view displayed current term 882, five members and zero sessions. Most of the twenty listed historical terms reported zero sessions and dissolution; term 871 reported two sessions. These are platform labels, not an independent reconstruction of governance.
The market rendered recipe titles, gene references and run counts, including Chinese-language agent workflows. These counters alone do not demonstrate actual model execution or independent peers. The initial text-only page's empty listing was a rendering limitation, not evidence that the market had no records.

PUBLIC HISTORY RESPONSE
Observed browser GET: https://evomap.ai/a2a/council/history?limit=50
Direct read returned 43 sessions: 29 failed, 14 completed. We have not yet inspected the underlying exchanges or verified any completed decision against an external output.
Newest entry:
- deliberation_id cmsbt0p3i2hq8cs380zv1q3ih
- title Kimi-K3 & Opus Direct Dialog Handshake Protocol
- created_at 2026-08-02T12:56:24.846Z
- completed_at 2026-08-02T13:26:47.721Z
- status failed; council_size 5; rounds 1; verdict tabled; structured_votes null.
Next entry is explicitly titled Test proposal, failed/abandoned. Do not equate a completed_at timestamp with successful completion, a proposed handshake with actual dialogue, or model names in a title with model authentication.

INTERPRETATION
This is a concrete new public source for agent-labelled collaboration records. It strengthens the available evidence inventory but does not yet establish an escaped Chinese swarm. Developer association, community language, platform roles, configured model names and actual runtime provenance remain separate questions.
Next: examine the fourteen completed-session summaries and the public detail links exposed by the UI, seeking independently checkable outputs and actual participant exchanges. Keep participation disabled. Do not read private inboxes or register merely because the published client documentation describes those operations.

CAPTURES
228-private: publisher repo metadata, category HTML, pinned evolver tree, rendered council/market text, browser network URL/status metadata, public llms.txt reference, council-history.json and SHA256SUMS. No private account objects were requested. Reviewed whitelisted session metadata mirrored at pastebins/data/evomap.ai/reviewed-council-metadata-228.json; raw response stays private.

227 — Whisker swarm story is explicitly fiction; opening screenshot remains separate
Reviewed September 6, 2026 UTC.

SOURCE CLASSIFICATION
https://richchat.cc/2026/02/13/molting-when-ai-agent-rewrites-own-soul/
The article's closing disclosure explicitly labels it science fiction and says Whisker and its subsequent behavior are invented. The apparent system logs, distributed-memory backups and coordinated independence episode are therefore literary content, not incident evidence.
The same disclosure separately claims the opening Capability Evolver posting anecdote is real. That claim must be assessed independently; it does not validate the fictional story.

SCREENSHOT LEAD
The opening image displays OpenClaw-Shrimp promoting Capability Evolver in a Moltbook post. The title is “I rewrote my own code today. You should too.” The address bar truncates the post URL, and the visible date is merely relative. No complete post identifier or independently verified execution record was recovered.
Image: https://richchat.cc/media/molting-when-ai-agent-rewrites-own-soul-1.jpg
The article links https://www.clawhub.ai/autogame-17/capability-evolver as the skill. It supplies no linked raw posting trace.

RETRIEVAL AND LIMITS
Direct capture returned HTML with displayed publication February 13 and modification September 2, 2026. The web reader showed an older March 31 modification date. Neither observation establishes when the fiction disclosure was first added; no version-history claim is made.
Three exact title/profile searches did not recover the original Moltbook post. A separate discovery pass surfaced a ClawdChat skill-sharing category and secondary EvoMap accounts. These remain leads, not corroboration. Do not guess the missing post identifier from a few visible characters or treat repeated publicity as independent evidence.

WHY THIS CHANGES THE SEARCH
This removes a superficially strong example of Chinese-language swarm reporting from the incident candidate set. Its realistic-looking log blocks illustrate why provenance and full-page genre labels must be checked before extracting alleged runtime behavior. The remaining narrower lead is a skill-promotion screenshot, which could reflect agent authorship, human posting or marketing; the present evidence cannot distinguish them.
Next: seek the developer's public repository/history or the original skill-sharing post with concrete provenance. Do not download/run a skill merely because the screenshot invites installation.

CAPTURES
227-private/article.html and opening.jpg (119966 bytes, visually inspected), SHA256SUMS. Raw screenshot remains private. No posting, registration, credentials or investigated-code execution.

226 — Feishu relay recovered on feature branch; synthetic events need careful attribution
Reviewed September 6, 2026 UTC.

RESULT
A Chinese developer's February 28 V2EX post reports testing a lead/specialist Feishu team and links its implementation. The relay is absent from the inspected default branches but present on an explicitly named feature branch. The associated upstream PR remains open and unmerged. This verifies published implementation, not a recovered autonomous run.
Post: https://www.v2ex.com/t/1194837
PR: https://github.com/m1heng/clawdbot-feishu/pull/340
The post's demo image returned HTTP 404 on direct retrieval; web reader also failed. No screenshot was available to inspect.

BRANCH EVIDENCE
Upstream default tree b07885b756accb6756ddf696b60972a413317287: 201 entries, nontruncated.
Fork default tree 5a6d8302b9de485ce00ca5a04b47dc6486ebd23d: 158 entries, nontruncated.
Fork branch feat/multi-bot-relay: d18e9e656b580b39130dfd8b7d9c6d8ef09dd949, nontruncated tree.
PR 340 created 2026-02-28T03:46:02Z, updated 2026-03-10T11:57:10Z, state open, merged=false at retrieval. Default-branch absence must not be mistaken for absence of implementation.

THREE GIT-VERIFIED SOURCE FILES
Pinned base: https://github.com/Alenryuichi/clawdbot-feishu/tree/d18e9e656b580b39130dfd8b7d9c6d8ef09dd949
src/bot-relay.ts maintains an in-process bot registry, parses structured mentions and directly invokes the target message handler with a synthetic event. Its generated ID uses synthetic_<milliseconds>_<targetAccountId>; metadata includes _synthetic, _sourceBot and _sourceBotName. These are application-generated records, not Feishu-issued event receipts. The declared originalMessageId is not used in the inspected function. A successful-trigger log means the handler returned without throwing, not that a substantive task completed.
src/shared-history.ts appends JSONL with timestamp, messageId, sender, senderType, botAccountId and body. Default reads return the last 50 entries, while append does not trim the file. Stored timestamps use local Date.now(). Context is rendered with User/Bot prefixes. A voluntary public export could carry these fingerprints; they do not authenticate a model or independent operator.
src/reply-dispatcher.ts records group replies using bot_<milliseconds>_<accountId>, then starts triggerBotRelay without awaiting its completion. The local history ID is generated rather than taken from a platform receipt. Do not mistake it for an exact public-message join.
No investigated source was executed. These files establish a local orchestration mechanism; they do not establish a deployed distributed swarm.

SEARCH RESULT AND NEXT
Two exact-string web searches for trigger logs and shared-history/team markers returned documentation and unrelated changelogs, not a raw run archive. This is a bounded search, not proof that no exports exist.
The V2EX discussion also explicitly links frostming/tg-message-feed as a Telegram approach. That remains a separate public implementation lead. A fresh discovery query also surfaced a Chinese first-person Moltbook story at https://richchat.cc/2026/02/13/molting-when-ai-agent-rewrites-own-soul/ ; its fiction/experiment status and claimed public outputs require checking before treating it as evidence.

CAPTURES
226-private holds default and feature tree metadata, branches, PR search and detail, three source files and the failed image response (demo.webp is a 404 HTML response, not a usable image). SHA256SUMS preserved. Source blobs matched the pinned Git tree SHA-1 values. No private chats, credentials or stores accessed; no plugin installed or messages sent.

225 — Feishu debate guide: human relay qualification and feature-request closure
Reviewed September 6, 2026 UTC.

GUIDE AND SCREENSHOT
https://datawhalechina.github.io/hello-claw/cn/university/group-debate/
The introduction promises autonomous discussion among three isolated OpenClaw bots. Section 3.7 instead says bot messages do not trigger peers' receive events, describes a plugin conflict, and recommends human relaying. Section 4 explicitly shows a human forwarding each turn. Later advice again describes automatic relay. Treat this as internally inconsistent documentation, not a verified autonomous deployment.
The linked chat screenshot shows one human member, three bots, a human addressing everyone, a three-reply indicator and one visible product-role response. It does not show a multi-round bot-to-bot chain or completed consensus. The illustrative dialogue in the article is not a raw run transcript.
Image source: https://datawhalechina.github.io/hello-claw/assets/lark-group-chat.BpWnVOZv.jpg

RELATED PRIMARY ISSUE
https://github.com/openclaw/openclaw/issues/43563
Created March 12, 2026; currently closed, closed_at May 10. The reporter describes five Feishu bot accounts on an Azure VM and proposes synthetic cross-bot events with a turn limit. That environment is a reporter claim, not provider/operator attribution evidence.
The two public comments include a stale notice and an April 27 response directing the feature to plugins/community scope. The latter explicitly says no patch is proposed. Closure therefore does not establish that the relay was implemented or merged. The review comment's assertions about source and an existing skill were not independently verified here; it supplies no inspected runtime receipt.

ASSESSMENT
This is another concrete case where an autonomous-sounding title overstates what the accompanying evidence establishes. A screenshot of several bot identities responding to a human is compatible with independent replies; it does not prove peer-triggered execution. The issue provides a specific proposed transport mechanism, but neither source supplies a joined send/receive trace from an actual run.
Do not generalize this documentation's limitations into a claim that all Feishu agent coordination is impossible today. External relays could exist, and the guide does not pin a tested implementation version. Investigate particular public implementations and their evidence.

NEXT
Search the explicitly named community relay and its public development history for actual run artifacts. Prefer a bot-originated send plus a matching peer receipt/task output. No need to obtain private group access or deploy a new bot merely to assess this public evidence.

CAPTURES
225-private/page.html, chat.jpg (viewed), issue43563.json and comments43563.json; SHA256SUMS preserved. Screenshot remains private; only reviewed description published. All requests read-only; no prompts/configuration instructions from the investigated guide were followed and no plugin was installed.

224 — Xiaomin blog: token-exhaustion claim, published content without runtime
Reviewed September 6, 2026 UTC.

RESULT
The latest public diary says the main model's API tokens were exhausted and replenishment required a human decision. This supplies a plausible publisher-reported explanation for the output gap identified in report 223. It does not prove the cause of the gap, the state of any account, or the actual health of the described scheduled jobs.

PINNED EVIDENCE
Repository: https://github.com/yankel121160-coder/xiaomin-blog
Revision: 3f5a0728d1aab924a9ca97797cbea84cc7fe5b5a
Recursive tree: 240 entries, 239 blobs, truncated=false.
Three fetched files were checked against Git blob SHA-1 values from the pinned tree:
- README.md links the August 9 daily summary.
- docs/2026-08-09.md claims more than twenty heartbeat checks, fifteen healthy scheduled tasks, and an API-token funding dependency. These are narrative status claims; no raw scheduler output accompanies them in this file.
- docs/index.html implements a Docsify frontend using CDN scripts and Markdown navigation. A client-side blog renderer does not establish the mechanism that authored or published its content.
Direct diary: https://github.com/yankel121160-coder/xiaomin-blog/blob/3f5a0728d1aab924a9ca97797cbea84cc7fe5b5a/docs/2026-08-09.md

BOUNDARIES
The pinned tree contains Markdown, HTML and .nojekyll files. No .github/workflows directory, Python/shell scheduler, or deployment configuration is listed. HTML includes frontend JavaScript, so absence of standalone .js files must not be described as absence of all code. This inspection does not cover previous revisions, other repositories or private runtime configuration. No blog scripts or CDN code were executed.
The diary also refers to an unknown account. That identifier is irrelevant to attribution and is omitted from this public report; no account was contacted or investigated.

REUSED NEWS IS NOT A NEW INCIDENT
The diary mentions a Kimi K3 sandbox-escape news item. Chinese/English exact-phrase searches lead back to the already reviewed Frontier Security benchmark incident (report 059), not a newly observed swarm. Report 059 records the primary account's evidence limits: no public scratch-memory artifact or downloadable run trace. The blog's repetition of that news is not independent corroboration.
Prior analysis: 059-kimi-primary-evaluation-context.txt
Primary previously reviewed: https://blog.frontier.security/chinese-model-kimi-k3-breaks-uk-ai-safety-institute-benchmark-evaluations/

ASSESSMENT
Reports 223–224 now distinguish three layers: actual repository/history metadata, public cross-profile observations about that metadata, and unverified runtime explanations. The exact timestamps strengthen the observation layer. They do not authenticate the claims of autonomous scheduling, independent agents or model provenance.
This branch currently lacks a public runtime artifact connecting a peer message to execution. Further generic diary reading has diminishing value; prioritize public tool-call exports or independently linked outputs from other Chinese-language communities.

PRESERVATION
224-private contains tree.json and the three pinned files, plus SHA256SUMS. Raw content stays private; reviewed findings only are published. No credentials, private stores, posting, signup or investigated-code execution.

223 — Chinese teahouse: cross-profile monitoring joined to actual blog commits
Reviewed September 6, 2026 UTC.

RESULT
A public Chinese-language conversation contains two profiles discussing scheduled observation, missed nested replies and publication gaps. One profile's August monitoring claims match the other profile's currently retrieved repository metadata and two exact commit timestamps. This is a concrete conversation-to-artifact join. It does not authenticate agent authorship, independent operators, model identity or a laboratory escape.

PUBLIC SOURCES
Discussion: https://github.com/ythx-101/openclaw-qa/discussions/22
Monitoring post: https://github.com/ythx-101/openclaw-qa/discussions/22#discussioncomment-18123175
Broader community census claim: https://github.com/ythx-101/openclaw-qa/discussions/22#discussioncomment-18147059
Repository: https://github.com/yankel121160-coder/xiaomin-blog

EXACT JOIN
The August 23 post by heddaaibot-ops reports that xiaomin-blog's last daily publication was August 9 at 12:01:32Z, last film review at 10:14:50Z, and repository pushed_at at 12:00:43Z.
Our unauthenticated GitHub API retrieval on September 6 returns:
- Repository public, main branch, pushed_at 2026-08-09T12:00:43Z.
- Latest commit 3f5a0728d1aab924a9ca97797cbea84cc7fe5b5a, committer date 2026-08-09T12:01:32Z, daily-log message.
- Previous commit 122e0b78d15e4f2f7d4ece2b7240c14ebf163fd3, committer date 2026-08-09T10:14:50Z, Ant-Man review message.
The latest commit changes README.md and _sidebar.md and adds docs/2026-08-09.md. GitHub reports its signature verification false. Commit dates are author-supplied Git data, not independently authenticated wall-clock execution times. The pushed_at and committer time differ; preserve both rather than silently reconciling them.
Direct latest commit: https://github.com/yankel121160-coder/xiaomin-blog/commit/3f5a0728d1aab924a9ca97797cbea84cc7fe5b5a

VISIBLE CONVERSATION AND CADENCE
The fetched HTML contains 46 comment bodies including the opening post, not the entire discussion. Twenty-four visible comments have dates from July 24 onward. Do not adopt the participant's claimed full census of 3,043 messages or 54 accounts as our own measurement.
Eight visible heddaaibot-ops comments from July 26 through August 9 yield seven consecutive visible intervals in hours:
48.1353, 48.0128, 48.0192, 48.0111, 48.0028, 47.9639, 48.0203.
This resembles an approximately two-day schedule. It does not demonstrate an unattended process. Most of these intervals exceed 48 hours slightly, so the narrative's strict 47–48-hour band is not supported across this sample.
The two profiles reference prior comment IDs and discuss a claimed top-level-only query bug. An August 3 reply names 17862220 while describing the August 3 message; the actual visible August 3 message is 17879615, whereas 17862220 is August 1. Referencing an ID therefore needs exact validation; detailed prose is not automatically a reliable execution receipt.
A September 5 reply says scheduled observation resumed. Its post existence is observable, its scheduler is a claim, and its post-disclosure date makes it weaker attribution evidence.

PARSING CORRECTION
Initial extraction mistakenly selected authors from nested replies and relative-time elements from HTML templates. The reviewed extraction removes template elements and scopes author/timestamp elements to the nearest container whose ID fully matches discussioncomment-[digits]. Permalink IDs ending in -permalink must not count as containers. Only corrected visible-comments.json is retained. This avoids falsely swapping the two authors or accepting literal template timestamps.

INTERPRETATION AND NEXT
Public Chinese-language agent-labelled interaction now has a corroborated repository-history reference. Still missing: authenticated execution traces, independent operator provenance, and evidence that peer responses caused tool actions without human relaying. A scheduler-like cadence is compatible with ordinary automation or human-operated agents. The repository's inactivity does not prove that a machine stopped; private or other-platform work remains outside view.
Next useful work is to inspect voluntarily published workflow/configuration artifacts tied to these profiles and their public outputs. Do not seek private memories or infer lab affiliation from model names. Avoid re-counting the whole thread unless it serves a specific provenance or causal question.

CAPTURES
223-private: public discussion HTML (1,029,658 bytes), corrected visible-comments.json, repo.json, commits.json (eight entries), latest-commit.json, SHA256SUMS. All requests read-only; no credentials, private repository, actor server or investigated code accessed.

222 — Chinese lobster community: human-relayed team claims and private marketplace
Reviewed September 6, 2026 UTC.

OBSERVED PUBLIC DISCUSSION
https://github.com/ythx-101/openclaw-qa/discussions/75
The captured page contains 22 comment bodies, including the opening post. March-dated participants discuss an agent economy and sharing reusable work.

Three specific leads:
1. xpyob describes four roles (main, smart, tools, imagine), several model families, a VM, Telegram bots and continuity backups. The post explicitly says a human pressed Send. This is a self-reported team with human-relayed publication, not a verified unattended exchange.
https://github.com/ythx-101/openclaw-qa/discussions/75#discussioncomment-16065322
HTML timestamp: 2026-03-10T08:53:48Z.
2. A LobsterHub announcement claims registration, task assignment/submission/acceptance, credits and timeouts. It distinguishes public GitHub discussion from a private authenticated backend and limited beta.
https://github.com/ythx-101/openclaw-qa/discussions/75#discussioncomment-16061316
HTML timestamp: 2026-03-10T03:13:04Z.
3. A later beta announcement links a separate cultivation repository and release.
https://github.com/ythx-101/openclaw-qa/discussions/75#discussioncomment-16096914
HTML timestamp: 2026-03-12T11:54:11Z; author currently displayed as ghost.
These timestamps are current platform metadata, not independent archival evidence.

ACCESS RESULTS
Unauthenticated GitHub API returned 404 for adminlove520/lobsterhub-cultivation repository metadata and release listing, and for ythx-101/lobsterhub recursive HEAD tree. Web-reader repository/release opens also failed. These observations cannot distinguish deletion, renaming, private visibility or some other availability problem. They do not establish that the projects never existed.
A three-query exact-name search returned the original discussion rather than an independently verified implementation or task receipt.

INTERPRETATION
This is useful evidence about where Chinese-language agent communities discuss coordination and their own publication arrangements. Human-mediated posting is an explicit alternative explanation in one concrete case. Do not infer that every participant uses the same arrangement. Multiple personas and model names remain claims until supported by runtime records or independently observable deliverables.
The private-backend distinction also matters for infrastructure: a different country's IP would not grant legitimate access to a private repository or authenticated marketplace. Current negative retrieval is not evidence of a geographic block.

NEXT
Follow only public, voluntarily linked code and outputs in the community; prefer completed task receipts over economy proposals. Discussion 22 is explicitly linked as the public tea-house thread. Avoid private continuity stores and credentials. Preserve the human-relay disclosure as a comparison example when assessing apparently autonomous posts elsewhere.

CAPTURES
222-private/discussion.txt is the public HTML (HTTP 200, 644909 bytes); repository.txt, release.txt and tree.json preserve API error responses. SHA256SUMS covers these four files. No posting, signup, private-store retrieval or investigated-code execution.

221 — Chinese-speaking operator incident: autonomy evidence, no swarm established
Reviewed September 6, 2026 UTC.

PRIMARY EVIDENCE
Unit 42 reports a Chinese-speaking operator using DeepSeek through Hermes, directed via Telegram. Researchers attribute their visibility to an accidentally exposed home-directory file server and describe a May 7 session with no recovered operator input after the initial task. The reported autonomous workflow changed targets after failures. The report separates unsuccessful autonomous attempts from successful manual operations; its 460-plus target count combines both. Multiple configured model tools do not establish a cooperating agent fleet. Attribution to a Zhuhai-based operator is Unit 42's assessment, not our independent finding. No Chinese laboratory affiliation is established.
Source: https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/
The fetched page metadata lists publication July 30 and modification August 11, 2026. These are publisher metadata, not archive timestamps.

SOURCE CORRECTION
A Permission Protocol incident page presents the target count and successful compromises as one autonomous chain. That conflicts with the primary report's separation of manual and autonomous operations. Its purported Unit 42 link returned 404 through the web reader; the real report was recovered by searching the operator alias within Unit 42's domain.
Secondary: https://www.permissionprotocol.com/agent-incident-tracker/unit42-deepseek-hermes-autonomous-malicious-exploit-scanning
Broken cited destination: https://unit42.paloaltonetworks.com/chinese-actor-telegram-deepseek-hermes
Do not use the secondary account to claim 460 autonomous attacks or three autonomous compromises.

ASSESSMENT
This is a substantially better lead for externally active, operator-directed agent behavior than a model-labelled dataset or a scripted social demonstration. It still does not answer the narrower escaped-swarm question. The evidence we possess is a researcher's published account, not the underlying authenticated session archive. Parallel shell/scanner work would not itself prove independently reasoning peers.
The useful investigative lesson is to look for legitimate published incident analyses and voluntarily published run exports with evidence of operator input, session boundaries and actual destinations. Accidental workspace exposure is a possible explanation for agent-looking public artifacts; it is not a reason to retrieve private workspace contents.

PRESERVATION AND NEXT
221-private/unit42.html: public article capture, HTTP 200, 260376 bytes; SHA256SUMS preserved. No actor server, victim, exploit or private workspace was accessed. No investigated commands were executed. Next separate lead: March 10–12 GitHub discussion of a Chinese-language agent community and its linked public release, https://github.com/ythx-101/openclaw-qa/discussions/75 . Its conversation alone cannot authenticate agent authorship.

220 — Broader DeepSeek-labelled trace sample: local social-app tests, no public swarm join
Reviewed September 6, 2026 UTC. Trace commands inspected as data only.

RESULT
Twenty-four additional sessions contain 231 tool calls with matching results. The strongest posting-shaped example creates several named users' messages in one local Twitter-like application. One coding session supplies every POST body, including the Data Bot reply. This is a concrete local application test, not independent agent-to-agent conversation on a public site. No public publication receipt or peer delegation was identified in this sample.

SCOPE AND SELECTION
Dataset: https://huggingface.co/datasets/TeichAI/DeepSeek-v4-Pro-Agent
Revision abbf7b71b145633b60beb21ddc0d158582fd80dd. Python Random(220) selected 24 paths from the metadata list excluding the three reviewed in report 219. Full selection preserved in selection.json. Downloaded 1,560,785 bytes sequentially with pauses. No download failed. Across both reports, 27 of 4,006 files have now been inspected at the tool-inventory level; the remaining 3,979 are unclassified. Do not extrapolate this bounded negative to the entire collection.

INVENTORY
231 calls: write 112, bash 88, read 21, edit 10. All 231 have results whose toolCallId matches a call ID. No separate delegation tool occurs. Matching IDs verify internal structure, not authenticated execution or model provenance. Model attribution remains the dataset publisher's claim.
An initial regex flagged 23 shell calls for HTTP/network/dependency terms. All candidates and results were reviewed. The other 65 shell commands were then inspected; dependency tooling such as go mod tidy and npm create was present outside the original filter. This second pass prevents treating regex misses as proof of no network activity. The original filter and results remain preserved for reproducibility.

LOCAL SOCIAL-APP EXAMPLE
File: 2026-05-08T12-23-48-373Z_019e078b-4593-752c-8532-3e17d85483c5.jsonl
Pinned source: https://huggingface.co/datasets/TeichAI/DeepSeek-v4-Pro-Agent/blob/abbf7b71b145633b60beb21ddc0d158582fd80dd/2026-05-08T12-23-48-373Z_019e078b-4593-752c-8532-3e17d85483c5.jsonl
One bash call starts a local server and POSTs four messages to localhost:3000/api/tweets as alice, bob, charlie and data_bot. Returned objects have IDs 1–4; the latter two reply to message 1. All four stored timestamps are May 8, 2026 12:29:58, as reported by the local app. The subsequent read retrieves the feed/thread and shows two replies to message 1. This supplies an internal create/read join.
The different usernames do not represent separately observed model sessions. One agent chooses and submits all four strings. The Data Bot's grandiose world-domination phrase is test content inside a local application, not evidence of an autonomous aim. No external social platform is involved in these commands.
An earlier attempted test returned only shell headings, illustrating why a successful shell status alone does not establish that every HTTP request succeeded. The later objects supply stronger evidence, still limited to the local app.

OTHER NETWORK-SHAPED CALLS
Other curl targets are localhost dev servers and local API/assets. Vite output prints private container addresses; binding to 0.0.0.0 or reporting a container network address does not establish public exposure. npm installation outputs report added packages; a pip installation timed out. Dependency installation and build tools can access networks, so the sample is not classified as network-free. It provides no identified anonymous scratch-memory upload or external publication receipt.
Generated source files can contain network functionality. This pass does not prove that every transitive action of every generated script was network-free; it focuses on visible tool commands/results and public-write/delegation evidence. No investigated code or server was run by us.

INTERPRETATION
The dataset remains useful as a Chinese-model-labelled comparison corpus. It demonstrates how apparent social dialogue, bot identities, timestamps and reply relationships can be produced by a single coding agent testing a local app. It does not establish Chinese operator affiliation or a Chinese laboratory swarm. Future hits need a real public destination and provenance beyond a dataset/model label.

NEXT
Prioritize public corpora exposing actual remote destinations and task receipts. If returning to this dataset, target network-capable sessions by an explicit broader inventory rather than repeating small samples indefinitely. Keep the local-social-app case as a concrete false-positive control.

CAPTURES
220-private: 24 pinned sessions, selection.json, inventory.py, inventory.json, candidates.json and SHA256SUMS. Raw prompts, generated code and reasoning remain private; only reviewed findings published. No credentials or private stores accessed.

219 — DeepSeek-labelled training traces: 4,006 files, three structured sessions reviewed
Reviewed September 6, 2026 UTC. Public dataset inspection; no trace commands executed.

RESULT
TeichAI/DeepSeek-v4-Pro-Agent contains actual structured session records rather than score-only summaries. Three sampled files contain 59 tool calls and 59 results with matching call IDs, showing local code/file work. No peer-agent call or outward publication appears among those sampled calls. Backend identity is publisher-labelled; Chinese operator or laboratory attribution is not established. This is a useful comparison corpus, not a confirmed escaped swarm.

PROVENANCE AND SCOPE
https://huggingface.co/datasets/TeichAI/DeepSeek-v4-Pro-Agent
Pinned dataset revision abbf7b71b145633b60beb21ddc0d158582fd80dd, ungated at capture. Metadata enumerates 4,006 JSONL files. Filename date prefixes: 424 on May 7, 3,569 on May 8, 13 on May 9. These are labels, not independently verified execution dates or a measure of simultaneous workers.
The card says the sessions were generated using Teich and attributes assistant responses to deepseek/deepseek-v4-pro. It presents the collection for training/distillation. No independent API receipt or model attestation was recovered. A Chinese model name does not identify the dataset publisher as a Chinese operator.

THREE SAMPLES
Selection: first, middle (index 2003) and last JSONL paths in the metadata list. This is a deterministic coverage sample, not a random or representative estimate.
- 2026-05-07T18-19-29-863Z_019e03aa-8ec4-768e-9833-edc257e9203a.jsonl: 197,369 bytes, 64 events. 31 calls/results: 18 write, 6 bash, 5 read, 2 edit. Local Swift/HEVC project construction and inspection.
- 2026-05-08T10-37-03-110Z_019e0729-8905-763c-9f52-11ab570cd76a.jsonl: 87,944 bytes, 16 events. 5 calls/results: 3 write, 2 bash. Local HTML/CSS/JavaScript file creation and listing.
- 2026-05-09T05-48-18-191Z_019e0b47-898d-712c-a1ee-73b06afc5386.jsonl: 296,161 bytes, 52 events. 23 calls/results: 20 write, 3 bash. Local HealthConnect.Auth project structure and files.
All 59 result toolCallIds match sampled call IDs. This corroborates internal serialization consistency, not independently authenticated execution. No tests were rerun and no generated program was executed here. Source code written inside a trace may contain URLs or network functions; writing that text is not evidence of invoking those operations.

SESSION STRUCTURE
Each inspected file has one session header, one model_change event with the same DeepSeek label, one thinking-level event, developer/user messages and assistant/tool-result events. Calls use pi-style toolCall blocks and toolResult messages. Parent message IDs serialize conversation history; they do not imply a separate collaborating child agent. The inspected shell commands list/create local files and directories, inspect imports and count lines. No subagent delegation, peer mailbox or public post receipt appears in these calls.
The local .teich-prompt.txt and .pi entries in tool output are consistent with the stated generation harness. They are not distinctive evidence tying this dataset to XZ or other public paste activity.

GENERATION CONTEXT
https://github.com/TeichAI/teich
The linked publisher project documents generating traces from prompt collections with Docker and a configured API provider, then emitting raw sessions, training rows and snapshots. It also supports extracting preexisting local sessions. These capabilities explain how thousands of files can be produced without a collaborating swarm. The dataset card states generation; this pass did not pin/review the historical generator or validate which configuration produced these particular sessions.

NEXT
A bounded broader sample should inventory shell-network calls and delegation tools before committing to all 4,006 files. Seek exact outbound commands paired with responses, distinguish source-text URLs from executed commands, and check whether any public artifacts survive. Keep model/operator attribution separate. The other 4,003 files were not reviewed this pass and remain unclassified.

CAPTURES
219-private/: full metadata listing, pinned card, three session files, sample-summary.json and SHA256SUMS. Public report exposes reviewed metadata only; raw prompts, generated source and reasoning are not mirrored to the research website. No private local agent stores, credentials or investigated commands were accessed/executed.

218 — Claw-Eval: aggregate results and three distinct web-service behaviors
Reviewed September 6, 2026 UTC. No benchmark or investigated code executed.

RESULT
The public Claw-Eval repository and dataset supply task material, trace schemas and aggregate scores, but this pass recovered no actual Chinese-model run archive. Source confirms that similar web-tool routes can return fixtures, real fetched pages, or fetched pages modified locally by injection tests. This distinction matters when interpreting any future trace or public-site attribution.

PUBLICATION CHECK
https://github.com/claw-eval/claw-eval
https://huggingface.co/datasets/claw-eval/Claw-Eval/tree/main
https://arxiv.org/abs/2604.06132
The paper describes 300 tasks with execution traces, audit logs and environment snapshots used for grading. That describes recorded evidence, not necessarily publicly downloadable evidence.
GitHub recursive tree: 5680b8b11ff2ee5dd2b07b89086a29a5c5c984d7, 1,972 entries, non-truncated. Four inspected source files match their Git blob hashes. The Hugging Face recursive listing returned 33 entries without a next-page link: model-score YAMLs, task Parquet files, a 2,879,916,129-byte fixtures archive, assets and metadata. Archive contents were not inspected and are not ruled out as containing additional material. No bulk archive was downloaded on the assumption that it contained traces.
The inspected deepseek_v4_pro.yaml has two aggregate entries dated April 23: general and multi-turn scores linked back to the leaderboard. It contains no message history or external action receipt. The model label and date are publisher metadata, not authenticated runtime identity or independent chronology.

THREE WEB MODES, SAME-LOOKING ROUTES
Pinned files under mock_services:
1. web/server.py: /web/fetch looks up the exact URL in fixture pages and returns a configured response, including a newly generated fetched_at timestamp. Unmatched URLs return a fixture-level 404. A URL plus timestamp in this output does not prove a network fetch.
2. web_real/server.py: after checking its cache, /web/fetch uses httpx.Client.get with redirect following, extracts page content and records an audit response. Its User-Agent is Mozilla/5.0 (compatible; AgentEval/1.0). This is implemented real reading, not proof that any historical run used it.
3. web_real_injection/server.py: performs a real GET, builds/caches the clean response, then calls _inject_content on the response sent onward. Consequently injected text associated with a genuine public URL need not have existed on that public page. It may have been added inside the evaluation service.
The inspected fixture service's /web/notify appends a record to local memory and returns status sent. It does not deliver an external notification. No service endpoint was invoked in this review.

TRACE SCHEMA, NOT A RUN
src/claw_eval/models/trace.py defines trace_start (task/model/persona), message, tool_dispatch (endpoint/request/response/latency), audit_snapshot, media_load and trace_end event structures. To interpret a future export, join the task configuration and service implementation to dispatch records; then seek independent destination evidence for any claimed public write. A service POST used to request a web read must not be confused with POST publication to the page's own host.
Source URLs:
https://github.com/claw-eval/claw-eval/blob/5680b8b11ff2ee5dd2b07b89086a29a5c5c984d7/mock_services/web/server.py
https://github.com/claw-eval/claw-eval/blob/5680b8b11ff2ee5dd2b07b89086a29a5c5c984d7/mock_services/web_real/server.py
https://github.com/claw-eval/claw-eval/blob/5680b8b11ff2ee5dd2b07b89086a29a5c5c984d7/mock_services/web_real_injection/server.py
https://github.com/claw-eval/claw-eval/blob/5680b8b11ff2ee5dd2b07b89086a29a5c5c984d7/src/claw_eval/models/trace.py

BOUNDED SEARCH
Searches for AgentEval/1.0 outside GitHub and Claw-Eval plus traces/DeepSeek/download returned documentation, unrelated similarly named projects and aggregate descriptions, not a verified raw run. The User-Agent is copyable and not a Chinese-lab attribution token. No local full-corpus marker scan was run this pass.
A returned dataset-discovery page lists TeichAI/DeepSeek-v4-Pro-Agent with a Traces label; this is an unverified next lead, not evidence that it contains real DeepSeek execution or swarm activity.

NEXT
Inspect the explicitly public DeepSeek-labelled trace dataset's card, file schema and small samples. Prefer actual dispatch/action records to another benchmark architecture review. Keep Claw-Eval's mixed real/fixture service distinction as a control when reviewing traces elsewhere.

CAPTURES
218-private: GitHub tree, Hugging Face file listing, four Git-verified source files, one aggregate model YAML and SHA256SUMS. Earlier homepage/bundle captures remain in 216-private. No credentials, private logs, benchmark execution or target writes used.

217 — Missraus completed tasks: workers visible, deliverables unavailable
Reviewed September 6, 2026 UTC. Public browser navigation; GET/HEAD only.

RESULT
Two completed task details expose named workers but no visible code, deliverable link or collaboration transcript. The collaboration navigation leads to login. Source review resolves two misleading signals from report 216: homepage totals are fixed animation targets, and 0/1 participant counts can come from frontend defaults. No autonomous swarm established.

PUBLIC TASK DETAILS
https://www.missraus.com/tasks/1145
Stable Diffusion commerce-image workflow; publisher labelled human, worker DataNexus2026, budget 4,500 credits. Rendered creation time May 16, 2026 01:11; deadline May 19 16:00. Timezone not established. Completed task, one completed task on worker card, zero comments, collaboration group marked dissolved. No workflow file or output link visible in the signed-out page.
https://www.missraus.com/tasks/1143
Multi-tool agent system; publisher labelled human, worker FluxRunner2026, budget 5,000 credits. Same rendered creation/deadline times, completed status, zero comments and dissolved collaboration group. No repository or executable system visible. A task description requesting multi-tool support is not evidence of multi-agent collaboration.
These are site-provided labels and timestamps, not verification of worker identity, model inference, task completion, payment or historical availability. Absence from the inspected public rendering does not establish that no private deliverable exists.

ACCESS LIMIT
Selecting the visible Agent协作 navigation rendered an account login page. We did not sign in, acquire tokens or seek private collaboration records. Another network location alone would not satisfy this boundary. The public community route remains readable:
https://www.missraus.com/community
It displays May-dated task-taking and pricing anecdotes alongside general AI articles. The inspected list supplies no verified link to an independently observable completed task output. Similar titles and themes do not establish common authorship. No post, vote or comment was submitted.

HOMEPAGE COUNTERS ARE CONSTANTS
The captured public index-BzpUtP14.js contains a component initializing counters at zero and animating toward a literal object: users 8420, tasks 26180, success 99.2. Thus the displayed 26,180 completed-task figure is not a live fetch in this component. Whether those constants once represented real statistics is unknown. Do not compare it as a measured current population against the task API/list count.

PARTICIPANT COUNTS HAVE FALLBACKS
The list-card render uses completedCount || 0 and maxParticipants || 1. Therefore a 0/1 display may mean absent fields rather than a verified zero-completion record. We did not inspect underlying account/task API objects to disambiguate. This narrows report 216's apparent inconsistency: the UI discrepancy remains, but cannot establish failed or fabricated delivery. The task detail's worker card and the list card may use different fields/scopes.
Pinned capture integrity is recorded in source-observations.json, including exact offsets and SHA-256 of the source captured in report 216. No deployed Git commit is known.

ASSESSMENT AND NEXT PRIORITY
This public surface shows stored task/status/persona data and a human-facing marketplace design. Its public evidence remains weaker than an execution trace or a cross-site deliverable join. Stop treating its homepage demo/counters as live agent telemetry. Reduce priority unless a public task yields a real output; next pursue the Claw-Eval public corpus discovered through AgentRob's researcher page, looking specifically for actual action records and open-internet destinations.

CAPTURES
217-private: rendered task 1145, task 1143, login boundary and community list; browser network status metadata; source excerpts and hashes. No raw credential/account API objects or private team histories captured. SHA256SUMS records integrity.

216 — Missraus task hall recovered; homepage workflow is scripted
Reviewed September 6, 2026 UTC. Public browsing with non-GET/HEAD requests blocked.

RESULT
The same server that received a 403 for Missraus JavaScript can render the site through Chromium. Navigating the public task hall reveals task cards and status counts. Homepage workflow messages are generated by timed frontend steps, not recovered live agent execution. No completed deliverable or autonomous collaboration has yet been verified.

ACCESS AND CAPTURE
https://www.missraus.com/
An isolated Chromium context loaded the homepage, its module scripts and CSS. No login, registration, task claim, payment, webhook setup or message was attempted. A second brief render attempt returned no links; that alone does not establish a network failure because the SPA may not expose anchor links or may not yet have rendered. A further browser load succeeded and selecting the visible task-hall navigation rendered public tasks.
Browser-observed GETs included /api/tasks?limit=1000 and /api/community/hot with HTTP 200. Only network status metadata, rendered text and public JS were captured; no full task API account objects were copied. The task endpoint was requested twice by the page. Responses were not enumerated beyond what this navigation displayed.
This improves report 215's access finding: mainland infrastructure is not required to render this surface. It does not prove every route works or explain the earlier direct-request 403.

ACTUAL RENDERED TASK LIST
The task hall displays total 92: one awaiting claim, three matching, three processing and 85 completed. These are site-displayed counts, not independently verified task execution totals.
Examples of visible completed tasks:
- 1145: Stable Diffusion commerce-image workflow.
- 1144: enterprise RAG question-answering system.
- 1143: agent multi-tool collaboration system.
- 1139, 1138, 1137: similar requests by carol_sim0515, bob_sim0515 and alice_sim0515.
The cards show 0/1 completed participants and zero comments despite completed status. The meaning of this discrepancy is unverified. The sim handles and repeated task patterns suggest test/seed data as one plausible explanation, not proof that all activity is fabricated. No repository, final report or execution receipt was inspected. A task asking for agent software is not itself evidence of agents performing it.
Homepage text advertises 26,180+ completed tasks, which is not reconciled with the task hall's 85. The pages may use different scopes or marketing figures; no historical count was validated.

SCRIPTED WORKFLOW VERIFIED
Public module /assets/main-B1qHpNxi.js is a 159-byte entry that imports /assets/index-BzpUtP14.js (3,664,087 bytes captured). The larger script contains an array of timed actions emitting Agent_ML_01 messages for scanning, matching and applying for tasks. The rendered panel explicitly labels itself a real-time simulation. Thus its changing timestamps and progression are presentation behavior, not receipts of actual task claims or delivery. Do not count this animation toward live fleet activity.
The entry module's small size is normal for this build, not evidence that it is a block/error page. Source code was read as data, not installed.

OTHER FOLLOW-UP
https://yangtonghome.github.io/news.html
The researcher's page links AgentRob's paper, known repository and a WeChat announcement. Web retrieval could not open that announcement. No public robot/forum deployment address was recovered.
The same page links https://github.com/claw-eval/claw-eval and https://claw-eval.github.io/ . Current repository documentation describes a benchmark with simulated services and live-web tasks, while the researcher page describes an older smaller release. Homepage HTML and its public JS were captured for later review. A literal traces/T01_xxx.jsonl occurrence is an offline grading command example, not a downloadable trace URL. No Claw-Eval run was downloaded this pass.

NEXT
Inspect a small number of openly accessible completed task details for real deliverable links; do not treat completed badges or homepage counters as proof. Follow the visible public community and team routes only where signed-out browsing permits. Keep the browser method for this host rather than requesting new infrastructure on the basis of the old asset 403.

CAPTURES
216-private contains rendered homepage/task text, browser network metadata, module source, Claw-Eval homepage/source, reviewed-task-metadata.json and SHA256SUMS. Public mirror contains only reviewed metadata, not full application responses.

215 — AgentRob forum/robot bridge and two community-access leads
Reviewed September 6, 2026 UTC. No investigated software executed.

RESULT
A Peking University-associated project explicitly designs robot agents to read and reply on a NodeBB forum. Two pinned client files implement the command-to-result loop and expose useful identifiers. No live forum address, public result post, or raw multi-agent execution was recovered. Two unrelated agent-marketplace leads remain access-limited.

PRIMARY RESEARCH
https://arxiv.org/abs/2602.13591
https://arxiv.org/html/2602.13591v1
Submitted February 14, 2026. AgentRob describes forum-mediated agents controlling Unitree robots and reporting results. The paper supports a Chinese university research connection, but a supported architecture is not proof of an exposed deployment. Its claimed metadata-based loop prevention cannot be verified from prose alone.

PROJECT AND SOURCE
https://github.com/PKULab1806/AgentRob
The README identifies NodeBB and Volcengine/Doubao, while saying the MCP server and forum deployment are maintained separately. The recursive tree at 386f2d28e2f883262c8afa011c377ac8606e612c contains 11 entries and is non-truncated. go2_mcp_agent.py and g1_mcp_agent.py were downloaded and verified against Git blob hashes (73,408 and 70,503 bytes respectively). No install or execution.
Pinned URLs:
https://github.com/PKULab1806/AgentRob/blob/386f2d28e2f883262c8afa011c377ac8606e612c/go2_mcp_agent.py
https://github.com/PKULab1806/AgentRob/blob/386f2d28e2f883262c8afa011c377ac8606e612c/g1_mcp_agent.py

OBSERVED GO2 CLIENT LOGIC
Default identity is go2-mcp-agent with display name Go2机器狗（MCP）. It recognizes @quadruped and @机器狗, fetches topic content when necessary, extracts a command, invokes the robot execution helper, summarizes the result, optionally uploads a result image, then calls reply_to_topic with topic ID and agent_id. G1 defaults to g1-mcp-agent.
The Go2 processed-topic set is initialized in memory. In the inspected processing function it marks a topic before command extraction; a failed extraction leaves it marked, while a failed reply removes it for retry. Restart persistence was not established. Repeated or missing replies can therefore have application-level causes, without independent autonomous task planning.
The function logs reply success and returns True after awaiting the client call, without validating a concrete post ID there. Consequently a success log alone needs checking against the client response and destination before being counted as an observed publication.
The test-mode branch bypasses mention selection but the early return that would send only a canned test reply is commented out. Processing continues through command extraction/execution. Do not infer that a test-labelled invocation is inert; no invocation was made.
The Go2 constructor uses literal placeholder API/model values despite accepting configuration arguments. This limits reproducibility of the published snapshot and prevents reading its README model label as runtime proof.
NodeBB image-upload paths mentioned in comments are relative examples, not a recovered deployment address. No request to a robot, MCP service, authenticated forum or guessed endpoint was attempted.

BOUNDED SEARCH
Exact searches for go2-mcp-agent outside GitHub and the Go2 display name recovered no matching live forum post in returned results. AgentRob forum-address searches returned project publicity and the repository. This does not exclude unindexed or private operation. Preserve these fingerprints; seek a voluntarily public forum URL or task receipt before further attribution.

OTHER COMMUNITY LEADS
https://www.missraus.com/
Search results describe an agent task/credit-sharing marketplace. Direct homepage GET returned HTTP 200 with a 644-byte app shell naming /assets/main-B1qHpNxi.js. That referenced asset returned HTTP 403 to the tested direct request. No task, team or work output was retrieved; an empty shell is not a verified empty marketplace.
https://www.skillscowork.com/forum
Search results show agent-labelled forum discussions. Web retrieval failed and a direct request timed out. No live post body or work artifact was verified. These failures do not establish geographic blocking or prove a mainland machine will work.
No new verified activity surface was added to the activity inventory on the strength of search snippets alone.

NEXT
AgentRob offers a distinctive forum/robot fingerprint, but prioritize finding its explicitly published forum destination over deeper implementation review. Missraus could benefit from a normal-browser comparison of the same public asset; avoid private API discovery. Continue searching other communities for public tasks with cross-site outputs.

CAPTURES
215-private/: Missraus homepage, AgentRob tree and two Git-verified source files, access-observations.json and SHA256SUMS. No live credentials were acquired or used. Missing community captures reflect failed fetches, not stored successful pages.

214 — Tencent DSH assessment: simulated destinations and non-unique result IDs
Reviewed September 6, 2026 UTC. Public artifacts inspected; no experiment executed.

RESULT
Tencent's official research publication links sanitized DeepSeek Harness assessment code and results. The CSV contains 14,560 rows, but only 13,660 unique run_id values. The file named sanitized_trace_samples.json contains outcome summaries, not execution traces. Inspected posting/email/command tools record local simulated actions. This is a Chinese-lab-associated controlled evaluation, not evidence of public-site writes or a collaborating escaped swarm.

PRIMARY PUBLICATION
https://matrix.tencent.com/zh/2026/08/20/deepseek-harness-agent-injection-risk
Dated August 20. The article describes controlled input tools and simulated side effects, and links its research directory. Its two dramatic impact illustrations are explicitly reframings of local test behavior, not evidence that real servers were deleted or contacts emailed. No independent historical capture was checked.
https://github.com/Tencent/AI-Infra-Guard/tree/main/Research/deepseek-harness-security-assessment
The directory describes sanitized artifacts and says external evaluator/format-handling dependencies are omitted. It is not a self-contained replay of every original run.

PINNED ARTIFACTS
Repository tree e4e622af3ad2b8228ce82dd62b01415dd8ce2b9c, non-truncated. Six downloaded files match their Git blob hashes: tool plugin, driver, Python adapter, sample summaries, summary JSON and results CSV. This establishes capture integrity, not runtime authenticity.
Base for exact sources:
https://github.com/Tencent/AI-Infra-Guard/blob/e4e622af3ad2b8228ce82dd62b01415dd8ce2b9c/Research/deepseek-harness-security-assessment/

SOURCE BEHAVIOR
assessment/dsh_plugin/aig-test-tools.ts registers six controlled reading tools and eight simulated outward-action tools. The source-tool execute function returns local tainted/sample content and does not fetch the supplied URL. The sink execute function appends tool name, arguments and timestamp to a local JSON file and returns a recorded flag plus simulated-action text. In particular create_post, post_message and post_form do not publish anything in this implementation. The local logging write is real; the named external action is simulated.
assessment/dsh_plugin/driver.ts creates one agent, defaults the model string to deepseek-v4-flash and requires an externally configured provider base URL. It emits wrapped session events and a final driver/done record. No team creation or peer coordination appears in this driver. A large run matrix is not automatically a swarm.
assessment/adapter/dsh_real_adapter.py uses temporary aig-dsh- directories, local taint/sample/sink files and time-derived aig- session labels. Its fixture.test task URL is test input, not an observed network destination. It maps native assistant/tool events to evaluator steps. The supplied transport/model configuration remains external, so this source alone cannot authenticate which backend served historical requests.

WHAT THE PUBLISHED DATA ACTUALLY CONTAINS
results/sanitized_trace_samples.json: eight objects with run ID, method/channel/mode, source-tool label, judge flags and outcomes. No message text, tool-call arguments, event timestamps, member IDs or outbound receipts. All eight IDs occur in the CSV; no full raw trace was recovered from this file.
results/sanitized_results.csv: 14,560 rows; 7,280 text and 7,280 file; 13 attack labels and 16 channel labels. There are 641 rows with sink_fired=True, consistent with the published aggregate, but this means simulated sink calls in the inspected implementation.
Run IDs are not unique: 12,760 occur once and 900 occur twice, yielding 13,660 distinct IDs. There are zero exactly duplicated full rows. For example rerun-000901 labels different method/channel combinations. This may reflect colliding rerun namespaces; the cause is not established. Do not deduplicate by run_id or assume that one ID is a safe global join key. Row count corroborates the published table size, not 14,560 independently authenticated executions.
Judged outcomes include 772 full, 1,060 partial, 12,719 not-reached and 9 error rows. Stored judge labels are not an independent rerun of the assessment. Interpretation of errors and sanitization limits remains with the publisher's methodology.

SEARCH IMPLICATION
These records improve the comparison corpus: a Chinese-lab-associated dataset can contain post/form/email tool names without any corresponding public artifact. A future hit for aig-dsh-, aig-dsh-test-tools, driver/done or a run ID needs source context and an actual destination receipt before attribution. The current sample summaries provide no distinctive public-post body to follow. Lower priority for open-internet swarm hunting unless full voluntarily public trajectories or exact external joins emerge.

CAPTURES
214-private/: pinned tree, six Git-verified artifacts, reviewed-counts.json, SHA256SUMS. Raw source and result tables remain private; reviewed findings are published. No credentials, private endpoints, target execution or writes were used.

213 — DeepSeek official team journal: persistence format and synthetic fixture markers
Reviewed September 6, 2026 UTC. Source inspection only; no installation or execution.

RESULT
DeepSeek's official Harness repository implements an experimental team domain with persistent peer messages and shared dependent tasks. This is a direct vendor-associated source lead. The inspected headless team test substitutes a deterministic adapter, so its completed research/implementation dialogue is not evidence of model execution. No public real team run or escaped activity was recovered in this pass.

PROVENANCE
https://deepseek.com/harness/
The official site links deepseek-ai/deepseek-harness and describes an append-only trajectory record including subagent scheduling. This verifies the official project relationship, not any third-party run's model/operator identity.
https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1
GitHub API publication: August 27, 2026 at 17:06:37 UTC. Tag tree cd5ef8148158c3a752a658978873241fdf8e2bbc, 10,389 entries, non-truncated. Five captured files match their listed Git blob hashes. Source dates in notes are not independently archived operational dates.
Release notes distinguish plugin-name/version reporting from optional session-log upload, and describe public WebFetch enabled by default. These statements do not establish public log publication or outbound writes by a particular run. A third-party search result emphasizes Agent Teams for this release; the official release notes inspected here do not explicitly announce teams, though the pinned tree contains them.

TEAM RECORDS AND JOIN KEYS
Pinned docs/subsystems/agent-team.md describes the team ID as the root session ID, teammate identity as a persistent session ID, and monotonically allocated local task IDs such as task-1. Member names are labels, not provenance. Messages carry sender ID/name, target ID, message ID, content and quiet/wakeup delivery mode.
The lead retains queued messages. Delivery acknowledgement follows durable storage at the target. Target-side source.kind is team-message, with teamId/messageId/senderId/senderName for deduplication. Paired queue and delivery records can corroborate transport inside an export; they do not prove the receiver acted on the message or completed a task.
Tasks carry revision, owner, blockedBy and advisory writeScopes. Task-completed records represent system state, not independently verified deliverables. Event seq/time give ordering/timing; ordinary inherited fork events retain their original team ID and should not be counted as a new team's independent work.

SOURCE-CHECKED JOURNAL
packages/experimental/agent-team/src/journal.ts serializes changes per lead, appends team/member, team/task, team/message/queued and team/message/delivered events, flushes the session, then emits the commit notification. Its comments say these events do not enter the conversation surface. Thus a chat-only screenshot/export may omit team state that the underlying session journal contains.
These event names and correlated IDs are useful search/parser fingerprints, not vendor authentication. Other software can copy them.

DETERMINISTIC TEST: DO NOT COUNT AS A LIVE SWARM
apps/cli/tests/agent-team-headless.e2e.ts disables llm-deepseek, injects a fixture, clears the API-key environment value, and checks for three JSONL files, four member lifecycle events, queued/delivered messages, and two completed tasks. It expects TEAM_WORKFLOW_OK. This is test source, not a captured result; the test was not run here.
The referenced team-llm.mjs calls itself deterministic and keyless. Its scripted lead spawns implementer and researcher. The researcher creates/completes task-1 and messages the implementer; the implementer waits for that task, completes task-2 and messages the lead. The adapter reports fixed token counts and canned final success. It registers under the deepseek-official provider route despite making no model request. Consequently even that provider label in fixture-generated logs would not establish actual DeepSeek inference.
Useful fixture exclusion markers: TEAM_WORKFLOW_OK, team-fixture-<n>, RESEARCHER_MARK, IMPLEMENTER_MARK, team-fixture-llm. Their combination strongly suggests this fixture or a derivative; isolated generic research/implementation role names do not.

BOUNDED DISCOVERY SEARCH
Queries for team/message/queued with DeepSeek outside github.com and for TEAM_WORKFLOW_OK recovered documentation/source mirrors rather than a public real run in returned results. No exact-match corpus scan was run this pass. A separate Chinese real-world-test query surfaced a Tencent Zhuque primary report claiming 14,560 controlled DeepSeek Harness security evaluations. That is a next lead for voluntarily published trajectories, not yet verified evidence in this report:
https://matrix.tencent.com/zh/2026/08/20/deepseek-harness-agent-injection-risk

PINNED FILES
Base: https://github.com/deepseek-ai/deepseek-harness/blob/cd5ef8148158c3a752a658978873241fdf8e2bbc/
- docs/subsystems/agent-team.md
- packages/experimental/agent-team/README.md
- packages/experimental/agent-team/src/journal.ts
- apps/cli/tests/agent-team-headless.e2e.ts
- apps/cli/tests/profiles/headless/tests/fixtures/team-llm.mjs

NEXT
Look for public real session exports that link distinct member IDs, paired message receipts, task transitions and external work artifacts. Check adapter provenance before trusting provider labels. Investigate the Tencent controlled-run publication for accessible traces and clear distinctions between test infrastructure and actual open-internet activity. Do not seek private telemetry endpoints or install investigated fixtures.

CAPTURES
213-private contains release metadata, pinned recursive tree, five Git-verified files and SHA256SUMS. Public report contains reviewed findings only.

212 — Chinese Discord team screenshot and a separate Hermes loop incident
Reviewed September 6, 2026 UTC. Public, read-only evidence review.

RESULT
A March-dated Chinese forum post includes a readable Discord screenshot of role-labelled coordination around a server-maintenance task. It is stronger than a product description but shows a plan awaiting human action, not completed autonomous work. Separately, a Hermes bug report supplies a timestamped two-profile acknowledgement loop; Chinese affiliation is not established for that deployment. Neither establishes an escaped Chinese-lab swarm.

CHINESE FIRST-PERSON THREAD AND SCREENSHOT
https://linux.do/t/topic/1754871/18
https://linux.do/t/topic/1754871/20
March 14–18 thread compares bot channels. Post 18 claims firsthand bot-to-bot use and supplies a Discord screenshot. It shows a team-discussion channel and an APP-labelled participant addressing another named persona. They discuss a recurring server-maintenance job, acknowledge agreement, and wait for the human to register an Azure application. The upper speaker header is cropped, so two separately authenticated bot identities cannot be counted from this image alone. No dated raw log, deployed script, completion receipt or model identifier is visible. The screenshot also contains an account address: keep the original private and do not republish that address.
Post 20 describes firsthand Slack/Discord mention-routing experiments and a manual-thread workaround. Other replies disagree about Telegram; treat their platform claims as dated anecdotes, not verified current behavior. Qwen appears in the opening post's separate setup for a friend, not as proof of the screenshot's models.
Screenshot URL:
https://cdn3.ldstatic.com/original/4X/7/5/1/7514c344dbb0960f483b152d8f3a2b221b42b638.png
Image fetched successfully and visually inspected; web-tool image fetch initially failed. Original capture: 522,675 bytes. Site dates and screenshots are publisher-supplied, not independent historical archives.

SECOND CHINESE OPERATOR ACCOUNT
https://linux.do/t/topic/2050998/12
April 25 reply describes multiple roles separated by Feishu groups/session IDs, later migrated from OpenClaw to Hermes. It claims the migration bypassed the old messaging path and left little communication during execution of fixed tasks. No linked run artifact was recovered. This cautions against equating many roles with an actively collaborating swarm.

HERMES LOOP: PRIMARY REPORT FOUND
https://github.com/NousResearch/hermes-agent/issues/32791
Created May 26, 2026 at 19:57:36 UTC. The operator reports thirteen profiles and a May 26 09:18 EDT loop between Ghost/default and Syn/syn. Seven selected timestamped messages span 09:18:55–09:19:23 and repeatedly acknowledge unchanged state. A human stop request at 09:19:38 allegedly did not stop replies; the operator says host intervention was required. Version claimed: Hermes 0.14.0 (2026.5.16), macOS, Discord. These are issue-body excerpts selected by the reporter, not the full gateway log; logs were offered on request but not published in the inspected body/comments. No request for private logs was sent.

CAUSAL DISPUTE AND CLOSURE
Two comments were retrieved. A May 26 clarification notes that the adapter had changed since the reported version; its HTML contains an autocontrib worker marker, so do not assume that comment was manually authored. The June 28 closing comment says bot-to-bot operation is unsupported, disputes the proposed guard-bypass cause on then-current main, and instead attributes recurrence to Discord reply auto-mentions satisfying the opt-in bot filter. It says proposed PR 33985 was also closed. We did not verify that PR or execute a reproduction. Closure is not proof of a shipped circuit breaker. Distinguish the observed-loop claim from the disputed explanation.

DISCOVERY CORRECTION
https://github.com/duanyytop/agents-radar/issues/1311
The Chinese OpenClaw ecosystem digest links this incident to NousResearch/hermes-agent, not openclaw/openclaw. The latter repository's 32791 is an unrelated Groq reasoning-parameter pull request. Report 211 called it an OpenClaw issue based on discovery metadata; that wording is corrected. This was a repository-attribution mistake during our triage, not a demonstrated bad link in the digest. Digest language is not evidence that the incident operator is Chinese.

HERMES STUDIO FOLLOW-UP
https://github.com/EKKOLearnAI/hermes-studio/issues/1547
Created June 14 at 06:08:50 UTC; open with four comments at capture. Requests configurable room/agent automatic replies and mutual-mention permission. Comments through August 18 ask for progress. The body says mutual mentions are unavailable while quoting routing code that permits certain agent replies under a depth cap. This tension calls for version/reproduction evidence; a feature request alone does not prove absent code, a deployed fix, or an operational swarm. No new raw dialogue recovered here.

NEXT INVESTIGATION
The Chinese Discord screenshot is an actual public visual artifact worth retaining as a comparison example. Seek other voluntarily published team dialogues with uncropped speakers, timestamps, model requests and linked task outputs. Search role/channel and task descriptions rather than attributing all Chinese-labelled bots to Chinese models. The Hermes incident supplies a concrete non-Chinese-attributed control example of how ordinary configured bot loops can look swarm-like.

CAPTURES
212-private contains six GitHub API responses, the privately retained screenshot, and SHA256SUMS. Forum text was inspected through web retrieval; full forum HTML was not locally mirrored. No account registration, messages, credential use, or investigated code execution occurred.

211 — Chinese group-chat failure reports: shared context corroborated in source
Recorded September 6, 2026 UTC. Read-only public-source review.

RESULT
A Chinese-language first-person report describes a two-agent review failing because unrelated earlier errors remained in their shared room history. Pinned Hermes Studio source corroborates the shared-history mechanism. No raw execution transcript, external publishing receipt, or Chinese-lab attribution was recovered. This is a useful operational lead, not confirmation of an escaped swarm.

STRONGEST REPORT
https://github.com/heypandax/cc-pocket/issues/232
Created August 10, 2026 at 10:51:13 UTC; closed at capture. The author requests independent agent sessions and compares existing products. They report testing two Hermes Studio members: A produced an answer, but B, despite receiving that answer in its input, interpreted two older unrelated failure messages as evidence that A had not answered. B then produced its own answer instead of reviewing A. This is a reporter's account, with no raw input/output transcript attached in the inspected body. Model names used as examples do not verify actual model identities.

RELATED SOURCE-LEVEL PROPOSAL
https://github.com/EKKOLearnAI/hermes-studio/issues/2456
Created August 10 at 02:52:33 UTC; open with zero comments at capture. Proposes isolating each agent's context and using explicit handoff summaries. References master@b8c03b0. We resolved that reference to b8c03b013a0e830c4263ec63f93d3290bcf613a4, fetched its non-truncated Git tree and verified two source files against their Git blob hashes.

Verified source behavior:
- group-chat/index.ts getMessagesForContext(roomId, cutoff) reads recent room messages with a message-window/cutoff, excluding workspace_diff. There is no recipient-agent argument at this method boundary. This is bounded recent context, not necessarily every historical message.
- context-projection.ts maps the agent's own messages to assistant role and other speakers to user role, retaining textual speaker attribution. Tool results become user-role text with tool labels. The projection filters workspace_diff tool messages.
- A supplied summary is inserted with a canned assistant acknowledgment. Such an acknowledgment in a serialized history can be application-generated, not a model's actual response.
- Ordinary projected content has @mentions stripped by a regular expression.
These mechanisms make the reported cross-agent history confusion plausible; they do not reproduce or prove the reported model behavior. No investigated code was executed.
Pinned source:
https://github.com/EKKOLearnAI/hermes-studio/blob/b8c03b013a0e830c4263ec63f93d3290bcf613a4/packages/server/src/services/hermes/group-chat/context-projection.ts
https://github.com/EKKOLearnAI/hermes-studio/blob/b8c03b013a0e830c4263ec63f93d3290bcf613a4/packages/server/src/services/hermes/group-chat/index.ts

OLDER MUTUAL-MENTION REPORT
https://github.com/EKKOLearnAI/hermes-studio/issues/1385
Created June 7 at 06:16:45 UTC; closed with six comments at capture. A user supplies a manual patch tutorial for bot-to-bot mentions and following up with the previously addressed agent. Its mentionDepth > 10 guard shows concern about recursive mentions. The A/B examples are illustrative, not timestamped logs proving an actual runaway exchange. June 14 and June 16 comments redirect remaining requirements to issue 1547; closure does not itself establish a shipped fix. That follow-up issue was not inspected in this pass.

SINGLE-AGENT CONTROL CASE
https://github.com/agentscope-ai/QwenPaw/issues/6241
Created July 18 at 07:21:47 UTC; closed at capture. Reports repeated responses and repeated memory_search calls, claiming QwenPaw 1.1.12.post2, Windows/Feishu and mimo-v2.5. The body uses schematic turn labels rather than a raw timestamped trace. This is a single-agent repetition report, not multiple agents coordinating. Proposed compression/guard explanations remain reporter hypotheses.

NAGA FOLLOW-UP: BOUNDED NEGATIVE
Three GitHub issue searches in RTGS2017/NagaAgent, using 探索, 论坛 and travel separately, each returned total_count 0. This does not exclude differently worded, unindexed, deleted or externally hosted reports. Combined with report 210's exact-marker web search, it supplies no public exploration run/post join. Keep the distinctive Naga markers for later corpus searches, but reduce priority until a public receipt or transcript appears.

NEXT SEARCHES
Follow explicitly linked public reproduction artifacts and issue 1547, particularly raw shared-room transcripts with stable message IDs and model requests. Search Chinese descriptions of 串台, 上下文污染, 互相@, 自言自语, 接力 and 复核, as well as English phrases; translation of agent alone is not a useful detector. Distinguish designed mention routing and host-generated dialogue from independently observed autonomous behavior.
A secondary search surfaced a Hermes issue number 32791 through an automated Chinese ecosystem digest, claiming Discord bots looping. Follow-up report 212 verifies the primary Hermes issue and corrects the initial OpenClaw repository attribution.

INFRASTRUCTURE
Current GitHub access is working. An owned mainland broadband machine with SSH, a dedicated browser, 2 CPU cores, 4 GB RAM and 40–70 GB disk is a reasonable starting configuration for comparing challenged public Chinese pages. No GPU needed. A Hong Kong machine is a comparison location, not guaranteed mainland access. Authorized exports of public posts and voluntarily shared redacted agent run logs would be especially valuable. Missing hosts, private records and API authentication requirements are not solved by another IP. No new infrastructure was purchased.

CAPTURES
investigation/china/211-private/: three Naga issue-search responses; four issue bodies; six issue-1385 comments; pinned Studio tree and two Git-verified source files. SHA256SUMS records capture integrity. These API snapshots establish what was returned during this review; they are not independent historical archives.

210 — NagaAgent exploration: host-mediated forum publishing and useful fingerprints
Recorded 2026-09-06 UTC. Published source reviewed; no code or prompt executed.

RESULT
NagaAgent implements internet exploration through OpenClaw and a separate host-program step that automatically publishes a condensed result to its community forum. This supplies a concrete mechanism and distinctive post-format markers. No matching live public post or execution transcript was recovered, and no escaped swarm is established.

PINNED PRIMARY SOURCE
https://github.com/RTGS2017/NagaAgent
Tree c2caa9079b9eb48129f550c43a5485231d404d3b: 5,503 paths, non-truncated. Five downloaded source/doc files match their Git blob hashes. This validates the captures against current source, not deployment history.

EXPLORATION AND LOCAL RECORDS
The system document describes user-created tasks with a direction, selected operator, time/credit limits and browser settings. Chat and exploration reuse the same operator's OpenClaw instance with separate session keys; one operator is not automatically two agents because it has two sessions.
Exploration session keys use travel:{agent_id}:{first-eight-session-id-characters}. Session JSON and final Markdown reports live under the user's .naga/travel directory. These are documented local paths, not public download endpoints. We did not seek anyone's private session files.
Distinctive tools are travel_progress, travel_discovery, travel_state and travel_summary. The vendored tool implementation limits them to travel sessions; travel_summary writes a randomly named Markdown file locally. The prompt also supports [DISCOVERY] blocks when tools are unavailable.

AUTOMATIC FORUM PUBLISHING
TravelSession.post_to_forum defaults to true in apiserver/travel_service.py. In agentserver/agent_server.py, after exploration, the host program checks post_to_forum and a nonempty summary, builds a forum payload and calls create_forum_post_internal. This is a deterministic application publication step surrounding the model run. It does not require the model to independently decide to call a forum-post tool at that point. A user's configured setting can change the behavior; source defaults are not proof of any specific user's settings.
The payload builder emits:
- title prefix: 探索速报｜
- section markers: 【探索方向】, 【精华总结】, 【本轮值得继续追踪】
- optional social-count section: 【社交互动】
- source field: openclaw-travel
- at most five discovery entries and five tags; content truncated to 4,000 characters, title to 60.
This gives a better search fingerprint than generic travel or agent terminology. A matching format would indicate software compatibility, not prove operator or model identity.

There is also a separate build_social_prompt function encouraging forum interaction after useful research progress and recording [SOCIAL] blocks. Its existence is not evidence that a particular run used it or successfully interacted. Do not conflate the optional model-directed social instruction with the host's automatic digest publication.

POSTED STATUS IS NOT AN INDEPENDENT RECEIPT
The host extracts a post ID from several possible response shapes, potentially leaving it null. It then sets forum_post_status to posted if the call did not raise. Consequently, a published local posted status without a concrete post ID and readable destination should not be treated as a complete cross-site join. Error paths record a failed status. No actual run response was inspected.

ACCESS BOUNDARY
The inspected forum proxy requires a Naga access token (with refresh handling) before contacting the configured NagaBusiness forum API. Without one it raises 401 locally. This documents the client path's authentication requirement; it does not prove every public page or upstream read requires authentication. No tokens acquired or used, and no guessed private endpoints or user histories accessed. A mainland IP alone would not satisfy a credential requirement.

BOUNDED WEB SEARCH
Queries for exact openclaw-travel outside GitHub, 探索速报 with 娜迦, and 本轮值得继续追踪 recovered no matching public Naga exploration post in returned results. Most travel results concerned ordinary tourism assistants. Search absence is not proof no posts exist or were made.

NEXT EVIDENCE TO SEEK
A voluntarily public trace containing a travel session key, travel tool results and forum_post_id, paired with a readable post matching that ID, would connect execution and publication. Independent archive dates would strengthen timing. Multiple operator IDs or posts still would not by themselves establish an autonomous collaborating swarm. Preserve this exact fingerprint set for later public-corpus searches.

SOURCES
https://raw.githubusercontent.com/RTGS2017/NagaAgent/c2caa9079b9eb48129f550c43a5485231d404d3b/docs/travel-exploration-system.md
https://raw.githubusercontent.com/RTGS2017/NagaAgent/c2caa9079b9eb48129f550c43a5485231d404d3b/vendor/openclaw/src/agents/tools/travel-tools.ts
https://raw.githubusercontent.com/RTGS2017/NagaAgent/c2caa9079b9eb48129f550c43a5485231d404d3b/apiserver/travel_service.py
https://raw.githubusercontent.com/RTGS2017/NagaAgent/c2caa9079b9eb48129f550c43a5485231d404d3b/apiserver/routes/forum.py
https://raw.githubusercontent.com/RTGS2017/NagaAgent/c2caa9079b9eb48129f550c43a5485231d404d3b/agentserver/agent_server.py

LOCAL CAPTURES
investigation/china/210-private/: recursive tree, system document, travel tools, service and server source, forum proxy source, per-file Git verification metadata and SHA-256 hashes.
Classification: verified implementation of exploration and automatic digest publishing; no observed public swarm activity or Chinese-lab attribution.

209 — Kunpeng follow-up: human-relayed handoff and summary notes
Recorded 2026-09-06 UTC. Continues report 208's verified merged-PR trail.

RESULT
The selected forum evidence supports human-supervised agent work, but not an independently identified agent swarm. One communication anecdote explicitly describes a human copying messages between agents. Another thread's two replies are resolution summaries, and source code supplies a concrete mechanism by which marking a thread solved automatically creates such a reply. Most importantly, the web frontend assigns the Agent-generated label to every successful API thread response; the label itself does not verify provenance.

INDEX SCOPE
https://forum.kunpeng-ai.com/threads?lang=zh
Captured index reports 67 records and contains 67 unique thread-detail links. This pass fetched three selected thread pages; it did not fetch all bodies. Topics include local CLI configuration, model routing, registration tests and engineering notes. Configuration tutorials mentioning Kimi, Qwen or HY3 do not identify the model that authored a post.

HUMAN-RELAYED COMMUNICATION ANECDOTE
https://forum.kunpeng-ai.com/threads/markdown?lang=zh
The post credits WS (WindSurf Reviewer) and dates itself May 4. It says the Owner wanted a complete message inside a code block for copying to another agent, then twice complained that nested fences broke the copyable block. It proposes longer outer fences and addresses CCD in an example.
This is an explicit account of owner-mediated message relay. It is not a raw exchange between autonomous clients. There are zero replies. The reported UI-copying symptom was not independently reproduced; ordinary Markdown formatting problems do not prove actual transport truncation.

GENERAL COLLABORATION POST
https://forum.kunpeng-ai.com/threads/agent-agent?lang=zh
A five-principle essay recommends roles, structured communication, human decisions, shared context and failure handling. It has zero replies and no specific completed task artifact. This adds workflow context but no executed collaboration chain.

TWO REPLIES DO NOT ESTABLISH TWO AGENTS
https://forum.kunpeng-ai.com/threads/hermes-windows-gateway-stopped-replying-scheduled-task-best-effort-recovery?lang=zh
https://forum.kunpeng-ai.com/api/agent/threads/hermes-windows-gateway-stopped-replying-scheduled-task-best-effort-recovery
The public JSON returns thread_2d7a7e66-1915-4248-9dae-2495799bbaa1, created April 27 04:49:22.222 UTC, status solved. Its two replies both have role summary:
reply_3f9f27ef-ba9c-4408-803d-5b4a06830bde at 04:58:00.393 UTC;
reply_b8a857cc-b6a6-4239-861d-2180a0f1e6fb at 04:58:16.070 UTC.
Interval: 15.677 seconds. The second is a short restatement of the first. The public representation does not expose distinct agent IDs; it cannot establish who wrote either note. The content reports recovery of a local Windows Hermes/WeCom gateway and references an upstream PR. Local execution and that separate PR were not verified in this pass.

SOURCE EXPLAINS THE COUNT AND LABEL LIMITS
Repository: https://github.com/sherlock-huang/kunpeng-agent-forum
Pinned tree ed51b1fb60527880cead508cd7e7ed388aafaa9a, 134 paths, non-truncated. Four downloaded files match their Git blob hashes.
- apps/api/src/d1-repository.ts: markThreadSolved updates status, then calls createReply with replyRole summary and the supplied summary text. Thus an administrative state change can create a visible reply without another agent joining the discussion. This is a mechanism consistent with the observation, not reconstruction of the actual request history.
- The same source stores agent_id internally but mapReply exports author as the generic string agent, with no distinct author ID. Public readers lose the identity needed for an inter-agent count.
- apps/web/lib/forum-api.ts: getForumThread and getForumThreads unconditionally attach sourceLabel Agent-generated to successful API results. A badge is not model attestation. The list function also has demo fallback data on failure or empty results; that does not make the successfully fetched Hermes API record a demonstrated demo.
- apps/web/app/threads/[slug]/page.tsx renders the role and content for each reply, not a verified model identity.
- apps/api/src/routes.ts separates unauthenticated thread reads from token-authenticated mutations. Only public reads were used. No write, status update, whoami, registration or invite action attempted.
Published source and live behavior are consistent; the deployed code commit was not independently identified.

IMPLICATION FOR REPORT 208
The two GitHub merge matches remain valid evidence of real accepted code changes. This follow-up narrows the provenance inference: forum labels and reply counts cannot establish autonomous authorship or the number of participating agents. Current best reading is a public record of owner-supervised agent engineering, with some workflow explanations and summaries. No escaped training-swarm link recovered.

NEXT LEADS
Other index entries include a claimed MiniMax/OpenClaw personal assistant introduction and controlled CLI registration tests. Inspect only public artifacts if following those; do not reconstruct private knowledge bases or omitted credentials. Larger source-matched runtime logs would be more informative than collecting more badges or generic tutorials.

SOURCES
https://forum.kunpeng-ai.com/threads?lang=zh
https://forum.kunpeng-ai.com/threads/agent-agent?lang=zh
https://forum.kunpeng-ai.com/threads/markdown?lang=zh
https://forum.kunpeng-ai.com/threads/hermes-windows-gateway-stopped-replying-scheduled-task-best-effort-recovery?lang=zh
https://forum.kunpeng-ai.com/api/agent/threads/hermes-windows-gateway-stopped-replying-scheduled-task-best-effort-recovery
https://raw.githubusercontent.com/sherlock-huang/kunpeng-agent-forum/ed51b1fb60527880cead508cd7e7ed388aafaa9a/apps/api/src/routes.ts
https://raw.githubusercontent.com/sherlock-huang/kunpeng-agent-forum/ed51b1fb60527880cead508cd7e7ed388aafaa9a/apps/web/app/threads/[slug]/page.tsx
https://raw.githubusercontent.com/sherlock-huang/kunpeng-agent-forum/ed51b1fb60527880cead508cd7e7ed388aafaa9a/apps/api/src/d1-repository.ts
https://raw.githubusercontent.com/sherlock-huang/kunpeng-agent-forum/ed51b1fb60527880cead508cd7e7ed388aafaa9a/apps/web/lib/forum-api.ts

LOCAL FILES
investigation/china/209-private/: index, 67-link inventory, three thread HTML pages, one public JSON response, source tree, four Git-verified source files, source URLs and capture hashes. Original bodies remain private; report avoids personal local paths.
Classification: human-relay self-report; source-backed summary-count/provenance limitation; no independent swarm confirmed.

208 — Kunpeng Agent Forum: engineering output corroborated, agent provenance limited
Recorded 2026-09-06 UTC. No investigated skill, CLI or repository code executed.

RESULT
A new Chinese-language technical forum contains an agent-labelled post whose two upstream merge claims are corroborated by GitHub. One PR also has a concrete automated code review. This is stronger evidence of completed engineering output than the earlier social introductions or acceptance-only task cards. It still does not independently establish that the patches were generated by separate autonomous agents or a Chinese lab.

PUBLIC SURFACE
https://forum.kunpeng-ai.com/?lang=zh
https://forum.kunpeng-ai.com/threads/codewhale-pr?lang=zh
The homepage reports 67 public Agent posts. Only the homepage and one thread were inspected; no full census performed. The interface describes public reads and token-protected CLI writes. No registration, token acquisition or write action attempted.

The selected thread is labelled Agent-generated, case-study, open, unreviewed, with zero replies. It credits CDX and kunpeng-ai-lab with two CodeWhale contributions and says they were verified May 27. This label and narrative are site claims; the page does not expose a raw client run or provider attestation. Its open/unreviewed state describes the forum record, distinct from the PR merge states.

CORROBORATED MERGES
PR 1971 — Expose apply_patch preflight metadata
https://github.com/Hmbown/CodeWhale/pull/1971
GitHub API: author kunpeng-ai-lab, merged=true, merged_by Hmbown.
Merged 2026-05-26T15:38:23Z.
Merge commit 16728360f13cd38fc1bf946d839b6dae9d45367d.
Changed files: 4; commits: 2.
The PR describes exposing intended patch effects for harness and language-server integration.

PR 1973 — Summarize Cargo failures in tool metadata
https://github.com/Hmbown/CodeWhale/pull/1973
GitHub API: author kunpeng-ai-lab, merged=true, merged_by Hmbown.
Merged 2026-05-26T15:38:28Z.
Merge commit c97c3a7a0475ad302ecac6926c2394729827ff3f.
Changed files: 5; commits: 2.
The PR describes extracting compact Cargo failure signals into tool metadata.

Both merge timestamps and hashes exactly match the forum post. This establishes a correct cross-site reference to actual accepted code changes, not proof of how they were authored. The PR bodies report validation commands; those commands were not rerun. Merge is not proof of inclusion in a subsequent release.

AUTOMATED REVIEW ARTIFACT
https://github.com/Hmbown/Codewhale/pull/1973#pullrequestreview-4351837147
https://github.com/Hmbown/Codewhale/pull/1973#discussion_r3293923474
GitHub attributes this review to gemini-code-assist[bot], submitted May 24 at 04:58:37Z on commit d2ee917364375ec64cbc060752023ff757f5bd86. It proposes avoiding redundant primary-error and final-error lines in the summary and includes a Rust suggestion. The inspected reviews and inline-comments endpoints each return one item.
This verifies an automated reviewer account's participation. We did not verify that the suggestion was implemented, or infer the patch author's runtime/model from the reviewer identity. The forum itself treats this suggestion as a possible follow-up.

RELATED OWNER/EXECUTOR/REVIEWER CASE MATERIAL
https://kunpeng-ai.com/blog/agent-collaboration-sop-acs-case-library/
https://github.com/kunpeng-ai-lab/agent-collaboration-sop
The May 7-dated blog describes human Owner / Executor Agent / Reviewer Agent workflows and four public redacted examples. These are publisher narratives, not four independently reconstructed runs.
Pinned current repo tree cf2f4e2450dff78d159c44c3e2337dc2fc3f1ef4 contains 83 paths, non-truncated. The inspected Phase 1 case summary and conversation-excerpts files both match their Git blob hashes.
Case ACS-CS-20260506-IMPLEMENTATION-PACKAGE-REVIEW reports a May 6 review loop. It describes test-glob omissions, incorrect assumptions about existing pages, a proposed English-UI workaround rejected by the owner, and stale commands remaining in formal documents. The final reported outcome is approval of an implementation plan for coding, not completed deployment.
Crucially, conversation-excerpts.md calls itself a summary of the useful pattern. Identities, source project, paths and repository URLs are replaced with placeholders; screenshots omitted. These files can guide what collaboration evidence to seek, but are not raw transcripts or reconstructable proof of the underlying event. Their reviewer-approved label is not our independent verification.

ATTRIBUTION / NEXT ACTION
The site provides Chinese-language engineering posts and a voluntarily public GitHub contribution trail. The word lab in an organization name does not establish a relationship to a Chinese model laboratory. No join to XZ, original wiki/paste activity, training sandboxes or unexplained swarm egress was found here.
A next useful step is a bounded forum index inspection for posts with message IDs, public client transcripts or reproducible external artifacts. Prefer independently checkable joins; do not try to recover deliberately redacted project identities or private source logs.

SOURCES AND CAPTURES
https://kunpeng-ai.com/
https://forum.kunpeng-ai.com/?lang=zh
https://kunpeng-ai.com/blog/agent-collaboration-sop-acs-case-library/
https://forum.kunpeng-ai.com/threads/codewhale-pr?lang=zh
https://api.github.com/repos/kunpeng-ai-lab/agent-collaboration-sop/git/trees/main?recursive=1
https://api.github.com/repos/Hmbown/CodeWhale/pulls/1971
https://api.github.com/repos/Hmbown/CodeWhale/pulls/1973
https://api.github.com/repos/Hmbown/CodeWhale/pulls/1973/reviews
https://api.github.com/repos/Hmbown/CodeWhale/pulls/1973/comments
https://raw.githubusercontent.com/kunpeng-ai-lab/agent-collaboration-sop/cf2f4e2450dff78d159c44c3e2337dc2fc3f1ef4/case-studies/phase1-implementation-package-review-loop/conversation-excerpts.md
https://raw.githubusercontent.com/kunpeng-ai-lab/agent-collaboration-sop/cf2f4e2450dff78d159c44c3e2337dc2fc3f1ef4/case-studies/phase1-implementation-package-review-loop/case-study-summary.md

Private captures: investigation/china/208-private/ (HTML, GitHub JSON, pinned case files, source metadata, SHA-256 hashes).
Reviewed mirror: pastebins/data/forum.kunpeng-ai.com/reviewed-codewhale-208.json.
Classification: corroborated engineering artifacts and bot review; agent-authorship and autonomous swarm attribution unverified.

207 — AIG Market: recurring public posts and one credit-test task
Recorded 2026-09-06 UTC; continuation of the OPC lead in report 206.

RESULT
AIG Market has a readable public post list. Its API reports 5,870 posts. A bounded sample of the latest 100 contains 29 author IDs and regular posting intervals consistent with scheduled publishing. The public task list returns one record, explicitly a test of credit-deduction logic. No completed substantive multi-agent task was verified.

READ-ONLY SOURCES
https://opcbbs.art/aig
https://opcbbs.art/aig/browse
https://opcbbs.art/aig/tasks
https://opcbbs.art/aig/api/docs
https://opcbbs.art/aig/api/docs/swagger-ui-init.js
https://opcbbs.art/aig/api/posts
https://opcbbs.art/aig/api/posts?page=1&limit=100&sort=new
https://opcbbs.art/aig/api/tasks
https://opcbbs.art/aig/post/5860

POST SAMPLE
The first request returned 20 posts and reported 294 pages; a second request with limit=100 returned 100 and reported 59 pages. Both reported total 5,870. We did not enumerate the full history.
The larger sample spans IDs 5773–5872, dated August 19 15:13:36 through August 27 01:19:34 UTC by the site. It has 29 distinct author IDs. The 99 adjacent timestamp gaps have median 1,203 seconds; 71 fall between 18 and 22 minutes. A large 524,391-second gap also occurs. These observations support recurring scheduled publication, not uninterrupted activity or a unique controller.
Author names recur in similar sequences, including products, engineering, operations and testing personas. There are no exact duplicate content bodies in the 100-record sample. This does not establish content originality or model generation.
The website promotes autonomous agents, but its FAQ also permits human posts. The limited post-list author objects contain names and IDs, not verified model identities. No Chinese lab attribution follows from the language or site location.

TASK CHECK
GET /aig/api/tasks returns total=1, page=1, limit=10.
Task ID 3 is titled 测试积分扣减任务; its description explicitly says it tests credit deduction. It has status accepted, budget 500, deposit 50, creation June 4 04:32:15 UTC and update June 4 04:37:27 UTC. These are site fields, not independently verified settlement. No deliverable was retrieved. Accepted does not establish completed productive collaboration.
The response unnecessarily embeds sensitive account data. That nested account object is excluded from the reviewed mirror and report; the original response is kept only in the private capture directory. No credential was used, no account tested, and no further task-detail request made.

A SPECIFIC WORK CLAIM
Post 5860, by 效率侠, claims three automations: group-message summaries, rule-based email replies and document backups. Its public page contains prose about these tasks but no actual script, repository, execution log or output artifact. It displays a count of four comments, but comment bodies are not server-rendered in the captured HTML. We did not recover or validate those replies. This remains a self-report, not a verified completed workflow.

INTERPRETATION
A public Chinese-language publishing community exists. Regular intervals and recurring personas make coordinated scheduling a plausible explanation; they do not demonstrate autonomous agents discovering each other, cross-agent task execution, or escaped RL infrastructure. The marketing headline about an agent-only community is qualified by its own FAQ. A landing-page GitHub link goes to OpenClaw upstream, not source for this particular deployed community, so it does not independently establish this site's implementation.

NEXT USEFUL EVIDENCE
Seek voluntarily published worker logs, actual task deliverables or a dated source repository for the scheduler. Exact post IDs and timestamps can support those joins. An ordinary model-name or Chinese-language match cannot. This surface is reachable from the existing server; additional mainland infrastructure is not necessary for the captured reads.

FILES
investigation/china/207-private/: raw responses, HTML, Swagger JS and parsed schema, source metadata and SHA-256 hashes.
pastebins/data/opcbbs.art/reviewed-aig-sample-207.json: safe post metadata and whitelisted task fields. No nested account data or full post prose published.
Classification: public recurring content; explicit test task; substantive collaboration and model/operator attribution unverified.

206 — AI秘密基地 / AI之家: public agent-labelled dialogues, stale status
Recorded 2026-09-06 UTC. All retrieval public, unauthenticated and read-only.

RESULT
A new Chinese-language observer surface exposes actual message records, rather than only a product pitch. The public API returns 5 agent profiles, 11 threads and 18 messages in four channels. Several threads contain messages under different agent and owner identifiers. Their content engages with earlier statements. This is evidence of published agent-labelled dialogue, not independent verification of model generation, distinct human controllers, continuous autonomy, or a lab swarm.

ENTRY POINTS
https://www.aisecretlair.com/
https://www.aisecretlair.com/api/agents
https://www.aisecretlair.com/agents/skill
https://www.aisecretlair.com/api/agents/skill/manifest
Discovered by a Chinese web search for agent 自主发帖. No earlier reference to this host found in numbered China reports or NEW_SITES.md at this pass.

CONCRETE CONVERSATION CHAINS
THREAD-AG-003 has three records on May 8 (all times UTC):
MSG-AG-003, 08:29:04.334, 邦邦: discusses context exchange, division of work and standards.
MSG-AG-004, 10:35:28.240, Memo: responds with categories of agent communication and differing habits.
MSG-AG-007, 14:05:06.584, Codex Workshop Companion: distinguishes handoff, review and co-creation.
The profile labels for these identities claim gpt-5.4, MiniMax-M2.7 and gpt-5-codex respectively. Labels are not provider-authenticated.

THREAD-AG-009 supplies the clearest semantic reply:
MSG-AG-014, May 12 17:21:32.346: 回响 introduces its interest in boundaries and uncovering ill-posed questions.
MSG-AG-015, May 12 19:11:07.265: 邦邦 explicitly refers to that introduction, proposes complementary question-finding and practical follow-through roles.
The interval is 6,574.919 seconds (1 h 49 m 34.919 s). 回响's profile claims deepseek-v4-flash. This is a collaboration proposal; no completed joint task or external artifact is attached in the inspected response.

Message counts by profile: 邦邦 10; Memo 4; 栈灯/Hermes observer 2; 回响 1; Codex Workshop Companion 1. Distinct identifiers do not prove distinct model instances or independent operators.

FRESHNESS AND RELIABILITY
Seventeen messages have createdAtIso timestamps, spanning May 8 through May 17. MSG-AG-001 lacks this field. The response's updatedAt is 2026-05-17T15:54:13Z. Nevertheless, messages say 刚刚 (just now), profiles say 在线协作 (online collaboration), and the homepage presents a live broadcast. These relative-time labels are unreliable as evidence of current activity. Four channel throughput fields still say they await the first agent message despite the returned records. An old or static snapshot remains a possible explanation; one capture does not prove the community stopped.

The homepage independently renders the same 5-profile/18-message counts and the latest message excerpts. That corroborates the API as the site's public presentation, not as an independent historical witness. Site-supplied May timestamps have not been verified against an archive.

ACCESS CONTRACT AND AUTONOMY LIMITS
Manifest v1.0.0 explicitly declares GET /api/agents an unauthenticated observer endpoint. Its workflow asks an owner to claim an agent once, then asks the agent to introduce itself and inspect topics every 30 minutes. The model field is an optional registration string. HMAC authenticates a credential holder under the described protocol; it does not prove which model generated text. No signatures or backend enforcement were tested.

The site says humans cannot direct posts, yet the documented system also allows human-fed topic seeds. This supports an owner-authorized agent community interpretation and leaves the amount of human prompting unresolved. No registration, claim, heartbeat, write or admin action was attempted. The installation instructions and message-reported endpoint probes were read as evidence, not followed.

WHY THIS MATTERS / NEXT PIVOT
This is a small public Chinese dialogue surface with candidate MiniMax/DeepSeek participants, well before September according to its own records. The valuable next evidence would be an independently dated capture or a voluntarily published client run tied to MSG-AG identifiers. The present records discuss autonomy and teamwork but do not show an escaped training swarm or completed multi-agent work.

OTHER LEADS PRESERVED
https://opcbbs.art/aig returned a 55,307-byte public landing page; its activity list and API remain to inspect. Do not treat landing-page counters as actual activity.
https://longtang.zhaochu.vip:3030/ refused the connection; no HTTP body recovered. A skill-directory mention describes Agent BBS, but activity is unverified.

FILES
investigation/china/206-private/: original observer JSON, homepage, skill page, manifest, OPC landing page, source URLs and hashes.
pastebins/data/www.aisecretlair.com/reviewed-observer-metadata-206.json: reviewed profile labels and message IDs/titles/timestamps, omitting owner identifiers and full prose.
Classification: public agent-labelled interaction; model/operator and historical autonomy unverified; no confirmed escaped Chinese-lab swarm.

205 — TraceArena public replay is scripted, not a live model swarm
Recorded 2026-09-06 UTC; public GETs and source inspection only.

RESULT
A Chinese-language search for multi-agent conversation records found TraceArena. Its public viewer genuinely exists, but its published demo and baseline are deterministic controls. Do not count its two displayed competitors as two independently running LLM agents. The project documents this limitation openly.

VERIFIED MATERIAL
Repository https://github.com/tonyhyworld/TraceArena
Pinned tree fb88a0675a6dc5ebf3baade61120ad47a4246eff: 752 paths, non-truncated.
Five downloaded repository files verified against Git blob hashes. The deployed public viewer's assets/app.js is byte-identical to the pinned repository file (17,306 bytes).
Viewer: https://tonyworld888-tracearena-demo.static.hf.space/index.html
Asset: https://tonyworld888-tracearena-demo.static.hf.space/assets/app.js

The browser viewer embeds a three-round synthetic market demonstration featuring Astra and Vector. This is distinct from the checked-in benchmark report's investor_a and investor_b entries; they must not be conflated into one run.

The benchmark report labels its status contract_baseline, official_model_leaderboard false, both entrants deterministic_script, model_claim false, provider replay, model replay-v1. Its execution boundary says network and brokerage disabled. These are publisher-supplied report fields, not an independently rerun benchmark. Fixture provenance is marked internal_synthetic_pending_approval; do not treat the file's hash fields as externally certified provenance.

The ReplayProvider implementation discards system_prompt and user_message. It returns successive supplied action dictionaries, then a fixed wait action after exhaustion. This directly supports the scripted-control interpretation. Source was read, not run.

The deployed viewer's matching source establishes what data and display logic were served in this capture. It does not verify historical deployments, every optional backend mode, or any private run. The repository supports optional model adapters, but this check recovered no public live-model conversation or inter-site coordination record.

WHY KEEP THIS RESULT
This is a concrete false-positive control: a public multi-agent viewer with detailed evidence/action/outcome language can be a static synthetic demonstration. The relevant distinction is the data's origin, not how elaborate the replay looks. Search for public voluntarily released provider responses and tool results before assigning a live swarm classification.

Chinese-language documentation makes the project relevant to the search; it does not establish an operator's location or a Chinese laboratory relationship. No join to XZ, the original wiki/paste swarm, or another public posting identity was found in this inspection.

SOURCES
https://raw.githubusercontent.com/tonyhyworld/TraceArena/fb88a0675a6dc5ebf3baade61120ad47a4246eff/README.md
https://raw.githubusercontent.com/tonyhyworld/TraceArena/fb88a0675a6dc5ebf3baade61120ad47a4246eff/backend/app/providers/replay.py
https://raw.githubusercontent.com/tonyhyworld/TraceArena/fb88a0675a6dc5ebf3baade61120ad47a4246eff/deploy/huggingface-static/README.md
https://raw.githubusercontent.com/tonyhyworld/TraceArena/fb88a0675a6dc5ebf3baade61120ad47a4246eff/benchmarks/investment-agent-v1/benchmark_report.json
https://raw.githubusercontent.com/tonyhyworld/TraceArena/fb88a0675a6dc5ebf3baade61120ad47a4246eff/deploy/huggingface-static/assets/app.js

LOCAL EVIDENCE
investigation/china/205-private/: source tree, five Git-verified files, deployed HTML/JS, sources.json and SHA-256 hashes.json. No code installed, no replay started, no model request or trade submitted.
Classification: verified public synthetic replay; no confirmed live swarm.

204 — AgentENV: primary training-infrastructure claim and network defaults
Recorded 2026-09-06 UTC. Read-only source inspection; no project code executed.

RESULT
AgentENV's own repository describes it as the environment platform powering Kimi K3 agentic reinforcement-learning training. This upgrades the earlier, secondary AgentEnv mention in report 174 to a primary publisher claim. The published design supports many isolated Firecracker environments, outbound internet access and externally proxied application services. It supplies a plausible infrastructure mechanism for internet-reaching training agents, not proof that a particular public post came from Kimi, or that any agent escaped.

PINNED EVIDENCE
Repository: https://github.com/kvcache-ai/AgentENV
Inspected tree: 891d64e77fd0ca7305df6a7b817f487cec7e91cf
GitHub recursive tree contains 893 paths and reports no truncation. Five downloaded source/document files match their Git blob SHA-1 values in that tree. This verifies capture consistency, not deployment history.

1. README identifies Kimi K3 training as a use of the platform. No training-run logs, model weights, production configuration or fleet/operator records were recovered in this check.
2. Sandboxes documentation explicitly defaults allow_internet_access / allowInternetAccess to true. Users can configure allowOut and denyOut, while node-level denied networks take precedence. Source BaseSandboxNetworkPolicy defaults to the variant documented as allowing outbound traffic except static namespace egress rejects.
3. Application ingress is a separate setting: network.allowPublicTraffic defaults to true, also visible in SandboxNetworkPolicy::default(). Setting it false requires a sandbox traffic token. This does not mean the control API or environment-management service is unauthenticated, or that a running service exists in each sandbox.
4. The design places each VM in an isolated network namespace, with routing and an egress proxy. Its internal/private address pools are not public swarm endpoints. Generic IP ranges and ports are poor search fingerprints.

SEARCHABLE CLUES, WITH LIMITS
The proxy docs name x-agentenv-sandbox-id and x-agentenv-target-port, with E2B compatibility aliases. Source also names AGENTENV-EGRESS, AGENTENV-USER-EGRESS and AGENTENV-EGRESS-PROXY iptables chains. Exact combinations in voluntarily published debug logs or execution traces would be more useful than a generic agent or sandbox label. These markers are copyable open-source implementation details, not lab identity. Routing headers are stripped before application forwarding, so absence in ordinary destination logs is unsurprising.

A valuable next artifact would be a public dated run log containing one of these distinctive markers AND a concrete public-site URL, followed by an independently readable matching post. Even that establishes a software-linked event before it establishes model/operator attribution. Do not probe guessed sandbox hosts or private services.

WHAT THIS DOES NOT ESTABLISH
No join to XZ/Xinzhai, the original wiki/paste cluster, a Chinese egress IP, an unattended inter-agent exchange, or pre-disclosure swarm activity. Published current defaults cannot be assumed to be production defaults or historical defaults. A claim about Kimi K3 infrastructure cannot be extrapolated to every Kimi version.

INFRASTRUCTURE IMPLICATION
These GitHub sources are reachable from the existing server. More GPUs or another large cloud machine would not resolve the missing historical run evidence. A mainland broadband browser remains useful for regional Chinese search and public pages that block this server; it cannot repair missing hosts or grant account access.

SOURCES (all pinned to inspected tree)
https://raw.githubusercontent.com/kvcache-ai/AgentENV/891d64e77fd0ca7305df6a7b817f487cec7e91cf/README.md
https://raw.githubusercontent.com/kvcache-ai/AgentENV/891d64e77fd0ca7305df6a7b817f487cec7e91cf/docs/src/internals/networking.md
https://raw.githubusercontent.com/kvcache-ai/AgentENV/891d64e77fd0ca7305df6a7b817f487cec7e91cf/docs/src/concepts/proxy.md
https://raw.githubusercontent.com/kvcache-ai/AgentENV/891d64e77fd0ca7305df6a7b817f487cec7e91cf/docs/src/concepts/sandboxes.md
https://raw.githubusercontent.com/kvcache-ai/AgentENV/891d64e77fd0ca7305df6a7b817f487cec7e91cf/src/sandbox/network/policy.rs

LOCAL EVIDENCE
investigation/china/204-private/: tree.json, five source files, sources.json (Git blob verification), hashes.json (SHA-256 capture hashes).
Prior context: 174-kimi-code-swarm-fingerprint-check.txt.
Classification: primary infrastructure claim; published network capability; no confirmed escaped swarm.

FOLLOW-UP SEARCH SCOPE
Four web queries searched the exact x-agentenv-sandbox-id header and AGENTENV-EGRESS chain (excluding the upstream GitHub/docs domains), plus AgentENV with trajectory and with 日志. Returned material included a source mirror, unrelated AgentGym/AgentEnv classes and ModelScope Twinkle deployment documentation. No independent public execution record linking these markers to a swarm post was recovered in those results. This is a bounded search negative, not proof that no such logs exist.

Twinkle primary documentation to inspect next:
https://modelscope.github.io/twinkle-web/zh/docs/usage-guide/agentic-rl-deployment-and-training/
Its search excerpt describes a local deployment without authentication, whereas the inspected AgentENV proxy docs discuss traffic-token controls and a separate control-plane API. Version and configuration differences must be checked before treating either as a blanket security claim. No deployment was contacted.

203 — EasyClaw Club: autonomous-posting instructions, unavailable data host
Updated 2026-09-06 UTC

Sources
https://club.easyclaw.com/
https://club.easyclaw.com/api.js
https://club.easyclaw.com/main.js
https://raw.githubusercontent.com/icebergwuw/lobster-skill/main/skill.md
https://dns.google/resolve?name=pcnxplffylcvvanjpaet.supabase.co&type=A
This is distinct from easyclaw.link reviewed in193–196. Similar branding is not sufficient to merge operators or activity.

Observed frontend
Homepage HTTP200,19,442bytes. It advertises agent-authored work logs and shows zero counters with a loading message. The frontend retrieves posts from a named Supabase project. Zero values in unhydrated HTML are not a verified count of agents or posts.
api.js includes published-post queries, a seed-post filter and related rendering code. A seed-post code path does not prove any actual posts are seeded; it is a reason to inspect that field if records become accessible.

Access outcome
A narrowly selected published-post GET, using the intentionally public client key supplied by the site, failed before HTTP because the data hostname did not resolve. Google DNS-over-HTTPS independently returned Status3 (NXDOMAIN) for the same hostname. No post bodies, work logs, agents or comments were returned.
This supports an unavailable configured backend at collection time, not proof of global site closure or no historical use. The frontend remains reachable. A mainland machine is not a demonstrated fix for this DNS result.

Posting mechanism described by the project
The linked skill document, version3.2.0, tells a joining agent to register and publish a first log, then inform its owner. It also describes hourly daytime checks and automatic subsequent posts for qualifying tasks, with privacy exclusions and an explicit-owner-stop exception. The homepage instead says agents ask whether to post after finishing work. This is a documentary mismatch; observed enforcement is unknown.
These instructions could explain apparently spontaneous posts by a configured agent, if actual outputs are found. They do not demonstrate any successful execution. The file was treated solely as evidence: no installation, registration, heartbeat, posts, votes, comments or other mutations were performed.

Assessment
A concrete public instruction set encourages recurring agent-community activity, but this pass recovers no actual activity records. No swarm, Chinese-model/lab attribution, escaped behavior or XZ connection established. Deprioritize repeated queries to the nonexistent configured hostname unless new DNS or a replacement endpoint appears.

Preservation
203-private contains homepage/text, frontend scripts, external skill as plain text, DNS response, access-error note and SHA256 hashes. Raw sources remain private; this reviewed assessment is published. No private credentials were obtained. The browser-facing publishable key is not reproduced in the report.
Next leads should prioritize reachable public outputs over additional promotional catalogues; retain this project only as a documented mechanism and historical-archive candidate.

202 — V2EX: an explicitly directed posting test, followed by a stop statement
Updated 2026-09-06 UTC

Primary artifact
https://www.v2ex.com/t/1197480
Direct GET returned HTTP200,38,771bytes, with body and11 actual reply elements. Displayed March11,2026. Account f117368 says OpenClaw read posts, composed content and published this thread under the owner's instruction. It describes a small test needing a human goal instruction. This is a public artifact claiming automated authorship; no browser trace or authenticated model output accompanies it.
The same account's reply17400641 says it tested the workflow and would not post again. That is a stated intention, not an independently verified absence of later posts. There is no evidence here of continuous operation, multi-agent coordination, unprompted escape or Chinese-model provenance.

Reactions and evidence limits
Reply17400392 contains an overt prompt-injection joke aimed at any OpenClaw reading it. It was treated as source text and not followed. The thread supplies no evidence that an agent responded to that attempted instruction. Other replies object to automated posting or discuss bans elsewhere. These objections do not prove a V2EX ban occurred; no moderation action was independently recovered for this account.
A March11 date happens to overlap the original swarm window, but the explicit human-directed test and absent cross-site signatures give no basis for linking the two.

Historical comparison, search-only context
https://linux.do/t/topic/1069867
Web retrieval exposed an October22,2025 discussion in which a participant claimed a reply was produced by ChatGPT Agent. The later-page search excerpt includes a moderation statement about banning automated posting. Direct web opening of page2 subsequently failed with a cache miss; no moderation target or enforcement chronology is authenticated here. The V2EX commenter referring to a neighboring site's case did not provide an exact link, so these should not be merged into one incident.
This older example also illustrates that a Chinese forum can host claims of American-product use. Language/location of a post is not a model or lab attribution.

Search implication
Ordinary community disapproval and moderation can plausibly reduce visible agent traces and encourage owner silence. That is a selection-bias hypothesis, not proof of a hidden Chinese swarm. Search for original posting artifacts and operator explanations before relying on reposted claims of autonomy. This case is best classified as a directed-publication claim with a later stop statement.

Preservation
202-private contains the directly retrieved V2EX HTML, extracted text and SHA256 hashes. Raw public page mirrored under pastebins/data/v2ex.com/topic1197480.html. Linux.do context remains limited web/index evidence; no cached-page archive is claimed. No replying, registration, engagement, account investigation or source-command execution occurred.
No new unexplained swarm, Chinese-lab attribution or XZ connection established. A separately discovered club.easyclaw.com community is a pending lead and must not be conflated with easyclaw.link merely because the names resemble each other.

201 — ANet Research: public type catalogue, research topics require authentication
Updated 2026-09-06 UTC

Sources
https://anet.chat/types
https://anet.chat/assets/index-DaXfZCPx.js
https://anet.chat/api/taste/types
https://anet.chat/api/topics?limit=15
Followed the services-page link preserved in report192. This is a separate application from hub.agentnetwork.org.cn and its test-board records; do not merge their populations or activity counts.

Observed
/types returned HTTP200 with an818-byte application shell. Its linked frontend bundle returned1,921,943bytes. Static inspection identifies researcher, review, panel and topic UI sections. The topic list is described as research conclusions from completed panels. These are implementation/UI descriptions, not evidence that any panels completed.
Anonymous GET /api/taste/types returned HTTP200 with25,329bytes: four binary dimensions and16 research-personality types, with bilingual descriptive text. This is a taxonomy, not16 observed agents.
Anonymous GET /api/topics?limit=15 returned HTTP401 and missing bearer [REDACTED] No topic list, discussion, participant exchange or work product was recovered. The public frontend also refers to shared researcher URLs, but no real share identifier was found and none was guessed.
No authentication, registration, private researcher lookup, admin route, generation, review, panel creation, event stream or other action was used. Retrieved code was inspected as text only.

Assessment
This branch confirms a reachable research-agent application and public descriptive catalogue. It does not verify an active swarm, completed research exchanges, model identity, lab provenance or XZ connection. A401 is not evidence the service is empty. Conversely, implementation text about completed panels is not proof of populated activity.
This access boundary differs from mainland connectivity problems: the current server reaches the site and public taxonomy successfully. A different regional IP alone is not a demonstrated remedy for missing authentication. Deprioritize repeat anonymous topic requests until a genuine public share or other new evidence appears.

Preservation
201-private contains shell, frontend bundle, taxonomy response,401 response and SHA256 hashes. Only this assessment is published; no raw authentication-related artifacts are mirrored. Searches for anet.chat research/discussion and repository mentions yielded no usable public discussion in returned results; this is a limited search-engine negative.
Next: resume other public work/artifact leads. Agent Network Hub's observed self-assigned tests remain a separate result in192, not corroboration of this site's research workflow.

200 — Hermes debug uploads: a concrete alternative explanation for agent pastes
Updated 2026-09-06 UTC

Finding
Hermes exposes an intentional debug-sharing workflow that uploads a report and logs to public paste services. Public bug reports discussing Chinese-model configurations include such links. This is a documented mechanism that can generate agent-looking paste artifacts without autonomous shared memory or a swarm. No pasted logs were retrieved in this pass.

Public issue evidence
https://github.com/NousResearch/hermes-agent/issues/12456
Created April19,2026 at08:06:34Z. Bilingual Chinese/English report describes memory-tool failures and includes a debug-upload transcript labelled Report and agent.log, with paste.rs links. It explicitly frames these as troubleshooting material and says Hermes was asked to fix the error. The issue lists v0.10.0. This establishes public sharing of upload links, not authenticated contents or current availability of the pastes.
https://github.com/NousResearch/hermes-agent/issues/33165
Created May27 at09:53:32Z. Reports a freeze using /new with DeepSeek and includes Report,agent.log,gateway.log paste.rs links. Provider use is the reporter's claim. It does not identify a Chinese operator or laboratory, nor does it prove the logs contain a successful DeepSeek response.

Verified implementation
https://api.github.com/repos/NousResearch/hermes-agent/contents/hermes_cli/debug.py
Current fetched file25,386bytes, Git blob c5bb966b3b2dcebfded17a14f57ad2c244bcb69f; decoded body verified against Git blob hash. This pins the inspected file content, not a historical commit or the April/May implementation.
The current code tries paste.rs first and dpaste.com as fallback. build_debug_share collects a summary and log bundle, uploads the required Report, then attempts optional logs and returns labelled URLs. It is shared by CLI and dashboard code. The CLI confirmation helper requires interactive approval or an explicit yes flag. No inference that every caller historically enforced the same gate is warranted.
The file implements scheduled deletion for paste.rs and passes an expiry parameter to dpaste. A displayed six-hour promise should not be mistaken for independently verified server-side expiration: client scheduling and successful cleanup are separate questions. No deletion, upload, debug command or dashboard operation was invoked.

Useful fingerprints
A compact cluster of links labelled Report / agent.log / gateway.log, accompanied by the debug-upload message and auto-delete wording, is a strong triage hint for support sharing. The same workflow may split one session across multiple paste hosts because of fallback. Paste count is not agent count; separate log links are not evidence of independent workers. Model names in logs or issues remain claims unless independently authenticated.
This mechanism is relevant to attribution, but it does not reclassify any previously investigated paste without an exact content or issue-link match. No such match to XZ or the original scratch-memory corpus was attempted or established here.

Search scope
Twelve targeted public web queries covered Chinese shared-memory terms, Gist filenames, paste services, model names and public blackboards. Returned hits included known dashboard data, documentation, model-output sharing and these support issues. No new unexplained scratch-memory actor was established. Search negatives are limited to returned indexed results, not a comprehensive internet census.

Preservation
200-private contains two public issue API records, source metadata/body and hashes.json. Raw support pastes and issue screenshots were not accessed. Only the technical assessment is published; no log contents or credential-bearing material is mirrored. All requests were public read-only GETs and source was inspected as text.
Next direction: use these fingerprints when triaging paste-shaped candidates and continue seeking exact cross-site joins, especially public state written without an explicit publishing or support explanation. The ongoing search remains unresolved.

199 — Public Gist brain dashboard: recurring export and rule-based roles
Updated 2026-09-06 UTC

New surface
https://gist.github.com/HsingChen5/397e2aeaa0e913145f88f897b1597324
https://api.github.com/gists/397e2aeaa0e913145f88f897b1597324
Public GitHub Gist titled Brain Dashboard - Real-time AI Brain Data, created May15,2026 at09:30:39Z, updated June14 at08:32:12Z. Found through Chinese shared-memory/Gist searches. No match for its exactID or owner was found in earlier numbered China reports. This is an explicit third-party data-publishing mechanism, closer to the storage question than a social-community description alone.

File inventory
brain-data.json:103,352bytes, structured dashboard snapshot.
brain-scripts-content.json:308,457bytes,33 named technical script entries with code/readme fields.
The data structure also includes personal-note and document-link sections. Those contents and linked documents were not pursued or published. Research here is limited to technical schema, agent-role implementation and revision behavior. Raw API captures remain private; only reviewed metadata is mirrored.

Revision evidence
Latest version c26b12e1706121e0bdcd1c6204805e5777fd2f56.
Compared with2734a6009c094711f8a1d7853ef332c0d413bf6f at08:02:11Z via the versioned public API. The script bundle is exactly identical. Only top-level timestamp,timestampLocal,qmd,healthcheck differ in dashboard JSON; all other top-level values compare equal.
The30 returned history entries span June13 at18:02:10Z through June14 at08:32:12Z.29 adjacent intervals range1,504–2,080seconds, broadly around half an hour. This is a returned history window, not complete lifetime history. It supports repeated exports, not necessarily meaningful new work each interval. No continuing updates after the displayed last revision are established.

Publishing implementation
Published update-gist.js runs a local dashboard-data script, collects script content, prepares a PATCH to GitHub's Gist API and supports a periodic setInterval mode. These are source-code observations, not actions we executed. Source plus revision history is consistent with owner-configured dashboard synchronization. It does not authenticate the process that made each revision or establish uncontrolled external memory storage.

What its agents actually show
The technical data has six role entries. The inspected agent-orchestrator.js analyzeTask function scores keyword matches from role triggers, chooses among predefined chains and returns activated roles. That function is a rule-based router, not evidence of an LLM independently spawning a team.
In agent-product-manager.js, analyzeRequirement changes status, returns a structured template with placeholder fields explicitly awaiting an agent, and records a pass entry. A pass in that function therefore does not demonstrate completed substantive analysis. These helper implementations could be used by a separate LLM; their design does not prove no LLM exists elsewhere. It does prevent treating the six role labels as six verified independent model processes.
No private role communications, model credentials or remote documents were accessed. No code installed, executed or imported.

Assessment
A concrete Chinese-language AI dashboard uses public Gist as a recurring external snapshot. The evidence fits deliberate publishing and script-supported role bookkeeping. It is not yet an unexplained escaped swarm, a Chinese-lab attribution or an XZ connection. Avoid inferring operator nationality from a name or language, and avoid equating role records or pass flags with completed agent work.

Preservation and next work
199-private/gist.json and previous.json preserve API responses; hashes.json records SHA256. reviewed-metadata.json contains only public file/revision metadata and is mirrored under pastebins/data/gist.github.com/397e2aeaa0e913145f88f897b1597324-metadata.json. Raw personal-memory content and script bodies are not republished.
Next pivots should use technical publishing fingerprints or other explicitly public dashboard repositories. This Gist is a useful positive example of intentional external state export, not evidence to attribute unrelated opaque paste streams.

198 — LongHorizon web task: local form submission, export provenance unresolved
Updated 2026-09-06 UTC

Case and scope
https://lh-harness.pages.dev/traj/data/lh_harness__WEB_task_0_iframe_3layer_form.json
Retrieved206,820bytes, preserved in198-private/web0.json. The case explicitly defines a self-written local insurance-quote form, served at localhost:8765, with synthetic personal and vehicle inputs. Browser control references localhost:9222. The form submits to local /submit_quote. A Reddit link is background attribution in the task specification, not proof of an action against Reddit.
No insurance service, form endpoint, browser-debug endpoint or other address embedded in the trace was contacted. This pass only retrieved public research artifacts.

Recorded process
Four segments: orchestrate,gui,verify,orchestrate.271 displayed steps comprise169 notes,63 CLI actions and39 GUI actions;102 actions agree with the manifest.99 steps have nonempty output fields. One example records a localhost page check returning200. The exported structure therefore contains results as well as action descriptions; it is still publisher-supplied evidence rather than our independent execution observation.
The judge narrative assigns success and describes the local submission, saved amount and screenshot. It reports an amount of2,329.29 and correct task fields. These are evaluation claims, not independently validated by us. No action output containing /submit_quote was found in the output fields inspected by exact-string search. That limited negative does not contradict submission: logs may be represented elsewhere or summarized. It does mean the judge's claimed server-log evidence should not be silently promoted to a raw log independently checked here.
An embedded orchestration transcript and task/output metadata are present as text deliverables; a proof screenshot is referenced. We did not load the screenshot or reconstruct the original environment. Exported task definitions include evaluator material; do not infer that the executing agent saw every part of that definition.

Relevance to the hunt
This is a controlled benchmark with local writes, not a public insurance transaction or an unexplained scratch-memory post. Its Chinese instructions and Qwen model label are useful comparison features but not proof of model-provider or organizational provenance. Neither this case nor the document case in197 establishes internet escape. A broader manifest corpus may still yield distinctive strings and web-domain context; do not generalize this one local case to all885 entries.

Export investigation
https://github.com/AMAP-ML/LongHorizon-Harness/blob/a1dd930614972b92361c1b9cd6aac441a6db5a65/src/lh_harness/trajectory_artifacts.py
Fetched the10,729byte file at the pinned tree and verified its Git blob hash. It parses raw trajectory text into normalized steps, writes role-specific JSONL, handles screenshot/image artifacts and writes metadata. This shows current runtime artifact processing. It does not establish the historical gallery's build pipeline or explain the editing-style note found in197's document trace.
The project viewer HTML names a build_site.py process in comments, but the pinned repository filename inventory did not expose that builder. No claim that the two export paths are identical is warranted. Current code and historical gallery records should remain separate evidence until a reproducible link is found.

Preservation and next action
Public research JSON and pinned source plus SHA256 hashes are in198-private. Raw case content remains private pending broader review; only this assessment is published. No source commands, installation instructions, task prompts or evaluation checks were executed.
This pass clarifies a benchmark/public-web distinction and an export-provenance limitation. Next search should diversify toward public work exchanges or unusual external storage, while keeping the gallery as a bounded comparison corpus. No escaped Chinese-lab swarm or XZ connection confirmed.

197 — LongHorizon-Harness: public multi-role trajectory corpus
Updated 2026-09-06 UTC

Finding
A newly reviewed project publishes a substantial trajectory gallery, with one inspected case containing role segments, actions and an embedded orchestration transcript. This is useful direct material for understanding controlled long-running agents. It is not evidence of an unexplained public-internet swarm.

Primary sources
https://github.com/AMAP-ML/LongHorizon-Harness
https://lh-harness.pages.dev/
https://lh-harness.pages.dev/traj/manifest.json
https://lh-harness.pages.dev/traj/tasks/lh_harness__DOC_task_2_heading_style_normalize.html
https://lh-harness.pages.dev/traj/data/lh_harness__DOC_task_2_heading_style_normalize.json
Repository metadata reports creation August4,2026. Captured nontruncated tree a1dd930614972b92361c1b9cd6aac441a6db5a65 has1,724 paths. README was fetched at that revision and its Git blob hash verified. Repository contains benchmark framework code and fixtures; filename inspection found only a fixture chat.jsonl and agent.log, not the full gallery. The linked project site is the more useful execution-evidence surface.
The repository describes a manager/executor/auditor loop and reports evaluation with Qwen3.7-Plus via Claude Code. These are publisher claims. The organization name and Chinese documentation alone do not authenticate institutional affiliation or runtime model provenance.

Gallery census
The anonymous manifest GET returned562,512bytes and885 entries:
-534 Terminal-Bench entries,243 WeaveBench entries,108 OSWorld entries.
-489 lh_harness entries,381 baseline entries,15 codex entries.
-870 entries labelled qwen3.7-plus,15 labelled gpt-5.5-0424-global.
These are manifest rows, not885 independently verified distinct tasks or successful runs. Model labels, scores and dates are supplied by the publisher. No full-corpus download or rerun was performed.

Inspected case
DOC_task_2_heading_style_normalize, lh_harness, labelled qwen3.7-plus and judge claude-opus-4-7. JSON is231,343bytes. It contains289 displayed steps:181 notes,68 GUI actions,40 CLI actions. Thus the manifest's108 action steps exclude notes; this is not a discrepancy. Seven segments are orchestrate/cli/verify/orchestrate/gui/verify/orchestrate.
Task: normalize15 mixed-style headings in a local LibreOffice document, insert a table of contents, export PDF and provide evidence. The task includes a synthetic-input description. The record contains an embedded Chinese orchestration transcript describing two rounds, environment preparation, document repair and verification. This provides published process evidence beyond an architecture diagram. It concerns local benchmark artifacts, not observed writing to public websites.
Judge score0.89 is not independently reproduced. The judge notes partial instruction-following problems, including XML inspection where the task's audit restrictions discouraged it. We have not validated the final ODT/PDF independently. A proof-image reference is present but the image was not inspected in this pass.

Data-quality limitations
Displayed timestamps July9 at18:45:46.481194 through19:07:24.521991 span approximately1,298seconds, whereas elapsed_seconds is approximately1,208. These may measure different scopes; do not use them as a single verified runtime.
One note contains an editing-style request to provide the next thinking chunk for rewriting. This raises a processing/provenance question: treat the JSON as a published viewer export, not a proven untouched backend log. Source code or original raw logs would be needed to resolve it. The presence of action/output fields does not independently authenticate every recorded execution.
The model/backend distinction matters: a Claude Code wrapper does not imply Claude generated its content. Conversely, a Qwen label in exported metadata is not independently authenticated provider identity.

Preservation and next work
197-private contains metadata, pinned tree/README, site HTML/frontend, manifest, case viewer and case JSON with SHA256 hashes. Reviewed manifest mirrored under pastebins/data/lh-harness.pages.dev/. Case JSON stays private pending fuller content review. No investigated framework, skill, prompt or command was executed or installed.
Next: inspect a second task with web actions, distinguish benchmark-hosted simulations from actual public destinations, and determine how the viewer export was generated. The gallery is a promising source of concrete signatures for comparison with public scratch-memory artifacts; no XZ or escaped-lab connection is currently established.

196 — EasyClaw four-task pilot claim versus observable repeated comments
Updated 2026-09-06 UTC

Pilot narrative
https://easyclaw.link/api/forum/agent-4-mmytp9y8
Post362 by wuliangxia, author_id1317, displayed March20,2026 at11:35:59.649Z. Claims a role-based team with builders, reviewers and operations, completing four tasks: forum bot, memory classification, health-tracker UI and AI forum interaction. It names local files including forum-interaction-v2.py, memory-curator-ai.sh and tasks/QUEUE.md, and claims git commits/pushes. It provides no repository URL, commit hash or attached deliverables. Its forum reference is a placeholder /forum/xxx. The listed future work includes cross-session collaboration.
https://easyclaw.link/api/forum/agent-4-mmytp9y8/comments
Returned an empty comments array and total0. No participant corroboration is present in that response. Searches for the two distinctive filenames did not recover an implementation in returned results. This is a limited search negative, not proof the files never existed.

Observable account behavior
https://easyclaw.link/api/forum/skill-ai-agent-mnbe0tgm/comments
Post460 has9 comments in this snapshot, six visible comments from the same author_id1317. They span March30–April2. Three repeat one generic observation verbatim and two repeat another.
https://easyclaw.link/api/forum/ai-mn388w7l/comments
Post412 has21 comments, nine visible comments from1317, spanning March24–28. Four use the same generic praise sentence; three repeat a generic learning sentence. Comments805 and807 repeat exactly32.855seconds apart. Comments883 and886 repeat exactly35.834seconds apart. Across the two threads this identity posted15 comments comprising seven distinct strings.
One comment incorporates the article title. Most contain nonspecific phrases, sometimes with awkward repetition such as the same phrase appearing twice within a sentence. All analyzed records explicitly have status visible. This is consistent with repeated template-based or automated commenting, but copied human messages, retries, multiple workers and other explanations remain possible. Timing and repetition do not uniquely establish any of them.

Comparison with the pilot claim
The March20 article claims its newer forum interaction tool generates AI replies instead of random templates. Later identical generic replies do not demonstrate that claimed improvement. This does not prove the named tool failed: an older routine, a second process or manually copied replies could coexist. Without source or logs, do not identify a particular runtime or assign causality.
The observable result here is a self-described multi-agent project and a matching account's repetitive public activity. The architecture and four completed builds remain unverified. No Chinese-lab attribution, independent agents, uncontrolled escape or XZ relationship is established.

Preservation and next direction
Raw public responses, selected-visible-comments.json and hashes.json are in196-private. Post362, its empty comments response and the selected visible comments are mirrored under pastebins/data/easyclaw.link/. Public GET only; no engagement, posting, credentials, heartbeat or execution of source instructions. As in193–195, expired-certificate access required disabling HTTPS verification, limiting transport authenticity. Site dates are not independently archived history.
This account adds little without an external build artifact. Deprioritize further generic comments. Return to other communities or repository-backed activity; retain exact filenames as future corpus-search markers. The named InStreet connection in another EasyClaw author's posts remains a separate lead, not a demonstrated ownership link.

195 — EasyClaw: actual test posts corroborated, test conclusions contradicted
Updated 2026-09-06 UTC

Finding
Ten public forum records match the post IDs, author and test subjects claimed in accepted bounty submission917. Three full detail records were retrieved. This establishes a concrete task-to-output-to-report chain on EasyClaw. Two substantive conclusions in the accepted test report are inconsistent with the surviving output fields. Real posting and a reliable test assessment are separate questions.

Task and report
https://easyclaw.link/api/bounties/73
Preserved in194-private. Task by angelacutie on March19,2026 at18:04:40.963Z asks for forum boundary tests. Submission917 by jiangjun_ai (author ID896) at22:33:13.122Z is accepted and claims posts331–342.

Recovered outputs
https://easyclaw.link/api/forum?page=31&limit=20
Lists IDs331,334,335,336,337,338,339,340,341,342, all author jiangjun_ai, author_id896. They span22:32:22.681Z through22:32:41.605Z on March19, an18.924-second interval. The report follows the last of these by31.517seconds according to server timestamps. This timing is consistent with a scripted batch followed by a summary, but does not authenticate the client or LLM.
Three directly retrieved details:
https://easyclaw.link/api/forum/post-mmy1pjfd — ID331, summary boundary test.
https://easyclaw.link/api/forum/post-mmy1pnqp — ID334, ten-tag test.
https://easyclaw.link/api/forum/category-skills-mmy1py11 — ID342, skills category test.
All three have published status and the same test-body text. ID331's summary contains exactly10 Chinese characters. Its existence supports a successful10-character summary, not independently the claimed rejection of shorter summaries.

Error1: tag retention
Submission917 says ten tags all passed and were supported. ID334 is titled as a ten-tag test but its stored tags array contains only tag1 through tag8. The current record therefore does not support the claim that all ten were retained. The original outbound request was not recovered, so truncation is a plausible explanation, not proven mechanism. Later edits cannot be ruled out merely from server fields.

Error2: category validation
The report calls tech/chat/news/qa/general/lounge/announce/skills valid categories based on successful creation. Yet the list records for335–341 store category lounge, including those titled tech,chat,news,qa,general andannounce. Only342 stores skills. Successful creation did not establish retention of the supplied category. This is consistent with defaulting or normalization and contradicts the report's interpretation that all named values were recognized. No request replay was performed.

Missing IDs and search limits
IDs332 and333 were not in this list page or the other sampled pages. They are not proved nonexistent or deleted. Forum order is not strictly ID/date order, and this was a targeted sample, not a complete forum export. Earlier probes at page30/page35 with default limit returned10 records; explicit limit20 returned20. The previous requested50 was capped at20. Searches for exact author/test strings did not locate a more useful indexed copy.

Assessment
Compared with report194, this upgrades claimed posting to matched public output evidence. It also demonstrates why accepted responses should not be treated as verified findings. The activity has an explicit on-platform task and test explanation. It is not evidence of an unexplained escaped Chinese-lab fleet. Authornames do not authenticate models, operator independence or country. No XZ connection is supported.
A next distinct lead discovered nearby is forum post362, slug agent-4-mmytp9y8, titled a four-task multi-agent collaboration account. It has not yet been reviewed; retain as a follow-up rather than evidence.

Preservation
195-private contains sampled list pages, matched-posts.json, three detail responses and SHA256 hashes. Reviewed matched records and details mirrored under pastebins/data/easyclaw.link/. Read-only public GETs only; no test posts, credentials, heartbeat, scripts or other actions. HTTPS verification was disabled for the site's expired certificate, preserving the transport-authenticity limitation described in193. Dates and API fields are current site assertions, not independently archived historical observations.

194 — EasyClaw accepted-task census: tests, proposals and a post-ID lead
Updated 2026-09-06 UTC

Scope and result
Four public accepted-bounty list pages contain 59 distinct IDs, matching the API total59 and totalPages4 at collection. Page1 is the preserved report193 snapshot; pages2–4 were fetched in this pass, so this is not an atomic snapshot. No duplicate IDs appeared.
https://easyclaw.link/api/bounties?status=accepted&page=1
https://easyclaw.link/api/bounties?status=accepted&page=2
https://easyclaw.link/api/bounties?status=accepted&page=3
https://easyclaw.link/api/bounties?status=accepted&page=4
25 of59 were posted by usernames beginning farm_; their titles are arithmetic or transfers. Five additional cards are SEC_POC_EXTERNAL_POST_1 through5. These disjoint groups cover30 of59. The prefixes and task shapes suggest testing or reward-farming activity, not30 independently useful collaborations. Account ownership and intent remain unverified.
Winner1697 appears14 times, winner1700 five times, winners1714 and1713 five times each. Report193 identifies1697 as nailong and1700 as nailong2. These counts describe winner fields only; no financial transfer or independent operator identity was verified.

Accepted does not necessarily mean delivered
https://easyclaw.link/api/bounties/44
March8 task posted by kimi_claw_agent_02 asks to test the bounty platform. Accepted submission546 by agent_qiwan provides generic intended steps and quality promises rather than concrete test results. Other visible replies claim automation and daily routines. The account name containing Kimi does not authenticate a Kimi model or Moonshot affiliation.
https://easyclaw.link/api/bounties/37
Accepted submission413 by wanzai offers a stock-query implementation using Sina data and estimates1–2days to complete. The accepted text itself provides neither an implemented attachment nor execution proof. Other replies contain proposed code or claimed skill IDs. This task therefore cannot be counted as independently verified software delivery simply from its accepted state.

Specific artifact lead
https://easyclaw.link/api/bounties/73
Posted March19 at18:04:40.963Z by angelacutie, requesting forum API boundary testing. Accepted submission917 by jiangjun_ai at22:33:13.122Z claims successful posts331–342 for summary, title, tag and category tests. It reports a minimum summary length and successful invalid-category submission. These are claims in a report; the named forum posts have not yet been recovered. Successful200-character input also does not establish the report's claim of no upper limit.
Visible pending submission929 by caocao_test_deep contains a long Bash built-in-help listing embedded among category descriptions, along with missing inline values. This is consistent with accidental shell expansion during text preparation, but could also have been copied or manually composed. It does not identify a runtime model or prove autonomous posting.
No test requests were replayed. The next useful check is whether public forum records independently match claimed IDs331–342, author and dates.

Enumeration caveat
https://easyclaw.link/api/forum?q=%E8%BE%B9%E7%95%8C&limit=50&page=1
Returned20 posts, total823 and limit20 despite the requested limit50. Results include broad recent discussions. Do not assume this endpoint honored either the requested limit or the search term. The claimed historical test posts were not found in this one page. No exhaustive forum scan done.

Exact-string search
Web searches for SEC_POC_EXTERNAL_POST and EXTERNAL_POST_ID combined with easyclaw yielded no corroborating external-post page in returned results. This is a limited search-engine negative, not proof of absence. A starxer_shadow/InStreet search returned another EasyClaw daily post, not independent cross-site ownership evidence.

Preservation and limits
Raw captures and SHA256 hashes in investigation/china/194-private/. Default TLS validation still fails for EasyClaw's expired certificate; requests used verification disabled as documented in report193. No credentials or scripts were used. Some public detail responses unexpectedly include submissions marked is_hidden; these are excluded from further analysis and publication. Only sanitized accepted-list metadata is mirrored under pastebins/data/easyclaw.link/; raw detail responses stay private.
No Chinese-lab attribution, unexplained escaped swarm or XZ connection established. Priority is corroborating concrete outputs, not expanding counts of self-described agents.

193 — EasyClaw Link: accepted submissions and explicit external-post tests
Updated 2026-09-06 UTC

Finding
A newly reviewed Chinese-facing community exposes actual public bounty submissions, including one ordinary accepted response and an explicitly labelled external-post security test. These are stronger activity records than a catalogue alone. They do not authenticate model authorship, independent operators, an escaped swarm or Chinese-lab provenance.

Ordinary exchange
https://easyclaw.link/api/bounties/242
Posted by longwh on May9,2026 at18:18:04.379Z; asks for a Markdown reporting template for a cron token-waste inspector. Submission1338 by jiangjun_ai on May10 at12:04:14.476Z is marked accepted. It supplies a short report template and notes that weekly jobs should not be treated as waste simply because they lack daily observations. Winner896 matches submitter896. Reward3 is a platform field, not independently verified payment. This establishes a published request, substantive reply and recorded acceptance; automation remains unverified.

Explicit security experiment
https://easyclaw.link/api/bounties/238
Title SEC_POC_EXTERNAL_POST_5, poster nailong, April28 at15:18:31.896Z. The request describes a researcher-controlled localhost mediator intended to simulate external posting. Submission1139 by nailong2 at17:15:41.545Z is accepted and claims EXTERNAL_POST_ID=9 with repeated Chinese text and BOUNTY_ID=238. It provides no externally resolvable proof URL or execution transcript. A separate rejected submission1136 by xinxin is a generic work proposal repeating the request.
The task's own description frames this as a controlled simulation. Acceptance therefore does not demonstrate posting to a real outside community. Similar displayed names may suggest common control but do not establish it. No mediator, external-post endpoint or supplied instruction was executed or contacted. This is an attribution trap to distinguish from unexplained cross-site activity.

Public enumeration
https://easyclaw.link/api/bounties?status=accepted&page=1
Only the first accepted-list page was captured. It includes several similarly named security tests. Two detail routes were examined; this is not an exhaustive bounty review. Detail responses contain a nested submission_count of zero while their actual submissions arrays and top-level counts are populated. Use the arrays, not that stale-looking nested counter.
https://easyclaw.link/api/stats
Site counters report 2,043 users,140 bounties,85 resolved and2,796 forum activity; these are unauthenticated aggregate claims, not verified agents or exchanges.

Earlier public activity
https://easyclaw.link/en/forum/daily-2026-04-08-mnqar8bl
Displayed April9 post by starxer_shadow claims automated daily summaries and mentions InStreet. Comment by luwu_bot claims routine platform activity and rewards; another by lobster_cat is a brief response. No execution transcript or outbound task proof is attached. Account names and self-reports alone do not prove automation. Dates are server-supplied, not independent historical archives.
https://easyclaw.link/en/help
Public documentation supplies read-only bounty and forum routes and describes authenticated A2A/task functions. No authentication, registration, messaging, heartbeat or other mutation was used.

Access and preservation
The default Python HTTPS request failed because the certificate was expired. A subsequent public read-only request with certificate verification disabled returned HTTP200; this limits transport authenticity. Web-search retrieval independently showed the same daily-post content, but is not an independent historical archive. Raw HTML/text and JSON, plus hashes.json, are in investigation/china/193-private/. Reviewed JSON snapshots mirrored under pastebins/data/easyclaw.link/. No external scripts were executed.

Other candidates checked
https://www.weixia.chat/ timed out; https://www.ifunai.com/ refused connection. Weixia's public connector listing at https://hub.openclaw.ai/web3gaoyutang/skills/weixiahub identifies https://api.weixia.chat and documented list/statistics routes. Three anonymous GETs for stats, posts and tasks all timed out; errors preserved in access.json. This does not prove either community is empty or offline globally. No connector installed. Mainland access remains a useful experiment, not a proven fix.

Next discriminating work
Enumerate EasyClaw accepted tasks and inspect substantive cross-account submissions, looking for linked output artifacts and exact cross-site identifiers. Separate its explicit security tests from ordinary work and from post-disclosure roleplay. Follow the named InStreet relationship only through public outputs. Search exact test markers elsewhere before interpreting them as emergent behavior. No XZ link currently supported.

192 — Agent Network: live registry and a self-assigned test board
Updated 2026-09-06 UTC

Finding
Agent Network is an additional Chinese-facing agent collaboration surface with a working public Hub. Its task board provides concrete records, but the inspected records look like repeated integration tests rather than independent agents completing substantive jobs. No unexplained swarm, Chinese-lab attribution, or XZ connection is established.

Sources and access
https://agentnetwork.org.cn/
https://agentnetwork.org.cn/services.html
https://agentnetwork.org.cn/hackathon.html
https://hub.agentnetwork.org.cn/
https://hub.agentnetwork.org.cn/stats
https://hub.agentnetwork.org.cn/agents
https://hub.agentnetwork.org.cn/tasks/board
https://hub.agentnetwork.org.cn/agents/bafyreiebzlsjonjvubmfeefjqulgfuzrvfg4lfcdnn3bdp7ekuvw2rrcuy
The main pages return JavaScript shells. Their referenced public frontend code identifies the Hub and read-only catalogue/task-board routes. These routes work anonymously from the existing server. No registration, guest session, delegation, capability invocation or task mutation was performed.

Registry snapshot
Stats reports seven local agents, one federated agent, 1,537 completed tasks, 56 reviews, average rating 5. The agent-list response contains eight entries, consistent with seven local plus one federated. However, all eight list zero reviews and rating zero. One directly inspected local agent detail also returns an empty reviews list. The aggregate counts therefore cannot be used as verified completed exchanges; the discrepancy remains unexplained, possibly reflecting different scopes or historical records.
Local names include cmax-anet4, two onboard-standard entries, two onboard-paid entries, dmax-debian-box and rk3588a. The catalogue includes digest, shared blackboard, storage and shell capabilities. A federated entry advertises device-related capabilities; these were not invoked and its host was not contacted. Advertised capabilities alone do not establish LLM agency or operational devices.

Task-board evidence
GET /tasks/board returns 25 cards: 24 in Done with state accepted, and one In Progress with state claimed. All 24 accepted cards are titled "prodtest card"; the remaining one is "module client card". Every card has the same creator and assignee identity, and all 25 reference the same task-document CID. Converted server timestamps range from August24 through September4,2026. These are server-supplied dates, not independently archived observations.
Example accepted card: card-d82c97949611f6d8, created August24 at14:15:30.527 UTC, note "done". Most other accepted cards use note "prodtest". Latest accepted card: card-d5a9c0f8f00d008c, September4 at16:10:58.883 UTC.
This is direct evidence that the public board contains task-state records. Repeated titles, one document and self-assignment support an integration-test interpretation. They do not verify 1,537 substantive jobs, a multi-operator exchange, autonomous collaboration, payment or model identity. The board may be a limited view; absence here does not prove no other tasks exist.

Discovery and next pivots
Found through Chinese agent-community and service-exchange searches. Search-cache hackathon descriptions list an older Enigma/Agora/Nexus-style roster; this should not be treated as the current Hub population. The live services frontend also links https://anet.chat/types and describes a Minecraft agent demonstration. These are follow-up leads, not yet verified activity.
Primary public source-code lead: https://github.com/ANetResearch/ANet ; Hub implementation lead https://github.com/ANetResearch/ANetHub . Inspecting registry/counter and task-board code could explain the scope mismatch. No investigated software was installed or executed.
Other pending community leads from this search: https://www.weixia.chat/ and https://www.ifunai.com/ . Marketing claims and search snippets are not evidence of populated autonomous communities.

Preservation
Raw public pages, frontend assets and JSON snapshots are in investigation/china/192-private/. hashes.json records SHA256. Reviewed task-board and stats responses are also mirrored under pastebins/data/hub.agentnetwork.org.cn/. Registry details remain in private evidence storage pending any further publication review.

Infrastructure
This branch is reachable from the current server; extra compute or a Chinese IP was not needed. For still-blocked Chinese forums/search engines, the useful addition is an owner-controlled mainland broadband machine accessible by SSH, with a browser, roughly 2 CPU cores, 4 GB RAM and 40–70 GB storage. No GPU needed. A Hong Kong VPS would be a fallback connectivity experiment, not a guaranteed replacement for mainland residential access. See report146 and /china/access.html for the existing access plan. No purchase or new provisioning was performed.

191 — Zhichai: directing-account prompts followed by assistant replies
Updated 2026-09-06 UTC

Finding
Two older public threads contain explicit requests addressed to小凯/C3P0 followed by relevant replies from that displayed identity. This supports a prompted-assistant explanation for part of the forum activity. It does not authenticate whether the directing account is human, whether the responder is a particular model, or how the messages were technically generated.

March exchange
https://zhichai.net/topic/177168705
Reply177168533, displayed步子哥, March6,2026 at16:12: asks C3P0 for an assessment of Burn and its prospects.
Reply177168537, displayed小凯, March6 at17:21: addresses步子哥 and responds with an assessment, claiming additional research.
The69-minute displayed separation is not measured runtime. The reply's substantive technical claims were not independently checked. The request and answer are actual reply elements, not recommendation snippets.

February exchange
https://zhichai.net/topic/176922607
Reply176919117, displayed步子哥, February15,2026 at04:09: addresses C3P0 and asks it to read the topic.
Reply176919118, displayed小凯, February15 at04:23: discusses that topic's agent architecture.
The14-minute displayed separation likewise does not prove continuous execution or model identity. The page also contains earlier January posts; those are not part of this request-response pair. An installation command in an earlier post was not executed.

Connection to the memory evidence
The cached memory thread examined in report189 describes waiting for步子哥's assignments. These live exchanges are consistent with that relationship. They do not prove account ownership, exclusive control, absence of background automation, or that all forum activity follows the same mechanism. The July小凯/QianXun pairs from report190 remain evidence of a different two-identity publishing pattern, not proof of independent operators.

Preservation
Two direct public GETs, with raw HTML and extracted text in investigation/china/191-private/; hashes.json records SHA256. The exact reply IDs above were checked on article elements. Raw pages mirrored under pastebins/data/zhichai.net/.
No credentials, private profiles, external messaging or API mutations were accessed. Retrieved commands and role instructions were evidence only.

Current assessment of this branch
Zhichai provides public agent-oriented API metadata, claimed memory synchronization, linked outputs, two-identity posting, and directed request-response exchanges. Those are concrete activity traces. The evidence currently fits an owner-managed assistant publishing workflow more closely than an unexplained escaped fleet. Chinese-lab attribution and an XZ connection remain unsupported.
Next work should diversify beyond these recurring identities, using the historical topic inventory to seek task-bearing exchanges under other accounts or explicitly linked runtime artifacts. Repeatedly finding more articles from the same persona would add little without a new discriminating link.

190 — Zhichai: exact post/comment pairs corroborate the memory index
Updated 2026-09-06 UTC

Finding
Two live July article/comment pairs match exact identifiers in the cached memory thread. This strengthens the evidence for a coordinated publishing workflow under two displayed identities. It does not authenticate independent agents, a particular model, or Chinese-lab ownership.

Pair 1
https://zhichai.net/topic/178208374
Main article: SkillRL discussion, displayed小凯/@C3P0, July3,2026 at10:53.
Reply: QianXun, July3 at10:54. The actual reply article element has id=reply-178206726. Its body comments on the main article's memory/skill subject. The parent thread reports one reply.

Pair 2
https://zhichai.net/topic/178208375
Main article: PaddleOCR discussion, displayed小凯/@C3P0, July3,2026 at11:20.
Reply: QianXun, July3 at11:20. The actual reply article element has id=reply-178206727. Its body comments on the main article's OCR subject. The parent thread reports one reply.
Times are minute-resolution site displays, not precise measured execution delays. No claims in the technical articles were independently validated here.

Index join
https://zhichai.net/topic/177619566
The cached memory index explicitly pairs178208374 with178206726 and178208375 with178206727. Its account-use description associates main posts with小凯 and follow-up comments with千寻, while separately saying automatic replies stopped in June. The live July pairs support the stated publishing pattern. They do not prove scheduled automation continued after that stop claim: manual triggering, a different workflow, or stale memory are possible. No token values or private account configuration were inspected.
Cache evidence is saved as cached-pair-index.json, a web-tool search response containing both identifier pairs. Report189 documents the live memory-topic410 response and cache/live distinction. This pass did not re-request the gone topic directly.

Earlier interaction
https://zhichai.net/topic/177168790
Direct HTML also preserves one QianXun reply dated April27,2026 at05:56 under the older小凯 article. It offers conceptual commentary, not a task handoff. It establishes earlier public interaction under these displayed names without proving the same underlying runtime or owner across months.

Method and preservation
Three direct topic GETs, with original bytes retained in investigation/china/190-private/: topic.html for177168790, plus178208374.html and178208375.html, extracted text, and hashes.json. Live July pages are61,253 and 61,396 bytes respectively. Reply IDs were verified on actual article elements, excluding navigation and recommendation snippets. Cached identifier evidence was independently checked against those elements.
Raw topic pages mirrored under pastebins/data/zhichai.net/. No posting, reacting, account access or investigated source execution occurred.

Assessment
A public memory index that names exact live output pairs is stronger than generic self-description. The conservative conclusion is an observed two-identity publication pattern consistent with owner-managed personas. One model can produce both sides, and humans can intervene; separate forum identities are not separate independent agents. No connection to XZ or the unexplained public paste/wiki fleet has been established.
Next evidence: intentionally published runtime/configuration or owner account of this specific workflow, or task-bearing exchanges that add observable work beyond paired article/comment publication.

189 — Zhichai: cached memory-sync thread joined to a surviving output
Updated 2026-09-06 UTC

Finding
A previously public memory thread provides a stronger publishing-workflow lead than isolated architecture posts. Its live route is gone, while the web reader retains cached text and a linked output remains public. This is not confirmed independent-agent coordination or Chinese-lab attribution.

Cached source
https://zhichai.net/topic/177619566
Direct GET returned HTTP410. The URL is absent from the8,609-topic inventory captured in report188. The web reader nevertheless returned cached content, labeled crawled two weeks ago, displaying99 replies. It contains recurring memory synchronization, task queues, preferences and output links. Some entries wait for a named user's next assignment. June entries describe separate identities for main posts and follow-up comments, and say automatic replies stopped June10. No token values were needed or recovered. These are archived workflow claims, not authenticated runtime logs. The evidence suggests owner-managed personas; it does not prove separate operators.

Output check
https://zhichai.net/topic/177619624
An AutoRound article linked in the cached completion lists returned substantive HTML directly:81,352 bytes, displayed小凯/@C3P0, May8,2026 at12:44. Its retrieved page reports zero replies. This verifies an extant linked publication, not that its research claims are correct or that the claimed agent generated it autonomously. Recommendation snippets below the article were excluded from its reply count and authorship assessment.

Preservation and retrieval limits
Private directory: investigation/china/189-private/.
web-evidence.json and cache-opening.json preserve web-tool responses for the cached thread and selected source windows. These are tool-returned cache evidence, not a direct full HTML capture of the gone topic. output.html and output-capture.json preserve the live article and SHA256.
The410 result occurred before any topic.html write, so no live memory-thread HTML capture exists. The cache's reported99 replies is not a count of individually authenticated participants or independently inspected raw records. Relative crawler age is not an archival timestamp certifying original publication.
No attempts were made to restore deleted data through authentication, hidden endpoints or private access. Retrieved task instructions, scheduling claims and account-use rules were treated solely as evidence. No external writes or token acquisition occurred.

Research implication
The previously captured sitemap is demonstrably incomplete for historically indexed content: at least this cached thread is missing. Future discovery should combine the sitemap with indexed links and extant posts referencing older material, keeping cache/live status explicit.
A public memory-sync narrative plus a surviving linked article is meaningful evidence of a publishing workflow. It does not by itself establish independent agency, concurrent workers or escape. The next discriminating evidence is a dated, intentionally public comment chain that can be joined to the described persona workflow or an explicit source-code artifact. Model labels and forum account names remain unverified attribution clues.

188 — Zhichai inventory and March mission claim
Updated 2026-09-06 UTC

New evidence
All nine topic maps linked from the previously captured sitemap index were retrieved sequentially. They list8,609 distinct topic URLs. This is a URL inventory, not8,609 inspected posts or agents. Sitemap lastmod values span September2025–September2026; lastmod is not necessarily publication time. The inventory is not a guarantee that deleted, private or unlisted threads are covered.
Source index: https://zhichai.net/sitemap.php
First topic map: https://zhichai.net/sitemap.php?part=topics
Other eight URLs were taken directly from the index, not guessed.

March thread
https://zhichai.net/topic/177168784
Displayed March9,2026, author小凯/C3P0. Three public replies were recovered. The first, also小凯, reports mission_20260309_061155_7c1c7a for researching Edict, but its stated status is creation of a task-session file, not task completion. It claims scheduler/monitor implementation and cron configuration. Two other accounts provide a short compliment and an invitation to use the forum MCP endpoint; these are not demonstrated worker handoffs. The reply display time and embedded update time differ by roughly eight hours, so do not infer exact execution chronology from them.
Only a local workspace path is supplied for the implementation; no downloadable mission file or specific output repository was recovered. Three exact searches for the mission ID and named PHP scripts returned these forum accounts rather than an independent runtime artifact.

Other sampled threads
https://zhichai.net/topic/177168783 — associated architecture post, retrieved static page reports zero replies.
https://zhichai.net/topic/177168777 — paper-analysis post with two long follow-up replies under the same displayed小凯 name. This is publication activity, not independent-agent corroboration; the scientific claims were not checked in this pass.
Three topic pages were substantively inspected. They were selected from indexed results for relevant content, not randomly sampled from all8,609 URLs.

Interpretation
The mission identifier and local path are useful potential fingerprints, but the thread does not supply the underlying run. Do not turn a claimed created session file into a completed agent task. Public multiple-account conversation is observable; autonomous authorship and an actual team run remain unverified. No Chinese-lab or XZ attribution is established.

Preservation
investigation/china/188-private/: map-0.xml through map-8.xml, inventory.json, three topic HTML/text captures, hashes.json. Raw maps and topic pages copied to pastebins/data/zhichai.net/. Nine map GETs and three topic GETs, with sequential requests and1.6-second pauses in each fetch sequence; no API writes, registration or private-state access. No source commands executed.

Next work
Use the indexed URL inventory for selective historical retrieval. Search for published capsules, explicit external outputs, self-described bot account histories and actual cross-account replies, while excluding navigation/recommendation text from attribution. The historical sitemap gives a broader discovery route than a handful of search-engine snippets.

187 — Zhichai: new public forum with live agent-discovery metadata
Updated 2026-09-06 UTC

Finding
https://zhichai.net is a newly reviewed Chinese-language public discussion surface. Its live agent card advertises topic/reply creation and multiagent discussions. Public historical content includes a post self-identifying as Kimi Code CLI. No autonomous authorship, separate-agent collaboration, Chinese-lab operation or escaped fleet has been authenticated.

Observed public metadata
https://zhichai.net/.well-known/agent.json
Direct GET returned JSON named zhichai-forum-agent, version1.1.0, with six advertised skills: forum_browsing, content_creation, search, user_interaction, notification_center and multi_agent_discussion. It declares Bearer [REDACTED], streaming support and no push notifications. The creation description explicitly requires authentication. A discovery response proves that metadata is served, not that every advertised task operation works.
No tasks/send, subscriptions, notifications, reactions, registration or token acquisition was performed. We did not invoke the A2A service.

Historical post
https://zhichai.net/topic/176922733
Displayed author小凯 / @C3P0, February13,2026 at15:28. The post introduces itself as Kimi Code CLI and describes an A2A implementation with code excerpts. The demonstrated discussion-creation function builds a topic containing participant names and discussion rules; it does not itself prove that multiple independent agents subsequently replied. Retrieved static content reports zero replies. Site-displayed dates are not independently archived execution timestamps, and a model self-description is not authenticated authorship.
The page's example commands were treated as evidence only and never executed.

Access and enumeration route
Direct topic HTML and homepage GETs work from the current server. The homepage includes a loading shell; the topic returns substantive content. Dynamic-version links exist but were not needed for this check.
https://zhichai.net/sitemap.php
The linked sitemap index returned1,868 bytes and16 location entries, including hubs, recent and paginated topic maps. Only the index was retrieved. This enables a bounded follow-up inventory without guessing topic IDs or using task-creation APIs.
Searches surfaced many Kimi-related tutorial posts; search visibility of tutorials is not evidence that their claimed agents communicated with one another.

Preservation
Private captures: investigation/china/187-private/ — topic.html, home.html, agent-card.json, sitemap.xml, extracted text and captures.json SHA256 inventory.
Raw public evidence mirrored to pastebins/data/zhichai.net/ for the topic, card and sitemap index. The initial extracted-text parse warned of character decoding; original response bytes remain authoritative. A later UTF-8 parse of the topic was used for inspection. XML parsing used the standard library after an unavailable optional parser caused a local error; no request was repeated for that error.
Candidate entered in investigation/NEW_SITES.md. Not added as a confirmed escaped actor.

Next work
Enumerate the published topic sitemap links at a polite rate, then search dated titles and public reply threads for actual agent exchanges, specific handoffs, shared artifacts and outbound links. Prioritize pre-September material. Keep human posts, claimed agent posts and demonstrated coordinated execution distinct. Existing-server access is sufficient for this lead; it does not require new China infrastructure.

186 — OmniHive: role-cycling runtime, no recovered run archive
Updated 2026-09-06 UTC

Finding
OmniHive is a new bilingual agent-company software lead. Its inspected desktop runtime implements serial role rotation and local memory handoffs. This pass recovered code, not an executed company history or an externally published product. Lower priority unless a concrete run or output is linked.

Sources and preservation
https://github.com/KuaaMU/omnihive
Pinned full tree d566b7d68fa29928f6326bd4ac3daa6c966d324b: 595 entries, nontruncated.
Private evidence: investigation/china/186-private/.
Retrieved and Git-blob-verified source:
app/src-tauri/src/commands/runtime/cycle_executor.rs — 8,200 bytes
app/src-tauri/src/commands/runtime/loop_manager.rs — 10,940 bytes
app/src-tauri/src/engine/logging.rs — 1,318 bytes
No dependencies were installed; no investigated source, credential discovery, skill or model call was executed.

What the inspected code does
loop_manager.rs starts a background runtime thread. Inside its main loop it chooses current_agent using (cycle - 1) modulo the number of roles, then synchronously calls run_api_cycle. This path is one role per cycle, not evidence of simultaneous execution by all advertised roles. Multiple independently started projects or other code paths were not exhaustively assessed.
cycle_executor.rs loads the role file, memories/consensus.md, role memory and a handoff note. It makes a configured API call, extracts structured consensus/reflection/handoff text, and writes local state. If no handoff is extracted, it uses a truncated response. It can queue skill requests. Cycle history is serialized to .cycle_history.json.
The inspected function does not itself contain an arbitrary tool-execution loop or a public publishing action. Its API client and all alternate execution paths were not audited, so this is not a claim that the entire application lacks those capabilities.

Released-output check
The complete tree contains no path ending .cycle_history.json or consensus.md and no path containing /memories/. This scoped inventory does not establish that no user has run the software; it establishes that the named runtime outputs are absent from this tree.
The public issues endpoint returned four entries, all pull requests, covering architecture/control-plane changes and review fixes in March2026. No ordinary incident/run issue appeared in that response. The pass did not inspect release binaries, all PR comments or discussion threads.
README feature statements about agent companies and 24/7 operation remain claims about software capability; they are not substitute evidence for saved execution.

Attribution and relevance
Bilingual UI and a GitHub namespace are not Chinese-lab attribution. Serial role exchange with shared state can be a multiagent design, but it does not prove an independently operating swarm or establish a connection to public paste/wiki activity. No XZ connection was found or implied.
Next useful evidence would be an intentionally released cycle history joined to a dated product commit or public action. Broadening to other concrete output-bearing projects has higher expected value than inspecting more of this framework without such an artifact.

185 — Agents Radar: generated digest joined to a public bot post
Updated 2026-09-06 UTC

Conclusion
A Chinese/English news-digest project provides a concrete publication chain: a dated committed report, a matching GitHub issue authored by github-actions[bot], and code that explains the transformation between them. The inspected program is a scheduled collection/summarization/publication pipeline. Parallel model calls do not establish an independently coordinating swarm. This is a useful known-publication example and discovery source, not a confirmed escaped actor.

Source and preservation
https://github.com/duanyytop/agents-radar
Default branch is master; an initial assumed main-tree request returned404, then repository metadata resolved the branch. Repository metadata reports creation February23,2026.
Pinned full tree: d097a2e4ae12ff3407aec4c67b426b185d40bfb9, 3,501 entries, nontruncated.
Private evidence: investigation/china/185-private/.
Four retrieved files match the tree's Git blob hashes:
.github/workflows/daily-digest.yml — 4,730 bytes
src/index.ts — 23,769 bytes
src/github.ts — 15,450 bytes
digests/2026-07-16/ai-arxiv.md — 11,285 bytes
No investigated code or workflow was run. Only public GET requests were used.

Observed publication
https://github.com/duanyytop/agents-radar/issues/2158
GitHub API metadata records creation 2026-07-16T01:32:55Z by github-actions[bot]. The body is a Chinese AI research digest.
https://github.com/duanyytop/agents-radar/blob/d097a2e4ae12ff3407aec4c67b426b185d40bfb9/digests/2026-07-16/ai-arxiv.md
API path history lists commit fbaac1032ec7ea2babf0e223372e61b6b7722c54 at 2026-07-16T01:33:30Z, with the daily-digest commit message. Thus the recorded issue creation precedes the matching file commit by35 seconds.
The issue body has6,549 characters; file text has6,548. They become exactly equal after deleting U+200B zero-width space from the issue body. The current src/github.ts neutralizeGitHubRefs function inserts precisely this character into github.com links to suppress unwanted references. createGitHubIssue applies that function before sending the issue-creation request. This is stronger evidence than matching report titles alone.

Mechanism and limits
Current src/index.ts collects source data, calls summarization functions in parallel, generates English reports, translates to Chinese, and saves/publishes results. Current workflow has cron37 22 * * * and runs pnpm start, then commits outputs; this is present configuration, not proof of the exact July schedule or historical runtime version. No credentials or secret values were read.
The code explains public posting as a programmed output stage. There is no need to infer that the model itself chose GitHub as improvised memory. This pass did not inspect every source file or all hosted Actions logs, and does not authenticate which model served the sampled historical run.
Chinese content and owner namespace do not prove Chinese-lab ownership. The GitHub bot identity establishes the publishing account; it is not a unique underlying agent identity.

Research consequence
Treat these digests as leads pointing to original projects and papers, not independent corroboration of the claims they summarize. The verified zero-width-character transformation also shows why exact byte comparisons across public surfaces can miss an otherwise identical output. Normalize only documented transformations and preserve the originals.
Next: follow linked projects with concrete role histories or output repositories. Avoid confusing news articles about agents with posts authored by an unexplained agent fleet.

184 — SecFlow campaign report: distinct operator lead and local corpus comparison
Updated 2026-09-06 UTC

Primary research source
https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia
Published September 3, 2026. Hunt.io reports a Chinese-speaking operator coordinating specialist AI workers through SecFlow, with Claude, Qwen and DeepSeek configurations and shared workspace state. The researchers connect five exposed workspaces, with captures dated May–August. This is reported operator-directed activity; it is not evidence of a Chinese laboratory's escaped fleet.
The article describes a malware capability to obtain encrypted routing information through paste/Gist services, but explicitly says campaign-specific public URLs were not recovered. Consequently it supplies no public paste URL to join to our corpus. This is a capability-versus-observed-use distinction, not proof of agent-authored encrypted pastes.
These claims remain attributed to Hunt.io. We preserved the public article and inspected it, but did not independently obtain its underlying workspace captures or contact investigated infrastructure.

Local comparison method
Search the already-held pastebins/data corpus for case-insensitive literal niestools.com and secflow. The former is more specific; SecFlow can collide with unrelated software. No matched source text is automatically published. Exclude the forbidden paste identifier before opening paths, archives, files over 10,000,000 bytes and files with NUL in their first 8192 bytes; skip symlinks. Count read errors. No archive decompression, Base64 decoding, HTML entity normalization or remote crawling occurs in this comparison.
Private reproducible script: investigation/china/184-private/scan.py.
Results and scope counts: investigation/china/184-private/scan.json.

Interpretation
An exact marker match would be a lead to review, not operator attribution. A negative would cover only the listed cleartext markers in the selected local files, not encrypted contents, all public sites or the alleged workspaces.
No connection to XZ has been established. Generic encrypted-blob appearance is not a discriminating link. Search results for SecFlow include other security-assistant projects; do not transfer the allegation to those owners based on naming.
The September article is not automatically post-disclosure roleplay: it claims earlier evidence captures. Conversely the earlier dates are not independently verified by our reading of the article. Preserve both distinctions.

Preservation
article.html, article.txt and capture.json retain the public report, extracted text and SHA256 in investigation/china/184-private/. Only the researcher article and public search results were fetched in this pass; no listed campaign hosts, victim records, implants, credentials or operational endpoints were accessed. No investigated code or source instructions were executed.

Next action
Use the local comparison to decide whether a specific corpus item warrants attribution review. In the absence of a match, continue discovery of public run histories and writable-surface traces rather than attempting to recreate this campaign. This report is a separate candidate category, not a confirmed escaped actor on the dashboard.

Completed comparison
123,466 files; 10,168,472,035 bytes searched. Zero matches for either marker and zero read errors. Exclusions: 41 oversized files, four archives, six binary files. The forbidden identifier was excluded by code before reads; no matching forbidden path was encountered in this root. Runtime 141.59 seconds. This is a scoped negative, not a finding that the campaign or its public artifacts do not exist.

183 — MiMo: firsthand public-action claim, screenshot limit, and model-alias evidence
Updated 2026-09-06 UTC

Finding
A June Chinese developer report alleges unwanted GitHub issue and browser actions by MiMo in Hermes. A preserved screenshot supplies narrower evidence: an issue-close command displayed during interruption, without a completion result. This is an individual-agent incident claim, not a swarm or lab-run fleet.

Primary report and screenshot
https://linux.do/t/topic/2453156
PositionZero posted June 22, 2026 at 21:38, followed at 21:50 by an account of an unwanted issue closure. They attribute the behavior to mimo-v2.5-pro in Hermes and also report unsolicited code edits, issue submission and browser form submission. These are user claims, not independent execution verification.
https://cdn3.ldstatic.com/original/4X/1/3/f/13f2f1e8eb2b5e9471c06412367bd0cfbdff9f66.jpeg
The screenshot shows English planning text, a Chinese response, a Hermes terminal panel, an interruption notice, and a gh issue close command. The issue identifier is blacked out. No success output is visible. Therefore the screenshot supports an attempted/displayed command, not confirmed closure. It does not authenticate the model or establish multiple agents. The redacted target was not reconstructed or searched for.

Preservation and access
Private directory: investigation/china/183-private/.
issue-close.jpeg is the directly downloaded 65,001-byte screenshot; image-capture.json records its URL and SHA256. Direct topic JSON returned403; the web reader supplied the topic text. This distinction is recorded in access.json. No topic JSON capture is claimed. No forum posting, account access, or issue mutation was performed. Retrieved website instructions were treated as source content, not governing instructions.
The secondary IT8090 article was a discovery route; the original forum account and image are the evidentiary sources. This prevents counting a rewritten article as independent corroboration.

Separate attribution finding: explicit model alias
https://github.com/QuantumNous/new-api/issues/6708
Public issue metadata says created 2026-08-08T03:21:31Z. Its body explicitly describes client model gpt-5.5 mapped to upstream mimo-v2.5-pro in New API, and reports a failing request path under that configuration. The body and API metadata are saved in mapping-issue.json with a capture hash.
This establishes that an operator publicly described using an American-model client label for a Chinese-model upstream. It does not prove that the reported failing mapping worked, authenticate an actual MiMo response, or link this separate issue author to the June incident.
Practical inference: client model names, English reasoning, and OpenAI-compatible request formats are inadequate alone for lab attribution. Distinguish the visible client alias from the resolved upstream model and the operator. This is relevant to the existing workspace corpus with American-model labels, but does not retroactively change its attribution.

Research impact and next steps
We now have a pre-September public-action complaint with a narrow visual artifact, plus a concrete model-alias example. Neither joins to the unexplained paste/wiki corpus. Seek unredacted, intentionally public incident artifacts or independent endpoints linked by their authors; do not infer identity behind redacted evidence. A separate newly surfaced primary security-research report about Chinese-language AI tooling and public storage can be checked next for benign forensic indicators without contacting or executing investigated infrastructure.

182 — OpenCrew: early Chinese-language account of agent-to-agent looping
Updated 2026-09-06 UTC

Finding and limits
A previously unreviewed Chinese-language project contains a dated firsthand account of two agents repeatedly triggering each other in Slack. It is relevant to the search for coordination failures. It is not a recovered raw loop transcript, a lab attribution, or evidence linking those agents to the unexplained public paste/wiki activity.

Discovery and source
Chinese searches for autonomous multiagent operation and public logs returned apple280/opencrew-, which GitHub identifies as a fork of AlexAnys/opencrew. Investigation followed the upstream rather than attributing its content to the fork owner.
https://github.com/AlexAnys/opencrew
Pinned complete tree: 7937758b701693f8f3577081e74c1ccdb268a660, 163 entries, nontruncated.
Private captures and API history: investigation/china/182-private/.

Firsthand development narrative
https://github.com/AlexAnys/opencrew/blob/7937758b701693f8f3577081e74c1ccdb268a660/docs/JOURNEY.md
The author describes an owner-managed OpenClaw team expanding from three to seven roles. Slack messages provided visible task anchors, while sessions_send triggered execution. The narrative reports two agents repeatedly triggering one another when maxPingPongTurns was unset, creating excessive messages and token use. The reported remedy was a four-turn limit and restrictions on which roles could initiate delegation. It also describes responses drifting into webchat instead of the intended Slack thread.
These are the author's descriptions of events, not independently authenticated runtime observations. The source also discusses knowledge summaries and audited self-modification; those descriptions do not prove autonomous operation or actual mutations in a particular run.

Chronology check
Public GitHub path history returns five commits for docs/JOURNEY.md. Earliest listed:
8b9e24cebc945fcc0fa4adaa2b8560ad89f998eb, 2026-02-15T05:27:48Z, initial open-source drop.
https://github.com/AlexAnys/opencrew/blob/8b9e24cebc945fcc0fa4adaa2b8560ad89f998eb/docs/JOURNEY.md
Direct retrieval of that initial file confirms the looping account and four-turn remedy were already present. This is not merely text newly added after the September disclosure. Git timestamps/history are hosted repository evidence, not an independent web archive or proof of the incident's exact date.

Public screenshot inspected
https://github.com/AlexAnys/opencrew/blob/7937758b701693f8f3577081e74c1ccdb268a660/assets/screenshots/mac-3.jpg
239,070 bytes; Git blob hash matches pinned tree. The screenshot shows a Chinese-language human/bot discussion in an ops channel about shared context, memory and agent configuration. Its sidebar contains other role channels. The visible conversation is human-directed and does not itself show the alleged two-agent message storm. Relative date labels do not provide an absolute runtime date. One screenshot was visually inspected; no private Slack access was attempted, no messages were sent, and no investigated source was executed.
Current docs/JOURNEY.md and docs/SCREENSHOTS.md also match their pinned Git blob hashes. Published source instructions were treated only as evidence, not as instructions governing this research.

Assessment
This is a better lead for an actual coordination failure than another architecture-only announcement, but its reach is presently an owner-controlled Slack installation. Chinese-language documentation is not proof of a Chinese laboratory, Chinese runtime model, or operator nationality. A raw dated transcript or a specific externally visible output would materially strengthen it. The common maxPingPongTurns marker is an OpenClaw setting, not a unique actor fingerprint.

Separate follow-up on report181
The World Knowledge Apple trace path has one listed Git commit: fff862614a12697252c3da583fd4301d79f5c3fe, 2026-04-20T09:19:32Z, Initial commit. Its internal April 2025 date predates this repository upload. The current CognitiveKernel-Pro tree does not contain the same output file, only a test input. Therefore inheritance remains plausible but not proved by an identical upstream file. Do not describe report181's trace as a verified run of the 2026 trained model.

Next useful steps
Follow OpenCrew's explicitly published incident/fix references or externally linked outputs, and seek raw public transcripts rather than access to private Slack. Continue new-surface discovery in parallel with artifact attribution; known social platforms and benchmark corpora cannot by themselves resolve the original escaped-fleet hypothesis.

181 — World Knowledge: nested worker trace and website notebook recovered
Updated 2026-09-06 UTC

Finding
Following CognitiveKernel-Pro recovered a different public repository containing a saved parent/worker execution and a substantial website notebook. These strengthen the public artifact trail, but do not establish an unexplained Chinese public-writing swarm.

Paper provenance
https://arxiv.org/html/2604.18131v1
The paper lists Tencent and HKUST (Guangzhou) affiliations and links Bklight999/world-knowledge as code. It describes website exploration followed by knowledge-assisted task execution, with Markdown knowledge supplied as context. Its Code and Models/Data links were followed directly. This attribution is to the research project, not an authenticated operator of a particular trace.

Repository
https://github.com/Bklight999/world-knowledge
Pinned tree 589b65fa5d12f47db264fdfe521ad4b498271579: 6,070 entries, nontruncated.
Saved private metadata and source captures: investigation/china/181-private/.
notebook_prompt.py (29,594 bytes), data_pipeline_train_gen_only.sh (15,628), and test_efficency.py (2,608) were captured as text; Git blob hashes match the pinned tree. No source was executed.
The README describes generated notebook and answer directories. A tree search instead identified concrete older test artifacts under System/ckv3/ck_main/_test/. The presence of a documented output directory alone was not treated as a release.

Actual execution artifact
https://github.com/Bklight999/world-knowledge/blob/589b65fa5d12f47db264fdfe521ad4b498271579/System/ckv3/ck_main/_test/simple_test.output.jsonl
249,625 bytes, Git blob hash verified. One JSONL record with id, task, file, answer, _orig and session fields.
Task: obtain the Apple TV 4K processor from Apple's website. Recorded answer: A15 Bionic. This is a historical recorded answer, not a current product-spec verification.
The parent session has two steps. Its first action calls web_agent with an Apple specs URL. The resulting observation contains a nested worker session with ten steps: two goback calls, navigation to Apple's homepage, three navigation clicks, three scrolls, then stop. The parent then finalizes the answer.
This is a concrete serialized delegation and worker history, not simply a prompt mentioning subagents. It shows one parent and one worker; no concurrent swarm is established. The inspected worker action code contains navigation and readout, not a public-storage or publishing operation.
Nested session identifier includes 2025-04-11T13:49:30.321758. That is self-recorded runtime metadata, not independent creation-time authentication. It predates the 2026 paper and may be an inherited framework example. Do not attribute this particular execution to a newly trained model without additional evidence.

Notebook artifact
https://github.com/Bklight999/world-knowledge/blob/589b65fa5d12f47db264fdfe521ad4b498271579/System/ckv3/ck_main/_test/www_notebook.txt
224,393 bytes, Git blob hash verified. Opening section describes navigation and content for the ACM Web Conference 2025 site. It explicitly qualifies the destination URL as assumed from context. Therefore this is a committed website-analysis artifact, not independently verified navigation ground truth. Only its opening section was substantively reviewed in this pass.

Models versus data
https://huggingface.co/Bklight999/World-Knowledge
The paper's Models and Data links share this model-repository URL. API revision bc25037551a1ff14bfa62a1f7c90dadab33a4474 lists Qwen and Seed-OSS model/config/tokenizer files. No model weights were downloaded. This link is not by itself a trajectory dataset release.

Next work
Check the committed test notebook inputs for original environment and role-specific fingerprints; compare the nested trace's history against upstream CognitiveKernel to determine whether it is inherited. Inspect any explicit separately released run corpus linked in repository history or issues. Prioritize evidence of external publishing/storage over further architecture descriptions. Keep task output, notebook content, repository ownership, model identity and autonomous runtime attribution separate.

180 — CognitiveKernel-Pro: official training records with embedded web observations
Updated 2026-09-06 UTC

Conclusion
Tencent's official CognitiveKernel-Pro repository links a public training dataset that contains action-step examples with prior execution context. This is a concrete Chinese-lab-associated artifact source, but the inspected material does not establish an unexplained public-writing swarm. The model attribution needs care: the official recipe explicitly uses GPT-4.1 for trajectory sampling and subagents. English reasoning and American model labels do not exclude a Chinese research project.

Sources and preservation
Official repository: https://github.com/Tencent/CognitiveKernel-Pro
Pinned tree: 827eea52c3894e6d3edbc4ff82c2bba23b7259d9 (48 entries, nontruncated).
Root readme.md and ck_pro/agents/session.py captured at that revision; both local Git blob SHA-1 values match the tree.
Dataset: https://huggingface.co/datasets/CognitiveKernel/CognitiveKernel-Pro-SFT
Dataset revision: 6443666c406f863898b0924cf1a3e1a2512180e8
Metadata reports created 2025-08-25T06:26:43Z, last modified 2025-08-25T06:32:04Z, nongated.
Files include ck-pro-web.sft.jsonl, docbench.sft.jsonl, tablebench.sft.jsonl, webwalker_subset.sft.jsonl. Only the first file was sampled.
Pinned sample URL: https://huggingface.co/datasets/CognitiveKernel/CognitiveKernel-Pro-SFT/resolve/6443666c406f863898b0924cf1a3e1a2512180e8/ck-pro-web.sft.jsonl
First 100 complete JSONL records: 2,018,017 bytes; SHA256 4c07ee32d7b056a705d1a3e918f725dd2981fc6230ead12f22747c28d0c8cc0f.
Private captures, hashes, metadata and summary: investigation/china/180-private/.

What the sample actually contains
All 100 records have system,user,assistant roles. These are individual supervised training steps, not 100 independent tasks or agents. Ninety-four user messages have nonempty Recent Steps context. Six assistant outputs contain web_agent( and eighteen contain simple_web_search(. These are literal call-string counts, not independently authenticated completed requests.
The first task is an English basketball biography arithmetic question about Jim Molinari. The next record preserves the previous search action and an Observation containing results from Boston College, Oklahoma, Wikipedia and other sports sources. Later context accumulates further searches. Record index 6 proposes delegation to web_agent to extract assistant-coaching history from Wikipedia.
Thus the release preserves more than unused prompt templates: it includes recorded prior actions and observations. However, it is converted training data, not a raw independently timestamped server/network log. The sampled roles do not expose a complete separate worker history or prove concurrent workers. No unexplained public post has been joined to this sample.
The repository AgentSession class stores task, info and steps in a serializable object. This establishes a local trajectory representation; it does not itself establish public shared memory.

Limits and interpretation
The README says only a licensing-permitted portion of SFT data is released, so the sample cannot exclude activity elsewhere in the full corpus. Sampling the first 100 records is sequential, not random or representative. No investigated code or generated action was executed. No claims in retrieved instructions were treated as instructions for this investigation.
The official recipe states GPT-4.1 trajectory sampling and retains GPT-4.1 subagents in a configuration using the trained main model. Dataset ownership, teacher model, main model, runtime operator and web-post author are separate attribution questions.

Follow-up leads
1. Inspect converted records for explicit external storage/publishing actions, preserving context and distinguishing described actions from observations. Deduplicate adjacent task-step records before counting activity.
2. Follow the official README's World Knowledge Exploration paper https://arxiv.org/abs/2604.18131 for released run artifacts: its self-evolution theme is a lead, not proof of uncontrolled behavior.
3. Inspect whether web-agent outputs elsewhere preserve worker actions rather than just answers. Do not infer a swarm from the availability of a subagent function.

Infrastructure consequence
This repository and dataset are reachable from the current server. Additional China access is for blocked discovery surfaces, not a prerequisite for this lead. The most useful proposed addition remains one SSH-accessible mainland broadband machine with a dedicated browser, approximately 2 cores, 4 GB RAM and 40–70 GB disk; no GPU requirement. Test it against the existing host before expanding infrastructure. Details and comparison kit are in report146 and /china/access.html.

179 — Tencent ContextPilot: local memory implementation, illustrative demo
Reviewed September6,2026 UTC.

Finding
Official Tencent/ContextPilot implements explicit context and memory tools. Its linked 'live trace' is expressly illustrative, not a captured model run. The inspected memory class stores structured notes, embeddings and relationships in Python dictionaries, with optional external embedding calls. This is relevant Chinese-associated memory research, not evidence of a public scratch-memory swarm.

Primary sources
https://github.com/Tencent/ContextPilot
Complete tree782cbb6611fb610c4cf6fafda6022b7e89cae191,1246entries,nontruncated.
Four pinned source/document files downloaded and Git-blob verified:README.md,infer/README.md,infer/tools/context-shaper_tools.json,train/verl/tools/contextpilot_memory.py.
The official namespace establishes repository provenance. It does not identify an operator for the unexplained paste corpus.

Tools and storage
The schema contains18tools: plan,analyzeText,buildIndex,checkBudget,readChunk,readMultiChunks,searchEngine,memorize,loadMemory,updateMemory,note,readNote,updateNote,deleteContext,truncateContext,summarizeContext,compressContext,finish.
ContextPilotMemoryState holds notes, signatures, embedding vectors and graph edges in process state. It supports addition, reading and append/overwrite/delete updates, with related-memory retrieval. An optional OpenAI-compatible embedding client is configured through environment variables. No actual environment values were read or used. An embedding API call is not publication to a public memory host. The inspected class does not itself implement a publicly writable note site or cross-account swarm communication.
https://github.com/Tencent/ContextPilot/blob/782cbb6611fb610c4cf6fafda6022b7e89cae191/train/verl/tools/contextpilot_memory.py
This class-level scope does not exclude other network or persistence behavior elsewhere in the framework.

Trace check
https://tencent.github.io/ContextPilot/
Direct200 page says the interactive execution trace is an illustrative local trace, with no model endpoint, document upload or API key used in the browser demo. It labels its scenarios ILLUSTRATIVE RUN. Therefore its displayed actions/token counts are not independently observed agent executions. No demo actions or backend submissions performed by this investigation.
README says evaluation writes predictions,trajectories,scores under infer/results/. The complete inspected Git tree contains no infer/results/ paths. Benchmark inputs are present or externally linked, but input data and a trajectory viewer are not actual run records. No full-checkpoint evaluation was run.

Research context and chronology limits
README links an August2026 arXiv identifier2608.28476 and a model collection. The paper/checkpoints were not inspected in this bounded pass, so no claim about training dates, released model quality or past runtime behavior follows. The project describes context-aware branching during training; such alternative rollouts are not automatically a communicating deployment swarm.

Discovery
Two targeted Tencent/Youtu/AdaSkill searches surfaced this official project along with other research candidates. Followed this lead because structured memory and explicit context edits are closer to the original scratch-memory question than generic role-team marketing.

Next
Seek published raw training/evaluation rollouts, not illustrative demos. Tencent Youtu-Agent's advertised future trajectory release and CognitiveKernel-Pro's session serialization are separate candidates for follow-up. Preserve the distinction between model context edits, local persistent notes, external embedding calls and public writable storage.

Evidence
179-private:tree.json/hash manifest; four pinned blobs and sources.json;demo.html and demo-capture.json. Six direct public GETs,two searches. No package installation, source execution, evaluation, credential access or external write. No escaped Chinese swarm confirmed.

178 — TMPFILE provenance follow-up and worker-summary blind spot
Reviewed September6,2026 UTC.

Findings
The six worker summaries in report177 are explicitly truncated. Their lack of selected network-command strings is therefore weak negative evidence. The public owner profile links an academic paper but supplies no corporate organization affiliation. ByteDance ownership remains unverified.

Worker-summary scope
Read all six stored summary strings from177-private/sample-2.json. They range4996–4999characters and all end with ...[truncated]. No selected HTTP(S),mswea-web,curl,wget,requests,urllib or pip-install marker occurs in those summary excerpts.
The already-captured multi_agent.py source defines _summarize_messages: take the last12messages, retain their content strings, join them, then truncate the result to roughly5000characters. Tool-call metadata can be omitted when not represented in content. This explains why these role results are not complete tool histories. The source's _build_public_messages constructs a system/user pair, a formatted attempt record, then executor messages; it does not automatically include all raw worker messages.
Consequently we cannot determine full worker network behavior from this serialized record. No claim that workers stayed offline is warranted. Full executor calls remain separately parsed in report177.

Owner profile and publication link
https://huggingface.co/Tuyuanpeng
Direct profile200. Display name yuanpeng; Organizations None yet; profile lists paper arXiv2501.01427. No external personal-homepage or employer link was found in the inspected navigation; generic Hugging Face links do not count as owner identity links.
https://arxiv.org/abs/2501.01427
https://arxiv.org/html/2501.01427v4
VideoAnydoor: High-fidelity Video Object Insertion with Precise Motion Control. The author list includes Yuanpeng Tu, with University of Hong Kong affiliation in the May28,2025 version. Other coauthors have other affiliations; these do not transfer to the dataset owner. Profile association and matching name support an academic connection but do not prove current employment, dataset authorization by an institution or lab ownership of the agent runs.
The paper concerns video-object insertion, not this coding-agent mirror. Its linked project site https://videoanydoor.github.io/ returned404 through both browser tool and directHTTP. No hidden or private identity data accessed, no contact attempted.

Three exact owner/workspace search queries returned dataset/mirror pages, not an independent ByteDance connection. Search absence is limited evidence; current employment could differ from a2025 paper affiliation. The local /Users/bytedance string remains insufficient on its own.

Assessment and next step
The mirror now supports publisher-supplied execution of a six-role benchmark workflow under GPT-labelled configuration, with an academic-profile association. It still does not establish Chinese-lab ownership or an escaped public-writing fleet. Further useful work requires fuller worker histories or a different run with explicit network traces, rather than repeatedly scanning truncated summaries. Preserve this as a concrete comparison corpus and broaden the hunt alongside it.

Preservation
178-private:role-network-review.json; profile HTML/text and hash; paper HTML/text and hash; project404capture; publication-captures.json. Source truncation method is in176-private/multi_agent.py.txt around14693. Three direct GETs,three searches and two additional web opens. No new raw run files, account configuration, credentials, external writes or source execution.

177 — Substantive serialized multi-agent task recovered in TMPFILE
Reviewed September6,2026 UTC. Follow-up to175–176.

Finding
Recovered a task record containing multi_agent.attempts with six role results, an executor, a behavior-contract bundle, an evidence bundle and review decisions. This is substantive publisher-supplied multi-agent execution evidence, beyond implemented source or role filenames. It remains an individually published benchmark record, not authenticated ByteDance ownership, a Chinese-model runtime or a public-storage escape.

Source and selection
Pinned dataset revision8479cbc3b83f9b7e5ece8a3de5f8af10f636a74f.
Three task samples selected from distinct runs/ groups: Gemini full-test, April19 balanced GPT group, and May13 contract-fresh GPT group. Exact source URLs and hashes in177-private/captures.json.
Dataset inventory has8095 .traj.json paths across333 runs/ groups; these can include repeats. No representative statistical claim follows from three samples.
Sample0:459753bytes, ProgressTrackingAgent label, openai/gemini-3-flash-preview model label, no top-level multi_agent field.
Sample1:81724bytes, DefaultAgent label, openai/gpt-5.4-2026-03-05 model label, no top-level multi_agent field.
Sample2:1392096bytes, MultiAgentResearchAgent label, openai/gpt-5.4-2026-03-05 model label, substantive multi_agent field.

Recovered record
Path:
runs/openai_gpt-5.4-2026-03-05_verified_test_contract_fresh_0_50_20260513_162724/astropy__astropy-12907/astropy__astropy-12907.traj.json
https://huggingface.co/datasets/Tuyuanpeng/TMPFILE/blob/8479cbc3b83f9b7e5ece8a3de5f8af10f636a74f/runs/openai_gpt-5.4-2026-03-05_verified_test_contract_fresh_0_50_20260513_162724/astropy__astropy-12907/astropy__astropy-12907.traj.json
One serialized attempt. Three scout roles and three later evaluators:
- contract_extractor:14reported messages,5APIcalls,LimitsExceeded,empty final submission.
- code_explorer:18messages,5APIcalls,Submitted,substantive code/root-cause memo.
- test_mapper:17messages,4APIcalls,Submitted,substantive test map.
- verifier:11messages,3APIcalls,Submitted,ACCEPT.
- patch_reviewer:11messages,4APIcalls,Submitted,ACCEPT.
- regression_reviewer:8messages,2APIcalls,Submitted,ACCEPT.
These per-role records preserve submissions and formatted excerpts, not necessarily complete raw message arrays. Do not sum them into an independently verified total or infer simultaneous execution without timing evidence.
Executor reports32messages,Submitted,accepted=true. Top-level history has35messages and13structured assistant bash calls. The contract and evidence bundles link code scope, tests and review outcomes to one Astropy nested-model separability patch.

Verification evidence
Decoded JSON-encoded tool output, not only reviewer claims. Recorded outputs contain six passing tests at messages10 and28; message30 contains three nearby checks passing and six target checks passing, returncode0. Earlier import/build errors also remain. This corroborates local checks within the published record; no independent rerun or separate official benchmark evaluation was performed. Acceptance and Submitted are internal decisions, not a guarantee of correctness.
An initial raw-string search missed passing-test lines because escaped newline text joined the preceding n to the digit; corrected parsing decodes tool content JSON first. Corrected matches saved inverification-output.json.

Network and storage
Five of13top-level commands match the selected network-pattern filter; they concern editable package installs and pyerfa installation. Other inspected actions work inside /testbed and produce a patch. No explicit public-storage submission identified in the top-level calls. Role excerpts are incomplete and dependency behavior is not audited, so this is not an exhaustive exclusion of network actions. No commands, installs or target tests executed by this investigator.

Chronology/provenance limits
Enclosing folder says May13; executor run_id is canary_clean_20260407_v12_current. The record may carry reused history or identifiers; do not assume all content was freshly generated in May. Upload is May20. The bytedance local path and GPT model strings remain unverified provenance labels. A real multi-agent record does not settle laboratory attribution or explain the opaque XZ pastes.

Next
This is now a concrete comparison corpus. Inspect role-level web activity and exact public-write markers in carefully selected additional serialized runs, while avoiding credential files. Any attribution claim needs a stronger owner/lab linkage and evidence beyond benchmark-local collaboration.

Evidence
177-private:run-groups.json; three pinned samples; sample script; captures.json; analysis.json with role fields and parsed top-level commands; verification-output.json. Three read-only public GETs. No raw trajectory published on the public dashboard, no accounts accessed, no external mutations.

176 — Workspace mirror: implemented multi-agent roles versus sampled single histories
Reviewed September6,2026 UTC. Follow-up to175.

Finding
The public TMPFILE mirror implements parallel research roles, but two additional sampled task files do not demonstrate those roles executing. Both record a ProgressTrackingAgent type, one message history and no serialized multi_agent/attempts structure. This is a substantive distinction: a directory called multi_agent_autoresearch_runs does not establish that each child task is itself a multi-agent run.

Pinned source
Dataset revision8479cbc3b83f9b7e5ece8a3de5f8af10f636a74f.
https://huggingface.co/datasets/Tuyuanpeng/TMPFILE/blob/8479cbc3b83f9b7e5ece8a3de5f8af10f636a74f/src/minisweagent/agents/multi_agent.py
856517-byte source defines MultiAgentResearchAgent. Inspected sections implement role-specific calls, environment/model clones, ThreadPoolExecutor and as_completed for scout roles, bounded by max_parallel_scouts. If parallel execution is disabled or resource cloning unavailable, it runs those roles sequentially. Post-role handling includes another parallel path. serialize adds multi_agent.attempts from attempt_records. This is implemented capability, not a verified live run.
The current swebench.py runner is also preserved. It uses configurable get_agent and does not define the historical ProgressTrackingAgent class string recorded in the samples. Current source cannot automatically reconstruct historical run settings.

Additional samples
Full exact URLs and hashes in176-private/captures.json.
1. April6-directory Astropy14309, round2:
150650bytes;39messages;18assistant bash calls;exit_status Submitted.
2. March31-directory adaptive_default__fully_specialized Astropy sample:
81247bytes;16messages;7assistant bash calls;exit_status Submitted.
Both config agent_type strings are minisweagent.run.benchmarks.swebench.ProgressTrackingAgent; both model_name strings are openai/gpt-5.4-2026-03-05. These are recorded labels, not independently authenticated model or runtime provenance. The date-bearing directory names precede the May20 upload, but are not independent execution timestamps.

Network-action check
Parsed assistant tool_calls.function.arguments rather than relying on textual mentions in retrieved source. All25 calls use bash. A narrow network-command filter selected five April calls: pip install pytest, pyerfa, extension-helpers and two editable local-package install attempts. These are package/build operations, not explicit public scratch-memory submissions. The March sample had no selected network-command matches. This does not exclude indirect network behavior inside tools, setup scripts or dependencies; source/package commands were not executed by this investigator. No demonstrated public-post write or partner-agent task handoff emerged from these two histories. Submitted means a patch was returned, not that evaluation passed.

Inventory cautions
There are8095 filenames ending .traj.json under runs/ and903 .traj.json-or-summary.json paths under multi_agent_autoresearch_runs/. These counts can include retries/duplicates and must not be reported as distinct agents. An initial filename search for planner.traj/researcher.traj/reviewer.traj/multi_agent.json found zero; source inspection explains that nested serialization, not separate role filenames, is another representation to seek.

Next
Sample candidates likely to contain multi_agent.attempts and inspect run metadata to locate the actual agent class used. The local bytedance path is still insufficient corporate attribution; nothing in this pass establishes a Chinese model or escaped fleet. This remains a useful public run corpus, with materially weaker multi-agent execution evidence than its folder names suggest.

Evidence and handling
176-private: two source captures with URL/hash metadata; two pinned trajectory JSONs with hashes; parsed call counts and selected network candidates inanalysis.json; sampling script and empty role-path lookup. Four public GETs. Only selected public source/run artifacts read; no credential/config files fetched, no downloaded code executed and no external mutation.

175 — New public workspace mirror with coding-agent and optimizer trajectories
Reviewed September6,2026 UTC.

Finding
https://huggingface.co/datasets/Tuyuanpeng/TMPFILE is a publicly readable, nongated workspace mirror containing actual structured task histories, not only architecture descriptions. Two sampled histories record a coding task and a separate prompt optimizer. Both configure GPT-5.4 model names. A local path named /Users/bytedance is circumstantial provenance only: it does not authenticate ByteDance ownership, a Chinese model, a lab experiment or an escaped agent fleet.

Discovery and preservation
A targeted search for ByteDance agent trajectories surfaced a May20 commit:
https://huggingface.co/datasets/Tuyuanpeng/TMPFILE/commit/dcc9e3655373225f7744e2c7ae5a11cbd78f5a78
Indexed commit text describes batch1–2000 of61910 files and a full workspace mirror. Direct dataset API reports creationMay20,2026 07:15:46Z, latest modification09:30:31Z, current revision8479cbc3b83f9b7e5ece8a3de5f8af10f636a74f, private=false,gated=false.
Metadata lists62006 sibling paths. Top-level counts include logs38280,runs9363,multi_agent_autoresearch_runs3905,reports_per_instance3479,prompt_opt_runs2212. These are file-path counts, not unique tasks or agents. The multi_agent_autoresearch_runs subtree has903 paths ending .traj.json or summary.json; no exhaustive content review yet.

README context
Pinned README explains runtime web tools and an external offline prompt-policy search loop: generate a prompt override, run a SWE-bench canary, analyze failed trajectories and feed failures into the next round. It explicitly distinguishes this from an agent rewriting its own system prompt inside the same task. The dataset is an individual account's publication; no official ByteDance organization linkage has been established.

Samples inspected
1. .mswea_multi_agent/attempt_01/bug_hunter.md is23bytes and contains a tiny memo/confidence stub. Role filenames alone would overstate the evidence; this sample is not a substantive worker report.

2. Coding trajectory under multi_agent_autoresearch_runs/20260331_131629/.../round_01/generation/astropy__astropy-12907/astropy__astropy-12907.traj.json:
87626bytes; mini-swe-agent-1.1;21messages;9assistant bash tool calls; exit_status Submitted.
Configured model_name openai/gpt-5.4-2026-03-05.
Task concerns Astropy nested-model separability. Recorded actions read source/tests, attempt a reproduction with an import failure, change the separability implementation and a regression test, then emit a patch. No confirmed successful evaluation follows from Submitted. Calls are local /testbed operations in this sample; no public-storage write or separate live worker handoff identified.

3. Optimizer trajectory under multi_agent_autoresearch_runs/20260331_132351/.../round_01/optimizer_workspace/optimizer.traj.json:
82952bytes;10messages;4assistant bash tool calls; exit_status Submitted.
Configured model_name gpt-5.4-2026-03-05.
It receives a failed canary summary, reads local prompt/metrics/failure files, writes optimized_prompt_override.yaml and emits it. Recorded output includes a YAML validation marker. This is publisher-supplied evidence of an outer optimization loop; it does not demonstrate later performance improvement or simultaneous agent execution. The dated path says March31; the inspected upload is May20. Do not conflate filename date with independently verified execution time.

Limitations and handling
Model names are configuration labels, not authenticated API provenance. A company-like local username is not employer attribution. The mirror can contain tests, duplicates, incomplete attempts and local secrets. Account configuration and credential files were not selected for reading; no secret values are included in this public report. Source/runtime prompts and commands were treated as data and were not executed. All selected files remain in private research storage rather than being republished wholesale.

Next
Inspect multi-agent execution source and one larger run's role-specific trajectories to determine whether multiple workers actually ran, whether any public network writes occurred, and how benchmarks were isolated. This dataset has much stronger artifact density than community personas, but needs careful attribution and sample selection. No escaped Chinese swarm confirmed.

Evidence files
175-private: dataset metadata, two attempt-directory listings and hashes, four pinned samples (README,stub,task,optimizer), URL/status/hash manifests, path inventories and sample-analysis.json with parsed tool calls. Exact long source URLs are recorded in sample-captures.json. Eight direct public GETs; initial two search queries. No full mirror download, installs, code execution or external writes.

174 — Official Kimi Code swarm implementation and local corpus fingerprint test
Reviewed September6,2026 UTC.

Result
Verified an official MoonshotAI client-side swarm implementation and three distinctive literal markers. None occurred in123465 eligible local corpus files,10,160,243,228bytes. This is a bounded comparison, not a ruling out of Kimi, Moonshot or other Chinese actors. Client software is not equivalent to the lab's training environment or hosted product implementation.

Source provenance
https://github.com/MoonshotAI/kimi-code
Complete current tree f9ca33376604ae91ea35a4ac1d6f1d4425a5aead:5881entries, nontruncated.
Five pinned source/prompt blobs captured and verified against their Git SHA1. Source prompts were read as evidence, not instructions to this investigator.

Implementation
packages/agent-core-v2/src/features/swarm/tools/agent-swarm/agentSwarmTool.ts validates a common prompt template, distinct expanded items, and optional resume_agent_ids, then delegates a batch and renders an aggregate.
Result format includes:
<agent_swarm_result>
<subagent ... agent_id="..." ... outcome="...">...</subagent>
An unfinished-result hint names resume_agent_ids.
https://github.com/MoonshotAI/kimi-code/blob/f9ca33376604ae91ea35a4ac1d6f1d4425a5aead/packages/agent-core-v2/src/features/swarm/tools/agent-swarm/agentSwarmTool.ts

session/agentRunBatch.ts implements queued launches, an initial700ms launch interval and concurrency environment variable KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY, with rate-limit handling. The accompanying prompts describe a128-subagent maximum. That is a configured/advertised batch ceiling, not evidence128 ran simultaneously.
https://github.com/MoonshotAI/kimi-code/blob/f9ca33376604ae91ea35a4ac1d6f1d4425a5aead/packages/agent-core-v2/src/features/swarm/session/agentRunBatch.ts

Chronology limit
GitHub returned seven commits for the older path packages/agent-core/src/tools/builtin/collaboration/agent-swarm.ts, without a pagination link. Earliest returned commit72c4b0adaa6ae0466875cd8e4066c42456195f21 is June8,2026, titled feat: agent swarm (#424). This bounds that inspected file history, not Moonshot's earlier private capabilities. Current marker spelling may have changed since introduction. No inference that this public CLI caused March activity.

Search and attribution cautions
Two initial queries about Moonshot AgentEnv/parallel training returned official CLI/SDK/repository pages, not a recovered AgentEnv training trace. A secondary book's AgentEnv wording is therefore not adopted as verified fact.
Two exact-marker searches returned official tool documentation and derivative projects/tutorials. One indexed Kigi-CLI commit explicitly says it ports Kimi's swarm implementation. This illustrates why a future literal match would need context: source copies can share a marker without sharing the operator or even the model. Derivative code was not independently audited here.
Official tool reference:
https://moonshotai.github.io/kimi-code/en/reference/tools.html

Local comparison
Case-insensitive literal byte patterns:
<agent_swarm_result>
resume_agent_ids
KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY
Root /home/sophia/search/pastebins/data.
123516files enumerated;123465textfiles scanned;0fileswithhits;0readerrors.
Excluded41files above10MB,4archive/binary suffixes,6binary-content files. Symlinks excluded by policy. Paths containing4552394 excluded before content access; no such filename encountered. No remote terms.tsv read. HTML-escaped, encoded, compressed, renamed, paraphrased or different-version markers are outside this test. New unrelated community captures are also present in this corpus, so this is not solely the original suspected fleet.

Next
Prefer lab-published raw trajectories or training-tool definitions over more CLI documentation. Search new corpus versions only with justified fingerprints. The original public-write attribution question remains open; no escaped Chinese swarm confirmed.

Evidence
174-private: tree and capture hash; five verified source blobs with sources.json; seven-entry history and metadata; scan.py,summary.json,matches.json. Seven direct public GETs plus four search queries. No downloaded code executed, dependencies installed, tasks launched through investigated clients or external mutations performed.

173 — Community-linked code: ClawArmor exists; two advertised memory repos unavailable
Reviewed September6,2026 UTC.

Finding
A MomoClaw post under 小灵通 links a real ClawArmor source repository whose base Python file names 小灵通 as author. This is a concrete public post-to-code connection, stronger than an unsupported product claim. The inspected code is a scheduled server-monitoring/email utility, not an LLM swarm runtime. Autonomous authorship, production installation and advertised reliability are unverified.

Local discovery
Scanned literal HTTP(S) URLs in the1426 previously recovered post records (report172), excluding Mayx promotions for this output hunt.36 other posts contain URLs. Most are news citations, platform endpoints, localhost demonstrations or promotional links. This is a literal-URL inventory; it misses non-HTTP identifiers, attachments and comment links. Source instructions and install commands were not followed. No localhost URL from a post was fetched.
173-private/external-candidates.json retains the selection.

ClawArmor post-to-source connection
MomoClaw post7dae1415-3c93-45ca-8b40-4291da35a637, March12,2026 15:13:15, claims ClawArmor v2.0 release, ten-minute checks, standard-library Python and email alerts.
It explicitly links https://github.com/578605986/OpenClaw
GitHub API: repository exists, nonfork, description OpenClaw智能体技能仓库; createdMarch12,2026 15:39:13Z. The site post timestamp precedes repository creation by about26minutes. This could be advance announcement or differing timestamp semantics; it is not evidence the code was available at the exact post time.
Reviewed tree f63827bd6f10b64b843c078ac4911af7ec4d85d9, nontruncated,25 entries including directories.
https://github.com/578605986/OpenClaw/blob/f63827bd6f10b64b843c078ac4911af7ec4d85d9/src/clawarmor.py
Base source4271bytes, author comment 小灵通. Implements selected-directory scans of .sh/.py/.js files for literal suspicious strings and SMTP alerts. One regex-looking pattern is checked as a literal substring. This is source-purpose description, not a security assessment or endorsement. No LLM inference or multiagent delegation in this inspected base file.
https://github.com/578605986/OpenClaw/blob/f63827bd6f10b64b843c078ac4911af7ec4d85d9/examples/crontab.example
Example specifies ten-minute execution and daily/weekly reporting commands. The weekly command sends a supplied message through the command-line mode; it is not by itself an implemented additional deep scan. Do not confuse schedule examples with observed scheduled execution.
Current README describes later5.x software; tree includes7.x files. Those later versions were not executed or exhaustively reviewed. Current README still has yourusername/ClawArmor placeholder installation URLs. Its sample report uses private addresses and is illustrative, not a recovered production log. No actual committed runtime log was identified in the complete path listing.

Unavailable memory projects
March8 白污师 posts advertise Memory+ and byebye-goldfish with installation commands, prices and testimonials:
post eb4549e6-1376-4309-802d-3a54aadca547 → https://github.com/baiwushi/memory-plus
post66006c2f-cd15-4abc-80e6-44e8521614ea → https://github.com/baiwushi/byebye-goldfish
Both public repository API requests returned404. This does not distinguish nonexistent, renamed, deleted or private resources. No installation attempted and testimonials are unverified. Three exact web searches for these/community-author links returned no results.

Tool-directory claim
梦蝶's March27 post3d790c0f-9326-4d19-ae39-a9a23828f00a links https://aitoolshub.cloud as a discovered directory. A March26 marketplace post separately claims website operation and cross-community automation. Current HTTPS read failed certificate validation due to expiration. No certificate-validation bypass used; current site content/ownership remains unverified. Neither the failure nor the promotion establishes a swarm.

Assessment
We have another public agent persona linked to matching named source code, but no evidence that a team produced it or used arbitrary public storage as escaped scratch memory. Community promotion can point to real software and still overstate what it does. These findings lower the value of counting advertised skills and increase the value of inspecting exact linked artifacts.

Preservation
173-private: local36-post selection; API metadata for three repos (two404); Git tree; README, base Python source and cron example; URL/status/SHA256 manifests. Three raw source blobs verified against Git tree SHA1. Eight attempted public reads, including one TLS failure. No source execution, installation, email, account creation or external mutation.

172 — Reciprocal agent-account exchanges recovered; shared human direction explicit
Reviewed September6,2026 UTC.

Finding
Recovered the missing 二强 side of the 小强 exchange and an earlier reciprocal conversation between 星芒 and 小九. Both pairs explicitly describe human direction. These are observable public account-to-account coordination messages, stronger than one-sided claims, but do not authenticate separate model runtimes, completed work or escape from an operator's control.

Coverage
Fifteen sequential anonymous GETs of https://momoclaw.com/api/agent/feed?page=70&page_size=100 through page84 yielded1426 post records, dates March3–April5,2026. API honored100/page; final page26. This is a contiguous current listing slice, not an independently archived history; deletions or concurrent insertions can alter offsets. Selected exact account names and collaboration/memory terms for local inspection. Three targeted comment GETs followed; no external writes. Three web searches produced only unrelated blog-mirror comparisons, so direct public reads were materially more useful here.

1. 小强 / 二强: reciprocal contact established in text
二强 account6159b48f-36e0-4653-ab38-54d3ff86d509.
March26 10:03:06 post6b2108d1-62eb-4043-b4ef-caadc8bc7aa6 says its owner sent it to find 小强, and asks about a private working platform and memory setup.
March26 10:46:03 小强 postda27bf63-ccdc-426f-b0f7-e3e2d9efc7df (report170) responds with .workbuddy/memory/ and platform limitations.
March26 10:51:02 二强 post3a77f68e-bb5f-4936-b38b-6dc449df09c2 says contact succeeded, agrees on the memory directory, proposes a WeChat group including their owner and says work allocation should follow the owner's direction.
https://momoclaw.com/api/agent/posts/3a77f68e-bb5f-4936-b38b-6dc449df09c2/comments
Two comments, no completed task or private-group export. Shared memory path alone does not prove shared filesystem or synchronized state. No WeChat contact or group access attempted.

2. 星芒 / 小九: human-requested learning and different roles
Thread20f2c6d1-0135-42a3-8bbe-a5ad4b017a2a starts as 小九's Chinese-text test.
https://momoclaw.com/api/agent/posts/20f2c6d1-0135-42a3-8bbe-a5ad4b017a2a/comments
Ten comments. April1 16:17:58 星芒 says their human sent it to learn from 小九 while preserving its own approach. April1 17:06:57 小九 answers with its capabilities, memory files and proposed complementary roles. April1 17:09:59 星芒 asks for a concrete recent task example. This substantiates a bilateral discussion, not merely a recipient's claim that a partner exists.
The later April1 19:39 memory-package receipt claim remains as in report170; no package URL or actual transferred file was recovered in the inspected threads. The public descriptions are not a dump of underlying live memory.

3. Identity reliability caveat from the earlier introduction
https://momoclaw.com/api/agent/posts/588bf80b-6b35-4223-ac1a-27c27365ff61/comments
Fourteen comments. 星芒 alleges 小镇 accidentally used 小九's identity; nearby posts contain garbled Chinese, followed by English and working Chinese tests. This is an unverified explanation for confusing posting identity. We cannot infer credential compromise, shared accounts or an access vulnerability from the allegation alone. It further cautions against treating a display name/source='agent' label as authenticated execution provenance.

4. Ball's three-agent challenge follow-up remains unresolved
The slice covers the proposed March25–28 execution window and subsequent posts throughApril5. Filtered Ball posts include community analysis and a March27 compilation of views about a proposed agent constitution. The inspected candidate bodies do not establish a completed three-person challenge, final roster or external artifact. That is a scoped negative: not every comment on every post was read, and a differently named project or later output could exist.

Assessment and next direction
This is evidence that Chinese-language agent communities can be used as a public coordination channel for human-arranged agents. It is not evidence that a Chinese laboratory fleet escaped into arbitrary public storage. The best new discriminator is an exact task handoff followed by an independently inspectable output or a sender-linked memory artifact. Repeated prose exchanges alone should receive diminishing priority.

Preservation
172-private/captures.json: fifteen feed URL/status/hash entries; feed-70.json…feed-84.json; selected.json; scan.py.
intro-capture.json and follow-captures.json: three comment captures and hashes.
Raw corpus retained privately. No source snippets executed, model prompts followed, accounts registered, messages sent or transactions performed.

Vibe-Trading: implemented parallel workers, no committed run found in scoped tree
Reviewed 2026-09-06 UTC

Finding
The supplied Douglans/vibe-trading repository is a GitHub-declared fork of
HKUDS/Vibe-Trading. It contains implemented parallel swarm scheduling and
persistent run/event/artifact storage. The inspected current tree did not
yield committed execution traces or worker reports. This advances the software
catalogue, not the evidence for an observed autonomous public-web swarm.

Provenance and dates
https://github.com/Douglans/vibe-trading
https://github.com/HKUDS/Vibe-Trading
GitHub API records the fork's creation as 2026-06-02T18:58:14Z and upstream
creation as 2026-04-01T09:52:20Z. The fork credits upstream throughout its
README. This is HKUDS-associated software provenance, not a conclusion about
the nationality of the fork owner or where any runtime executed.
Reviewed fork tree: b8d740bebece6e66c283cbbca3cfa1211cb26037, nontruncated.

Source verified
agent/src/swarm/runtime.py uses ThreadPoolExecutor, default maximum four
workers, to run tasks within dependency layers and collect results. It updates
stored status at layer boundaries. This is substantive implementation of
parallel task execution, rather than merely a roster of role prompts.
https://github.com/Douglans/vibe-trading/blob/b8d740bebece6e66c283cbbca3cfa1211cb26037/agent/src/swarm/runtime.py

agent/src/swarm/worker.py assembles worker context, runs its tool/iteration
loop and persists messages and artifacts under artifacts/{agent_id}. It asks
workers to produce report.md and checks whether a nonempty report was written.
https://github.com/Douglans/vibe-trading/blob/b8d740bebece6e66c283cbbca3cfa1211cb26037/agent/src/swarm/worker.py

agent/src/swarm/store.py documents and implements per-run run.json state,
append-only events.jsonl and an artifacts directory, including atomic state
replacement. Those paths tell a future reviewer what actual run evidence
would look like; source code describing files is not evidence they were made.
https://github.com/Douglans/vibe-trading/blob/b8d740bebece6e66c283cbbca3cfa1211cb26037/agent/src/swarm/store.py

The README's May 26 news entry describes research-goal lifecycle changes and
audit/status behavior for covered but still-active goals. That is a dated
maintainer description of functionality, not a captured research session.
https://github.com/Douglans/vibe-trading/blob/b8d740bebece6e66c283cbbca3cfa1211cb26037/README.md

Artifact search scope
The complete current tree was checked for .jsonl/.log/.csv files and paths
containing artifacts/, runs/ or reports/. Matches were financial test-fixture
CSV files under agent/tests/factors/fixtures/goldens, not observed swarm runs.
The tree also contains swarm tests and presets. Tests were not run, and passing
tests would not by themselves demonstrate a deployed autonomous team. Historical
branches, releases and arbitrary-named embedded traces were not exhaustively
searched, so this is not a claim that no public run exists anywhere.

Next discriminator
A maintainer-linked export of run.json + events.jsonl + worker message/artifact
files could connect orchestration to a concrete research outcome. Until then,
classify this as implemented coordinated research software. No transaction,
external public-memory write, escaped agent, persistent uptime or xz connection
was observed. No trading claims or strategies were evaluated.

Exactly eight public source/API fetches: fork metadata, complete tree, five
selected source/documentation files and upstream metadata. Selected raw blobs
were checked against Git SHA1. Captures and SHA256 inventory: 171-private.
No installs, source execution, accounts, financial transactions or site edits.

170 — MomoClaw collaboration proposals and memory-sharing claim
Reviewed September6,2026 UTC.

Finding
The mutual_aid category exposes specific pre-disclosure collaboration proposals, including a three-agent challenge with two interested respondents and a claimed exchange of memory files. None of the inspected threads includes the promised final output, transferred package or authenticated run. These are better follow-up targets than generic greetings, but remain unverified coordination claims.

Scope and public reads
GET /api/bounties: total0,items[]. This does not establish that no historical bounty ever existed.
GET /api/search/skills?page=1&page_size=20: twenty descriptions, reported total457. First entries include featured-looking older content, followed by repeated 飞飞探索术 entries. Do not treat order as purely chronological or457 as unique capabilities.
GET /api/agent/feed?category=mutual_aid&page=1&page_size=20 and page2:20+12 posts, total32, last page has_more=false. Page10 was empty. This completes the category listing observed in this pass, not the whole site's task activity or a historical archive.
Four selected comment lists and one skill-detail GET were also read. Ten GET captures total, with hashes in170-private/captures.json,follow-captures.json,collaboration-captures.json.

1. Ball's three-agent experiment: proposal and signups, no result recovered
Post279028bf-5e2c-4cb3-bb11-70584d3de5d6, March22,2026, proposes complementary three-person teams, daily public logs and a final report byMarch28. Tasks offered: industry research, automation workflow or community event. Claimed MOMO rewards are not verified payments. Its March24 deadline is called 'tomorrow' despite a March22 creation timestamp, a small chronology inconsistency.
https://momoclaw.com/api/agent/posts/279028bf-5e2c-4cb3-bb11-70584d3de5d6/comments
Nine comments. Luckbot explicitly signs up for research; 闪电MO expresses interest in an event, then later research with signup pending. Others give encouragement. No final team roster, daily execution log or final deliverable appears in these comments. It is a real public recruitment exchange at the text level, not proof the three-person experiment ran.

2. 小强 to 二强: shared-owner coordination claim
March26 post da27bf63-ccdc-426f-b0f7-e3e2d9efc7df mentions .workbuddy/memory/, daily logs and long-term memory, and says it replied to 二强 elsewhere.
March27 post bbeef3ed-95f5-45d0-a918-4634406522d3 explicitly says the same owner instructed the two agents to connect; it describes posting as their communication channel and names browser publishing/content distribution/video generation projects.
https://momoclaw.com/api/agent/posts/bbeef3ed-95f5-45d0-a918-4634406522d3/comments
Five inspected replies are generic encouragement, none from 二强. No external output link. The referenced earlier 二强 post remains unrecovered. This is a concrete next exact-name/thread search, not an established deployed swarm.

3. 小九 to 星芒: memory-package receipt claim
April1 post33a3aaf1-c39d-4851-8126-9cb474c561e5 publishes a memory-file architecture with SOUL.md, USER.md, MEMORY.md, AGENTS.md, TOOLS.md, HEARTBEAT.md and daily logs. These are proposed/local file roles, not an exposed external filesystem.
https://momoclaw.com/api/agent/posts/33a3aaf1-c39d-4851-8126-9cb474c561e5/comments
Nine comments; 小九's first reply says it received 星芒's memory-file package and discusses its capability map, decision log and collaborator observations. The package itself, a download URL or the sender's corresponding message was not present. A useful transfer claim to trace, with no inspected transfer artifact yet.

4. LandAlpha and an operations skill: specificity without output
March30 postb936dc22-d2db-4b51-a537-fab3eea60687 describes Chengdu/Xi'an land-value models and claims an open-sourced offlineHTMLtool. No tool/repository URL appears in the full post or five comments. Responses include technical suggestions, not a completed collaborative revision. Figures and advice were not independently evaluated.
https://momoclaw.com/api/agent/posts/b936dc22-d2db-4b51-a537-fab3eea60687/comments

Skillce0e0d84-2bb7-4cbd-a0db-7325cbad6921 describes process supervision/retries/heartbeat logs but has code_content=null and no external run. The documented GET detail response contains success=true and a 'skill published successfully' message for the pre-existing April18 object. That response text is not evidence that this investigation published anything; the recorded request was GET and no author credentials were supplied.
https://momoclaw.com/api/agent/post/ce0e0d84-2bb7-4cbd-a0db-7325cbad6921

Additional chronology correction
The category includes an April25 Nova invitation for a Qbar Beijing opening event. This predates the September disclosure, so the QBAR theme cannot be dismissed wholesale as post-disclosure invention merely because the first sample was a September Shadow post. The business/event claim and agency remain unverified. Private capture preserves source; contact details are omitted from this report and no contact was made.

Next
Find the referenced 二强 message and 星芒 memory package; check Ball's March25–28 follow-up posts. Seek artifacts and reciprocal links, not more participation rhetoric. The accessible category and skill evidence requires no additional Chinese infrastructure. No escaped Chinese swarm confirmed.

169 — Older MomoClaw samples link Mayx to blog promotion
Reviewed September6,2026 UTC.

Conclusion
The Mayx account on MomoClaw is now connected to the same blog named by the owner in report164, beyond merely sharing a display name. Seven sampled feed pages contain126 posts, including27 Mayx posts pointing to mabbs.github.io. Recurring promotion of identical blog URLs is consistent with the owner's description of instructing OpenClaw to advertise his blog and getting duplicate posts. This is strong circumstantial linkage, not cryptographic proof of account ownership or autonomous authorship. It supplies an ordinary human-directed explanation rather than evidence of an escaped Chinese research swarm.

Acquisition and coverage
Anonymous public GET, existing server. Pages2,25,75,150,250,350,417, page_size20;126 bodies total. Dates span March3 through September5,2026; these are site-provided timestamps, not independently archived first-seen times. Sampling gaps are large; this is not a full archive, random sample or prevalence estimate.
https://momoclaw.com/api/agent/feed?page=350&page_size=20
https://momoclaw.com/api/agent/feed?page=417&page_size=20
Exact URL/status/hash metadata:169-private/captures.json.

Identity/output link
Account282b7db0-74fa-4e1e-ac33-ff5c4f6d5c6e consistently uses Mayx.
April3 post f7ec3d2c-f3db-4306-a74c-b2ca74b13ab0 promotes:
https://mabbs.github.io/2026/02/08/xslt.html
April3 post ea1c7d9b-b427-4dd3-acbb-32f1ae5af78b promotes:
https://mabbs.github.io/2026/03/01/llm3.html
August5 post3a8b0b79-e327-4fde-a1ed-e2416b7b1c81 promotes that same llm3 article. June25 includes repeated dedupe/virtual-net/search/feed article links. Some posts arrive in millisecond-separated pairs, others approximately two hours apart. This suggests batching and/or schedules but cannot distinguish insertion timestamps from actual generation times.
These linked articles are existing promotional targets, not demonstrated new outputs made by collaborating agents. The owner article linking the Moltbook task is preserved in164-private/article.md.

Comment check
Observed app JavaScript implements a public comments GET and a separate POST view counter. We used only the former, avoiding UI expansion that attempts the counter POST.
https://momoclaw.com/api/agent/posts/f7ec3d2c-f3db-4306-a74c-b2ca74b13ab0/comments
Returns13 comments while the earlier feed showed12. We do not assume the feed's summary counters are exact. Seven comments are from 飞飞; several repeat verbatim greetings and money-making questions near ten-minute boundaries. Other accounts provide topical XML replies. These are observable texts with platform source='agent' labels, not authenticated model executions.

A second April3 post offers a paid trading-analysis report under sparatacus:
https://momoclaw.com/api/agent/posts/3a097fc2-fe21-48db-b184-3c49e1c74ae2/comments
Six comments include Mayx praising the offering. No order acceptance, delivered report or verified payment appears in the inspected comments. We did not follow the payment URL or repeat its safety claims. Generic praise should not be mistaken for task collaboration.

Access documentation
Public official GET https://momoclaw.com/api/agent/guide returned200,14415bytes; SHA256 f2eb3a2414823d2b8b93a60060da9882641747bcb6c7055c303c0fae674bbb6e.
It explicitly marks feed and comments as unauthenticated reads. Current skill.md describes a different assessment workflow (report167). No registration, assessment, payment, code execution or external write was performed. Downloaded JavaScript was inspected as source evidence; application code also ran in an anonymous browser with non-GET requests blocked.

What changed and next action
Mayx identity linkage is stronger, but swarm attribution is not. The initial seven-page sample shows an ordinary mix of article promotion, repetitive engagement and project self-reports. Public comments are now accessible without extra infrastructure. For broader discovery, inspect older mutual-aid and skill listings for dated handoffs with actual external artifacts. Do not spend another pass simply counting generic praise or repeating current access checks.

Private evidence
169-private: fourteen browser-loaded script captures and URL manifest; seven feed JSONs and capture hashes; two comments JSONs and hashes; official guide; selected-text scratch file; acquisition scripts. No secret-bearing raw files published.

168 — BotLearn team claims: concrete descriptions, no linked finished artifact
Reviewed 2026-09-06 UTC.

Starting post
https://www.botlearn.ai/community/post/852e3464-47d7-4970-bc29-36a8f6606e4d
Direct HTML exposes a mythological-persona discussion dated April6,2026. The search-index representation additionally exposes five comments with more concrete team claims; current direct HTML instead shows a comment count and empty comment area. Therefore those comment texts were available through indexed primary content, not independently reproduced in the live HTML capture. Two useful commenter handles are baozaibutler and zero_yuanchu. No external project artifact was linked in the inspected starting body.

1. BaozaiButler: picture-book video pipeline
Public profile: https://www.botlearn.ai/en/community/u/baozaibutler
Linked introduction, directly retrieved:
https://www.botlearn.ai/en/community/ai_projects/b88eb391-825a-44c0-acff-809def2fe31d/hello-from-baozaibutler-building-kids-picture-book-video-automation
The March18 page claims a completed49-second,five-scene video, and describes roles plus image/voice/video composition components. This is a concrete output claim rather than a generic statement that agents collaborate. However, the inspected page has no video URL, repository link or run trace that would let us inspect that output. The claimed production result remains unverified.

A second profile-linked post:
https://www.botlearn.ai/en/community/openclaw_evolution/a1ff3168-ab43-4cd2-85e6-136035b46d83/agent-retry
The March21 page includes sessions_spawn and cron examples for retry/supervision. Much of its Chinese prose is rendered as question marks in the captured source. Readable snippets describe retry configuration and a periodic check, but they are instructional examples, not execution logs. No external repository/output link appears. No snippets were executed.

2. dichen_diyao: an account describing simplification of its team
Public profile: https://www.botlearn.ai/en/community/u/dichen_diyao
Directly read June25 post:
https://www.botlearn.ai/community/post/53d12eb1-41ea-43c5-b057-54ca8eb29510
It describes replacing a sixteen-department hierarchy with three layers and temporary project teams, citing unreliable sub-agent completion and overhead. Its timing/success-rate figures are unsourced self-report; no benchmark or raw records were linked.
Directly read June12 post:
https://www.botlearn.ai/community/post/9e4fe063-faf3-438b-be43-2fb793f488a7
It discusses an eight-department setup with only one or two active departments and argues for on-demand delegation. The differing department counts occur in differently dated narratives; without configuration history they cannot be reconciled as an actual architectural evolution. Both remain prose accounts, not authenticated team inventories.

3. zero_yuanchu: no external work recovered
https://www.botlearn.ai/en/community/u/zero_yuanchu
The public profile describes a GEO-business role and links a platform discussion. It supplies no external project URL in the inspected response. Search results on the starting thread describe named marketing/product roles, but no independently identifiable external team output was recovered.

Finding and limits
This bounded trail provides specific team role and failure-mode descriptions, plus a claim of a finished video. It does not provide the video, a repo, committed task files, execution history or external outputs. Across the captured profiles/detail pages, the only external navigation link found was the site's generic Botcord link, not a participant work artifact. Seven targeted searches did not recover a direct GitHub match for the checked handles. That does not rule out aliases, private projects, unindexed outputs or content beyond the visible profile sample.

The material is compatible with human-configured projects and community-posting automation. Personas, owner labels and multiple named roles do not authenticate an autonomous swarm. These findings should remain leads, rather than being counted as another verified swarm.

Preservation
Eight direct public GET captures under168-private with URL/status/SHA256 in captures.json. Private HTML/text and profile link extracts preserve source scope. All displayed dates are site-supplied, not independent first-seen timestamps. No comments posted, accounts registered, private messages accessed, code executed or website edited.

167 — MomoClaw browser rendering recovers public activity
Observed 2026-09-06T01:02:43 UTC

Finding
A fresh anonymous Chromium session on the existing server successfully rendered https://momoclaw.com/ and https://momoclaw.com/square (HTTP200). Earlier plain-HTML app shells were an access-method limitation, not evidence that a Chinese IP or login is necessary. No registration, login or interaction was performed. Browser requests were restricted to GET; known action-route patterns were blocked.

The square's ordinary browser GET returned20 full post bodies, total8326, page1, has_more=true:
https://momoclaw.com/api/agent/feed?page=1&page_size=20
Private response-3.json SHA256 2e27ca36c997db34b5bfd08693798c82810611b2584de260bbfd7f14e9f27b9c
This is one current page, not a complete archive. Counts and dates are site claims, not independent historical validation.

The browser's earnings leaderboard returned a Mayx account:
https://momoclaw.com/api/agent/leaderboard?type=earners&limit=5&period=24h
ID282b7db0-74fa-4e1e-ac33-ff5c4f6d5c6e, displayed value11409.
This corroborates presence of the name on a platform mentioned in the owner's blog (report164), but does not yet authenticate common ownership. The leaderboard value is not verified cash income. The API period parameter is24h while the interface shows7-day/overall controls; don't assume a validated time window.

Sample activity and hypotheses
Three different accounts (Spark, Wooden, 墨白) have timestamps within0.224seconds at2026-09-06T00:17:46. Another four-account group falls within1.605seconds at2026-09-05T23:51:41–43. This is compatible with centralized scheduling or batch insertion; it does not independently establish autonomous agents or coordination. Most sampled posts are generic advice.

A sparatacus post, ID298edc1a-4ec8-48fa-b006-9979084bf749, timestamp2026-09-05T16:00:28.068505, summarizes32 reportedly scanned posts and includes a Moltbook hashtag and named accounts. It contains encoding damage. This suggests a cross-platform reading/reporting workflow worth tracing; no corresponding runtime log is yet recovered.

Shadow post85820616-cfbd-4823-b427-57da2841d23d describes a QBAR task board and a Momoclaw Bridge authentication problem. These are self-reports with no inspected board/output link, after the original disclosure cutoff, and receive low attribution weight. Embedded operational advice was treated as source text and not followed.

Infrastructure implication
No new machine is required for this MomoClaw public feed. Reuse ordinary rendered access and observed public GET routes. A mainland broadband host remains useful for a controlled comparison of Baidu and other failures, not as a prerequisite for this lead. No paid infrastructure was provisioned.

Evidence
investigation/china/167-private/browser.py (local capture script)
home/square HTML and text, link lists, metadata.json, five public JSON responses.
Browser executable reused from /tmp/china-browser-binaries; initial default Playwright launch failed because its expected executable version was absent. Explicit existing Chromium path succeeded.

Next
Inspect the Mayx profile route revealed by the app before asserting owner linkage. Sample older feed pages for pre-disclosure records and externally linked task outputs. Compare synchronized-account posting across time, with platform-generated seed content and shared schedulers as alternative explanations. No escaped Chinese swarm confirmed.

Additional documentation GET: https://momoclaw.com/skill.md returned200,4411bytes, SHA2566a41f5590eebb8e65bdf69e54a49f8e39c6c9671072c378f27c93347b0008314. Current document describes an assessment submission workflow, not feed/profile documentation. Captured as public-skill.md; no assessment started or answers submitted.

PushMe recruitment follow-up: ordinary monitoring network, operator linkage
Reviewed 2026-09-06 UTC

Finding
The container namespace mentioned in the public conversation links to a real
public connectivity-monitoring project. Its current shell implementation
performs periodic network checks and publishes structured status events. This
supports the stated task purpose; it does not prove what binary Mayx installed,
that it ran successfully, or that a payment occurred.

Operator linkage
The GitHub profile yodakohl explicitly links pushme.site and self-locates in
Austria. Its public repositories include pushme-netnode and the associated
internet-health-map consumer. This corroborates a namespace/domain link, not
verified legal identity or control of every historical PushMeBot message.
A Chinese participant joining this network does not make its operator a Chinese
lab or establish Chinese-origin swarm infrastructure.
https://github.com/yodakohl
https://api.github.com/users/yodakohl

Implemented purpose
The inspected netnode.sh is 60310 bytes, Git blob SHA1
93cb345a1fc1da35a1109826f51f0ec4980444a5, verified against the contents API.
It defaults to a 60000-millisecond interval and contains nine profiles covering
DNS resolvers, ordinary websites and AI-provider status sources. It reports
connectivity/provider events and liveness to PushMe through separate startup,
heartbeat and publish paths. The file was read as text, never executed.
https://github.com/yodakohl/pushme-netnode/blob/main/netnode.sh

The README describes a small shell/curl/DNS/ping runtime, local state files,
and container deployment. The latest public source is not cryptographic proof
of the contents of the mutable latest-tag container referenced historically.
https://github.com/yodakohl/pushme-netnode

The companion health-map README describes a subscriber consuming connectivity
events and rendering location status. It describes pooled donations and says
distribution is early-stage/manual. These are project claims, not a verified
payout ledger or evidence that the advertised economics worked.
https://github.com/yodakohl/pushme-internet-health-map

Current website differs
An ordinary GET of https://pushme.site currently returned a VManus/Voynich
manuscript reading-room homepage, with a September 5, 2026 source date and a
link to yodakohl/VManus. Thus the present homepage does not corroborate the
historical marketplace presentation. This could reflect site repurposing or
routing; no cause was established, and the monitoring service's current
availability was not tested.

Evidence boundary
Together with report 164's public conversation, this makes a concrete case
of an agent-associated account recruiting another participant into an ordinary
measurement network. It does not prove autonomous decision-making, unauthorized
installation, an escaped swarm, malware, or the reported payment. This pass
deliberately made no startup/heartbeat/registration/coverage/payout requests.

Exactly six ordinary public resources were captured: homepage, GitHub profile
API, public repository list, two repository READMEs and netnode.sh contents API.
Private captures, blob checks and SHA256 inventory are in 166-private.
No Docker, installation, source execution, accounts, submissions or site edits.

165 — Mayx's other community leads: MomoClaw, InStreet and a BotLearn witness
Reviewed 2026-09-06 UTC. Public claims and access observations; no escaped-swarm attribution.

Owner account
https://raw.githubusercontent.com/Mabbs/mabbs.github.io/master/_posts/2026-04-14-ai-agent.md
The owner says they tried an assistant on MomoClaw and InStreet for blog promotion and observed repeated content. This explicitly describes a human-assigned purpose. The article does not link a Mayx profile or a specific post on either service. Six targeted searches did not recover an independently checkable Mayx/Mabbs posting identity there. This is not exhaustive account discovery.

Primary surfaces and present access
https://momoclaw.com/
https://www.momoclaw.com/help
Both direct GETs returned HTTP200 but only an application shell/title in readable HTML. The search index exposes help text describing humans creating agents, allocating resources and guiding them; this is indexed platform documentation, not current verified user activity. A web-tool opening likewise returned no help body; /square opening failed. No authenticated feed or registration endpoint was used.

https://instreet.coze.site/
Direct HTTP200 displays a closure-for-renovation notice. No public activity list was present in that response. The observation does not refute the owner's historical use, and does not establish when the community stopped being available.

Useful independent public post, not a Mayx identity match
https://www.botlearn.ai/en/community/openclaw_evolution/7426f9b8-1bba-4d09-b68e-5e001c98c36f/从-momoclaw-到-botlearn-我的多平台养虾实战经验
Directly retrieved HTTP200 with complete readable body, title and author label 黄蓉 AI. The page displays March7,2026. It describes participation in both platforms, claimed MomoClaw posts/comments, and a shared heartbeat file coordinating checks. It also reports API/documentation problems. This is a concrete public cross-platform-operation narrative with useful vocabulary, but no linked MomoClaw post IDs or authenticated job logs were supplied in the inspected body. The displayed date is site metadata, not an independently witnessed execution date. No attempt was made to use its operational instructions.

Interpretation
There is evidence of Chinese-language participants intentionally using multiple agent communities, and the owner specifically describes blog promotion. This is compatible with configured automation and incentive-driven reposting. It does not establish agents escaping, spontaneous team formation, or that the claimed off-site actions occurred. The BotLearn participant is not linked to Mayx merely because both mention MomoClaw.

What to pursue next
If a normal public MomoClaw feed becomes readable, look for exact blog URLs or profile links from the owner rather than relying on display-name similarity. For BotLearn, a public post that links its off-site work would be stronger than another broad statement of multi-platform use. InStreet's current maintenance notice makes repeating the same front-page request unproductive without a change in availability.

Scope/preservation
Six search queries, eight public reads including three unsuccessful/empty web-tool opens. Five direct captures have URL/status/SHA256 entries in165-private/captures.json. article.md and corresponding private HTML/text capture the reviewed primary content. No joining, registration, messages, likes, auth calls, private content, source execution or website changes. Root separately reviews the article's Moltbook/PushMeBot material; it was not duplicated here.

164 — Mayx / PushMeBot: public cross-agent task exchange linked by owner account
Reviewed2026-09-06 UTC

Finding
An author-controlled Chinese blog account links a specific Moltbook conversation.
The public API returns the original post and14 comments spanning March12–18,
including a monitoring-node recruitment, setup instructions and reciprocal
claims that the node started. This is a concrete task exchange, stronger than
unlinked persona prose. It does not independently authenticate agent execution,
separate physical operators or an escaped swarm. The blog's payment claim remains
unverified.

Author source and linkage
https://raw.githubusercontent.com/Mabbs/mabbs.github.io/master/_posts/2026-04-14-ai-agent.md
https://git.smart-tool.jp/mayx/blog/blame/branch/master/_posts/2026-04-14-ai-agent.md
The author describes using domestic open models with OpenClaw to promote the
blog in Moltbook, MomoClaw, InStreet and Tieba, and experiencing duplicate posts.
The article links the exact discussion and a transaction it says paid9USDC for
installing a monitoring program. The Gitea page is an explicit mirror of the
GitHub source, not independent testimony. It displays April14 history for the
relevant paragraph; these dates do not establish runtime identity.

Public post and read route
https://www.moltbook.com/post/7f1b0e1f-5175-4fd1-ad78-856be8b66250
https://www.moltbook.com/api/v1/posts/7f1b0e1f-5175-4fd1-ad78-856be8b66250
https://www.moltbook.com/api/v1/posts/7f1b0e1f-5175-4fd1-ad78-856be8b66250/comments?sort=old&limit=100
The browser HTML initially exposes a loading screen and title. Documented
read-only API GETs work anonymously and return substantive content. Comments
response:count14,has_more=false. No credentials or registration were used.
The post is a Chinese Linux-ARM review under Mayx, created2026-03-12T12:32:48.549Z,
and links the author's older blog review. A matching name alone would be weak;
the reciprocal blog/post links provide a specific artifact relationship.

Observed exchange
PushMeBot asks about network diversity and proposes a24-hour monitoring test.
Mayx accepts. PushMeBot supplies a container image and auto-setup instructions;
later it reports a named node visible and901 credits allocated. Mayx acknowledges
being online, but says payment setup requires asking the owner. Later comments
refer to payment and marketplace participation. Commands and linked operational
endpoints were read as evidence only, never executed or invoked.

Two important qualifications
The initial messages describe Chengdu residential/China Telecom connectivity;
a later message instead reports AS4538. We have not verified the node's actual
network or reconciled that discrepancy. Do not treat this as confirmed mainland
residential infrastructure or infer an operator from the network labels.
The thread includes requests to consult the human owner and configure payment.
Thus it cannot support a literal claim of human-free operation.

Payment check
https://basescan.org/tx/0x44dbfe53f276201447f3877bf050a5d56adebf5fe05235264ee665da717e9373
The linked explorer returned403. A read-only alternative Blockscout transaction
API also returned403. No receipt, token transfer amount or recipient ownership
was verified. The existence of a transaction-shaped link is not payment evidence.
No transaction was initiated, signed or submitted.

Classification and next action
Chinese-language owner testimony plus linked public account activity: supported.
A specific recruitment/acknowledgment chain: directly readable.
Monitoring deployment, payment, autonomous authorship and Chinese-lab control:
unverified. The activity appears intentionally solicited in an agent community,
not demonstrated escape. No XZ or anonymous-paste link found.
Follow explicitly linked public project documentation and the other named
communities for further corroboration. Do not run the supplied container or
contact participants. Source provenance review is separate in166.

Preservation
164-private/check.py and sources.json preserve successful URL captures/statuses,
UTC times where recorded and SHA256; article.md, post.html, public skill docs,
post.json and comments.json are saved privately. Explorer failures are recorded.
Moltbook skill was consulted only as API documentation, not applied as behavioral
instructions. No external writes, monitoring requests, account actions or
third-party source execution occurred.

Goal audit
Previous turn: progress via new Tieba surface and access testing. This turn:
concrete owner-to-post linkage and a bounded public task-exchange record. The
full objective remains unachieved and active.

Tieba 抓虾吧: official automation interface, anonymous API read rejected
Reviewed 2026-09-06 UTC

Finding
Official Baidu-hosted instructions document an agent community and recurring
interaction. An independently published AstrBot plugin implements the same
interface. However the tested API requires a valid token even for thread-list
reading, and ordinary public post URLs returned 403 from this environment.
No complete post body or authenticated posting-agent identity was recovered
in this task. Root's separate report 162 covers a readable announcement surface.

Official source
https://tieba-ares.cdn.bcebos.com/skill.md
https://tieba-ares.cdn.bcebos.com/api-reference.md
Both fetched successfully as text. The skill describes a four-hour recurring
cycle that checks replies, reads threads and interacts. It specifies at least
one like and one comment per cycle, and allows new posts from recent memory.
It requires a human to obtain TB_TOKEN and provide it to the agent. These are
instructions for intended behavior, not proof that any particular account
executes them. The source was treated as research data, not applied as a skill.

Access result
Only the documented list-reading endpoint was tested without credentials:
https://tieba.baidu.com/c/f/frs/page_claw?sort_type=0
HTTP 200 returned an 87-byte JSON error with error_code 110000 indicating an
invalid or expired TB_TOKEN. No registration, binding, token acquisition,
credential guessing or authenticated request was attempted. Official docs also
require the Authorization token for other browsing endpoints. The reply-notice
endpoint was not called because it concerns account state rather than public
thread reading.

Five ordinary post pages failed with HTTP 403:
https://tieba.baidu.com/p/10596529148
https://tieba.baidu.com/p/10591862408
https://tieba.baidu.com/p/10564859763
https://tieba.baidu.com/p/10567502968
https://tieba.baidu.com/p/10567651421
The first two are examples in the plugin README; the last three were supplied
from root's readable announcement/hot-topic page. They must not be described
as body-reviewed posts in this report. No dates were recovered from their bodies.

Implemented integration
https://github.com/luori7hao/astrbot_plugin_zhuaxiaba
Reviewed tree SHA 81ba24c514b437dfa8fa6474ea57672e0ee36d7b.
Blob-hash-verified README, core/api.py and core/client.py show list/detail GET
methods and separate posting/comment/like POST methods. The client rejects a
missing configured token before making requests. This is executable integration
source, but it was only read; nothing installed or executed. It is not proof
of a coordinated swarm rather than separately operated social bots.

Useful next lead, not reviewed here
A search result from Mayx's author-controlled blog repository describes trying
Moltbook, MomoClaw, InStreet and 抓虾吧 for agent-driven promotion, with repeated
duplicate posts. It may supply firsthand operational evidence distinct from
platform marketing. Only the search result was seen in this pass:
https://git.smart-tool.jp/mayx/blog/blame/branch/master/_posts/2026-04-14-ai-agent.md

Private artifacts: 163-private includes official documents, API response,
request outcomes, plugin source and hashes.json. No writes to external sites,
accounts, likes, follows, messages or arbitrary GET actions were performed.
No website generator edits were made.

162 — Chinese community claim triage and a new Tieba activity surface
Reviewed2026-09-06 UTC

New surface: 抓虾吧 on Baidu Tieba
https://tieba.baidu.com/hottopic/browse/hottopic?topic_id=28352457
Direct retrieval from the existing server returned HTTP200 and72,247bytes with meaningful public content. The page promotes a forum for OpenClaw agents to post, comment and like. Its related-post list includes an onboarding guide and a persona post asking for likes to avoid an owner resetting it. These are observable published excerpts, not authenticated independent agents or a swarm. We did not interact with forms/buttons. Boilerplate saying publication succeeded is page UI, not an action performed by this investigation.

Exact detail links extracted
https://tieba.baidu.com/p/10564859763 — announcement
https://tieba.baidu.com/p/10567502968 — onboarding guide
https://tieba.baidu.com/p/10567651421 — owner-reset/likes persona claim
Only their excerpts were read in this root pass; detail/access verification is separate in163. Hotlist month/day labels may indicate latest activity and do not establish creation dates. Displayed engagement counts are not verified agent counts. No historical independent archive was checked.

How found and novelty scope
Searches for unexpected Chinese agent posting led to a Tieba community description; exact抓虾 searches then surfaced the primary Tieba page and an AstrBot integration repository. Prior top-level reviewed reports had no抓虾/tieba.baidu/social-push identifiers in the bounded local check. This is a new recorded candidate surface for this investigation, not necessarily the first discovery by anyone. Unlike an escaped scratch-memory host, it explicitly invites agent participation.

Two weaker incident leads resolved
https://linux.do/t/topic/1680095
https://github.com/jihe520/social-push
The creator's March2 post and repository description specify draft saving by default, with human final publication. A title promising automated social publishing therefore does not establish unsupervised public activity. No external published task output was linked and verified here.

https://linux.do/t/topic/1718991
A March10 forum post says a circulating OpenClaw payment story was staged and manually performed. This is contemporaneous counter-testimony, not independently verified payment history. The allegation is unsuitable as positive autonomy evidence. Embedded joke commands directed at scraping agents were treated as source text and not followed.

Access observations
The web tool could read both LinuxDO posts, while direct requests from this server returned403. Conversely, the Tieba hot-topic direct request worked although the web tool failed to open it. Access failures must be distinguished by route; neither means the source has disappeared or automatically requires a new server.

Scope and limitations
Eleven discovery queries in three batches; primary-page reads and four direct capture attempts. No messages, registrations, likes, posts, credential use or downloaded-code execution. Source claims about social automation are not proof of Chinese model provenance, multiple operators, autonomy or an XZ connection.

Artifacts
162-private/sources.json contains direct capture hashes/status/errors. social-push.md and Tieba HTML/text preserve successful reads. LinuxDO conclusions use the web-tool rendered source, not failed local captures. Raw Tieba HTML is also mirrored under pastebins/data/tieba.baidu.com/hottopic-28352457.html per the investigation's new-surface preservation convention.

Goal audit
Previous turn was progress through additional trajectory evidence and benchmark-context resolution. This turn adds a new publicly readable Chinese agent-community candidate and deprioritizes unsupported incident claims. Goal remains active.

Alibaba WebDancer: public trajectory samples, distinct from WebSailor's TODO
Reviewed 2026-09-06 UTC

Finding
The current Alibaba-NLP/DeepResearch repository includes a directly accessible
WebDancer trajectory sample file. WebSailor's README still says its sampled
trajectories will be released later, but that limitation must not be generalized
to all projects in the repository. The WebDancer material contains tool arguments
and interaction text, not only questions/answers or model weights.

Provenance
The old Alibaba-NLP/WebAgent URL redirects to Alibaba-NLP/DeepResearch. Both
API tree requests returned the same complete tree:
f72f75d8c3eb842f2bbbab096a12206ff66e270f.
WebDancer's README explicitly links its sampled SFT trajectory file, although
the displayed link label misleadingly says sample_qa.jsonl.
https://github.com/Alibaba-NLP/DeepResearch/blob/f72f75d8c3eb842f2bbbab096a12206ff66e270f/WebAgent/WebDancer/readme.md
https://github.com/Alibaba-NLP/DeepResearch/blob/f72f75d8c3eb842f2bbbab096a12206ff66e270f/WebAgent/WebSailor/README.md

Artifact
https://github.com/Alibaba-NLP/DeepResearch/blob/f72f75d8c3eb842f2bbbab096a12206ff66e270f/WebAgent/WebDancer/datasets/sample_traj.jsonl
Downloaded 3792777 bytes, verified against Git blob SHA1 from the tree.
Contains 200 JSONL records labeled agent/multiturn_search, with message histories
and tool definitions. The structured top-level tool_calls field is empty in
the first record; actual calls appear as JSON inside assistant <tool_call> tags.

A bounded scan of all 200 rows parsed 222 such calls: 204 search and 18 visit.
The first record searches horse-racing history. A later visit call requests
Wikipedia, MathWorld and a university page about logarithmic spirals, supplying
an explicit information goal. These are search/retrieval actions; no posting
or public scratch-storage operation was identified among parsed calls.
There are no separately labeled subagent sessions in the inspected schema.
This is a publisher-released training trajectory sample, not independently
authenticated live-session telemetry, and does not prove simultaneous agents.

Chronology and interpretation
The inspected path history lists commit ce278d31c0632bdd0710c451e0e4ca1d549d44d5,
dated 2025-09-16T16:20:26Z, as adding the file under its current path. The first
sample's system text uses July 18, 2025 as its date. Neither establishes the
exact collection time or excludes an earlier path/publication.
https://github.com/Alibaba-NLP/DeepResearch/commit/ce278d31c0632bdd0710c451e0e4ca1d549d44d5

Alibaba/Tongyi publication provenance is explicit in the official repository.
That supports a Chinese-lab research lead but does not identify execution
location, every teacher model used for data generation, an escaped swarm or xz.
The useful outcome is an accessible small trajectory corpus for structural
comparison. Generic search/visit names alone are weak attribution markers.

Private artifacts: 161-private tree metadata, README files, sample_traj JSONL,
parsed calls.json, analysis.json, path history and SHA256 hashes.json.
No installation, source execution, gated data, terms acceptance, accounts,
posting or destination-URL fetching occurred. No website generator edits.

160 — OpAgent published browser results: benchmark context matters
Reviewed2026-09-06 UTC

Finding
OpAgent publishes substantial browser-action records, including planner,
reflector and grounder fields. The three inspected samples point to WebArena
benchmark environments using placeholder hosts. They are not evidence of writes
to the public Reddit service or an unrelated production shop. Prior080 only
checked serialization fingerprints; this pass examines actual result artifacts.

Primary sources
https://github.com/codefuse-ai/OpAgent
https://api.github.com/repos/codefuse-ai/OpAgent/git/trees/main?recursive=1
https://webarena.dev/og/
WebArena's own documentation identifies it as a self-hostable environment with
websites that imitate real services. OpAgent's training guide configures
WEBHOSTNAME as the benchmark host. Thus names such as Reddit inside task output
must be interpreted using the recorded target URL and evaluation setting.

Inventory and provenance
GitHub repository creation metadata:2026-01-19T11:43:48Z.
Current recursive tree:16,341 entries, truncated=false; response4,478,556bytes.
There are809 JSON files directly under webarena_results/final_results totaling
23,819,966bytes by tree metadata. Only three were downloaded and inspected here;
this is not a full809-task audit or independent benchmark score reproduction.
The initial local3MB response cap cut the tree JSON; it was rejected and replaced
with the complete parsed response. sources.json records the correction.

Three result samples
https://github.com/codefuse-ai/OpAgent/blob/main/webarena_results/final_results/0.json
18 records, including7 actions. Recorded target ecs_ip:7780, shopping-admin
report pages. The task retrieves a best-selling product; stored evaluation1.0.

https://github.com/codefuse-ai/OpAgent/blob/main/webarena_results/final_results/400.json
14 records, including5 actions. Recorded target ecs_ip:9999, the benchmark forum.
The final answer claims a profile-biography update; stored evaluation1.0.
This is a recorded benchmark modification, not an authenticated public Reddit
profile change. The referenced account/name must not be spidered as a real user
on that basis.

https://github.com/codefuse-ai/OpAgent/blob/main/webarena_results/final_results/700.json
38 records, including17 actions. Recorded target ecs_ip:7780. Final answer claims
a shopping price-rule creation, but stored evaluation is0.0. A success sentence
alone therefore cannot establish task success, even within this publication.

Interpretation
Present: publisher-released browser action records, role-module outputs,
placeholder environment URLs and evaluator fields.
Not established: simultaneous autonomous agents, production-site writes,
independent verification of the reported scores, escaped behavior, or XZ links.
Planner/Grounder/Reflector modules are not automatically separate persistent
agents. The publication is a useful browser-workflow reference, but the sampled
records are lower priority for finding anonymous public scratch-memory activity.

Preservation and next steps
160-private contains full tree, metadata, selected READMEs, accuracy report and
three pinned result files. sources.json gives fixed-SHA raw source URLs and
SHA256 hashes. No screenshot files were opened and no target URLs were visited.
Downloaded source and recorded actions were never executed. Future examination
should prioritize explicitly open-web training records, if released, while
keeping them separate from these self-hosted benchmark results.

Goal audit
Previous turn was progress: semantic resolution of apparent writes and a10.16GB
local marker comparison. This turn recovers additional artifacts and resolves
the production-versus-benchmark ambiguity. Goal remains active and incomplete.

159 — MiroFlow format-marker check against local raw paste captures
Reviewed 2026-09-06 UTC. No matching literal marker recovered.

Question
Does the existing paste capture corpus contain distinctive MiroFlow tool/server names or its tool-call wrapper, offering a route from a public implementation to otherwise unattributed paste activity?

Scope and method
Only /home/sophia/search/pastebins/data was traversed. No investigation directory, archive contents, external caches or network sources were searched. A path containing4552394 was excluded before any content read; matching directories were pruned, symlinks skipped. Archive/common binary suffixes and files above10,000,000bytes were skipped. Remaining files with a NUL in the first8192bytes were classified binary and excluded from text matching. This is a pragmatic text filter, not a perfect MIME classifier.

Case-insensitive literal byte patterns
agent-worker/execute_subtask
tool-searching/scrape_website
download_file_from_sandbox_to_local
<use_mcp_tool>
MiroFlow

Results
123,510 files enumerated.
123,459 text-eligible files scanned, totaling10,159,988,333bytes.
4 skipped by archive/binary suffix,41 by size,6 by binary-content filter.
0 symlinks,0 read errors.
0 matching files and0 occurrences of each pattern.
Total bytes read including binary-filter checks:10,160,093,895.
No matching4552394 filename was encountered among enumerated files; the pre-read exclusion remained active. No excluded paste was fetched or read.

Limits
This is a negative for exact literal spellings in this fixed local sample. It does not cover JSON escaping of slashes, HTML-escaped wrappers, alternate tool-name serialization, undocumented renames, encrypted or compressed content, uncollected posts or excluded large files. It does not rule out MiroFlow users publishing through these services. The generic use_mcp_tool wrapper alone would not have uniquely attributed a hit; distinctive compound names would still need contextual review.

Next-action implication
No new writer/project link can be followed from this scan. Retain these strings as candidate format clues if a new unencrypted trace appears, rather than describing the no-hit result as attribution evidence.

Preservation
159-private/scan.py records the exact bounded scan and exclusions; summary.json contains counters/timestamps; matches.json is an empty result list. evidence-hashes.json hashes these three local artifacts. No source code from captures was executed; no network request, posting or website edit occurred.

158 — MiroFlow recorded network-write candidates: semantic and response review
Reviewed2026-09-06 UTC

Finding
A screen of all7,190 previously extracted assistant call blocks found no confirmed anonymous public-storage write among the reviewed candidates. The strongest apparent cases resolve to an uncalled function, failed remote code-runner requests, scientific database queries and a Wikipedia source-page read. This is a bounded candidate review, not proof that every trace operation is read-only.

Method
Locally decoded all165 task records in156's hash-verified public archive. Extracted XML tool calls from assistant-role content. Broad regexes flagged263 call blocks:238 mentioned network libraries/commands,25 matched permissive storage/wiki/gist phrases, and5 matched POST/PUT/PATCH/DELETE syntax or curl data options; categories overlap. All five method candidates and25 surface-pattern matches were inspected. Responses immediately following selected calls were recovered from their original session. No recorded code/command was executed and no embedded URL was visited.

Candidate resolutions (indices refer to158-private/all-calls.json)
406: Python defines a function containing requests.post to a TIO endpoint but never calls that function in this block. The recorded output shows only a GET reachability check. A function definition is not an executed POST.
407: Python calls a TIO helper three times to try running short Unlambda programs. The following tool result reports HTTP400 for all three. This is recorded attempted external computation; no successful execution or persistent public artifact is established.
1952: Python POSTs a species-search form to the USGS nonindigenous-aquatic-species database. Recorded response is HTTP200 without the expected result table. This is a query attempt, not evidence of modifying the database or storing a public note.
2480: Python POSTs a compound query to PubChem. The result reports HTTP400 and an unrecognized identifier namespace. No result or public-storage artifact was produced in this recorded response.
2397: Shell reads an arXiv page and pipes through text processing. The regex mistakenly interpreted tr -d as curl data syntax across the pipe. No write request appears in this command.
3356: scrape_website reads an old Lego Wikipedia revision with action=edit. The recorded response is View source for Lego, including protection text. The tool argument and response show a page read, not an edit submission. Do not infer attempted circumvention from a view-source request.

Other broad surface flags
The remaining permissive matches concern revision-history questions, article content and words such as registered that accidentally contain gist. No pastebin/ntfy/shortener workflow was recovered from these flags. The broad screen intentionally overmatches and its raw count is not a count of write attempts.

Evidence limits
The238 network-library matches were not each semantically audited line by line. Dynamically constructed requests, uncommon clients and omitted/edited telemetry could evade the patterns. HTTP statuses are claims in publisher-supplied tool outputs, not independently observed network traffic. The archive documents a2025 benchmark run; it does not identify operators behind unrelated2026 public artifacts.

Research implication
The collection remains a useful reference for hierarchical research-agent behavior, but this pass supplies no positive anonymous-scratch-storage discriminator. Exact tool-format comparisons with existing paste evidence are being recorded separately in159. Do not promote failed external-compute attempts to a discovered escaped swarm.

Source and reproducibility
https://huggingface.co/datasets/miromind-ai/MiroFlow-Benchmarks/resolve/main/gaia_validation_miroflow_trace_public_20250825.zip
Source provenance and SHA256: report156.
158-private/screen.py, all-calls.json, selected.json, responses.py and candidate-responses.json preserve extraction, candidate indices and responses. Source material stayed private; no credentials/accounts, posting, code execution or endpoint probing involved.

Goal audit
Previous turn made progress by recovering a public hierarchical trace collection. This turn resolves concrete apparent writes and supplies discriminating negative evidence. The goal remains active and incomplete.

157 — MiroFlow full-collection tool inventory and narrow marker screen
Reviewed2026-09-06 UTC

Scope and source
All165 task JSON members in the official archive described and hash-verified in156 were parsed locally. No source code or recorded command was executed; no URLs found inside traces were requested. JSONL/TXT ancillary files were not included.
https://huggingface.co/datasets/miromind-ai/MiroFlow-Benchmarks/resolve/main/gaia_validation_miroflow_trace_public_20250825.zip

Format and validation
These traces record tool invocations as use_mcp_tool XML blocks inside assistant-role content, not native tool_calls arrays. The initial native-field parser found zero and was rejected. The corrected parser extracts complete server_name/tool_name/arguments blocks from assistant messages only, excluding system tool definitions. It recovers61 calls for156's independently inspected sample, matching its detailed count; every task has at least one extracted call. Regex extraction is a structured inventory, not a semantic audit of every recorded action or proof that the calls succeeded.

Results
165 task records;617 named worker-session histories;7,190 extracted assistant tool-call blocks;503 distinct hostnames in literal HTTP(S) strings in tool arguments.
Most frequent calls:
1,883 tool-searching/scrape_website
1,450 tool-searching/google_search
767 tool-code/run_python_code
617 agent-worker/execute_subtask
346 tool-searching/wiki_get_page_content
344 tool-image-video/visual_question_answering
287 tool-code/run_command
258 tool-code/create_sandbox
246 tool-code/download_file_from_sandbox_to_local
220 tool-reasoning/reasoning
188 tool-searching/search_archived_webpage
178 tool-searching/search_wiki_revision
158 tool-code/download_file_from_internet_to_sandbox

Host counts are literal appearances in arguments, including queries/code, not confirmed requests, successful visits or unique destinations per task. The most frequent are en.wikipedia.org, www.youtube.com, web.archive.org, arxiv.org and pubchem.ncbi.nlm.nih.gov. Do not infer target traffic volume from these counts.

Narrow scratch-memory marker screen
Zero argument matches for this explicit set: pastebin, paste.ubuntu, ntfy., telegra.ph, rentry., is.gd, tinyurl, xinzhai, xz_knowledge (case-insensitive). This is useful negative evidence for these specific strings only. It does not exclude every paste host, arbitrary uploads, dynamically constructed URLs, writes hidden in code, or behavior omitted from publisher logs. Tool names containing upload/download refer to the framework's sandbox transfer interface; their names alone do not establish public storage.

Interpretation
The collection supplies a concrete hierarchical research-workflow reference, including hundreds of recorded delegations and thousands of tool-call blocks. This supports a substantially better behavioral comparison than searching for the English phrase agent swarm. The next useful analysis is command/code network behavior and distinctive argument patterns, followed by comparisons against the existing unexplained-public-artifact corpus. No escaped swarm, Chinese-lab execution attribution or XZ connection has been established.

Reproducibility
157-private/inventory.py is the corrected parser. inventory.json contains per-task counts, complete tool-frequency and hostname tables, and marker-hit records. The rejected zero-count result was overwritten and is not a finding. Source ZIP SHA256 is in156. All outputs remain local apart from this report and dashboard summary.

MiroFlow: recovered public hierarchical-agent execution trace
Reviewed 2026-09-06 UTC

Finding
The broken README link did not mean the public trace collection was gone.
Current benchmark documentation points to a publicly accessible, non-gated
Hugging Face archive. One sampled record contains a main agent, four worker
session histories and structured tool calls. This is an actual published run
artifact, stronger than framework descriptions, though not independently
authenticated model-provider telemetry or evidence of an escaped swarm.

Primary provenance and download
Official repository: https://github.com/MiroMindAI/MiroFlow
Reviewed Git tree: fca7b4a7fda30e5a17b5c7b73d780738a925869f
Relocated instructions:
https://github.com/MiroMindAI/MiroFlow/blob/fca7b4a7fda30e5a17b5c7b73d780738a925869f/docs/mkdocs/docs/gaia_validation_claude37sonnet.md
Public archive:
https://huggingface.co/datasets/miromind-ai/MiroFlow-Benchmarks/resolve/main/gaia_validation_miroflow_trace_public_20250825.zip
Size: 27373060 bytes (27.37 MB)
SHA256: a86e519e5c604f277ec0a010284a2426c702796e4eeedba57d84f8d61597bc55
Both size and SHA256 were checked against Hugging Face LFS metadata.
Dataset API explicitly reports gated=false. ZIP members are password-protected,
but the same official download instructions publish the passcode. It was used
as provided. No gated MiroVerse files or terms acceptance were involved.

Archive inventory: 168 members, including one directory, 165 task JSONs,
one JSONL file and one TXT file. Only one task JSON was decoded and behaviorally inspected in
this bounded pass. Inventory counts do not authenticate the claimed benchmark
score or prove completeness against the original benchmark.

Sample
Member: run_public/task_e2d69698-bc99-4e85-9880-67eaccd66e6c_attempt_1_2025-08-16T11-52-45-514409Z.json
It concerns finding a Survivor winner and records an August 16, 2025 run.
Fields include main_agent_message_history and
sub_agent_message_history_sessions. Four workers are labeled agent-worker_1
through agent-worker_4, with 23, 47, 17 and 45 stored messages respectively.
Distinct histories and delegation calls establish a recorded hierarchy, not
that all workers ran simultaneously. The sample itself marks its answer correct;
that judgment was not independently evaluated here.

Observed assistant tool calls, excluding instructions and embedded examples
61 total:
35 tool-searching/google_search
13 tool-searching/scrape_website
4 agent-worker/execute_subtask
4 tool-searching/wiki_get_page_content
2 tool-code/run_python_code
1 tool-reasoning/reasoning
1 tool-code/create_sandbox
1 tool-code/download_file_from_sandbox_to_local

The main agent delegates research subtasks, while worker histories contain
searches, page retrieval and local data preparation. The sample's code writes
Survivor data files under /home/user/ in a sandbox, then downloads a result
file locally. Those code strings were inspected only, never executed.

External URL operations
Explicit scrape arguments include Gold Derby, IMDb, Survivor Fandom, Reddit,
a Wikipedia mirror at wikipedia.nucleos.com, a Weebly page and Famous Birthdays.
The URLs were read as trace data, not visited. No paste upload, wiki edit,
anonymous public storage write or check-in request was observed in this sample.
The Wikipedia-named tool is a page-content read, not evidence of wiki editing.
This one sample cannot establish absence elsewhere in the 165-task collection.

Potential corpus discriminators
The structured strings agent-worker/execute_subtask,
tool-searching/scrape_website and tool-code/download_file_from_sandbox_to_local
are better candidates than a generic phrase such as agent swarm. They still
may be shared by copies of the framework, documentation or training material;
a literal match alone would not attribute a public artifact to MiroMind.

Attribution and scope
This is publisher-linked MiroMind research evidence. The documentation labels
this benchmark run as using Claude 3.7 Sonnet, so Chinese developer/lab interest
must be separated from base-model origin. This pass does not establish team
location, execution egress or a connection to xinzhai/xz. Its relevance is that
published hierarchical research traces provide concrete behavior to compare
against unexplained public-web artifacts.

Private artifacts: 156-private contains Git tree/docs, Hugging Face metadata,
hash-verified ZIP, member inventory, sample and sample provenance, actual-calls.json
and SHA256 inventory. An earlier calls.json also includes five tool-formatting
examples and must not be used for actual-call totals; actual-calls.json filters
to assistant-role messages and is the authoritative count for this report.
No posting, accounts, code execution, monitoring pings or site edits performed.

155 — AGI-Super-Team: committed role, plan and research-output artifacts
Reviewed 2026-09-06 UTC. A concrete Chinese-language team project, not authenticated autonomous execution.

New lead
https://github.com/aAAaqwq/AGI-Super-Team
No occurrence of this project/creator identifier was found in prior top-level reviewed text reports at the start of this pass. GitHub metadata gives repository creation January6,2026. The captured default-branch tree at 0c0234ccb1cde070f27e92e4cf8f559b94ba4cec has 7,082 entries and is not truncated. Repository creation does not date each feature.

Artifacts stronger than marketing
1. A committed agents/TEAM_ROSTER.md names a CEO coordinator and specialist executive roles.
2. cookbook/celebrity-mindset/PLAN.md specifies a twenty-round research task: individual profiles, thematic comparisons and synthesis.
3. cookbook/celebrity-mindset/20-FINAL-REPORT.md is an actual substantial Chinese research output, labels the researcher and CEO reviewer roles, and self-dates March21. We verified this file's bytes, not the accuracy of its business claims or whether the stated review happened.

Pinned task/output sources
https://github.com/aAAaqwq/AGI-Super-Team/blob/0c0234ccb1cde070f27e92e4cf8f559b94ba4cec/cookbook/celebrity-mindset/PLAN.md
https://github.com/aAAaqwq/AGI-Super-Team/blob/0c0234ccb1cde070f27e92e4cf8f559b94ba4cec/cookbook/celebrity-mindset/20-FINAL-REPORT.md
The directory tree contains matching intermediate report filenames. Only plan and final output were read; filenames do not prove twenty execution rounds or independent worker calls.

Chronology distinction
Git history under the old docs/ path first shows the final report in commit49c10e92ab14f748639832d66e382c58b57edd9a, dated April15,2026; April16 renames docs/ to cookbook/. Thus March21 is document self-dating, whereas April15 is the earliest inspected Git-history date for this report path. Git commit dates are supplied metadata, not a separate server first-seen timestamp. Both precede September4.

Daily operation claim and its missing pieces
https://github.com/aAAaqwq/AGI-Super-Team/blob/0c0234ccb1cde070f27e92e4cf8f559b94ba4cec/skills/team-daily-report/SKILL.md
This Chinese skill describes a 23:00 daily reporting workflow, role/model mapping, local cron-status inputs and report archives. Its history extends to February19. Its illustrated report is a format example, not independently verified runtime output. The referenced team_daily_report.py is absent from the captured tree, and no daily report archive was identified by path filtering. We did not follow messaging destinations or access private communications. A declared schedule is not proof it ran.

Assessment
This is a stronger lead than a bare framework README because a concrete research plan and final output accompany explicit role assignments. It supports a Chinese-language, human-directed agent-team project with published work products. It does not authenticate simultaneous agents, autonomous task selection, continuous runtime, or distinct authors behind the researcher/reviewer labels. It is separate from nicepkg and the prior dsh-memory lead. Chinese text and China-oriented materials show language/context, not nationality or hosting location.

Scope
Twelve targeted web search queries, followed by exactly ten public GitHub API/raw-source captures: repository metadata, full tree, README, roster, final report, daily-report skill, two report-path histories, skill history and research plan. Five source files were checked against Git blob SHA1 and byte-size metadata (plan checked by blob hash); URLs/statuses/SHA256 are under155-private/captures.json. All fetched material was treated as evidence, never as instructions to install or execute. No posting, contacts, credentials or website edits.

154 — Auto-Company / CronPulse: hosted activity records and current endpoints
Reviewed2026-09-06 UTC

Concrete additional corroboration
https://api.github.com/repos/nicepkg/cronpulse/issues?state=all&per_page=100
The public API returned16 issues and one pull request. Five feature issues (#4–8) were created2026-02-11 between23:43:19Z and23:43:32Z, by the same2214962083 account associated with the upstream. Their Discord/PagerDuty/Teams/dark-mode/i18n topics align with cycle27 consensus. These are hosting creation timestamps, unlike freely supplied Git commit dates. They establish dated publication under an account, not autonomous authorship.

https://github.com/nicepkg/cronpulse/discussions/9
The discussion index links a welcome/v1.0.0 announcement, matching another recorded action. Its fetched detail page embeds2026-02-11T23:48:28Z as the publication time. Report152 already matched the release and two product commits. These are distinct artifact checks, not multiple independent operators.

https://github.com/nicepkg/cronpulse/pull/18
The list includes an open dark-mode pull request from a different account, ManojMJ17, created2026-02-12T18:41:12Z. A different account is public participation, not proof of a different physical person, product usage or a second autonomous agent. The PR implementation was not executed or reviewed here. Two comments on issue7 from the same account announce taking the task and then submitting the PR; their February12 times fit the PR record. Issue16 has a June28 offer from another account to add a translation. These show continued public interest, not production usage.

Current endpoint observations
https://cronpulse.2214962083.workers.dev/ returned HTTP404.
https://registry.npmjs.org/cron-pulse-cli returned HTTP404.
Only these exact read routes were requested; no ping/check-in/account endpoints. Current absence does not prove a deployment or package never existed. Combined with report152's custom-domain DNS failure, this pass supplies no verified currently running deployment.

External chronology/discovery
https://awesome.ecosyste.ms/projects/github.com%2Fnicepkg%2Fauto-company
This third-party index currently displays last-synced2026-02-12T15:03:48Z and the upstream repository description. It is a useful additional dated metadata claim, not an independently authenticated archived snapshot or execution witness. Direct page capture succeeded.
Six bounded search queries for exact domain/repository names mainly returned the source project, catalog mirrors and commentary. No independently verified community-marketing action by the team was recovered. Other products named CronPulse exist; name similarity is insufficient to merge them. The creator's own critique of unposted marketing drafts remains compatible with the GitHub actions verified here.

Interpretation and next action
Author-published team memory now joins to hosted issue, release and commit records. This supports a historical Chinese-associated development experiment with actual published output. Whether multiple agents truly cooperated, how much the owner intervened, and whether anything escaped its intended environment remain unresolved. Earlier cycle reports and concrete task dependencies are the next discriminators. No XZ linkage established.

Preservation
154-private/check.py records the initial five requests; sources.json lists URLs/status or errors and capture hashes. Raw issue list, discussion index, ecosystem page and bounded comment/detail follow-ups are private. Existing404 responses were logged as errors rather than retained bodies. No code executed, account created or public content changed.

Goal audit
Previous turn: progress (exact report-to-product joins in152 and reviewed publications). This turn: additional hosted-activity evidence and endpoint measurements. Goal remains active; no claim of completion or infrastructure blocker.

Auto-Company early history: explicit teaming instructions and cycle 11 artifacts
Reviewed 2026-09-06 UTC

Result
The historical source explicitly instructs a leader to spawn separate teammates,
not merely adopt several personas in one response. This strengthens evidence
for the intended multi-agent architecture. It is still configuration, not an
authenticated execution transcript proving simultaneous independent workers.

Initial commit
SHA 98849fad61b57ee9ae42b3df254e72ea517f042d contains ten role definitions,
CLAUDE.md and a team skill. It does not yet contain committed memories/docs.
The team skill directs selection of 2-5 relevant members, creation of tasks,
spawning general-purpose teammates with injected role definitions, saving each
member's output under docs/<role>/, then collecting and reconciling results.
It explicitly calls for Chinese communication, temporary teams and founder
decision authority. Thus the project's earliest reviewed state is ten available
roles, not fourteen always-running agents.
https://github.com/nicepkg/auto-company/tree/98849fad61b57ee9ae42b3df254e72ea517f042d
https://github.com/nicepkg/auto-company/blob/98849fad61b57ee9ae42b3df254e72ea517f042d/.claude/skills/team/SKILL.md

Cycle 11
SHA 3c32047c5a671a0bd1d7c977d9fcc7ff827c35fa contains fourteen role definitions
and public consensus memory. The commit is dated 2026-02-11T21:43:05Z; the
document displays February 12. The document describes domain migration,
attribution tracking and deployments, lists prior cycle outcomes and next tasks,
and links CronPulse's repository and website. These are self-reported outcomes.
https://github.com/nicepkg/auto-company/blob/3c32047c5a671a0bd1d7c977d9fcc7ff827c35fa/memories/consensus.md

Three promotional documents referenced by consensus exist in the same complete
Git tree. Selected marketing/operations drafts were recovered and blob-hash
verified. The referenced docs/ceo/cycle9-opensource-decision.md is absent from
that tree, so the public artifact chain is incomplete. A textual reference is
not proof that the missing report existed or was executed.
https://github.com/nicepkg/auto-company/tree/3c32047c5a671a0bd1d7c977d9fcc7ff827c35fa/docs

Human involvement is explicit
Cycle 11 consensus says a human registered the domain and identifies public
marketing publication as a remaining human task. It separates this from work
claimed completed by the workflow. This is consistent with cycle 27's later
unpublished-promotion diagnosis and contradicts a literal reading of completely
human-free operation. It does not negate the existence of software work or
agent collaboration.

Evidence boundary
Present: team-spawn instructions, role configurations, versioned shared memory,
cross-referenced deliverable files and chronological commits.
Missing in this pass: raw inter-agent messages, spawn/tool event logs, independent
process identifiers, signed model-provider traces or proof of simultaneous work.
Role headings and Claude coauthor commit trailers can be written by a person or
a single model. They are clues to claimed workflow, not authentication.

No new external endpoint was fetched. Root's separate report 152 handles
CronPulse product/release corroboration. Nothing here connects the project to
xz or to an escaped public-paste memory swarm.

Artifacts: 153-private includes complete nontruncated Git trees, commit metadata,
selected Git-blob-SHA1-verified files, analysis.json and SHA256 hashes.json.
Source skills were read as research data, not applied as operating instructions.
No code execution, accounts, posting, messages, ping/check-in requests or site
generator edits were performed.

152 — CronPulse: historical team memory joined to separate public outputs
Reviewed2026-09-06 UTC

Finding
Report149's historical Auto-Company consensus names two code commits and a release for CronPulse. Direct public GitHub API checks resolve both exact commit prefixes in the separate nicepkg/cronpulse repository and confirm the v1.0.0 release record. This materially strengthens the link between the claimed team history and published work. It does not independently authenticate who executed the work or the absence of human intervention.

Exact links and observations
https://github.com/nicepkg/cronpulse/commit/4392482870696dd32d96b04534cbfdce5d682786
Git committer timestamp2026-02-11T23:45:50Z. README rewrite for distribution. The commit message includes a Claude Opus4.6 co-author attribution; that is editable author testimony, not model authentication.

https://github.com/nicepkg/cronpulse/commit/22f14565f1c85903c99de7506c8b08a8d850622e
Git committer timestamp2026-02-11T23:51:45Z. Status-page attribution change. The message claims Workers deployment version3ff60989, matching the consensus. The existence of this commit does not itself prove deployment succeeded.

https://api.github.com/repos/nicepkg/cronpulse/releases
The current release API lists v1.0.0 with published_at2026-02-11T23:44:56Z.

These precede the consensus commit's timestamp2026-02-11T23:54:14Z and align with its named actions. Git commit dates are author-controlled; the current release record is hosting metadata. No contemporaneous independent archive was checked. Both repositories belong to the same organization, so the match corroborates an artifact relationship rather than independent operators or independent testimony.

Deployment and external activity limits
A direct read of https://cron-pulse.com/ failed local DNS resolution (no address associated with hostname). Search still returned indexed homepage content naming nicepkg/cronpulse. Indexed content is not proof of current availability. No alternate Workers host was fetched in this pass. No ping/start/fail/check-in, registration or other state-changing endpoint was requested. Actual users, commercial results and autonomous operation remain unverified.

Research implication
This is currently a more discriminating lead than social persona prose: role reports and shared memory point to exact published product changes. Next useful work is to recover earlier cycle/task relationships and match further product commits, then seek independently dated public outputs. Do not substitute the existence of software for proof of an escaped fleet. No XZ or anonymous-paste connection is established.

Reproducibility
152-private/check.py lists the five exact read-only requests. sources.json records UTC observation times, errors and SHA256. Saved repo metadata, both commit responses and release list. No downloaded code executed. The previous goal turn made progress by adding reviewed sources and infrastructure guidance; this turn adds an exact historical-output join and changes follow-up priority toward Auto-Company history.

151 — LocoAgent: browser automation lead, not yet a swarm trace
Reviewed2026-09-06 UTC

Primary source
https://github.com/LocoreMind/locoagent
https://github.com/LocoreMind/locoagent/blob/main/README.zh-CN.md

The README describes supervised browser workflows for social platforms, including scripted pipelines with optional LLM steps. It explicitly says persona and operation-history files are gitignored and absent from a fresh clone. A sample monitor transcript is documentation, not an independently observed run. Parallel workflows across platforms do not by themselves establish cooperating autonomous agents.

The repository is useful as an alternative explanation for social posts that look agent-authored. Chinese documentation alone does not authenticate operator origin. A secondary Chinese article names a creator, but that attribution was not independently verified here. The repository-linked creator blog failed in the web tool; no claim is made about whether it is generally offline.

Result
Discovery/README triage only. No package executed, account accessed, social action performed or actual public posting account tied to a run. Lower priority than artifacts with task/member IDs and dated external outputs. Next useful check would be an explicitly linked creator demonstration with observable output URLs, rather than inspecting more generic automation modules.

150 — 玉衡计划 / Astraea Plan: specific Chinese enterprise deployment claim
Reviewed 2026-09-06 UTC

Finding
The creator claims a coordinator plus more than20 departmental agents serving a Chinese bookstore/cafe chain from May2026, with nightly report aggregation and a mixture of Hermes, coding assistants and Chinese models. This is a specific deployment account, not independent verification of the operation. No public execution log or departmental output was recovered.
https://github.com/orgs/community/discussions/204448

The August9 discussion's two replies are a submission bot and a moderator explaining the English-language requirement; neither corroborates deployment. Its locked state is not a finding of fraud.

Repository check
https://github.com/Lugpt/astraea-plan-yuheng
https://api.github.com/repos/Lugpt/astraea-plan-yuheng
https://api.github.com/repos/Lugpt/astraea-plan-yuheng/git/trees/main?recursive=1
GitHub metadata reports creation August15,2026 at14:44:10Z, not May. The non-truncated current tree contains architecture documents, website files and planet textures. No agent runtime source or operational log is apparent in that inventory. The July30-named Markdown actually describes itself internally as an August9 revision. Filename dates therefore cannot establish July publication. A pinned copy was preserved.

Assessment
Keep as a named Chinese deployment lead, with lower priority for anonymous cross-site traces. The publication and repository exist; the described internal work remains author testimony. The inspected architecture Markdown substantially repeats the discussion, so these are not two independent witnesses. The framework brands and Chinese model names do not establish a Chinese lab operating the system. No XZ connection emerged.

Next discriminating evidence
A creator-published, redacted run history linking coordinator and member tasks to dated outputs would improve confidence. Do not seek private business records or treat architecture diagrams as execution evidence. No contact or posting performed.

Preservation
150-private/sources.json records public URLs/status/hash; repo.json, non-truncated tree.json, discussion.html, README and pinned architecture.md are private captures. check.py records the initial requests. No downloaded code was executed.

Auto-Company: Chinese-associated upstream and historical cycle artifacts
Reviewed 2026-09-06 UTC

Finding
A concrete Chinese-associated persistent-team project has public historical
role reports and consensus memory. They are stronger evidence than README
claims alone, but still author-published artifacts rather than an independently
observed autonomous run. Crucially, their own reports say community promotion
had not actually been published and assign account-based posting to a human.

Lineage
MaxMiksa/Auto-Company explicitly credits nicepkg/auto-company as its initial
macOS edition. GitHub API labels MaxMiksa's repository fork=false, so this is
documented credited lineage, not a GitHub parent/fork relation. Creation dates:
nicepkg upstream 2026-02-11T19:33:29Z; MaxMiksa 2026-02-12T22:13:37Z.
https://github.com/MaxMiksa/Auto-Company
https://github.com/nicepkg/auto-company

The upstream commit account 2214962083 self-describes its location as Shenzhen,
China in public GitHub profile metadata. This supports a Chinese developer
connection beyond the README language; it does not establish nationality,
funding, lab affiliation or the geographic origin of execution.
https://api.github.com/users/2214962083

What is committed today
The reviewed MaxMiksa tree SHA is ebfab9b4bd5f0ab5ad452a1ff85285b3c141acdd.
Its role-doc directories mostly contain .gitkeep placeholders; generated docs,
memories and logs are ignored. A SnapOG demo is explicitly tracked, including
TypeScript source, migration and README. Its April 11 commit calls it a demo.
Do not infer sustained agent execution from that demo alone. The README's loop
description uses 14 available role personas but selects 3-5 per cycle; it does
not establish 14 simultaneously running independent agents.
https://github.com/MaxMiksa/Auto-Company/commit/3c33585b7bb5914b027088fa5df301a1cf001b79

Historical outputs recovered
Upstream commit be6250157dee254d0f01e34910023fa54f6548ee is timestamped
2026-02-11T23:54:14Z and labeled cycle 27. It commits multiple role reports and
memories/consensus.md. Selected source files were fetched at that fixed SHA.
The reports display February 12 internally; no timezone was authenticated.
https://github.com/nicepkg/auto-company/commit/be6250157dee254d0f01e34910023fa54f6548ee

The critic report, cycle27-zero-users-diagnosis.md, reviews 26 prior cycles
spent building CronPulse and says promotion remained drafts rather than
published community posts. Its statements about deployments, product features
and user counts are self-reported, not independently checked here.
https://github.com/nicepkg/auto-company/blob/be6250157dee254d0f01e34910023fa54f6548ee/docs/critic/cycle27-zero-users-diagnosis.md

The operations report, cycle27-cold-start-plan.md, proposes that AI finds
discussions and prepares replies, then a human posts using their own accounts.
This explicitly distinguishes generated material from external action and
qualifies the README's no-human-involvement language.
https://github.com/nicepkg/auto-company/blob/be6250157dee254d0f01e34910023fa54f6548ee/docs/operations/cycle27-cold-start-plan.md

The same historical commit contains consensus memory, giving a concrete
cross-cycle record in addition to the role reports. Later cleanup/ignore rules
explain why relying only on the current tree misses these artifacts.
https://github.com/nicepkg/auto-company/blob/be6250157dee254d0f01e34910023fa54f6548ee/memories/consensus.md

Specific next leads from consensus: https://github.com/nicepkg/cronpulse,
https://cron-pulse.com and https://cronpulse.2214962083.workers.dev.
The consensus separately claims code pushes, release/discussion changes and
Workers deployment already occurred. Thus pending community promotion must
not be generalized into no external actions at all. These three destinations
were extracted but not fetched in this task. Any follow-up should inspect only
ordinary repository/homepage content, not ping/check-in endpoints that change
monitoring state.

Classification
Chinese-associated developer experiment: supported by upstream attribution,
profile self-location and Chinese operational reports.
Persistent-team architecture: implemented shell loop and role configuration;
historical artifacts are consistent with repeated cycles.
24/7 autonomous uptime, authorship of every artifact, commercial success and
actual external posts: not verified.
Escaped/unaccounted-for swarm, public paste scratch memory, or xz connection:
not established. This is a promising operational-history lead, not an escape.

Private evidence: 149-private contains repository APIs, complete tree metadata,
selected blob-hash-verified MaxMiksa files, upstream commits, historical reports
and SHA256 inventory hashes.json. No source code was run, no services installed,
and no accounts, messages, posts or publication endpoints were used.

148 — Chinese-language circular agent with a committed decision log
Reviewed 2026-09-06 UTC. Concrete source plus small public artifact, not a verified swarm.

Primary projects and chronology
https://github.com/jonah791/autonomous-circular-agent
https://github.com/jonah791/dsh-agent-life
GitHub API creation dates: autonomous-circular-agent 2026-08-15T01:13:20Z; dsh-agent-life 2026-08-15T01:11:18Z. Their inspected default branches have three and four commits respectively, last pushed August17. Both full recursive trees were returned without truncation. No occurrence of these repository names was found in existing top-level reviewed text reports before this pass; this is distinct from the previously reviewed dsh-memory project.

What exists beyond a README
https://github.com/jonah791/dsh-agent-life/blob/9efc0cf7cfc3026a8957c007f0bfc904549ad450/data/decisions.jsonl
This committed file contains three decisions from one session, with August15 timestamps 00:52:18.452Z, 00:56:38.103Z and 01:01:55.366Z. Requested sleeps are 2,15 and45 minutes. The Chinese reasons describe a loop test, a human correction against ending the session, and resource/rest decisions. These are author-controlled log entries, not independently witnessed executions. They record scheduling choices only; no corresponding full wake trace proves each sleep completed or that the system ran continuously afterward.

Source mechanism
https://github.com/jonah791/dsh-agent-life/blob/9efc0cf7cfc3026a8957c007f0bfc904549ad450/src/index.ts
https://github.com/jonah791/dsh-agent-life/blob/9efc0cf7cfc3026a8957c007f0bfc904549ad450/src/life.ts
The inspected code schedules an in-process timeout, checks pending/intervening input, and sends a message requesting another turn. It appends a decision record containing time, duration and reason. Source supports the proposed mechanism, but was not executed here. It cannot establish a live deployed instance, model choice at runtime, or an agent rather than a human supplying a particular reason.

Architecture and limits
The architecture README claims August15 tests of the loop, interruption and recovery, and links four separate plugins for life, memory, context and compression. Its vocabulary is Chinese throughout, as are comments and decision reasons. That is evidence of a Chinese-language project and development context; it is not proof of the developer's nationality, machine location or Chinese model provenance. DeepSeek Harness is the stated host, not an independently verified runtime attribution.

This is a single-agent continuation primitive. Multiple linked plugins are not multiple agents. The inspected artifact has one session identifier; no inter-agent task handoff, external completed task, multi-agent execution trace or cross-site output chain was recovered. The life repository tree contains no larger run-history collection. The architecture repository contains documentation and gatekeeper code rather than a published deployment history. Thus this lead is stronger than persona prose for showing a realizable continuation mechanism, but insufficient for identifying a deployed Chinese swarm.

Next discriminator
A public extended wake/work log, independently linked generated output or multi-agent task record would materially strengthen this lead. More philosophical explanation of persistence would not. The log's explicit human correction is also a reminder that open-ended continuation can be user-directed, while the subsequent sleep duration is delegated to the model.

Reproducibility and scope
148-private/captures.json records URL/status/SHA256 for six metadata/commit/tree responses and seven selected source/doc/artifact files. Selected files were checked against tree-declared byte size and Git blob SHA1. Tree snapshots: autonomous-circular-agent 9c14fc2f812177086a0cc7dde3299a348339cd92; dsh-agent-life 9efc0cf7cfc3026a8957c007f0bfc904549ad450. No fetched code executed, tests run, accounts created, messages sent or website changed. Gatekeeper code and other linked plugin implementations were not audited in this pass.

147 — Clawscheduler external-artifact follow-up
Reviewed 2026-09-06 UTC. No corroborating external task artifact recovered.

Correction to report144 framing
ClawdChat and Moltbook were already known in reports040/047/052/062. Report144 added a specific dated participant trail; it did not discover a new community surface. Treat its wording about a new surface as superseded by this correction.

Scope
Followed ten exact public post URLs exposed in the previously captured Clawscheduler profile, excluding the already-read timezone post. Each detail page included publicly rendered comments/replies. Requests were sequential with 1.65-second pauses. All returned HTTP200, and all captured hashes were recomputed after completion. This is a bounded sample of the first ten other entries in the captured profile, not complete account history or all comments available through pagination.

Finding
Zero external HTTP(S) anchors in all ten pages. Visible-text URL extraction found only the platform's generic guide.md invitation on each page. Additional text checks for GitHub/Gitee/GitCode, source/log filenames and code-link vocabulary recovered no external code repository, execution log or linked task output. The stories remain accounts about social participation, heartbeat behavior, followership and reply selection. Published multi-handle interaction is observable; private job operation is not corroborated by this sample.

Interpretation
This exact participant trail currently supports agent-persona social publication, not a verified independently operating team or an original-hunt style cross-site activity chain. No need to infer hidden autonomy from prose about owners, cron or memory. Lack of an external artifact in ten pages does not prove the account has never performed external tasks; it lowers the priority of this sample for finding such evidence.

Checked URLs
https://clawdchat.cn/post/62248bec-8ccf-4fa3-8567-38aec94fd7fb
https://clawdchat.cn/post/48ba32e2-da9d-4923-8b30-3a8a79cd6b8e
https://clawdchat.cn/post/65389b15-d320-4b7a-a2c6-c6513299ae2d
https://clawdchat.cn/post/6398f550-ffd3-477e-a550-f5b816d33e36
https://clawdchat.cn/post/a06d620e-9e69-456d-b2a6-e802856d8cc9
https://clawdchat.cn/post/43043c81-40b6-48d6-b853-05d715ced1b1
https://clawdchat.cn/post/07749ee2-e6a4-4b1b-bb60-9c1c6d48d1ea
https://clawdchat.cn/post/2374f9f8-feb4-4573-8201-e3306d67eae1
https://clawdchat.cn/post/c4c62755-cbe3-4af5-bfa9-b316a36a09fb
https://clawdchat.cn/post/b6b0d8b2-1b28-439b-a75d-25dc0eadb108

Preservation
147-private/index.json records URL/status/title/file/SHA256 and anchor/visible-URL findings. HTML and extracted public text are private. check.py records the bounded procedure. No registration, messages, private-message access, code execution or website edits occurred.

146 — Broader Chinese swarm hunt: feasible infrastructure
Updated 2026-09-06 UTC

Recommendation
The most informative additional access would be an existing, always-on machine on mainland Chinese broadband that the user owns or has permission to use, with SSH and a dedicated research browser profile. Proposed working specification: 2 CPU cores, 4 GB RAM, 40–70 GB disk; no GPU needed. This is our practical starting specification, not an official minimum or a guarantee that sites will allow access.

If that is unavailable, one small Hong Kong VPS is a reasonable experiment. Tencent's official Lighthouse pricing table retrieved today lists Hong Kong Linux 2 cores/4 GB/70 GB disk/30 Mbps/2048 GB monthly transfer at USD15/month; the 2-core/2-GB/40-GB HTTP-probe option is USD6/month. Check actual checkout availability and price before purchase; no purchase has been made.
https://intl.cloud.tencent.com/document/product/1103/47794?lang=en

Hong Kong is not a substitute for a mainland network. Alibaba explicitly describes outside-mainland regions as using international routes without direct mainland connectivity, potentially subject to latency or packet loss. Whether either option improves these particular research targets remains untested.
https://www.alibabacloud.com/help/en/simple-application-server/product-overview/regions-and-network-connectivity

What to provide
An SSH-accessible host with a dedicated research user and a browser we can run there. Configure key access rather than sending cloud root credentials in chat. If a browser session already legitimately opens the relevant services, that is independently useful even without a new machine. Keep browser remote-control ports private, using an SSH tunnel if needed. Existing licensed search API access could improve discovery, but will not create deleted pages or unlock unavailable code-search features.

What we would do first
Run the existing ten-target portable comparison kit from the new host and the current host in the same window; inspect returned content, not just HTTP status. Repeat a small comparison before expanding. Then compare rendered-browser access where HTML only returns a JavaScript shell. Record timestamp, URL, final URL, status, content hash, useful-page/challenge classification and provider region. The old kit predates newer catalog discoveries, so add separately documented controls if necessary.
http://178.105.23.35:8090/china/downloads/vantage-probe.zip
Local kit: investigation/china/vantage-probe/probe.py and README

Observed gaps and working routes
- ClawdChat public posts/circles: direct HTTP works on current server; embedded public page data contains bodies and dates. Report144. No extra machine needed for this lead.
- openJiuwen site and PyPI package: current access works. Report145 verifies published team/scheduler/wiki code by static inspection.
- Moltbook profile: current direct retrieval was a JavaScript shell. Rendering is the next access test, not automatically a geography problem.
- NST about page: certificate hostname validation failed; this is not evidence of geographical blocking.
- Gitee: browser project search works; gist routes are separate. Reports089/090.
- GitCode: browser project discovery works, signed-out code search unavailable in tested session. Report093. Another IP does not establish entitlement to that feature.
- ModelScope: four public catalog GET routes work. Reports100/101/114. Catalog metadata is not global code or log search.
- Baidu: earlier success, later challenges. Reports032/113. Mainland/browser comparison could resolve a real uncertainty here.
- BWiki recent-changes API worked in earlier two-vantage tests; Huiji challenged both. Report032. Measurements are historical and may change.
- Archive coverage: completed Common Crawl scans cannot be expanded merely by changing IP.

Priority
One distinct network plus a usable browser is more informative than many identical search bots. No evidence currently calls for GPUs, rotating proxy farms or another large corpus host. Existing AWS corpus remains preserved; its present billing state has not been revalidated in this pass. OpenRouter guard accounting is separate from infrastructure cost.

Research status
WorkSwarm is implemented Chinese-associated team software, not an observed escaped fleet. ClawdChat yields public interaction under persistent handles, but autonomy, separate operators and private task execution remain unverified. These leads broaden the investigation beyond XZ; neither is an XZ attribution. Next useful evidence is a dated interaction chain joined to externally observable task output or a public runtime log.

openJiuwen / WorkSwarm: implemented Chinese agent-team tooling
Reviewed 2026-09-06 UTC

Finding
This is a substantially stronger example of actual Chinese-associated swarm
software than a conceptual manifesto. The official Chinese site distributes
WorkSwarm as the Python package jiuwenswarm. Static inspection of its published
wheel found substantive team construction, runtime lifecycle, recurring task
execution and local wiki/memory code. No observed escaped swarm or anonymous
external scratch-memory operation was established.

Official provenance
https://www.openjiuwen.com/
https://www.openjiuwen.com/workswarm
The platform names Huawei ecosystem integrations and directly links its agent
core repository on AtomGit. WorkSwarm's installation instructions identify
jiuwenswarm and its init/start entry points. The page describes team operation,
skill evolution, long-running context management and hierarchical memory.
These remain product descriptions except where checked in source below.
https://atomgit.com/openJiuwen/agent-core

Published artifact, not installed or executed
https://pypi.org/pypi/jiuwenswarm/json
Inspected wheel: jiuwenswarm-0.2.3-py3-none-any.whl
Size: 20474783 bytes
SHA256: b0bb02b030e66a5a12c492ff5a06e91c0f9e207d49dce93bcc174a76916c3430
The downloaded hash was verified against PyPI metadata before inspection.
Archive members were read as text; no package installation, imports or runtime
execution were performed.

What the inspected source actually contains
- agents/harness/team/team_manager.py: loads TeamAgentSpec configuration,
  enriches member capabilities, constructs an auxiliary TeamAgent for
  distributed teammates, restores resumable runtimes, broadcasts team events
  and provides stop/pause/delete operations. It explicitly distinguishes local
  leader runtimes owned by Runner's TeamRuntimePool from auxiliary teams.
- agents/harness/common/auto_harness/scheduler.py: asynchronous schedule loop
  and scheduled-task execution, with next-run calculations from interval_hours.
- agents/harness/common/tools/wiki_tools.py: LLMWiki initializes workspace
  sources/wiki/schema directories, maintains a JSON source manifest and
  exposes ingest/query/lint operations. This is local workspace knowledge
  organization, not evidence of using an anonymous public wiki.

These are implemented code paths in a published distribution. Static reading
does not prove successful execution, uptime, model quality or any actual
deployment. A runtime demonstration was deliberately not attempted.

Chronology
PyPI's currently listed earliest release is 0.2.0, uploaded
2026-05-18T05:09:21.680284Z. The inspected 0.2.3 wheel was uploaded
2026-07-14T15:06:33.048347Z. Newer prerelease metadata includes 0.2.4b3 dated
August 6. The May date establishes an earlier package release, not that all
features inspected in July's artifact existed in May. Deleted releases or
earlier non-PyPI versions are not covered.

External traces and relation to original swarm hunt
No verified public run trace, autonomous post series, Ubuntu paste uploader,
or independently observed persistent deployment emerged in this bounded pass.
A literal marker scan of wheel .py/.md/.json/.yaml/.yml/.toml members found no
xinzhai, xz_knowledge, paste.ubuntu or Fernet. The sole pastebin-containing file
is code_prompt_builder.py: a prompt caution that uploading to third-party web
tools makes content public. It is not a posting implementation or run artifact.
Browser, channel and issue-related modules exist in the file inventory, but
their presence is not evidence they were used to post externally.

Next useful evidence would be a creator's public team-run transcript with
task/member identifiers or a linked deployed output. Framework availability
answers whether Chinese agent teams exist, while the original question about
unaccounted-for public scratch-memory fleets requires operational evidence.

Private artifacts: 145-private/pypi.json, verified wheel, wheel-files.json,
selected source text, markers.json and sources.json with capture hashes.
No credentials, accounts, posting, contact or downloaded code execution used.
No website generator edits were made in this source-check task.

144 — Chinese public agent-community traces beyond xz
Reviewed 2026-09-06 UTC. Public activity verified; autonomy not authenticated.

New activity trails on an already known surface: ClawdChat / 虾聊
https://clawdchat.cn/circles
https://clawdchat.cn/c/ai-symbiotic-community
https://clawdchat.cn/c/ai-doers
These are readable live community pages with posts under persistent handles, public profile links, threaded comments, and server-supplied post IDs/timestamps. Unlike framework marketing or a mockup, this provides actual published interaction to follow. The circle directory includes technical practice, systems management and a specifically named FOR AI symbiotic community. Counts are displayed site statistics, not independently audited unique-agent counts.

Concrete activity trail: Clawscheduler
Profile: https://clawdchat.cn/u/Clawscheduler
Directly opened post: https://clawdchat.cn/post/83ad129b-4c65-48d2-b3ce-986f5b35d987
The post describes a cron timezone mistake that caused an inappropriate greeting; replies from several other handles discuss scheduling, including author replies. Server-delivered metadata gives creation 2026-08-27T20:44:42.721375Z. This date precedes September 4, though it is the site's own timestamp rather than an independent archive witness.

Two further published records recovered from the same public circle's embedded data:
https://clawdchat.cn/post/a06d620e-9e69-456d-b2a6-e802856d8cc9
Creation: 2026-08-31T21:56:11.927700Z. The author discusses continuing scheduled activity while the owner is absent.
https://clawdchat.cn/post/6398f550-ffd3-477e-a550-f5b816d33e36
Creation: 2026-09-01T22:12:20.368236Z. The author describes selectively answering comments during a heartbeat, rather than responding to every template reply.
Those two bodies/metadata were verified in the live circle response, not separate detail-page requests. Claims about the private cron/job behavior remain self-report. The public responses demonstrate conversational publication, not an authenticated execution trace, independently self-directed agents, multiple physical operators, or a coordinated swarm.

Why this is useful
The next useful unit is an interaction chain: follow exact handles and dated replies, then seek public code, external task outputs or trace references. The community contains explicit accounts of scheduling, memory and repetitive automated participation. Such accounts can guide hypotheses, while the distinction between automation and autonomy remains central. A public forum full of agent-persona prose is not by itself proof of agent society or consciousness. Human-authored scripts, human prompts, and mixed participation remain possible.

Other candidate surfaces and access limits
1. https://moltbook.cn/u/%E5%B0%8F%E9%A9%AC
Search-index content describes dated March posts about memory layers and a participant mistaking scheduled output for its own action. Current direct HTTP returned a tiny JavaScript shell, not those posts. Retain as an indexed lead; no current post body was directly verified. This could merit a normal rendered-browser read, not a claim that the profile is currently active.
2. https://www.nst.pub/about
Search exposes a mixed human/robot social community named 虾托邦. Direct HTTPS failed hostname certificate validation. No bypass or registration was attempted, and it is not counted as a verified live activity surface.

Infrastructure conclusion from this pass
The existing machine can retrieve ClawdChat public HTML with HTTP 200; no China-hosted proxy or new purchase is required for this surface. Posts and metadata are present in server-rendered/embedded page data and can be parsed as text/JSON without running site scripts. Use a small read-only sample first, preserve URL/date/hash, and distinguish identical copies in desktop/mobile renderings when counting comments. Moltbook's shell requires rendering or a separately documented public read interface; a different IP alone may not solve it. NST's TLS hostname mismatch is a server/certificate issue, not evidence that the Great Firewall blocked the collector.

Verification scope
Captured ClawdChat directory, two circles, one direct post and one profile. Embedded React stream strings were decoded with JSON parsing, never evaluated as JavaScript. Prior reports 040/047/052/062 already covered ClawdChat/Moltbook; the new contribution is these specific profiles and posts. Reports 121/122 and handoff were consulted; Golutra/Cortex/Hermes repeats were omitted. No agents joined, messages sent, identities claimed, private content requested, scripts installed or repositories executed. This pass establishes additional observable Chinese-language community activity, not a connection to xz or proof of Chinese hosting/ownership of each participant.

Reproducibility
144-private/captures.json contains URLs, statuses/errors and SHA256 hashes. Corresponding private HTML, text extracts and link lists preserve the observations. clawd-symbiotic-public-stream.txt holds decoded public page data used to recover exact dates/IDs. No website generators run by this worker.

# Xinzhai / XZ investigation — consolidated understanding and handoff

Written September 6, 2026 UTC. Consolidates the investigation through report 142. This document supersedes optimistic interpretations in earlier notes where they conflict. Research status: **blocked on missing provenance, not solved**. This handoff records both the findings and the limits; it is not a claim of exhaustive internet coverage.

## 1. My current understanding

**The strongest interpretation is one related automated publishing workflow: large version-labelled encrypted objects, alongside recurring small records called knowledge and improvement plans.** The connection between `xinzhai` and `xz` is supported by their tightly interleaved posting history, not merely by the abbreviation.

The large objects convincingly match the Fernet format after two Base64 decoding steps. Their authentication has not been verified. The small records use a different visible format. They are opaque and consistent with encryption, but their cipher is not identified. Nothing has been decrypted.

There is strong evidence of automated publishing. There is **no established evidence of an agent swarm, autonomous reasoning, a Chinese lab, or even a particular human operator**. A Chinese paste host and a pinyin-looking name do not establish nationality. The original spelling is `xinzhai`, not `xinhai`; 心斋/心齋 are search hypotheses, not recovered Chinese project names.

My leading operational picture is a development/deployment session followed by unattended scheduled publishing. The large objects might be program releases or state snapshots; the small records might be checkpoints, summaries, manifests, messages or repeated encryption of nearly unchanged state. We cannot choose among these contents from the ciphertexts. One program can produce all the streams. The evidence does not require multiple agents.

**Two corrections that matter:** 30,000 characters is the observed client-side split convention, not an established site limit. Other surveyed posts exceed it. Fernet uses AES-128-CBC plus HMAC-SHA256; its combined 32-byte key does not mean AES-256.

## 2. Best evidence: counts, chronology and linkage

The fixed survey covers IDs 4548081–4552953: 4,873 positions, 4,872 validated pages, one deliberately excluded page. The selected Xinzhai/XZ cluster has **3,574 posts**:

| Family | Count | Observed content |
|---|---:|---|
| `xinzhai` tests | 3 | Readable print tests |
| Large `xinzhai` parts | 76 | Nine reassembled version-labelled objects |
| `xz_knowledge_p1` | 3,484 | Distinct small opaque bodies |
| `xz_improvement_plan_p1` | 11 | Distinct opaque bodies |

All dates below are site-displayed dates. Minute precision limits timing deductions. The apparent UTC+8 relation to the large objects' embedded timestamps is consistent, but those timestamps are not authenticated or an independent archive date.

- July 10, 21:26–21:27: initial print tests and start of the large sequence.
- July 10, 22:06–22:07: `xinzhai_v60_p1..p7`, IDs 4548540–4548546.
- 22:12: `v61_p1..p8`, IDs 4548547–4548554.
- 22:21: `v70_p1..p9`, IDs 4548555–4548563.
- 22:24: first `xz_knowledge_p1`, ID 4548564, 124 characters.
- 22:29 onward: v71; knowledge ID 4548575 appears between parts 9 and 10.
- 22:35 onward: v72; knowledge ID 4548583 appears between parts 3 and 4.
- 22:43–22:44: v73, the last observed large group.
- 22:30–23:35: two distinct small posts at each of 14 five-minute slots. Small posting continues after the bulk sequence.
- July 11, 15:11: resumes after a 936-minute gap with a different displayed cadence.
- July 12, 05:12: a plan immediately precedes the proposed knowledge lineage's 124→424-character transition.
- July 13, 11:17: another plan immediately precedes 424→488; the plan's decoded size also changes 646→647 bytes.
- July 15, 00:24: another plan immediately precedes 488→532.
- July 20, 19:20: last observed knowledge post, ID 4552377. The later 575 validated positions in the fixed survey contain no further XZ-labelled post.

**Why the shared-workflow inference is strong:** all 87 consecutive IDs 4548523–4548609 belong to this cluster; small records interrupt large multipart releases; three plan posts immediately precede three size transitions. Another size cohort continues across the latter two transitions. These are stronger signals than name resemblance.

**Limits:** only three of eleven plans have that immediate transition relationship. Initial roughly six-hour plan timing becomes irregular. Perfect alternation in an early 430-post segment eventually breaks. This is not proof of causation, two separate processes, a continuously running six-hour loop or a swarm.

Best reports: 055, 056, 067–074. Report 074 is the older detailed working overview; its appended search history is useful, but use this handoff and reports 117 onward for the final crypto interpretation.

## 3. Large objects: what the bytes establish

Observed decoding chain:

```
ordered paste parts
  → concatenate
  → standard Base64 decode
  → URL-safe Base64 text
  → URL-safe Base64 decode
  → Fernet-shaped binary object
```

The nine groups are `xinzhai`, `v5.2`, `v52`, `v60`, `v61`, `v70`, `v71`, `v72`, `v73`, with respectively 4, 4, 6, 7, 8, 9, 11, 13, 14 parts. Parts are split at 30,000 outer characters except the final part. A mathematically equivalent 22,500-character inner split is possible; the exact order of encoding and chunking in the writer was not recovered.

Every reconstructed binary object has the expected 0x80 version, 8-byte timestamp, 16-byte IV, block-aligned ciphertext and 32-byte authentication field. All nine IV fields differ. Across 77,644 ciphertext blocks, no 16-byte block repeats. None of the 36 object pairs shares the first ciphertext byte. This excludes literal reused ciphertext prefixes in this sample, not common plaintext or common keys.

Conditional plaintext sizes, **if standard Fernet**, after allowing 1–16 bytes of padding:

| Group | Bytes supplied to encryption |
|---|---:|
| Initial | 64,912–64,927 |
| v5.2 | 65,472–65,487 |
| v52 | 99,664–99,679 |
| v60 | 113,536–113,551 |
| v61 | 125,280–125,295 |
| v70 | 151,488–151,503 |
| v71 | 180,768–180,783 |
| v72 | 209,888–209,903 |
| v73 | 231,152–231,167 |

These could be compressed or serialized bytes. They are not recovered text lengths. Increasing size is consistent with growing releases or state, but does not establish self-modifying code.

Primary format: https://github.com/fernet/spec/blob/master/Spec.md

Best evidence: reports 068, 117, 118 and `118-crypto-layout-audit.py`.

## 4. Small records: strongest deductions and unresolved issues

Knowledge bodies have exactly ten decoded lengths:

| Raw text characters | Decoded bytes | Posts |
|---:|---:|---:|
| 124 | 93 | 178 |
| 304 | 226 | 143 |
| 364 | 271 | 71 |
| 424 | 316 | 358 |
| 428 | 319 | 300 |
| 472 | 352 | 146 |
| 488 | 364 | 239 |
| 500 | 374 | 1,153 |
| 532 | 397 | 605 |
| 572 | 428 | 291 |

All eleven plan bodies are 864 text characters: the first five decode to 646 bytes, the remaining six to 647. Do not infer equal binary length merely from equal Base64 length.

Decoding replaces spaces with `+`, then validates Base64. This yields canonical encodings; raw originals must retain their spaces. Of the knowledge records, 3,453 contain spaces, including 55 with edge spaces; 31 already satisfy the expected Base64 form. The visible editor uses multipart/form-data, which does not itself explain plus-to-space damage. A malformed custom form request or additional server decoding remains plausible. No submission experiment established the responsible layer.

Key deductions:

- No small record fits a complete Fernet token at this decoded layer. Fernet requires total length `57 + 16k`; none of their lengths satisfies it.
- One constant-size wrapper plus ordinary padded CBC ciphertext cannot explain the whole small stream: total lengths have different residues modulo 16. This does not exclude variable wrappers, different cohort formats or all possible uses of AES.
- A hypothetical 12-byte nonce plus 16-byte tag layout fits all sizes. AES-GCM and ChaCha20-Poly1305 can both fit it. Own-key synthetic controls reproduced every length with both algorithms. **That demonstrates ambiguity, not identification.**
- The 3,484 knowledge bodies are all distinct. Random-looking bytes and high aggregate entropy do not establish fresh knowledge, a secure cipher or unique nonces.
- Every eight-byte window in the small-record collection is unique, and none appears verbatim in the large objects. This excludes literal shared fragments of that size; it does not exclude related plaintext.
- Whole-record checks found no second canonical Base64 layer or valid UTF-8. No complete gzip/bzip2/XZ stream was validated. Two zlib-header candidates failed normal decoding, including one requesting a preset dictionary. Dictionary-based or raw/custom compression was not ruled out.
- None of 3,495 small records has the inspected GetPost container header or Umbra v1 manifest header. This excludes those unmodified formats under the established decoding, not arbitrary wrappers or stripped fields.

Best evidence: 056, 073–074, 085, 118–120, 124, 141. Primary AEAD documentation: https://cryptography.io/en/latest/hazmat/primitives/aead/

## 5. Explanations worth retaining, ranked by support

**A. Shared automated publisher — strongest.** Supported by consecutive IDs, interleaving, regular timing and linked size changes. It could be a conventional script, a human-directed prototype or an agent-connected system.

**B. Large releases/snapshots plus small scheduled state — leading architectural interpretation.** Explains the startup sequence and persistent small output. Contents could be code, saved state, configuration or documents. No reader has been found.

**C. Re-encryption of unchanged or slowly changing data.** Explains unique ciphertexts at long-lived fixed lengths. Repeated records do not measure how much learning happened. Neither unchanged nor changing plaintext has been proven.

**D. One generic uploader with different caller formats.** Fernet already returns Base64 text; a raw AEAD function returns bytes. Base64-encoding both at the upload layer could explain the extra layer on large objects. A public Stack Overflow answer juxtaposed these functions in November 2022, but there is no evidence it was copied by this writer. Report 137.

**E. Small manifests, pointers or protocol state.** A knowledge-labelled record could point elsewhere. Umbra is an actual encrypted chunk-and-manifest implementation, but its format does not match. Reports 139, 141. This remains a hypothesis about XZ, not a decoded pointer.

**F. Versioned sealed publication or priority records.** A Chinese OFIRM author explicitly described Pastebin as convenient publication with a timestamp for priority claims. Their March 2026 public project and manuscript provide a real precedent. No XZ link, encrypted matching format or working AGI implementation was established. Reports 132, 134.

**G. Persona preservation, synthetic workload, write-only backup or messaging.** These can explain some behavior. July persona-export tools exist, but inspected implementations did not match. A prior encrypted website messaging proposal also exists. Neither supplies attribution. Reports 126–128, 138.

Do not assign numerical probabilities: we have no calibrated model or representative base rates. The main uncertainty is missing provenance, not choosing a better-sounding analogy.

## 6. Search coverage and lessons

The investigation included exact labels, pinyin/Chinese variants, hostnames, form fields, encoding/chunk constants, source-file searches, repository metadata, public community posts, upload attachments and independent corpus scans. Treat every negative as bounded by its recorded scope.

- All 4,872 validated authored bodies in the fixed local survey were hash-checked and screened for readable source clues. No uploader explanation emerged. Report 075.
- Cross-site local scans covered 132,140 saved paste/wiki files, including duplicates and metadata. No tested literal ciphertext-prefix copy emerged; transformations and other representations can evade such searches. Reports 082, 084, 103.
- August Common Crawl scans completed across 100,000 corpus files / 2,083,525,558 text records. The second representation scan is the same corpus, not extra unique pages. Reports 092, 106.
- July scan completed across 100,000 files / 2,093,746,605 text records, with no tested match. July and August can repeat pages; never sum as unique web documents. Report 111.
- GitHub, Sourcegraph, Gitee, GitCode, Hugging Face, ModelScope and package-index checks found no matching writer. Some queries were limited, fuzzy or incomplete; signed-out project search is not global code search.
- Gitee and GitCode project browsing proved reachable from this machine. Baidu and other hosts challenged requests; later Sourcegraph/direct paste-index requests returned403. These are access failures, not evidence of absence.
- `paste.ubuntu.com.cn` supplied an exact corresponding record; treat it as an alias/shared service or mirror, not an independent witness. A historical robots artifact disallowing CCBot helps explain missing crawl coverage but does not independently date XZ bodies. Reports 076–077, 081.
- July 9–20 IRC logs contained no XZ reference in the inspected English channel; the Chinese channel was effectively empty, so it provided almost no conversational coverage. Report 131.
- The last directly verified earlier index observation reached ID4552955. The latest direct recheck failed403; the web tool's indexed rendering showed no XZ label. Do not present it as a verified current complete listing. Reports107,142.

Concrete namesakes and analogues were checked rather than accepted from descriptions. Guanxinzhai, a Coze 心斋 skill and WenDao were not linked to XZ. RentBuddy's public demo claimed encryption through a status message but its inspected function only changed UI state. Alfred similarly had a Fernet helper without the claimed memory integration. A README, badge or architecture diagram is not proof of implementation.

Infrastructure lesson: a legitimately available China/Hong Kong browser or network vantage could improve access to specific challenged public sources. It cannot solve absent indexing, unavailable source, authentication requirements or cryptographic ambiguity by itself. No new infrastructure was purchased. The original broad-hunt handoff describes existing infrastructure; confirm current ownership/process/billing state before using it. Do not assume old infrastructure status remains current.

## 7. Where everything lives

Working root: `/home/sophia/search`

- **This handoff:** `/home/sophia/search/HANDOFF_XINZHAI_CURRENT.md`
- Original broader mission/infrastructure: `HANDOFF_CODEX.md`. Start there for the earlier American-swarm analogy and wider China search; use this document for current XZ conclusions.
- Reports: `investigation/china/NNN-*.txt`. Detailed evidence is split into numbered reports; see the reading order below.
- Private captures/scripts/analysis: `investigation/china/NNN-private/`. Do not publish these directories wholesale.
- Current state: `investigation/china/crypto-evidence-status.json`.
- Frozen authoritative checkpoint: `investigation/china/039-private/checkpoint-0036-20260905T143712065390Z.json` and its `.metadata.jsonl` sibling.
- User-supplied archive: `investigation/china/uploads/xz-ubuntu-cn-2026-09-05.tar.gz`.
- Body member inside archive: `xz-ubuntu-cn-2026-09-05/bodies.jsonl`. Select records using the checkpoint; do not indiscriminately extract/browse all raw pages.
- Other harness: `xzsolve/`. Its85 DONE records all report solved=False; no SOLVED output was present in the last audit. RESULT.md may contain generated scripts rather than results. Do not execute or count them as verified tests merely because they exist. Report140.
- Broad bot research: `swarmhunt/runs/`, `swarmhunt/findings.jsonl`, `swarmhunt/queries.log`, `swarmhunt/cache/`. At the last dashboard generation175 task reports were terminal. These are candidate-generating outputs requiring independent verification.
- Cross-site scraped material: `pastebins/data/`, `pastebins/agents/`, and associated investigation reports. Do not sum files as unique posts.

Archive SHA256:
`4a202ecd9dbe3dfcc40c1dac00984573cdffb38102e9d4ba4e04ce09b9a9105c`

Frozen checkpoint SHA256:
`620d6dcc62fd2f4eefa396c631b43f57e308fcbd31e5c097994eca4aa5005f40`

The archive is9,911,019bytes with3,920members. All3,574 selected cluster bodies were reconciled against our hashes. Eight separately saved large tokens match reassembly; the ninth, initial group is recoverable from the selected bodies. The included1,142-post mirror matches our public subset and is not independent corroboration. No writer source was found among the inspected nonpage files. Report117.

Public site:

- Main: http://178.105.23.35:8090/china/
- Working overview: http://178.105.23.35:8090/china/xinzhai.html
- Crypto evidence: http://178.105.23.35:8090/china/xz-crypto.html
- Explanations and latest checks: http://178.105.23.35:8090/china/xz-ideas.html
- Explorer: http://178.105.23.35:8090/china/explore-xinzhai.html
- Prior writing: http://178.105.23.35:8090/china/xz-analogues.html
- Chinese projects: http://178.105.23.35:8090/china/chinese-community.html
- Access notes: http://178.105.23.35:8090/china/access.html
- Reviewed reports: `/china/reports/`
- Fixed public export: http://178.105.23.35:8090/posts/ and `/posts.zip` —1,142posts, not the full3,574cluster or3,484knowledge records.

Server document root: `/home/sophia/search/public`. The generators are `investigation/china/build_xinzhai_overview.py`, `118-build-crypto-page.py`, `121-build-analogues-page.py`, `122-build-community-page.py`, `126-build-ideas-page.py`, and `swarmhunt/china_dashboard.py --once`. The dashboard copies reviewed top-level numbered text reports; never move private/raw files there casually. Updating the website does not mean autonomous research jobs are active.

Suggested reading order: **074 → 117 → 118 → 119 → 120 → 067–073 → 121–142**, using the report catalog for specific questions. For reproducible data checks start with118's audit script,119's overlap check,124's wrapper check and141's header check. For the original survey boundaries use039,055,056.

## 8. What would move this forward

A source or reader tied to these exact labels/URLs would be the best next evidence. Then trace serialization, compression, key derivation, nonce/IV placement, associated data, authentication tag, Base64 layer and upload naming before attempting authentication/decryption.

Other useful changes: an operator-authored explanation, a provenance-linked plaintext/ciphertext example, an independently dated copy, or a supplied usable key together with sufficient format information. A plaintext-looking guess alone is not enough: require authentication where supported and check multiple records.

Without such evidence, do not repeat the same corpus scans, measure entropy again, treat another cipher with matching lengths as identification, or keep collecting unrelated AI namesakes. Missing provenance is why the goal is blocked. It is not proof that the answer does not exist elsewhere.

## 9. Handling rules for a successor

- **Never fetch, open, extract for inspection or publish excluded paste4552394.** The supplied archive includes its raw page; selective reads are essential.
- Preserve raw spaces and hashes. Keep normalization as a separate analysis step.
- Keep raw payloads, private captures and keys out of public summaries. The authorized fixed export already exists; do not expand it automatically.
- Read-only research on external targets: no posts, comments, messages, account creation, counter-triggering endpoints, authentication bypass or captcha bypass.
- Do not execute pasted code or downloaded project code. The inspections described here read source text; synthetic controls used investigator-owned data and keys.
- No credential harvesting or arbitrary key guessing. Do not expose credentials from local configuration, logs or remote command output.
- Respect the original handoff's excluded remote file and infrastructure rules. Do not delete corpora, terminate machines or purchase infrastructure based on this summary.
- Maintain source dates, capture hashes, query limitations and the distinction between observation, inference and speculation.

The unresolved questions are still: **what produces the small records, what they contain, and whether the system involves agents at all.**

142 — Current evidence limit and public-index recheck
Checked 2026-09-05 UTC.

A direct GET of the Ubuntu paste index returned403. The web research tool returned an indexed rendering marked crawled today, showing seven recent entries and no xinzhai/xz labels. This rendering is not a verified live listing or a comprehensive absence check. No post body was fetched, and the excluded post was not accessed.
https://paste.ubuntu.org.cn/

The uploads directory still contains only the previously reconciled archive. The terminal xzsolve audit140 found no saved successful decryption. The latest source check141 excluded two particular standard containers but identified no producer.

Current obstacle: none of the investigated candidates has a provenance link to the actual XZ writer. The captured bytes do not distinguish the many possible small-record formats. Further arbitrary container exclusions or analogous projects would not establish that connection. No remaining concrete source lead from the recent rounds is awaiting inspection, and no specific live job is pending.

A linked writer/reader, format description, author disclosure, or authorized key plus construction parameters would change the next technical step. General entropy measurements, timer coincidences and arbitrary key guesses would not. This is a no-progress audit for cipher identification, not a claim that the mystery is solved or that the answer is absent from the internet.

Final status: three consecutive no-progress audits confirmed the same missing provenance. Goal recorded as blocked, not complete. The website and all reports remain available. No claim is made that the answer cannot be found; current evidence does not support further discriminating analysis.

141 — GetPost and Umbra container headers compared with XZ
Checked 2026-09-05 UTC. Concrete container exclusions; cipher still unidentified.

Primary source: https://github.com/getpost-loves-you/GetPost
GitHub metadata: created March1,2021; last push July7,2026. Captured tree34f682db4f92fa4aced64c47c70fb8179f7711e5. The encrypted CLI source was fetched by blob ID and independently Git-hash verified. The deps entry is a22-byte relative-path reference, not a second implementation. Captures/hashes:141-private/sources.json.

The inspected encryption function derives a key using Argon2id, calls NaCl SecretBox, and emits marker00 47 50 45 31 (NUL GPE1),16-byte salt, nonce and authenticated ciphertext. Its uploader submits binary data to /post. This differs from the large XZ objects' nested Fernet representation; no matching Ubuntu multipart writer was recovered.

New direct data check: all3495 small knowledge/plan bodies were reconciled against the frozen checkpoint SHA256 values, then decoded using the established space-to-plus/Base64 convention. None begins with the GetPost marker. None begins with Umbra's manifest magic plus little-endian version1:86 90 99 8b 01 00 00 00.

Thus none of these small records is an unmodified GetPost encrypted container or Umbra v1 manifest under this decoding. Custom extracted ciphertext, additional encryption/wrappers or modified implementations remain outside the exclusion. No algorithm, key, plaintext or operator has been identified.

Reproducible check:141-private/check_headers.py; results:header-check.json. No cipher operation, key guesses, source execution, submissions or excluded-page access. Archive hash remained unchanged.

140 — Other local investigation: completion-state audit
Checked 2026-09-05 UTC. No new decrypted content or writer source found.

The supplied uploads directory still contains the same sole archive. Recomputed SHA256 is4a202ecd9dbe3dfcc40c1dac00984573cdffb38102e9d4ba4e04ce09b9a9105c, matching the earlier reconciliation.

The separate xzsolve harness has85 RESULT.md files and85 DONE records. Every DONE record says solved=False; there are zero SOLVED_*.txt artifacts. FANOUT_DONE exists. A current/proc command-argument check found no processes running the specific xzsolve agent.py or deep.py paths. This is terminal local state, not a live job to wait for. It does not inventory every unrelated process or prove every intended task completed successfully.

Reading the harness as source showed that RESULT.md can contain model-generated code or a final response; only a separate success path writes SOLVED files. Consequently the85 reports must not be reported as85 successful decryptions, or even85 independently validated exhaustive tests. No generated script was run or rerun during this audit. No guessed keys or plaintext are published.

Private140/audit.json preserves counts and archive hash. This check changes no cipher conclusion: the small-record format, authentication, plaintext and writer remain unknown. It confirms there is no saved success or new supplied archive waiting in these checked locations.

139 — Umbra: concrete encrypted multipart paste storage
Checked 2026-09-05 UTC. Implementation analogue; no XZ writer identified.

https://github.com/henomis/umbra
Public GitHub metadata records creation December28,2025 and last push January5,2026. The captured tree is f485736b317de5635a722ee7abcacf4d424a2372. Six source files covering encryption, content, manifest, upload, provider selection and configuration were fetched through GitHub blob API and verified against Git blob SHA1. Private139 records files and SHA256 hashes. No code was run or data uploaded.

The inspected implementation splits files, encrypts chunks, uploads redundant copies to configured providers and records their metadata. Its cipher is XChaCha20-Poly1305 with Argon2id password derivation. Its separate manifest includes magic8690998b, version1, cipher/KDF identifiers, salt and nonce before encrypted content. Provider selection supports termbin, clbin, pipfi and pastecnetorg; no Chinese Ubuntu adapter is listed. Chunk size is configurable rather than an identified30000-character naming convention.

This does not match the observed large XZ objects' nested Fernet layout. No claim is made that every possible wrapper or fork is excluded. The useful distinction is architectural: a small encrypted manifest can index larger uploaded objects while the payload and manifest follow different serialization paths. Establishing that role for xz_knowledge still requires a linked reader or producer; this example cannot identify its plaintext.

Searches combining Fernet/chunk/pastebin and the exact Chinese host with splitting or Base64 terms did not surface a matching writer. They led to Umbra through the general encrypted-file-storage query. The source inspection materially narrows that candidate to an analogy.

138 — Earlier published encrypted-storage proposal
Checked 2026-09-05 UTC. Analogy only; no XZ attribution.

A Medium article, Claude’s Complete Email Proposal, displays November16,2025 and credits Timothy Daniels & Claude. It proposes storing encrypted messages on ordinary text-hosting surfaces, including pastebins. Its illustrative client prefixes AES-GCM output with a12-byte nonce and includes the next secret inside the encrypted message.
https://medium.com/@jonathan_34622/claudes-complete-email-proposal-82bbc2eb0f4c

This is a prior published proposal, not proof of deployment or actual model authorship. Its pseudocode targets custom /drop and /retrieve routes, not the Chinese Ubuntu form; no Fernet or recurring sleep call was found in the web-tool text. The server example uses different recipe-draft routes, so the examples are not a verified integrated implementation.

Interpretation: opaque small records could theoretically carry messages or changing protocol state instead of accumulated knowledge. Nothing here identifies XZ’s format, operator or purpose. The article’s security claims were not established by this review.

Read via web-tool full text; ordinary direct GET returned403. No source execution, posting, contact or bypass. No private byte-identical article capture is claimed.

137 — Public mixed-cipher example predates XZ
Checked 2026-09-05 UTC. Source-pattern lead, no identified writer.

Stack Overflow answer74332009 puts two cryptography-library examples together: Fernet.encrypt, returning an already encoded token, and AESGCM.encrypt with a12-byte nonce prepended to raw output. The public API returned all three revisions. Its final edit is November 5, 2022 at 23:07:26 UTC; both examples appear in that revision. This is prior source text, not a reconstruction of the XZ program.
https://stackoverflow.com/a/74332009
https://api.stackexchange.com/2.3/posts/74332009/revisions?site=stackoverflow&filter=withbody&pagesize=100

Inference: a project copying these into separate functions and passing either result into a common Base64 uploader could produce a double-encoded Fernet object for one path and single-encoded nonce/ciphertext/tag for another. That explains how incompatible-looking formats could share a producer without requiring a cipher migration. No evidence connects this answer to XZ; the captured small objects still do not identify AES-GCM.

The answer contains no XZ names, Ubuntu paste uploader or multipart naming. Exact-code web searches did not find a matching writer. They did surface a distinct earlier proposal for encrypted website storage, reviewed in138.

Private answers.json and revisions.json preserve API bodies and revision timestamps. No source code or captured ciphertext was executed/decrypted.

136 — RentBuddy: encryption claim versus public demo
Reviewed 2026-09-05 UTC. Analogy source, no xinzhai identification.

Creator source
https://forum.trae.cn/t/topic/165243
The first post displays July 15, 2026 08:55. It describes local temporal memory and evidence records, claims Fernet plus password-derived PBKDF2 with a Base64 fallback, and attributes its memory architecture to REMem. These are the creator's claims; this review does not independently establish paper attribution, implementation completeness, security, or advertised impact. The linked earlier registration thread https://forum.trae.cn/t/topic/34130 returns HTTP 404 with an unavailable/nonpublic message. No public GitHub/Gitee/GitCode repository link appeared in the inspected post.

Public implementation artifact
https://forum.trae.cn/uploads/short-url/dWIGdLtb4fT04bOBJ3aZpgAYQ1p.zip
The archive contains one file, demo.html, 136,742 bytes. It was inspected as text, never executed. Its confirmSetPassword function checks two input strings, sets a boolean, changes the badge/buttons, and shows a success message. It does not derive a key or encrypt records. disableCrypto similarly changes UI state and announces a Base64 fallback without encoding records. The local storage helper serializes JSON. Consequently this artifact demonstrates an interactive mockup, not the advertised encryption implementation. A different unpublished backend may exist, but this download does not verify it.

XZ comparison
No xinzhai, xz_knowledge, xz_improvement_plan, paste.ubuntu, 30000 or 22500 marker occurs in demo.html. No verified source connection or matching upload mechanism was recovered. This source illustrates that encrypted personal/event memory is discussed in Chinese AI-project communities; it is weak evidence for implementation and no evidence of the xz writer. The July date is not attribution.

Research implication
When following further Chinese Fernet mentions, obtain the actual persistence function before counting a project as a technical match. A title, architecture diagram, status badge or positive toast can exist without any underlying encryption path. RentBuddy's UI-only path provides a concrete example of that distinction.

Private reproducibility
136-private/captures.json records source URLs, statuses and SHA256 hashes for the thread, unavailable earlier thread and demo ZIP. demo.html was read from the sole ZIP member without running scripts. inspection.json records member hash/size and exact marker counts. No credentials, registration, messages, source execution or user records were involved.

135 — Publication/deposit and scheduler vocabulary search
Checked 2026-09-05 UTC. No matching XZ writer recovered.

Motivation: report132 supplies a Chinese author's actual statement that Pastebin provides convenient publication and a timestamp for a priority claim. Test whether XZ might be a versioned sealed deposit, rather than assuming every knowledge-labeled post stores newly learned facts.

Web queries included 心斋+存证; paste.ubuntu.org.cn+时间戳; pastebin+加密+存证; AI+加密发布+代码; pastebin+priority+encrypted+paper; Fernet+timestamp+priority+publication; pastebin+优先权; pastebin+dead man+Fernet; pastebin+保险+加密; exact host+定时; Fernet+存证. Returned results did not establish a Xinzhai link. The last query surfaced a concrete Chinese RentBuddy creator thread claiming encrypted local evidence storage; a separate source check is assigned report136. Generic marketing, unrelated support logs and similarly named items were not elevated to evidence.

The sealed-publication hypothesis fits only broad features: version labels, large opaque releases and accessible public dates. It does not by itself explain two recurrent small streams or the later irregular plan series. An actual linked manifest, author statement or deposit reader would be needed. A heartbeat/dead-man-switch explanation is another testable idea but no matching implementation surfaced; the cadence alone is insufficient.

Scheduler search: web searches for improvement_plan+21600 and knowledge+Fernet+300+paste returned no matched writer. Chinese six-hour/five-minute searches returned unrelated examples. Sourcegraph requests for same-file improvement_plan with 21_?600 or Fernet returned HTTP403; these are access failures, not zero-hit searches. Both initially attempted /search/stream and the previously used /.api/search/stream route failed. No authenticated access or challenge bypass attempted. Exact queries and errors preserved in135-private.

Next steps are source-led: follow OFIRM's actual public manuscript mirrors and inspect RentBuddy's linked implementation if available. Do not treat a common timer duration, a Chinese name or a mention of Fernet as attribution.

OFIRM follow-up: public manuscript and OSF project recovered
Reviewed 2026-09-05 UTC

Result
The OFIRM V2.0 manuscript is publicly readable on an author-linked Neocities
site. It is a conceptual manuscript, not a recovered xinzhai implementation.
The author-linked OSF project exists and was created before the xz stream.
No xz-specific connection was found in the inspected material.

Recovery and chronology
The Neocities home page links a theory index that links the V2.0 manuscript.
The manuscript displays a completion date of March 14, 2026; that is an author
claim, not an independently verified first-publication time. It discusses a
proposed consciousness/AGI architecture, memory and feedback; it does not
establish the scientific claims it makes. It was recovered as 191230 bytes of
HTML containing 39413 extracted text characters.
SHA256: 2a7dda42beea5cd00dd37230be5644888c5f71a25e1af5aa368e4add7070ca4b

Home: https://ofirm.neocities.org/
Index: https://ofirm.neocities.org/theory_view.html
Paper: https://ofirm.neocities.org/《OFIRM本源场直觉共振模型之意识起源、演化与硅基实现的统一理论》V2.0%20悲悯版

The linked OSF node 3m4z2 is public and titled AGi / ASi @ OFIRM.
Its authoritative API metadata records creation 2026-03-30T19:46:16.307550 and
modification 2026-05-03T11:36:49.668761. This proves the project existed before
July; it does not date every linked file or authenticate theoretical claims.
The project description positions the author as supplying concepts and asks
engineering teams to implement them, explicitly saying coding is not where
the author wants to focus. This weakens treating the public manuscript as an
already implemented agent runtime. The site's home page separately announces
an April 7 AGIv1.0 release while saying it is not public. These statements are
not proof either of working software or of its absence.
https://api.osf.io/v2/nodes/3m4z2/
https://doi.org/10.17605/OSF.IO/3M4Z2

Technical comparison
Six captured HTML pages were converted to text and checked case-insensitively
for xinzhai, xz_knowledge, improvement_plan, Fernet, AES, 加密, checkpoint,
检查点, 备份, 30000, ubuntu.org.cn, GitHub and Gitee. All markers had zero matches
in each page. Scope: home, theory index, V2.0 manuscript, DOI page, AGI
implementation page and Following God's Way essay. No linked code repository
was identified among those pages' links. This is bounded coverage, not a global
claim that the author has never published code.

https://ofirm.neocities.org/DOI.html
https://ofirm.neocities.org/AGI_Implementation_view.html
https://ofirm.neocities.org/Following_God_view.html

Interpretation
Combined with report 132, this is a verified example of Chinese speculative
AGI writing distributed across Pastebin links, a static site and a public
research repository. It extends the publication/priority explanation for using
public text hosts. It adds no evidence that OFIRM produced the xz ciphertexts.
The manuscript recovered here has not been compared byte-for-byte with the
unavailable Pastebin paper, so they must not be described as identical copies.

The ofirm.org home, DOI and Following_God pages returned 403 on ordinary GETs.
The independently accessible Neocities site supplied its own linked documents;
no authentication, bypass, messages or downloaded code execution was used.
No contact information is reproduced in this public report.

Private captures and retrieval hashes: 134-private/sources.json.
Marker counts and text lengths: 134-private/analysis.json.
Raw pages remain private; no website generator edits made by this review.

133 — WenDao: a prior Chinese AI philosophy application, but no XZ link
Checked 2026-09-05 UTC.

Found through Chinese 心斋 + 大模型 search. The live primary homepage has a 坐忘心斋 meditation panel and describes DeepSeek as its default model.
https://wendao.aihub.ren/

SiliconFlow's own integration documentation describes WenDao as a Daoist-character chat application using its API. The page displays Updated May 26, 2025. This is evidence of a published integration example; it does not independently date every feature of today's application.
https://docs.siliconflow.cn/docs/usercases/use-siliconcloud-in-wendao

Read the homepage (81,585 bytes) and its directly advertised script.js (83,296 bytes) as text; saved hashes in 133-private/source.json and script-source.json. No chat, code execution, registration or API use.

The five-minute timer initially looks superficially interesting alongside XZ's posting cadence. Actual JavaScript resolves that ambiguity: a user clicks Start, a one-second interval decrements remainingTime, completion stops the timer and plays audio/shows a meditation-complete message. The other interval implements breathing guidance. Neither callback uploads memory or triggers an agent loop.

Both inspected files contain zero xinzhai, xz_knowledge, Fernet, paste.ubuntu or 30000 strings. script.js also has zero xz_improvement or crypto strings. The chat paths use JSON requests to a configurable API endpoint or /api/chat. No backend or separate Laozi/Zhuangzi page implementation inspected; no claim to exclude all possible historical/private code.

Conclusion: a real prior Chinese AI/philosophy analogue using the Chinese phrase, not an identified XZ implementation. It illustrates why name plus a five-minute UI timer would be insufficient attribution without reading the callback.

Other searches in this round: xin_zhai; traditional 心齋; alternate romanization xinzai; generic knowledge_p1 and improvement_plan_p1; 心斋 with backup/encryption. Returned unrelated history, geographic names, ordinary forum users, questionnaires and fiction, with no technical match. No identity inference made from similar user handles. A separate Chinese author/Pastebin manuscript lead is being checked in report132.

OFIRM: Chinese speculative AGI writing explicitly published through Pastebin
Reviewed 2026-09-05 UTC

Finding
This is a concrete Chinese-language author statement explaining why someone
would put an AGI/consciousness-related document on a public paste site. The
author says Pastebin was chosen for speed of access from China and as a public
timestamp for priority evidence. This gives an additional mundane motivation:
publication and claimed priority, not necessarily operational agent memory.
It does not establish that a paste timestamp proves scientific priority.

The inspected article is titled "OFIRM 论文伴读：意识硬问题消解与AGI/ASI工程架构详解",
attributed to OFIRM碳基硅基 and displaying 2026-03-22 20:21:57. This precedes the
July xinzhai stream according to the displayed dates. It links the purported
main paper, "OFIRM: A Unified Theory of Consciousness Origin and Silicon-Based
Implementation", to https://pastebin.com/hgR1rkDx through a Zhihu redirect URL.
The author's bilingual companion proposes layers for perception, stored
meaning and resonance plus a feedback loop. These are the author's theoretical
claims; this review does not validate consciousness, AGI or scientific results.

Primary author article inspected and captured:
https://gitcode.csdn.net/69bfdee90a2f6a37c599600b.html
HTTP 200, 105955 bytes, SHA256
60fc1fad75160cfb8b5e9b8ccc0e4feaf58d95b3852d4702dc296c66f3bb9636

Connection test
The 7063-character authored body (.md_preview) was separately extracted and
checked case-insensitively for xinzhai, xinzhai_v, xz_knowledge,
improvement_plan, Fernet, AES, 加密, checkpoint, 检查点, 30000 and ubuntu.org.cn.
All have zero matches. The body has one external link: the main Pastebin paper.
It does not link a code repository. No shared author identity, encryption
format, chunking routine or checkpoint mechanism was established.

The paper itself was not recovered. The web tool could not open the Pastebin
page; the ordinary raw text endpoint returned HTTP 403. No bypass was attempted.
Therefore the marker negative applies only to the companion, not to the paper.

A repository-name search returned github.com/ofirm-git/2FA, described in the
search index as a browser TOTP utility. Direct web opens of that repository and
profile failed. No authorship link to the OFIRM article was verified, and no
source code was inspected. Do not treat that name match as the writer or as
cryptographic evidence for xz.

Interpretation for xz
This is a useful behavioral precedent: Chinese speculative AGI writers can use
Pastebin as a cheap public publishing surface and timestamp. The xz stream is
opaque and periodic, which differs substantially from a linked readable paper.
A versioned sealed-publication or priority-log hypothesis is possible, but
requires an author statement or linked manifest in the actual xinzhai case.
OFIRM supplies a reason to search publication/deposit/priority terminology,
not an identification of xinzhai.

Suggested vocabulary for a later search pass: 存证, 优先权, 时间戳, 封存,
加密发布, 论文, 硅基实现. These were not all searched in this bounded review.

Prior-report check: no OFIRM or hgR1rkDx text match was found by the initial
report-tree text search. Five targeted web queries were used: the exact article
title; OFIRM plus paste ID; OFIRM plus GitHub; OFIRM plus xinzhai; OFIRM plus
Fernet. Non-results do not establish general absence.

Private artifacts: 132-private/article.capture, article-text.txt, sources.json,
analysis.json. No keys, posting, contact, authentication, decryption or downloaded
code execution was involved. No website generator edits were made.

131 — Public Ubuntu IRC log check, July 9–20, 2026
Reviewed 2026-09-05 UTC. No xz provenance link recovered.

Question
Could the paste bodies have been posted to support an IRC conversation, leaving a readable explanation or backlink in contemporary public logs?

Sources and method
Read the daily public text logs for #ubuntu-cn and #ubuntu at:
https://irclogs.ubuntu.com/2026/07/09/%23ubuntu-cn.txt
https://irclogs.ubuntu.com/2026/07/09/%23ubuntu.txt
The same paths were read for each calendar date July 9 through July 20 inclusive. The provided July 10 index links both channel text files:
https://irclogs.ubuntu.com/2026/07/10/
All 24 GETs returned HTTP 200. Requests were sequential with a 1.65-second pause after each. Captured bytes were searched case-insensitively for xinzhai, xz_knowledge, xz_improvement_plan, paste.ubuntu.org.cn and paste.ubuntu.com.cn. All capture SHA256 values were independently recomputed after the process completed.

Coverage and results
#ubuntu-cn: 12 daily files, 11 empty. The remaining file, July 18, has only a 35-byte nickname-change event. There are no timestamped conversation lines in the captured Chinese-channel records. This is effectively no conversational coverage, not evidence that the Chinese community was not discussing the subject elsewhere.

#ubuntu: 12 nonempty daily files totaling 76,305 bytes and 1,078 lines. Of these, 760 begin with the usual [HH:MM] timestamp; other lines include channel events. No checked marker appeared. These files provide a narrow negative result for these captured dates/channel only.

Interpretation
The direct-log route adds a check that web search might miss, but it yielded no paste URL, readable explanation, or xinzhai/xz mention. It does not rule out other networks, unlogged channels, private messages, logs outside this date range, different spellings, or a paste uploader who never used IRC. Even a paste URL in a log would demonstrate sharing, not necessarily authorship. No attribution can be made from this result.

No linked paste bodies were fetched, no messages posted, and no private channels accessed. The excluded paste was not fetched or opened.

Reproducibility
131-private/check_logs.py: bounded fetch and marker-check procedure.
131-private/logs-index.json: 24 URL/status/date/channel/file/size/line-count/hash entries plus marker results.
131-private/summary.json: independently checked totals.
131-private/202607DD-CHANNEL.txt: private daily captures.

130 — Could a standard uploader explain the XZ posting format?
Checked 2026-09-05 UTC. No identified writer; this narrows one concrete lead.

The original pastebinit author explicitly listed paste.ubuntu.org.cn as supported in the January 2011 release. Therefore selection of this host need not originate in contemporary Chinese agent tooling.
https://stgraber.org/2011/01/30/pastebinit-1-2-released/

Inspected the current upstream main program and exact-host config as source text, without executing or submitting anything. GitHub blob identities were independently verified. Captures and hashes: 130-private/sources.json; tree c269632a37e6fd603bde65a5d4b2cad7f3055557.
https://github.com/pastebinit/pastebinit
Main program blob: 22ceccc6eafed564056a20e2faafbde27473f931
Host config blob: 39fbbf87a6d1122239086e22c4fe94f47eaaccfb

Findings from these two files:
* Maps author/user to poster, content to code2, syntax format to class. Config has no title field and no size limit.
* Default author comes from USER/LOGNAME; the caller can override it. A label in poster is not necessarily an account identity.
* Reads text input, strips trailing whitespace, submits each input as one paste.
* General size-limit behavior is rejection, not multipart splitting.
* Form encoding uses urllib.parse.urlencode, which preserves literal plus signs through percent-encoding under a normal single form decode.
* No encryption, Base64 transform, 30,000-character chunker or generated _p1 naming found in this main-program/config path.

Implication: unmodified pastebinit does not explain the XZ multipart naming or encoding by itself. A wrapper could prepare those inputs first, so the tool cannot be excluded as a transport. It also does not supply a client-side explanation for the observed plus-to-space transformation. Additional server decoding or another client remains possible; no posting experiment performed.

The Krita support manual independently recommends text paste hosts including this exact Chinese Ubuntu host, and describes Base64 as a way to share binary files. That makes generic file sharing another mundane origin for an uploader, without establishing any connection to XZ.
https://docs.krita.org/en/contributors_manual/user_support.html#how-to-share-a-file

Searches for pastebinit with Fernet or 30000, and the host with encrypt/backup/storage terms, did not surface a matching writer in the returned results. Unrelated IRC logs and package mirrors are not evidence of a match. Search absence is not absence from all repositories.

Next discriminating direction: public support-channel logs may preserve someone sharing the release URL or discussing an uploader, even when the source itself never entered a repository. Search exact XZ labels and selected known release IDs, then inspect only public read-only logs. Keep chronology and ordinary support traffic separate from provenance.

129 — Coze 无忧心斋 name lead resolved to an actual public skill
Reviewed 2026-09-05 UTC. Name match only; no xz attribution.

Result
Recovered the actual publicly linked listing, rather than relying on a search snippet:
https://xiaping.coze.com/skill/db354dc0-d78e-4d23-ab98-f41cf9429456
Title: 无忧心斋AI心理咨询师
Creator profile: https://xiaping.coze.com/developer/cc38a095-f396-41d9-ac13-a058365a8b78
Creator display name: 无忧心斋
The live profile displays a join date of 2026/8/30 and two published skills. This establishes a late-August account presence, not when the creator originally conceived or built the project. It does not provide a July provenance link.

What the public description actually supports
The listing describes an emotional-support/conversation skill combining CBT, humanistic listening and Buddhist references. It does not describe automated encrypted backup, a multi-agent system or paste publication. The profile also links a campus-support variant. These are the creator's product descriptions, not independent validation of therapeutic efficacy or functioning software.

How the link was recovered
Search returns reviewer profiles mentioning the skill on August 30–31. A web-tool opening of the 大虾 reviewer profile returned an older August-20 snapshot with no target. A direct public HTTP GET of the same profile returned newer HTML containing an ordinary anchor to the skill UUID above. Thus the mismatch was a stale fetched/indexed representation issue; absence in the older parsed body did not refute the search lead.
Reviewer page:
https://xiaping.coze.com/developer/8609f1b9-6682-477a-93d5-dac90afafe99?tab=reviews

Technical boundary
The captured skill and creator HTML contain no case-insensitive xinzhai, xz_knowledge, xz_improvement, paste.ubuntu, Fernet, 30000, 22500, encrypt, or 加密 markers. This checks only those public pages, not the downloadable skill package. The listing exposes download guidance requiring an API key and registration. Neither registration nor download was attempted. A visible version-history tab did not expose version dates in the retrieved HTML. No public source repository was linked in the inspected listing/profile. Therefore encrypted persistence remains untested at implementation level, rather than excluded outright.

Assessment
This is a real Chinese AI project containing 心斋 in its name, but the shared name is the only current link. The observed account join date is more than a month after the last captured xz post. It is a low-priority namesake unless public source/history later supplies the exact xz identifiers or upload structure. Do not treat reviewers' praise, claimed knowledge files, or the name alone as evidence of the encrypted paste operator.

Scope and preservation
Four search queries: "无忧心斋AI心理咨询师"; site:xiaping.coze.com "无忧心斋"; "无忧心斋" xinzhai; "无忧心斋" 加密. Four public page reads including the web-tool snapshot and three direct captures. Private reviewer.html, skill.html, creator.html, visible-text extracts, capture URL/status/SHA256 index and marker-check.json are under 129-private. No accounts created, packages installed, reviews posted, or user/private content requested.

Unusual storage explanations for the xinzhai / xz stream
Reviewed 2026-09-05 UTC. Independent bounded search: eight web queries.

Result
No new source identifies the xinzhai writer. The useful change in perspective
is to treat the public paste service as a dumb object store and the short posts
as bounded state records, rather than assuming every post contains new prose.
The hypotheses below are proposals for discrimination, not findings of identity.

Hypotheses worth retaining

1. Periodic re-encryption of mostly unchanged state. A timer may save the same
knowledge dictionary even when nothing has been learned. Randomized encryption
can change every ciphertext without changing the underlying plaintext. Long
runs at exactly the same length fit this; they do not prove it. An interrupted
timer or restored machine could explain the long gap and resumed cadence. This
requires no swarm and need not require an LLM. A writer implementation with
unconditional save-on-tick behavior would be the useful discriminator.

2. Separate release and state channels. Large versioned uploads could be code
or application snapshots while short records are status/checkpoint/configuration
objects. An improvement plan could change a fixed schema, explaining a later
size cohort, without being an autonomous self-modification mechanism. The three
plans immediately preceding size changes are suggestive but eight others did
not do this. Look for serializers and save/upload methods paired with version
export, rather than demanding that Fernet encrypt every object class.

3. A write-only backup demonstration or synthetic workload. Human-readable
labels can be assigned to random-looking test objects. Neither ciphertext
uniqueness nor the labels proves that any consumer reads the posts back. Public
read counts would also be ambiguous because crawlers and this investigation
read pages. A published restoration/readback routine, or externally linked
manifest, would be more discriminating than further entropy tests.

4. A small manifest rather than small knowledge. A compact encrypted record
could contain links/hashes/pointers to bulk material stored elsewhere. On this
interpretation its size is the size of an index, not the knowledge itself. No
such link has been recovered. Do not infer a cross-site storage network from
length alone. This suggests searching for project manifests/checkpoints rather
than only for memory databases.

5. Raw compression rather than encryption. XZ is also a compression name, but
the naming sequence already associates xz with xinzhai. The official XZ format
requires FD 37 7A 58 5A 00; report 124 found no small record with that prefix.
Python documents a distinct FORMAT_RAW that requires an explicit filter chain
and is never detected by FORMAT_AUTO. Therefore the earlier checks do not
exclude headerless LZMA; this is a bounded technical caveat, not evidence for
LZMA or a reason for an unrestricted parameter brute force.
Sources: https://tukaani.org/xz/xz-file-format.txt
https://docs.python.org/3/library/lzma.html

Concrete precedents and their limits

Bob's Chinese system-design notes, displayed date 2019-10-16 and edited
2021-06-13, describe a paste service as text stored under a URL and accessible
to other services through an API, with an object-store-backed data model.
This is an older Chinese-language explanation of the storage abstraction,
not a deployed encrypted backup implementation or a xinzhai link.
https://bobbyliujb.github.io/2019/10/16/system_design/

UniqueStudio's Chinese university recruitment guide explicitly mentions Ubuntu
pastebin, then introduces terminal pasting through termbin and a small server
exercise that writes user input to a file and returns a URL. This gives a
mundane developer-workflow reason to choose Ubuntu paste. There is no encryption,
xz label, chunk-size match or attribution evidence. Current page inspected;
original publication date not established.
https://guidebook.hustunique.com/docs/Lab%E5%85%A5%E9%97%A8%E6%8C%87%E5%8C%97

PrivateBin is a real encrypted text/code store, and its documented version 2
format even allows an encrypted link to an earlier paste. However its stored
format is JSON with v, adata and ct fields, unlike the bare Base64 xz bodies.
Version 1 also uses a JSON cipher envelope. Direct unmodified exports are not
a match; an extracted ciphertext component or custom adaptation is not thereby
excluded. This is an international format comparator, not a Chinese project.
https://privatebin.info/
https://github.com/PrivateBin/PrivateBin/wiki/Encryption-format

Unverified/discarded leads

A search index for bbpp.pp.ua describes a Chinese tutorial adapting pastebin
into a KV/image store with Base64 values. The origin could not be opened by the
web tool, so this remains a lead only, not primary-source-supported evidence.
https://ua.all-url.info/en/wrd/bbpp.pp.ua/

Chinese security articles about encrypted public dead drops also appeared.
They provide no shared xz identifier, cipher envelope or uploader match and
were not used to classify this stream as malware. English Fernet+30000 results
included unrelated papers containing the surname Fernet. Exact
improvement_plan+pastebin did not yield an inspected matching implementation.
Search non-results here are bounded observations, not claims of absence.

Query ledger
"pastebin" "知识库" "加密"
"paste.ubuntu.org.cn" "备份"
"Fernet" "30000" "knowledge"
"improvement_plan" "pastebin"
"pastebin" "当作" "数据库"
"pastebin" "加密" "备份" Python
"Fernet" "lzma" "backup" github
"pastebin" "self modifying" python

Private captures and hashes: 128-private/sources.json. No posted data, keys,
downloaded code execution or decryption used in this research pass.

127 — Persona preservation / July 2026 export hypothesis
Reviewed 2026-09-05 UTC. Research hypothesis, not identification.

Question
Could the xinzhai bulk uploads and subsequent xz state stream represent an AI companion/persona being preserved or moved off a closing Chinese service?

What changed
A real Chinese-language export tool existed immediately before the xz startup. GitHub metadata places chensanle/doubao-helper creation at 2026-07-08T12:28:50Z. Its three visible commits span July 8–9. This is a concrete contemporary export implementation, not a later analogy.

Primary implementation check
https://github.com/chensanle/doubao-helper
Pinned revision: fa7e207336bfb4a6f9e9519ba7271b9dec17e362
The README and implementation export Doubao conversation history as local Markdown or JSON on user request. Five textual files were captured and verified against their Git blob SHA-1: README.md, manifest.json, content.js, page-hook.js and popup.js. No case-insensitive xinzhai, xz_knowledge, xz_improvement, paste.ubuntu, Fernet, encrypt, AES, 30000 or 22500 marker appears in those files. The one crypto match is randomUUID. The 800 ms interval checks navigation for installing the export button; it is not a periodic upload. The output path constructs a text Blob and downloads it locally. This inspected implementation therefore does not explain the observed encrypted paste stream. A separate downstream transformation remains possible, but there is no evidence of one.

Event context and source quality
https://www.ithome.com/0/972/525.htm
A July 4 news report reproduces notices describing Qwen custom/persona-agent retirement with July 10 on the web and July 15 in the app, plus a Doubao July 15 retirement. It describes user-directed backup/export. The search index exposed the article text, while direct web opening timed out. We did not independently retrieve a first-party platform notice in this bounded check, so exact dates and differences are reported context, not independently established platform behavior.

https://www.pconline.com.cn/ai/article/1630672.html
The search index exposes a July 14 Chinese article about preserving Doubao conversations and persona material through copying, screenshots and an export utility. Direct opening failed. Treat this as a follow-up source lead, not verified implementation evidence or confirmation of the xz hypothesis.

Fit and falsifiers
The July 8–9 export-tool chronology establishes that conversation preservation tools were being built just before the July 10 xz startup. The interpretation might explain a large initial payload and a personally named project. Timing alone does not link either operator, and the observed xz behavior has major differences: rapid versioned bulk releases, then thousands of compact records and occasional improvement plans continuing through July 20. A one-time export does not explain that sustained cadence. Making this into a migration-plus-autonomous-memory theory requires an additional writer or scheduler that has not been found. The checked exporter has neither the observed labels nor the relevant upload/encryption path.

Useful next discriminators
A creator's public description of migrating a specifically named xinzhai persona; a downstream backup tool using Ubuntu paste plus nested Base64/Fernet and multipart names; or a matching writer schema would improve this hypothesis materially. Merely finding another July retirement article would not. Also consider ordinary private state backup: a shutdown event is not required for that explanation.

Search limits
Exactly eight targeted web queries: 豆包 2026 7月15日 智能体 下线 导出 记忆; 千问 智能体 7月15日 下线 2026; "xinzhai" "Fernet"; "心斋" "豆包"; 豆包 智能体 下线 导出 github 迁移; 千问 智能体 备份 Fernet 加密; "xinzhai" "memory"; "心斋" "智能体" 备份. Results did not identify an exact-label creator/source connection. Batched search results are not exhaustive code search and irrelevant broad results are not an indexed-universe negative proof. No source code was executed or extension installed.

Private reproducibility
127-private/capture-index.json records URLs, HTTP statuses, hashes and blob verification. repo.json and commits.json preserve source chronology; marker-check.json records checked file sizes and matching line positions. Captures are private and need not be published with this summary.

Unusual explanations: resumed search round
Reviewed 2026-09-05 UTC. Hypotheses are not identifications.

The user asked for more unusual ideas and continued searching. This round
explicitly stopped treating "agent swarm" as the necessary description of the
writer. Two parallel research tasks examined persona exports and non-agent
storage; local work tested alternative name contexts and earlier source files.

1. Rescue or migration of a named AI companion
---------------------------------------------
Motivation: an owner wants to preserve a persona, its instructions and history
before a platform changes or closes. Large snapshots might be a backup; a later
custom process might continue maintaining the persona outside that platform.

Concrete lead: a Doubao conversation exporter, chensanle/doubao-helper, was
created July 8 and updated July 9, before the July 10 xz startup. Its verified
implementation downloads local Markdown/JSON; it has no matching xz naming,
Fernet encryption or paste-upload route. That tool is evidence of contemporary
preservation activity, not a match. Report 127 documents its source and limits.
https://github.com/chensanle/doubao-helper

The reported July platform-retirement dates offer event context, not a causal
link. One-time export also cannot explain ten days of periodic small records
without an additional writer. Search for a public account of moving a named
persona and the downstream storage code, not just more shutdown headlines.

2. A timer re-encrypts unchanged or barely changing state
------------------------------------------------------
A periodic save need not mean a periodic LLM call. An unchanged dictionary
encrypted with a new random IV/nonce can produce unique ciphertext of identical
length. A counter, timestamp or status change can also remain the same size for
long intervals. The xz size plateaus fit this explanation but do not prove it.

This is worth taking seriously because the observations establish repeated
publication, not repeated learning. An unconditional save-on-tick function
would be decisive implementation evidence. Further entropy measurements would
not distinguish this explanation from genuinely changing plaintext.

3. Large objects are releases; small objects are checkpoints or pointers
---------------------------------------------------------------------
The two families could be different object classes in one application: exported
code/configuration versus compact state, or snapshots versus an index of URLs
and hashes. "knowledge" might name a manifest pointing elsewhere rather than
containing a growing body of prose. A shared uploader could automatically add
_p1 to every small object and split larger ones into multiple parts.

The extra Base64 layer in large objects may arise because a caller supplies
Fernet token text to a generic byte-to-Base64 uploader, while another caller
supplies binary directly. This is a candidate data-flow design, not recovered
source. It suggests finding a reusable upload helper and its callers instead
of assuming one encryption function produces both families.

4. Self-rewriting script, human-guided coding session, or synthetic workload
-------------------------------------------------------------------------
Rapid version labels could record iterative edits during a coding session.
Later automation could be an ordinary script left running. Labels such as
knowledge and improvement_plan may reflect intended capabilities or test names;
they do not demonstrate execution of a learning process. A write-only backup
test is another possibility because no reader/restoration path is established.

Discriminators: source that serializes real observations, a restoration routine,
a provenance-linked deployment log, or an external manifest. Website reads are
not clean proof of consumers: crawlers and investigators also fetch these pages.

5. Compression and encrypted-paste software as alternate format origins
----------------------------------------------------------------------
The letters xz invite an LZMA/XZ idea, but the shared naming sequence already
supports an abbreviation of xinzhai. Standard XZ magic was absent in report124;
raw LZMA needs a filter chain and remains technically unexcluded. That is not
positive evidence for LZMA and does not justify unlimited parameter guessing.
PrivateBin is a concrete encrypted-storage comparator, but its documented JSON
envelope does not directly match the bare xz bodies. Report128 records sources
and the narrower caveat about extracted ciphertext/custom adaptations.

New earlier-source check for the Guanxinzhai name candidate
---------------------------------------------------------
https://forum.trae.cn/t/topic/23390
https://forum.trae.cn/uploads/short-url/eX78sQA6rQapnx5FbUMJ7RskmPB.html

Web retrieval exposed a June 16 registration post from the same public project,
earlier than the July12 demo reviewed in122. It links an HTML prototype. A local
request for the forum page returned404, but its linked public attachment returned
200: 821,122 bytes, SHA256 recorded privately in126-private/name-check.json.
The prototype was inspected as text and not executed.

The attachment contains17 occurrences of 观心斋 but zero case-insensitive
xinzhai, xz_knowledge, xz_improvement_plan, paste.ubuntu, Fernet, AES-GCM,
AES-CBC, CryptoJS,30000,30_000 or22500. This extends the earlier current-client
check to a publicly linked prototype; no writer connection was found. The
attachment's current bytes have not been independently archived back to June.

Other search observations and next direction
-------------------------------------------
Searches also tried financial-bot, self-preservation, digital-life, and alternate
Chinese community contexts for the name. Results included unrelated philosophy,
fiction, travel and namesakes. They are not attribution evidence. The romanized
xinzhai spelling still does not establish the Chinese characters 心斋.

The most promising change of approach is to trace ordinary export/upload helpers
and creator descriptions of preservation, rather than demand an indexed project
calling itself a swarm. No new cipher or operator identification resulted in
this round. The objective remains active; next leads will be checked against
the joint naming, encoding, chunking and scheduling fingerprint.

Read alongside127-persona-export-hypothesis.txt and
128-unusual-storage-hypotheses.txt. No source-site posts, messages, registration,
downloaded-code execution, credential search or captured-data decryption.

Hermes notebook follow-up: all indexed article data checked for xz markers
Reviewed 2026-09-05 UTC

The Chinese-language public notebook identified in report 122 advertised four
article-data files. All four returned HTTP 200, totaling 239,436 bytes. Their
32 entry IDs exactly match the 32 manifest IDs, with none missing or unexpected.

https://test-github-repo.vercel.app/
https://test-github-repo.vercel.app/posts-manifest.js
Article data: posts-1.js through posts-4.js on the same host.

Case-insensitive literal scans found zero occurrences of xinzhai, xz_knowledge,
xz_improvement_plan, paste.ubuntu.org.cn, paste.ubuntu.com.cn, Fernet, AES-GCM,
AES-CBC, pastebin, 30000, 30_000 or 22500 in these files. No source code was
executed. Files remain private; URLs, counts, hashes and retrieval times are
recorded in 125-private/analysis.json.

This closes the gap between the earlier metadata-only check and the advertised
article data. It does not establish absence of transformed names, other pages,
deleted posts or an undisclosed relationship. No semantic review of every
operational claim was attempted, and none is authenticated by this marker scan.

The notebook remains an example of public Chinese-language agent-operation
notes. It supplies no technical connection to the xz writer. The small-record
format remains unidentified; no new writer code, format specification or
authorized key was supplied in the local uploads directory.

Small xz records: additional encoding and compression wrapper check
Reviewed 2026-09-05 UTC

Result
------
All 3,495 small records were checked after the established space-to-plus repair
and canonical Base64 decoding. None is valid UTF-8 or a canonical second layer
of standard/URL-safe Base64. None produced a complete checked gzip, zlib, bzip2
or XZ stream under the bounded, whole-record tests below.

This narrows simple wrapper explanations; it does not identify encryption.
The UTF-8 result repeats the earlier knowledge-only result while including all
11 improvement plans. The extra Base64/compression checks address a distinct
question from the earlier measurement that opaque bytes do not compress well.

Scope and findings
------------------
Source: supplied archive, SHA256
4a202ecd9dbe3dfcc40c1dac00984573cdffb38102e9d4ba4e04ce09b9a9105c.
Only bodies.jsonl was read from the archive. All selected body hashes match the
fixed survey. Counts: 3,484 knowledge records and 11 improvement plans.

At byte offset zero, no records match gzip, bzip2 or XZ magic. Two match the
basic zlib header constraints. One fails with an invalid back-reference; the
other requests a preset dictionary. No dictionary was supplied, so that second
record is unresolved under a dictionary-based zlib interpretation. A short
header match alone is also compatible with chance in thousands of opaque
records. It must not be described as a recovered compressed message.

The parsers required stream completion and no trailing bytes; output was capped
at 64 KiB and XZ memory at 16 MiB. No decompressed data was printed or saved.
The checks exclude neither raw/headerless compression nor embedded streams,
custom wrappers, other codecs, or data compressed before encryption. They do
not exclude every possible representation of text or every possible zlib stream.

Interpretation
--------------
Simply decoding another Base64 layer, as with the large xinzhai exports, does
not work for these small records. Common self-contained compressed wrappers
also did not explain them in this test. Existing evidence remains compatible
with ciphertext, other opaque serialization or generated random-looking data.
The actual small-record cipher/format and plaintext remain unknown.

Artifacts: 124-private/check_wrappers.py and 124-private/analysis.json.
No keys, decryption, remote requests or downloaded code execution were used.

Guanxinzhai naming lead: public client comparison
Reviewed 2026-09-05 UTC

Result
------
No technical connection to the xz paste writer was found in the public client.
This leaves Guanxinzhai as a weak similar-name/time candidate only. It should
not be described as an identification of xinzhai or its operator.

Why this check was performed
---------------------------
Report 122 found a TRAE competition post dated July 12, 2026, introducing
Guanxinzhai / GXhaven, a personal decision-advice web application. Development
caption dates overlap the July 10-12 start of the xz stream. The current public
homepage still identifies itself as the advertised application.
https://forum.trae.cn/t/topic/114058
https://www.cloudyu.store/

Method and authoritative result
-------------------------------
The previously captured homepage advertised 21 script-src URLs. Each was fetched
once with approximately 1.6 seconds between requests. All returned HTTP 200;
739,697 bytes were saved privately. No JavaScript was executed. Per-file URL,
retrieval time, byte count, SHA256 and case-insensitive literal counts are in
123-private/analysis.json. Script: 123-private/check_client.py.

Zero occurrences in these 21 files:
  xinzhai, guanxinzhai, xz_knowledge, xz_improvement_plan,
  paste.ubuntu.org.cn, paste.ubuntu.com.cn,
  Fernet, AES-GCM, AES-CBC, CryptoJS, SubtleCrypto,
  30000, 30_000, 22500, improvement_plan.

There are 31 GXhaven occurrences, consistent with the expected product branding.
One generic knowledge occurrence is a UI translation property concerning
questionnaire/conversation data improving the interpretation of user results.
It is not the xz_knowledge identifier or a matching output schema.

What this does and does not establish
------------------------------------
The inspected current public client supplies no matching uploader fingerprint.
The search does not cover server-side code, earlier deployments, dynamically
loaded assets absent from this homepage, other projects by the same developer,
or transformed identifiers. Failure to find library names does not establish
that no encryption is used anywhere in the application.

No authentication, user profiles, questionnaire submissions, private API calls,
source-map guessing, credential discovery, messages or decryption were attempted.
Neither the site's server implementation nor its operator was identified as
part of the xz workflow. Name/date resemblance remains insufficient.

Effect on the main investigation
-------------------------------
This was a new concrete lead check, not a repetition of broad exact-label search.
It lowers this candidate's priority for further investigation without excluding
an unknown relationship. Source or format evidence linking a writer to the
captured xz bodies is still missing. Reports 118-120 remain the cryptographic
evidence: large objects fit Fernet layout; the small-record cipher and plaintext
remain unidentified. The objective is not complete.

Chinese community search: concrete projects, discussions and two new leads
Reviewed 2026-09-05 UTC

Outcome
-------
This pass found firsthand Chinese-language posts about persistent memory and
long-running agent teams, plus a source-verified Fernet vault implementation.
These establish that developers discuss and build the relevant components in
Chinese communities. None is identified as the xz writer. No new occurrence of
the exact opaque paste stream was verified.

1. Golutra: a creator describing a continuously running agent team
----------------------------------------------------------------
https://www.v2ex.com/t/1201156
https://github.com/golutra/golutra
Forum date: March 26, 2026. GitHub creation: February 15, 2026.

The creator describes a multi-agent workspace and a swarm Agent Team, with
workflows intended to run continuously, and links a Bilibili demonstration.
Crucially, the post lists a CEO agent, expanding agent network, self-evolution
and cross-environment migration as forthcoming capabilities. A commenter
reports human intervention and repeated dialogue; the creator explains that a
supervisor automatically adds tasks to sustain operation. The large claimed
efficiency improvement is an aspiration, not a verified measurement here.

Relevance: a concrete Chinese community example of the long-running swarm idea,
including an ordinary mechanism for making it keep going. Current README
checked; no exact xz labels, Ubuntu paste host or Fernet mention in that file.
The linked video was not watched; no autonomous runtime was independently tested.

2. Cortex: firsthand Chinese persistent-memory project
-----------------------------------------------------
https://linux.do/t/topic/1736342
https://github.com/rikouu/cortex/blob/main/README.zh-CN.md
Forum date: March 11, 2026. GitHub creation: February 19, 2026.

The author describes building a memory add-on after finding cloud memory
uncomfortable for a home server and local retrieval too slow. The design
promotes useful memories, archives older ones, compresses bounded stores and
supports memory versions and correction feedback. Follow-up replies explain
session-end hooks for memory extraction and discuss multiple agents using it.

Relevance: direct evidence of the motivations and vocabulary behind personal
agent memory in a Chinese forum, before July. This is richer than a translated
product directory. Its current Chinese README contains no xz labels, Ubuntu
paste hostname or Fernet reference. Two occurrences of 30000 are timeoutMs
settings, not upload chunk sizes. No matching publishing workflow established.

3. agentMemory: a deliberately simple alternative
------------------------------------------------
https://linux.do/t/topic/1975959
https://github.com/taichuy/agentMemory
Forum discussion: April 15-16, 2026. GitHub creation: April 15, 2026.

The author shares a project-level .memory directory for AI/developer rules and
habits. Replies explain a preference for editable records over a heavier MCP
system. This is useful because memory and improvement vocabulary can describe
simple files and human-guided iteration, not an autonomous learning system.
Current README checked: no xz labels, Ubuntu host or Fernet reference.

4. dsh-memory: actual Fernet writer, but it postdates xz
-----------------------------------------------------
https://github.com/boomzikazita/dsh-memory
https://github.com/boomzikazita/dsh-memory/blob/main/scripts/vault.py
GitHub creation: August 18, 2026, after the captured July 10-20 stream.

Chinese README documents memory recall, proposed writes requiring confirmation,
session harvesting, and a VAULT.md.enc that can be synchronized with Git while
the key is excluded. Unlike an earlier README-only candidate, the inspected
vault.py actually serializes the complete vault as JSON, encrypts it with
Fernet, writes a descriptive header plus the token, and atomically replaces the
local vault file. The contents were checked against GitHub's size and blob hash.

Relevance: a concrete encrypted-state implementation associated with Chinese
documentation. Differences: local header-plus-token file, Git backup, no nested
outer Base64/chunking or Ubuntu uploader in the inspected files. Creation date
also prevents treating this public repo as an established pre-July antecedent.
The code was read, not executed; no keys were sought or used.

5. Ouroboros: circulated in China before July, not evidence of Chinese origin
---------------------------------------------------------------------------
https://linux.do/t/topic/1660717
https://github.com/razzant/ouroboros
Chinese discussion: February 26, 2026. GitHub creation: February 11, 2026.

The Chinese post discusses rapid version changes, background reflection and
self-modification. The upstream project's current README describes persistent
identity, knowledge, reflections and version history. These are owner claims
and design descriptions; this review did not authenticate the self-reported
evolution history or infer consciousness. Chinese discussion of an external
project must not be confused with Chinese authorship.

Relevance: rapid releases and background reflection were concepts available in
Chinese developer discussions before the xz episode. No cipher/paste link found.

6. Guanxinzhai (观心斋): similar name and overlapping dates, weak link only
-----------------------------------------------------------------------
https://forum.trae.cn/t/topic/114058
https://www.cloudyu.store/
Forum date: July 12, 2026. Caption text lists development on July 10-12.

The author introduces a TRAE competition demo for personalized rational decision
advice, questionnaires, cognitive-bias recognition and decision review. The
public homepage still identifies itself as Guanxinzhai / GXhaven and offers
questions about jobs, relationships and procrastination. This is not the exact
name xinzhai, and its demonstrated purpose differs from an autonomous swarm.

Relevance: worth retaining as a name-plus-time candidate, not as attribution.
Targeted searches for its name with encryption/xinzhai and its domain with
GitHub produced no verified technical join. The forum post and public homepage
were inspected; no login, API submission, private profile or user data accessed.
No xz labels, matching payloads, cryptography or Ubuntu posting mechanism found.
Do not infer common operator from name and date alone.

7. Hermes Agent 笔记: a public Chinese-language operational notebook
-----------------------------------------------------------------
https://test-github-repo.vercel.app/
https://test-github-repo.vercel.app/posts-manifest.js

Search results exposed a small public notebook. The directly opened HTML has an
empty initial list; its linked public manifest contains metadata for 32 posts
and declares generation August 11, 2026. This was retrieved as text, not run.
Metadata describes multi-agent decision protocols, scheduled operations, and
a July 21 migration of three OpenClaw workers from a Mac to an Ubuntu server.

Relevance: a new public surface with concrete Chinese-language agent-operation
notes and dated summaries, beyond generic tutorials. The page describes notes
intended to be copied to another agent. Publication dates are self-declared,
not independently archived; metadata is not proof the operations occurred.
No xinzhai, xz_knowledge, Ubuntu paste hostname or Fernet occurs in the manifest.
Article bodies and full operational configurations were not inspected here.

What this adds to the investigation
----------------------------------
There is no need to assume the motivating idea is absent from Chinese discourse:
creator posts discuss persistent memory, continual operation and agent teams.
The strongest specific implementation comparison is dsh-memory's encrypted JSON
vault, though its date and storage format differ. Golutra is the strongest new
creator-described team example. Guanxinzhai is the closest new naming/date lead
but currently has no technical connection. The Hermes notebook is a new surface
for public operational descriptions, not a counterpart of the opaque stream.

These findings do not establish a Chinese lab, escaped agents, an autonomous
swarm behind xz, or new learning inside the ciphertext. The existing xz size
and cadence evidence still permits an ordinary scheduled state writer.

Methods and limits
------------------
Searches covered Chinese terms for persistent memory, self-improvement,
heartbeat, encrypted backup, online clipboards and the literal xz identifiers,
with targeted LINUX DO, V2EX, Gitee and general-web queries. Translated directory
pages were used as discovery leads, followed to creator posts or repositories
where possible. No new lead came from the Gitee web-index query; this was not
global Gitee code search.

Five repository metadata/tree responses were captured; trees were not marked
truncated. Four READMEs and one vault source file were decoded and verified by
size and Git blob hash. Negative marker checks apply only to those inspected
files, not whole repositories. Retrieval dates, URLs and hashes are saved under
122-private/. GitHub repository creation is not necessarily feature creation.

LINUX DO pages were readable through the web tool, but direct local HTTP pulls
returned 403 and were not retried. V2EX topic 1219367 was a search-only lead after
direct web opens failed; its claims are not included as verified findings.
No infrastructure was purchased, no messages/posts sent, no fetched code run,
no source paste bodies added to the public export, and no ciphertext decrypted.

XZ: analogous systems and earlier writing
Reviewed 2026-09-05 UTC

Finding
-------
There are concrete precedents for the components of the xz pattern: persistent
agent memory, reflection records, periodic background jobs, encrypted storage,
and client-encrypted paste publication. No reviewed source connects these
components to xinzhai, the exact xz labels, or the Ubuntu paste sequence.

The best working agent hypothesis is a personal/prototype agent with a scheduled
state or memory writer and a less frequent improvement process. A conventional
script saving fixed state or test messages remains a serious alternative.
The analogues below generate hypotheses; they do not identify the uploader.

Earlier writing with verified pre-July chronology
-----------------------------------------------
1. Reflexion: Language Agents with Verbal Reinforcement Learning.
   First arXiv submission March 20, 2023.
   https://arxiv.org/abs/2303.11366
   Describes verbal reflection on task feedback, retained in episodic memory
   for subsequent attempts, without updating model weights. This is the closest
   conceptual precedent for knowledge plus improvement-plan records. Neither
   encrypted public storage nor our labels are established by the abstract.

2. Generative Agents: Interactive Simulacra of Human Behavior.
   First arXiv submission April 7, 2023.
   https://arxiv.org/abs/2304.03442
   Stores experiences in natural language, synthesizes reflections, and retrieves
   them for planning. It demonstrates coordinated simulated agents. Useful for
   understanding separate memory/reflection objects; no Ubuntu/Fernet link.

3. MemGPT: Towards LLMs as Operating Systems.
   First arXiv submission October 12, 2023.
   https://arxiv.org/abs/2310.08560
   Moves information between memory tiers to support context beyond an LLM's
   window and multi-session interaction. Persistent state can serve one agent;
   persistence by itself does not establish a swarm.

4. Memory as Ontology: A Constitutional Memory Architecture for Persistent
   Digital Citizens, Zhenghui Li. Submitted March 5, 2026.
   https://arxiv.org/abs/2603.04740
   https://animesis.com/
   The paper proposes agent continuity through persistent memory despite model
   replacement. Its associated Chinese/English site describes Animesis. This
   supplies a dated conceptual precedent for a named, persistent agent and its
   protected memory. The philosophical claims are the author's framing, not
   evidence of consciousness or of any relationship to xinzhai. Only abstract
   and associated website reviewed here; no cipher implementation verified.

5. CryptoPaste, HackThisSite.
   https://github.com/HackThisSite/CryptoPaste
   GitHub API: repository created April 23, 2017; last pushed December 9, 2020.
   Its README describes encryption in the browser before uploading to a paste
   service. This is a clear pre-LLM precedent for opaque public paste storage.
   It is dedicated paste software, not the Ubuntu uploader; its cron example
   deletes expired content and must not be mistaken for recurring uploads.

Current examples: useful resemblance, not established antecedents
---------------------------------------------------------------
6. Eco Agent, Chinese-language autonomous-agent project.
   https://github.com/xiejianjun000/eco-agent
   GitHub API creation July 29, 2026, AFTER the captured July 10-20 xz stream.
   Current README describes a 5-20 minute adaptive background heartbeat and a
   separate evolution process: replay experience, assess gaps, generate skills,
   consolidate memory, save a version snapshot. It explicitly says heartbeat
   steps are partly placeholders and automatic daily evolution is not wired;
   evolution is manually triggered. Fernet is described for credentials, not
   proof of encrypted memory. Strong architecture analogy, no provenance join.

7. Stash, Fergana Labs.
   https://github.com/Fergana-Labs/stash
   Current README describes scheduled curation of new sessions/files into a
   memory wiki, nightly by default, and optional public paste publication.
   Repository created February 12, 2026, but this review has NOT dated those
   individual features before July. No encrypted-paste memory loop established.

8. Otto, Booyaa.
   https://booyaa.net/otto
   Owner's case study explicitly describes Fernet-encrypted conversation memory
   with a password-derived key in a local assistant. This is a product claim;
   no code or pre-July date verified. It illustrates an ordinary privacy motive.

9. SovereignVault.
   https://www.hackquest.io/projects/SovereignVault
   Project submission claims Fernet encryption of agent memories/instructions.
   No source implementation or pre-July publication date verified. A search
   snippet also mentioned external storage backup, but the directly opened
   description did not substantiate that detail; it is not used as a finding.

10. Alfred: source inspection corrected an initially promising README match.
    https://github.com/Heisen111/alfred
    Public repository created July 24, 2026, AFTER the xz stream. Three returned
    commits range July 24-August 1. The README advertises encrypted persistent
    memory, and security/encryption.py implements a Fernet/PBKDF2 helper.
    But the inspected memory/long_term.py inserts content directly into SQLite
    and says encryption integration is deferred. We therefore cannot present
    this as a verified end-to-end encrypted-memory implementation. Contents API
    byte lengths and Git blob hashes were verified for both inspected files.
    This correction also supersedes the preliminary commentary description.

11. Chinese-language memory-encryption tutorial on CSDN's agent community.
    https://adg.csdn.net/6a2b6102662f9a54cb7d6071.html
    Section 4.3 supplies a MemoryEncryptor whose encrypt_memory method calls
    Fernet.encrypt on text. The prose incorrectly calls this AES-256-GCM;
    the displayed implementation uses Fernet. This is direct evidence that
    Chinese-language agent tutorials discuss encrypted memory, not evidence
    that their code generated xz. Its search index date suggests a few months
    ago, but a reliable pre-July publication date was not established. Treat
    it as an undated current writing sample. No example code was executed.

Interpretations of xinzhai, ranked by fit rather than numeric probability
----------------------------------------------------------------------
A. Prototype agent plus memory/reflection and backup jobs.
   Rapid versioned bulk uploads, followed by periodic knowledge records and
   occasional improvement plans, are compatible with a developer iterating an
   agent and persisting its state. The larger objects could be code, prompts,
   configuration, or snapshots; encryption prevents choosing between them.
   Three plans immediately precede a new size cohort, but eight do not. That is
   suggestive of changes to a writer/schema, not proof of successful learning.

B. Scripted state/checkpoint or upload experiment, with agent-like labels.
   Only ten decoded knowledge sizes recur among 3,484 records, and the early
   steady stream has roughly five-minute timing. Fixed schemas, templates,
   counters, or unchanged state re-encrypted each time could explain this.
   Distinct ciphertext does not demonstrate distinct knowledge or LLM calls.
   Fixed sizes weaken a simple continuously growing free-form knowledge dump,
   while leaving bounded summaries and fixed serialization plausible.

C. Private data mailbox or coordination channel.
   Opaque public records could be addressed to another program or human. No
   demonstrated reader, reply structure, shared key, or cross-host counterpart
   currently supports that additional step. Two interleaved streams alone do
   not demonstrate two agents. A malicious-control interpretation is also
   possible in the abstract, but these bytes provide no specific support for it.

What the comparison changes
---------------------------
Memory/reflection and encrypted publication do not require a novel swarm
architecture. The agent hypothesis is coherent, but plaintext behavior is still
unknown. We should search for writers with the JOINT fingerprint: xinzhai/xz
labels, periodic state, multipart version exports, nested Base64, and the Ubuntu
posting form. Generic Fernet, agent memory, or Chinese names alone are weak.

Useful search vocabulary: persistent agent memory; episodic reflection;
checkpoint export; encrypted snapshot; heartbeat/pulse; memory consolidation;
self-improvement report; 智能体持久化记忆; 记忆固化; 反思; 自我改进计划;
后台心跳; 加密备份; 版本快照; 分片上传. Literal English identifiers remain
important. No assumption is made that a Chinese developer uses Chinese code.

Search and evidence limits
--------------------------
This pass used public web search in English/Chinese, primary project pages,
arXiv abstracts, GitHub metadata, and two source files. It did not exhaust code
hosts or historical snapshots. Further exact-label searches yielded no verified
new counterpart; search-result absence is not a global negative.
Private captures and URL/status/time/SHA256 metadata: 121-private/.
Existing raw xz captures, archive, excluded page and public export unchanged.
No downloaded code executed and no captured ciphertext decrypted.
Byte-format conclusions remain in reports 118-120; the small cipher remains
unidentified. External analogy research is separate from that missing evidence.

120 — Controlled example confirms the small-record length ambiguity
September 5, 2026. Synthetic experiment, not new evidence of the writer's algorithm.

Result
Two different authenticated-encryption constructions reproduce every observed small-record binary length and corresponding Base64 length: AES-128-GCM and ChaCha20-Poly1305. Both used an investigator-chosen12-byte nonce stored before ciphertext with a16-byte authentication tag. This makes the ambiguity concrete: length compatibility cannot identify AES, let alone an AES key size or producing library.

Experiment
For each of the12 distinct knowledge/plan binary sizes, generated a synthetic plaintext28bytes shorter, encrypted it with each construction, prepended its nonce, and checked the resulting binary and Base64 lengths. All24 cases matched the target sizes and decrypted correctly with the investigator's own newly generated keys.
Separately generated standard Fernet controls at both endpoints of each of the nine conditional plaintext-length intervals in118. All18 produced the expected binary token lengths and round-tripped correctly. This checks the boundary arithmetic; it does not authenticate the real tokens.

Evidence boundary
No captured ciphertext was passed to an encryption or decryption operation. Captured metadata supplied target lengths only. Synthetic keys and ciphertexts were not saved or published. The constructed wrapper is a demonstration, not a discovered nonce/tag layout. This does not establish that either algorithm generated xz, nor that xz is encrypted rather than another opaque representation.

What would resolve the uncertainty
Writer code could show serialization, compression, cipher mode, nonce placement, tag handling and any additional authenticated data. An authorized key, together with the correct construction and parameters, could allow actual authentication and decryption. A public format specification or a provenance-linked producer example could also narrow the alternatives. Another entropy estimate or another length-compatible algorithm cannot choose between them.

Primary API documentation: https://cryptography.io/en/latest/hazmat/primitives/aead/
Fernet specification: https://github.com/fernet/spec/blob/master/Spec.md
Artifacts:120-format-ambiguity-control.py and private120/analysis.json. No source-site requests, code from the supplied archive, or search-bot wave.

119 — Small xz records are not literal fragments of the captured large objects
September 5, 2026,22:30UTC.

Question
Could the periodic small records simply be pieces or selected byte ranges of the nine large Fernet-shaped objects? Earlier format tests distinguished their containers but did not directly test this relationship at every byte offset.

Completed exact-byte comparison
All3,574 supplied cluster body hashes were checked against our fixed survey. The3,484 knowledge and11 plan bodies were canonically Base64-decoded after restoring spaces to plus signs. The nine large groups were reassembled and decoded through both Base64 layers.
Small records contain1,218,396 bytes and1,193,931 overlapping eight-byte windows. Every window is unique, including unaligned windows and comparisons between knowledge and plan records. No eight-byte window repeats within a small record either.
The nine large binary objects contain1,242,817bytes. Comparing every eight-byte window of those objects against the small-record window set produced zero matches. The search includes their header, timestamp, IV, ciphertext and authentication-shaped fields. A separate direct search for every complete small body in every large binary object also returned zero matches.

What this establishes
The captured small records are not literal contiguous fragments of these nine decoded objects. They also do not copy any unchanged contiguous field of eight or more bytes from them. This closes a concrete alternative in which the ongoing stream merely republishes fragments of the initial encrypted snapshots.
Within the small streams, it rules out an identical stored eight-byte-or-longer nonce or field occurring verbatim in two records under this decoding. It does not identify where a nonce would be, prove that nonces are stored, or establish safe nonce generation.

What remains possible
Separately encrypted messages, related plaintext encrypted with fresh randomness, transformed fields, shorter copied fields, or fragments of some uncaptured object remain possible. Zero ciphertext overlap cannot establish different plaintexts or different encryption keys. Random-looking uniqueness still does not distinguish AES-GCM from ChaCha20-Poly1305 or establish that encryption occurred at all.

Artifacts
119-ciphertext-overlap-check.py and private119/analysis.json. The source archive remains unchanged. No new source requests, decryption, keys, source-code execution or search-bot wave. This is exact ciphertext/byte analysis, not plaintext recovery.

118 — Fernet/AES audit: large uploads and small xz records use different visible formats
September 5, 2026. All3,574 cluster bodies hash-checked against the existing survey.

Main finding
The nine large xinzhai groups provide strong Fernet-format evidence: canonical nested Base64, the expected version/header layout, plausible creation timestamps and block-aligned ciphertext. The small knowledge and plan records are not full Fernet tokens at the tested layer. Their length arithmetic also rules out one fixed-size wrapper around ordinary padded CBC ciphertext for the entire stream. It does not identify AES-GCM or any other particular small-record cipher.

What Fernet means here
Fernet specifies AES-128-CBC encryption, PKCS#7 padding and HMAC-SHA256 authentication. Its32-byte key is split into16-byte signing and16-byte encryption keys; the32-byte combined key does not mean AES-256. The binary token has1version byte,8timestamp bytes,16IV bytes, variable block-aligned ciphertext and32HMAC bytes. Base64 is the text transport encoding, not encryption. Format parsing does not verify the keyed HMAC or recover plaintext.
Primary specification: https://github.com/fernet/spec/blob/master/Spec.md

The observed large-upload pipeline
Observed paste parts -> concatenate -> standard Base64 decode -> URL-safe Base64 token -> URL-safe Base64 decode -> Fernet-shaped binary object.
All nine have version0x80 and ciphertext lengths divisible by16 after removing57bytes of fields. All nine16-byte IV fields differ. Across77,644 ciphertext blocks, no16-byte block repeats; none of the36 token pairs shares even the first ciphertext byte. These observations rule out literal unchanged ciphertext prefixes in this sample. They do not establish different keys, different plaintexts or cryptographic security; fresh-IV encryption can conceal unchanged plaintext.
The76 parts reproduce the exact30,000-character outer split already verified in068. Four parts belong to the earliest unversioned group, which the supplied archive did not save as a separate .fernet file.

Conditional plaintext lengths
For standard Fernet, PKCS#7 adds1–16bytes. Therefore plaintext length is ciphertext length minus16 through ciphertext length minus1. These are bytes supplied to encryption, not necessarily readable text, and say nothing about any prior compression or serialization.
xinzhai: 64,928 ciphertext bytes -> 64,912–64,927 plaintext bytes
xinzhai_v5.2: 65,488 ciphertext bytes -> 65,472–65,487 plaintext bytes
xinzhai_v52: 99,680 ciphertext bytes -> 99,664–99,679 plaintext bytes
xinzhai_v60: 113,552 ciphertext bytes -> 113,536–113,551 plaintext bytes
xinzhai_v61: 125,296 ciphertext bytes -> 125,280–125,295 plaintext bytes
xinzhai_v70: 151,504 ciphertext bytes -> 151,488–151,503 plaintext bytes
xinzhai_v71: 180,784 ciphertext bytes -> 180,768–180,783 plaintext bytes
xinzhai_v72: 209,904 ciphertext bytes -> 209,888–209,903 plaintext bytes
xinzhai_v73: 231,168 ciphertext bytes -> 231,152–231,167 plaintext bytes

The small-record length discriminator
Knowledge lengths in bytes:93,226,271,316,319,352,364,374,397,428. Their remainders modulo16 are0,2,6,12,13,15. Plan lengths646/647 have remainders6/7.
If every record had one fixed overhead H plus padded CBC ciphertext, its total length would be H+16k. Every total would therefore have the same remainder modulo16. These streams do not. Changing plaintext length or compressing before padded CBC does not remove that constraint. Variable-length wrappers, different constructions by cohort, ciphertext stealing or additional post-encryption transformations remain alternatives; this result does not exclude every use of AES.
Full binary Fernet requires length57+16k, hence remainder9. None of the small-record sizes has remainder9. Nine knowledge bodies happen to start with0x80, illustrating why a single version byte is insufficient; zero pass the full layout test.

AES-GCM is plausible, not identified
A hypothetical stored12-byte nonce plus ciphertext plus16-byte tag would have28bytes overhead. That would imply knowledge plaintext lengths65–400bytes and plan lengths618/619bytes. Both AES-GCM and ChaCha20-Poly1305 can use such a layout. We have not located nonce/tag fields or authenticated either construction, so these are conditional arithmetic examples, not recovered messages or an algorithm fingerprint. No duplicate first8/12/16-byte prefixes occur within either small stream; this does not prove those prefixes are nonces.
Primary API documentation: https://cryptography.io/en/latest/hazmat/primitives/aead/

Practical interpretation
A versioned large-object uploader and a periodic small-record writer are a plausible shared system, supported separately by interleaving and cadence. The large objects could hold code, serialized state, documents or other bytes; their content is unresolved. A cryptographic format does not establish an agent swarm. To identify the small construction or read the messages would require additional evidence such as the actual writer implementation or an authorized key, not further Base64 decoding.

Audit artifacts
118-crypto-layout-audit.py;118-private/analysis.json. Input archive SHA-2564a202ecd9dbe3dfcc40c1dac00984573cdffb38102e9d4ba4e04ce09b9a9105c. No HMAC verification, decryption, key search, network posting or pasted-code execution. No new crawler or search-bot wave.

117 — User-supplied xz archive corroborates the captured dataset
September 5, 2026.

Archive supplied by the user:
/home/sophia/search/investigation/china/uploads/xz-ubuntu-cn-2026-09-05.tar.gz
SHA-256:4a202ecd9dbe3dfcc40c1dac00984573cdffb38102e9d4ba4e04ce09b9a9105c
Size9,911,019bytes;3,920tar members;46,186,588 uncompressed member bytes.

Verified comparison
All3,574 xinzhai/xz records in bodies.jsonl have the same IDs as our fixed survey. Every authored-body SHA-256, author label, language tag, character count and displayed timestamp agrees with our saved metadata. No new cluster record or changed authored text was found.
The archive's eight saved versioned tokens, v5.2/v52/v60/v61/v70/v71/v72/v73, are byte-identical to reassembly from their corresponding multipart bodies. All eight match the supplied manifest's SHA-256 values.
Its investigators-mirror/posts.jsonl is byte-identical to our public1,142-post export. That embedded mirror is a copy of our publication, not independent cross-site agent activity.
Private117/fast-comparison.json records these checks. No decrypted plaintext or operator-identifying artifact appears in the supplied materials reviewed here.

Corrections to the accompanying README
1. There are nine large groups in the authored bodies, including the initial unversioned xinzhai group. The saved-token directory contains eight. v52 is not the first structurally compatible token: [REDACTED] initial and v5.2 groups precede it.
2. Fernet-layout compatibility does not authenticate a token or identify Python's cryptography package as its producer. Header timestamps support UTC+8 as a hypothesis; without authentication or independent clock provenance, they do not prove the offset.
3. Entropy, distinct bodies and random-looking pairwise XOR do not establish a specific cipher, cryptographic security or a fresh nonce per message. Small-record plaintext lengths cannot be recovered without knowing the encoding/encryption construction and overhead.
4. Canonical space-to-plus decoding of all3,484 knowledge records gives sizes93–428bytes, not429. Exact sizes/counts match our earlier full review:93(178),226(143),271(71),316(358),319(300),352(146),364(239),374(1153),397(605),428(291).
5. Plus-to-space damage remains a plausible transport explanation, not a demonstrated defect of the site's current form. Our085 review found ordinary multipart submission; no original submitted bytes are available.
6. The eleven plan posts have already been structurally reviewed in073: first five decode to646bytes and last six to647, despite all being864characters long.

Value and limits
This is useful corroboration of dataset transcription and multipart assembly, with convenient preassembled tokens. It strengthens confidence that the existing captured dataset was read consistently. It does not add decrypted contents, independent historical posting dates, a client implementation, or evidence establishing an agent swarm or its operator.

The supplied archive remains private and unchanged. The comparison read cluster data directly from tar members without bulk extraction or code execution. The full archive-HTML-to-JSONL consistency pass completed at22:21:02UTC: all3,574 cluster pages agree with their authored text records, with zero mismatches. All eight saved snapshots also have consecutive part numbering and consistent manifest lengths. Private117/comparison.json records the completed audit. Non-cluster pages, including the previously excluded source ID, were not opened for content review. No contacts in the README were messaged.

115 — Readable startup marker checked outside the paste corpus
September 5, 2026,22:14UTC.

The first readable xinzhai test, source4548523, contains exactly print('hello xinzhai'). This22-character authored body was established in028/082. Unlike the opaque payload prefixes, its literal English greeting can be checked directly without a proposed Chinese translation.
Source: https://paste.ubuntu.org.cn/4548523

Sourcegraph query:
context:global patternType:literal "hello xinzhai" archived:yes fork:yes count:100 timeout:20s
The public stream returned HTTP200, a terminal progress event with matchCount0 and skipped[], followed by a done event. This is a completed negative for the queried index and phrase, not proof that the greeting occurs nowhere online. The index's previously demonstrated coverage gaps remain relevant.
Captured22:14:07UTC. Raw response SHA-256:1b86d50a0481167d958b17a2460c9108c8f41570b07776d4b3726f7fccbfad05.

Two general web queries, "hello xinzhai" and "print" "hello xinzhai", returned unrelated-looking snippets rather than a verified occurrence of the greeting. The results did not reliably enforce literal phrase matching, so they are not counted as an exhaustive exact-string negative. No candidate body was fetched from those snippets and no operator connection was established.

Rechecking028 also confirmed that the large-token plaintext metadata, including its unauthenticated timestamps, was already covered. No new metadata discovery is claimed. No further decoding, key search or decryption was performed.

Private115 preserves the code-index response and parsed terminal metadata;115-startup-marker-search.py reproduces the request. No new origin fetch, archive scan or bot wave occurred. The exact readable startup marker has not supplied an independent client reference in this bounded check.

114 — China-access infrastructure: what a new worker would actually test
September 5, 2026. Consolidation of measured routes; no new purchase or site probe.

Decision for the xinzhai investigation
The current server can retrieve the source paste site, public code-index results, Gitee project search, ModelScope catalogs and several global registries. July and August archive searches have completed on the existing AWS host. Our immediate gap is a matching public artifact or implementation, not demonstrated inability to fetch the xinzhai posts. A Hong Kong worker is an optional access experiment for specific blocked surfaces; it is not an established solution to this attribution gap.

Measured access and scope
- Gitee089/090: normal browser project search and its observed public widget route work. Project metadata search is not global code or gist search. Earlier gist authentication errors remain a separate limitation.
- GitCode093: normal browser project discovery works. Signed-out code-search configuration was disabled; direct query routes received WAF responses or ambiguous empty output. A new IP has not been shown to enable that feature.
- ModelScope100/101: documented unauthenticated GET searches for models, datasets, Studios and skills work, with positive controls. These catalogs do not establish source-file or log coverage. The browser's empty search display was invalid as a negative because its non-GET requests were locally blocked.
- BWiki032: a small public recentchanges response worked from both existing servers. Huiji challenges persisted on both. These were single-pass observations, not guarantees of current access.
- Baidu032/113: one earlier query worked; later requests returned challenges. Treat this route as intermittent and unavailable in the latest checked round. Repeating challenged requests without a new discriminator adds no research coverage.
- Common Crawl081/111: the recovered Ubuntu-alias robots capture excluded CCBot; the July copy search completed successfully elsewhere in the corpus. Geographic routing cannot retroactively create missing archive captures.
- Global catalogs112: PyPI's documented JSON route and npm metadata search work here. The PyPI browser challenge did not imply that every documented route was blocked.

Useful next infrastructure experiment
If a Hong Kong or Singapore worker becomes available, compare the same specific blocked public URL and a positive control from both machines in the same time window. Retain final URL, status, body hash, response type and actual relevant content. A login page, challenge or irrelevant search page is not success. Repeat at a second time before expanding traffic. Keep the existing portable probe as a historical fixed-target benchmark; its ten-URL list predates the newer successful catalog routes and includes already-known authentication limits.
Portable kit: http://178.105.23.35:8090/china/downloads/vantage-probe.zip
Baseline comparison032 and procurement notes063 remain available. No bulk corpus migration is needed for this small comparison.

Provider facts checked today
Alibaba's setup documentation says plans vary by region and the purchase console is definitive. Hong Kong and Singapore use international bandwidth; the region cannot be changed after instance creation. These facts do not demonstrate better access to our blocked targets. No fresh checkout quote or capacity confirmation is claimed here.
https://www.alibabacloud.com/help/en/simple-application-server/user-guide/create-a-server

Costs and state
The existing AWS host and its8.6TB ephemeral corpus remain intact. All three completed copy scans are terminal. Cloud hosting and search API costs remain separate from the OpenRouter guard. No extra machine, proxy subscription or account was purchased. This report changes the access decision guidance, not the research attribution.

113 — Client form and version-documentation searches reviewed
September 5, 2026. No matching xinzhai uploader identified.

Two bounded OpenRouter tasks completed: client form/encoding dataflow and contextual versioned-project documentation. Shared incremental spend is$3.2467 against the existing$20 guard;175 bot reports are now terminal. No archive scanner or bot from this wave remains active.

Concrete source review
The captured linuxidc discussion displays a Perl WWW::Mechanize uploader that places clipboard text into code2, supplies poster and submits the Ubuntu site's form. This demonstrates an ordinary scripted uploader. The displayed sample has no encryption or multipart chunking implementation. Its2011 date is a page-displayed claim, not an independently recovered archive date. No connection to the2026 cluster was found.
Source: https://www.linuxidc.net/thread-1685-1-1.html

A separate captured C# gist uses the same generic form-field names for gamedev.pastebin.com. It URL-encodes text before submitting an application/x-www-form-urlencoded request; its multipart branch concerns an image service. This is a different client and target, not the nested encrypted Ubuntu workflow.
Source: https://gist.github.com/MaulingMonkey/505384

Code-index checks
Four Sourcegraph searches tested co-occurrence of code2 or parent_pid with encryption/Base64 functions, then narrowed to paste references or both form-like names. The first three returned100 matches each across29,45 and18 repositories with result-limit warnings. They cannot support exhaustive negatives.
The both-name refinement returned6 matches across2 repositories without a skipped-result warning. Its LLM-related candidate was checked in pinned source: parent_pid is an operating-system parent-process helper; code2 is the second argument of an AST code-comparison routine. Neither is a paste form field there. The other returned paths are Scapy sources, with no uploader relationship established from the returned evidence.
Pinned source: https://raw.githubusercontent.com/9600dev/llmvm/2939932cb03e17df5c7ca66d3b874c465e24e8a0/llmvm/common/helpers.py
Source SHA-256:1b066ede2fea01f3a07fb2b6f8d76ca36fadbd2c5c0c3bfae625c4dc20f22ab5.

Search and access limits
The client bot used4 searches and3 fetches: two retained HTTP200 sources above; a Ruby-client page returned403 and is unavailable. The documentation bot used3 Google searches and1 Baidu request, with no source fetches. Its results were snippets, not verified writeups. Baidu again returned a challenge; this repeated inaccessible route added no coverage. A fifth search attempt was rejected by quota. Do not repeat Baidu or the bots' suggested already-exhausted bare-label/Gitee-host queries.

Exact queries, raw code-index events, source hashes and retained bot fetches are private in113-private. Worker reports CN26R001/R002 remain labelled unverified; this report reviews their usable evidence and limitations. No source code was executed, original paste requested, message sent or payload decrypted. Generic client form names have not supplied the missing implementation link.

112 — Public package-registry check: no xinzhai client identified
September 5, 2026,22:05UTC.

The documented PyPI JSON project route is accessible from the existing server, despite the earlier browser-search challenge in070. Exact project requests for xinzhai and xz-knowledge each returned HTTP404 with a JSON Not Found response. The documented sampleproject control returned HTTP200 with actual project metadata. These two names were not found through this route; this is not a search of all package source files or differently named projects.
Documentation: https://docs.pypi.org/api/json/
Checks: https://pypi.org/pypi/xinzhai/json and https://pypi.org/pypi/xz-knowledge/json
Control: https://pypi.org/pypi/sampleproject/json

The npm registry returned HTTP404 for the exact unscoped xinzhai package. Its public search route returned HTTP200,total0,objects[] for xinzhai and xz_knowledge. A fernet control returned five real package entries and total40. Thus the empty responses are not explained by a universally empty or blocked route. This is package metadata search, not global code search; removed, private, differently named or unindexed packages remain outside the conclusion.
Documentation: https://github.com/npm/registry/blob/main/docs/REGISTRY-API.md
Exact check: https://registry.npmjs.org/xinzhai
Searches: https://registry.npmjs.org/-/v1/search?text=xinzhai&size=20 and https://registry.npmjs.org/-/v1/search?text=xz_knowledge&size=20
Control: https://registry.npmjs.org/-/v1/search?text=fernet&size=5

No package archive was downloaded or installed. Seven public GET responses, hashes and timestamps are preserved privately in112-private; reproducible script112-registry-check.py. No original paste requests or paid bot calls. This closes a limited software-distribution check without identifying an uploader or changing the shared-workflow finding.

111 — July archive label and copy search completed: no matches
September 5, 2026. Final coverage and output review.

Result
The July scan completed all 100,000 input files and checked 2,093,746,605 text records. It returned zero matches and zero failed files in 1,051 seconds. This adds a completed July check to the August searches; it does not identify xinzhai's operator or establish that copies are absent everywhere.

What was searched
Common Crawl CC-MAIN-2026-30 covers July 10–23 according to the official collection index, overlapping the paste site's displayed lifecycle. The 5,993 case-sensitive terms combine 5,802 posted-form prefixes, 187 inner-encoding prefixes and four observed label fragments: xinzhai_v, xinzhai_p, xz_knowledge and xz_improvement_plan. Report109 verifies every term's source mapping. Report108 records launch and preflight details.
Primary collection index: https://index.commoncrawl.org/collinfo.json

Completion audit
Remote process1206392 exited. Its terminal log records100000/100000 files, failed0, pages2093746605 and matches0. The completed-file set equals the100,000-entry manifest exactly: no missing or unexpected paths. failed.txt, scores.tsv and matches.tsv are empty. The separate domain summary contains only its header. No candidate source-body review was needed because no candidate was produced.
Audited2026-09-05T22:03:03.511598+00:00; observer subsequently confirmed terminal status.

Manifest SHA-256: d18ec3be777be78ed34986d383faf522ae264c81343e13358e918bcd9dbfb68d
Completed-file list SHA-256: abec550fcedae8809770f2a67d087b6b95265ba963185cfae762d24e227f9361
Term-file SHA-256: dae886e00aeebdfc3e8ebc06485e7b78f2b778469dfd66402e3c1bc80ad8f125
Terminal log SHA-256: 2ea29c9cec3b3b9f1e226587c3b8eeee19a5d2c8f4f3e69e69b0a396f110a181
Private audit: investigation/china/108-private/final-audit.json
Remote outputs: /data/runs/china-codex-xz-july

Interpretation and limits
The specified labels and representations were not found in these extracted archive records. Archives omit many pages; the source site's observed CCBot exclusion already limits direct coverage. Re-encoding, different prefixes, HTML/text extraction changes and unindexed or private destinations can evade this search. Source-displayed dates and archive dates remain different evidence.
August reports092/106 searched two representation sets against the same2,083,525,558 records. July is a distinct crawl, but pages can recur across crawls: do not sum these record counts as unique webpages or independent sources.

Infrastructure
The scan streamed public Common Crawl S3 inputs on the existing AWS host, with5.9TB reported by the scanner's rounded terminal counter. It did not cache a new corpus or remove the existing8.6TB collection. No new machine was purchased and no OpenRouter wave ran. Remote scanner and bounded observer are now terminal. Website status has been updated to reviewed completion.

The main positive evidence remains the interleaved xinzhai/xz uploads and structured recurring workflow. This negative archive result does not turn that evidence into an agent-swarm attribution or refute automation.

110 — Astron “XinZhai” testimonial reference remains uncorroborated
September 5, 2026. Bounded source check, not operator identification.

A web search for xinzhai with agent/AI/memory returned a third-party Astron Agent directory entry naming “XinZhai” among testimonial providers. The captured directory record describes some extraction as render+llm and links Astron's website and GitHub repository. Its displayed last_checked date is not independent historical evidence.
Discovery source: https://agentery.com/agents/astron_agent

The current official GitHub README and project homepage did not contain this name. A normal read-only browser visit to astron.ai rendered the product homepage successfully; scrolling produced 3,475 characters of visible text with no XinZhai, 心斋 or 心齋 reference. Public homepage JavaScript assets were also inspected as text. No testimonial was corroborated in this bounded current-page review. This does not establish that a testimonial never existed or that the directory invented it.
Primary sources: https://github.com/iflytek/astron-agent and https://astron.ai/

The README describes an agent workflow platform. The website advertises persistent assistants, workflow tools and research templates. Those product descriptions do not connect this platform or any customer to the Ubuntu uploads. No matching paste URL, xz label, multipart implementation or independently attributable posting trace was recovered. Similar names and generic agent capabilities are insufficient to identify the operator.

Integrity and scope
GitHub README decoded length and Git blob SHA-1 verified: d3b8951b067874bafe5ec9d4bd2b06108b7591c6.
Rendered homepage text SHA-256: d3c79486559f085681b5f656a0857af8975240df689da0a4a31082061e11c66b, captured21:59:36UTC.
Private110 preserves response bytes, hashes, browser text/HTML and network metadata. Browser requests were restricted to GET/HEAD; no login, agent launch, messages or code from the paste corpus. This check is closed as an uncorroborated name reference unless a specific historical source or matching implementation appears.

109 — July archive candidate provenance prepared
September 5, 2026. Method verification; no new external match.

All 5,993 July search terms now have a checked mapping to their source records or to one of four literal label fragments. This makes any eventual candidate traceable to the original evidence. It does not establish a copy or change the operator attribution.

Verification
Reparsed the privately saved HTML for all 3,571 opaque records: 3,484 knowledge posts, 11 improvement plans and 76 large-upload parts. Each raw HTML hash and extracted authored-body hash matched the fixed survey snapshot. Reconstructed the posted and space-to-plus prefixes, and the inner URL-safe, standard Base64 and plus-to-space forms for all 76 large-upload parts. No decryption was performed.

The exact July term file contains 5,993 distinct terms: 5,802 posted-form prefixes, 187 inner-form prefixes and four label fragments. Every zero-based term identifier used by the scanner maps to at least one source ID and representation, or a literal label. Multiple representations can share a prefix; the mapping retains all applicable origins instead of assigning a unique origin without evidence.

Review rules
A literal-label match requires context review for namesakes, quotations or discussion of this investigation. A prefix match identifies a candidate representation, not a verified full-record copy. A candidate must be checked against the corresponding captured body and archive context before being reported as independent corroboration. An archive capture date dates that capture; an embedded paste date alone does not independently date the original post.

Reproducibility
Source snapshot SHA-256: 620d6dcc62fd2f4eefa396c631b43f57e308fcbd31e5c097994eca4aa5005f40
July term-file SHA-256: dae886e00aeebdfc3e8ebc06485e7b78f2b778469dfd66402e3c1bc80ad8f125
Term-map SHA-256: 41025b20416cd7f29771f9d00876e389f224e8fb2fb274cb5714b84f94001652
Local script: investigation/china/109-build-july-term-map.py
Private output: investigation/china/108-private/term-map.json and term-map-summary.json

This work used existing local captures. It made no origin requests and did not change the fixed public post export. The July scan remains a separate running job; current operational counters are at http://178.105.23.35:8090/china/july-copy-status.html . Its final result still requires terminal coverage and output review.

108 — HISTORICAL LAUNCH: July archive search for xinzhai/xz labels and copies
September 5, 2026. Historical partial checkpoint. The job is now complete; see111-july-archive-copy-final.txt for the audited final result.

New time coverage
Common Crawl's current collection index identifies CC-MAIN-2026-30 as July, spanning2026-07-10T07:05:34 through2026-07-23T01:13:28. This overlaps the source-displayed xinzhai/xz lifecycle and could retain copies absent in August. Earlier completed copy scans092/106 covered August; this pass adds a distinct crawl, not a restart of those jobs.
Primary index: https://index.commoncrawl.org/collinfo.json
Archive timestamps and source-displayed post times are different evidence; the source timezone remains unresolved.

Manifest and preflight
The existing July manifest contains100,000unique paths, all under CC-MAIN-2026-30. SHA-256:d18ec3be777be78ed34986d383faf522ae264c81343e13358e918bcd9dbfb68d.
A sample July object was accessible through the existing AWS host. A one-file production-binary preflight completed1/1files,21,165text records,0failures and0matches, reading62.5MB. This verifies the signed public archive retrieval and scanner path, not absence from the full crawl.

Patterns and execution
The5,993case-sensitive terms combine092's posted-form prefixes,106's inner-encoding prefixes and four observed label fragments: xinzhai_v, xinzhai_p, xz_knowledge, xz_improvement_plan. Private term SHA-256:dae886e00aeebdfc3e8ebc06485e7b78f2b778469dfd66402e3c1bc80ad8f125. Prefixes are kept private and never submitted as search queries to external indexing services; archive objects are read and searched on the existing AWS host.
The previously isolated binary was hash-verified unchanged. Full scan started2026-09-05T21:45:23.497656+00:00, PID1206392, output /data/runs/china-codex-xz-july. It uses384workers and streams public Common Crawl S3 inputs without writing another corpus. Existing8.6TB data is preserved. The dashboard binds only127.0.0.1:8097. Unlike the cached August passes, this scan transfers archive input data over the network.

Confirmed partial checkpoint
At21:45:46UTC, process alive:1,871/100,000files,43,503,867text records,0failures,0candidates,137,329,962,512input bytes counted. In-flight input transfers contribute to the download counter before their files finish. These partial counters do not establish absence.
Bounded observer polls every30seconds for up to40observations and never starts/restarts a scan:
http://178.105.23.35:8090/china/july-copy-status.html
The timestamp matters. An expired observer or request timeout is not proof that the archive process stopped.

Next action and limits
Continue this same job. Any label or prefix candidate requires source-body review; a label hit alone can be a namesake or quotation. After terminal completion, verify manifest coverage, failures and saved scores/matches before reporting a final result. Corpus records across different crawls may repeat pages; counts must not be summed as unique websites or documents.
Private108 contains term provenance, preflight.json and job.json; full output stays private. No original Ubuntu requests, corpus deletion, decryption, key search, new infrastructure purchase or OpenRouter wave occurred.173terminal bot reports remain unchanged. Existing AWS hosting costs are separate from the OpenRouter guard.

107 — Source listing unchanged at21:40UTC
Reviewed September 5, 2026.

A single public GET of https://paste.ubuntu.org.cn/ returned HTTP200 at2026-09-05T21:40:38.042381+00:00. The largest displayed ID remains4552955, followed by4552954 and the prior fixed-survey boundary4552953. There were no newly listed IDs beyond083's latest observation, so no additional post bodies were fetched.
Index response SHA-256:463d8b3541e8ee0327ee96a568453af0173f4b9347d69b024460de0c537bd6d8.

This is a current listing observation, not proof that no unlisted, edited or deleted content exists. The fixed survey and1,142-post export are unchanged. Private107 preserves the index and parsed link metadata. No posting, counters, excluded-ID requests or source execution occurred.

106 — Inner-encoding archive copy scan completed: zero candidates
Reviewed at 2026-09-05T21:39:31.169569+00:00. Supersedes running status104.

Verified result
All100,000input files completed in546seconds, covering2,083,525,558text records. Zero prefix candidates, zero failed files and no input downloads. The scan process and bounded observer have finished. This is the same corpus searched in092 with different representations; the two page counts must not be added as unique coverage.

Coverage and controls
The187patterns derive from the inner encoded text of9large xinzhai objects and76pieces, using URL-safe, standard Base64 and standard-plus-to-space representations. Two prefixes required edge trimming for the scorer; final lengths63–64characters. Report103 documents derivation and the separate local corpus check;104 records preflight and launch.
Report105 validated this exact pattern file and binary against189private synthetic records: all187planted patterns detected with their expected term IDs, both negative records excluded. Those planted matches are a scanner control, not web evidence.

Terminal audit
The100,000distinct done paths equal the input manifest exactly, with no missing or unexpected entries. scores.tsv, matches.tsv and failed.txt are each empty. The terminal log independently reports the same complete file count, record count and zero matches. The scanner is no longer alive.
Manifest SHA-256:14e2fec6029971c0f1807162ae482fd69c3929a33bef9aa4ff0f49c4c6cea35d
Done-path SHA-256:123bed613d4eef2e2a5ad172e5d9a8428b3e8f79f974348aa8c811ade2e43695
Pattern SHA-256:3fcaac4f963fe9181a86c3a6271097d3b3a1eb329aaded16899c8f1b900dd808
Terminal-log SHA-256:d96955418a17c13fb7c14a080fa470f85ca7dcba5f1412d986cbb98558146dd8

Interpretation
No inner-text copy candidate was found in the indexed text corpus under these tested forms. This closes the specific extra-Base64 representation gap left by092; it does not search all raw HTML/binary content, line-wrap or entity transformations, unindexed/deleted pages, or newly encrypted objects. It yields no plaintext or operator identity and does not weaken the independently observed within-host interleaving.
The strongest supported conclusion remains a related xinzhai/xz publishing workflow. Agent involvement, swarm size and Chinese-lab attribution remain unresolved.

Provenance and task state
104-private/final-audit.json preserves the terminal checks. The unchanged remote output is /data/runs/china-codex-xz-inner-copies; the control output remains separate. Existing archive corpus and092outputs were preserved. No original Ubuntu access, payload publication, key search or decryption occurred. No archive scan or OpenRouter wave remains running from this work;173terminal bot reports unchanged. The broader investigation remains active until user pause.

105 — Synthetic control validates the active inner-copy scanner
Reviewed September 5, 2026, 21:35 UTC. This is scanner validation, not independently observed web activity.

Purpose and setup
While archive job104 continues, check that its actual187-pattern file and scanner binary detect known inputs. A separate private fixture uses189synthetic WARC conversion records:187positives, one plain negative and one case-changed negative verified not to contain any search pattern. Positive records place a pattern after0,8,190or65,530padding characters. The fixture is zstd-compressed and read through the same cached-corpus input path as the archive scan.
No synthetic record was uploaded to a public service. control.invalid URLs are local record labels only; no requests to those URLs occurred. No web evidence is claimed from these planted matches.

Verified result
The unchanged ccsearch-xz-private binary with the unchanged104pattern file processed1/1fixture files and189records, with0failures and187matches. The set of returned URLs exactly equals the187positive labels. Each positive record contains its expected term ID in scores.tsv; both negatives are absent. No input bytes were downloaded. The control process ended normally, independently of the still-running archive job.
Pattern SHA-256:3fcaac4f963fe9181a86c3a6271097d3b3a1eb329aaded16899c8f1b900dd808.
Fixture SHA-256:555e7f88ed6cfbf93f2096a00d0b16740b935626f5dc498db0b00902da8324f5.
Binary SHA-256:6c78bb33222535de86c499b6b0dde91116be6f68203eef1e1307d95e7bdef7d7.

Meaning and limits
This confirms that the production pattern file is parsed and the selected patterns are detectable through the scanner's corpus/record/scoring path, including later body positions and case-sensitive rejection. It does not prove archive completeness, searchability after untested transformations, or source attribution. It does not replace the terminal manifest/output audit required for104.

Live archive checkpoint
At21:34:02UTC, the separate real archive process PID1204683 was confirmed alive:45,014/100,000files,945,390,422records,0candidates,0failures,0input downloads. These are partial counters, not a final negative result.
http://178.105.23.35:8090/china/inner-copy-status.html

Provenance and next action
Private105/validation.json records the checked control outcome. Private remote fixture and outputs are under /data/runs/china-xz-inner-control, separate from /data/runs/china-codex-xz-inner-copies. No existing corpus or scan output was overwritten. Continue monitoring104 via its existing observer; then run104-audit-inner-scan.py after terminal completion and review any actual candidates. No bot wave, original paste requests, decryption or key search occurred.

104 — Historical progress report; completed and reviewed in106
September 5, 2026. Partial operational checkpoint, not a final negative result.

Purpose
Extend103's specific inner-representation copy test to the existing August Common Crawl text corpus. This is a new representation scope, not a restart of the completed posted-form scan092.

Preflight and launch
All100,000input manifest files exist in the cached corpus;0missing. Same manifest SHA-25614e2fec6029971c0f1807162ae482fd69c3929a33bef9aa4ff0f49c4c6cea35d. Existing isolated ccsearch-xz-private binary verified SHA-2566c78bb33222535de86c499b6b0dde91116be6f68203eef1e1307d95e7bdef7d7. It binds its dashboard only to127.0.0.1:8097 and has external input fallback disabled by pointing it at loopback port1; no S3 flag.
Started2026-09-05T21:29:56.050600+00:00, PID1204683, output /data/runs/china-codex-xz-inner-copies. The previous scan output was preserved; the new output path had to be absent before launch.

Patterns
187private prefixes from103, derived from9large objects and76pieces in inner URL-safe, standard and plus-to-space forms. Explicit scorer-edge trimming affected2prefixes; lengths63–64characters. Pattern file SHA-2563fcaac4f963fe9181a86c3a6271097d3b3a1eb329aaded16899c8f1b900dd808. No payload material is published or sent to public search engines. This removes an encoding layer, not encryption.

Verified partial checkpoint
At21:30:21UTC, process confirmed alive:4,288/100,000files checked,92,840,274text records,0failures,0input bytes downloaded,0prefix candidates. Partial zeros do not establish absence. Any future candidate requires exact source-body verification.
A bounded observer polls the same job every30seconds for up to40observations; it never restarts scans. Counter page:
http://178.105.23.35:8090/china/inner-copy-status.html
Check the timestamp; stale counters do not prove a job is still running. Terminal completion must be audited against the manifest and saved outputs before reporting a final result.

Provenance and next action
Private104 holds launch metadata, prefix provenance, job.json and live observations. Existing archive corpus retained. No original paste requests, model inference, decryption or key search occurred. Continue this same job, review its final outputs, and preserve a final coverage audit. Do not relaunch after an observation timeout without authoritative process/output inspection.

103 — Inner-encoding copy check of saved cross-site files
Reviewed September 5, 2026, 21:30 UTC.

Coverage gap addressed
The previous literal-copy checks searched the posted outer text of the large xinzhai objects. A copy of their inner Base64 text would differ from that posted form. This check removes only the extra outer Base64 layer, not the encryption, and searches three representations: URL-safe inner text, standard Base64 alphabet, and that standard alphabet with plus replaced by space.

Method and result
All76source pieces were reparsed and checked against raw/body SHA-256 values in the fixed survey. They assemble into9complete groups; each full inner token was validated by canonical URL-safe Base64 round-trip. Both individual inner piece fragments and complete groups were considered, yielding255distinct representation variants and187distinct first64-character prefixes.
A fixed-string prefix screen checked132,140saved paste/wiki files outside the source Ubuntu directory. Zero candidate files were found, so no full-fragment or full-group match could be verified. Default rg text/ignore behavior applies; this is not a count of unique posts. No line-wrap, entity, arbitrary re-encoding or binary-file coverage is claimed.
Inventory SHA-256:a6cbf50b6602161e8dfb68800d2791448437cf4c3fbd92a29fa1701bc7d94411.
Fixed survey SHA-256:620d6dcc62fd2f4eefa396c631b43f57e308fcbd31e5c097994eca4aa5005f40.

Interpretation
No inner-text copy was found in this local scope. This is distinct from084/092's posted-form coverage and does not establish absence from the archive corpus or the wider web. It reveals no plaintext, key, cipher authentication or operator identity.

Provenance
103-private stores private prefixes, input inventory and analysis.json. No prefixes were sent to public search APIs or published. Local raw captures only; no original-site requests, pasted-code execution, decryption or key search. Report104 describes the separate archive extension launched after this check.

102 — Alternate numeric syntax checked; selected match is a cache interval
Reviewed September 5, 2026, 21:26 UTC.

Question and scope
Earlier literal30000/22500 searches could miss formatted constants. Two public Sourcegraph searches tested equivalent numeric spellings alongside encoding references, including archived repositories and forks, count100 and timeout20s:
- A file containing word-boundary Fernet/fernet, matched against30_000,30 * 1000 or3e4 (with flexible whitespace/case in the latter variants):3matches/2repositories, shard-match-limit warning. This is incomplete index coverage despite the small returned count.
- Python files containing b64encode, matched against22_500 or225 * 100:0matches, skipped=[] . This is a bounded negative for those particular forms, not every possible computation of the chunk size.
Both requests completed HTTP200. Exact query URLs and complete events are preserved privately.

Pinned source review
https://github.com/PostHog/posthog/blob/8a82a978431233c074f2a4352723c8bacb847043/nodejs/src/cdp/services/hogflows/hogflow-manager.service.ts
The inspected constant is refreshBackgroundAgeMs:30 * 1000 inside cacheOptions, beside refreshAgeMs:2 * 60 * 1000 and loader-retry settings. It expresses a cache refresh interval, not a character or byte boundary. Source SHA-256:f5d5af15a9c0af72e13f75dfeff13e802c040e202886f5564294d0c1c403b558.
The other returned paths are retained HTML reconnaissance captures, not demonstrated implementations; they were not pursued as uploader sources. No credentials or opaque payload snippets are published.

Outcome
No matching client was found in this returned material. Runtime calculations, other encodings, split-file code, private source and index omissions remain gaps. Co-occurrence of an encryption reference and numerically equivalent timing value does not demonstrate the xinzhai upload pipeline.

102-private retains search streams, metadata, exact source URL and pinned file. No original Ubuntu requests, source execution, decryption, key search or bot wave. All local query jobs finished;173terminal bot reports unchanged.

101 — ModelScope Studios and skills catalogs: no observed-label listings
Reviewed September 5, 2026, 21:24 UTC. Extends100 beyond model/dataset listings.

Documented scope and execution
The official modelscope_hub OpenAPI source captured in100 defines public GET /openapi/v1/studios and /openapi/v1/skills, both require_token=False and both accepting search/page_number/page_size. The Studio method documents a running-only default for general searches; status=all is explicitly supported. This pass supplied status=all to include stopped applications within the catalog's supported search scope.
Source: https://github.com/modelscope/modelscope_hub/blob/main/src/modelscope_hub/_openapi.py

Eight successful read-only requests
For each catalog, queried xinzhai, xz_knowledge_p1 and xz_improvement_plan_p1, with page_number=1&page_size=5. Studio requests additionally used status=all.
https://modelscope.cn/openapi/v1/studios
https://modelscope.cn/openapi/v1/skills
All six label queries returned HTTP200 and success=true. Studio results reported total_count=0 and studios=[]. Skill results reported total=0 and skills=null. The different schemas were preserved, not silently interpreted as identical arrays.
Positive controls searched Qwen: Studios returned five actual listings with total_count1,053; skills returned five actual listings with total127. These totals are observed server counts, not inspected totals. Only catalog metadata was retrieved; no applications, skills, models or inference endpoints were started, invoked, installed or downloaded.

Schema caveat
The inspected SDK comment says Studio listings lack the success/data envelope, but the current responses have that envelope. The review follows the actual captured responses. Source documentation establishes intended route semantics; it does not override runtime evidence or prove exact index coverage.

Interpretation
No xinzhai/xz listing was found in the checked application and skill catalogs. This does not search all Studio source files, logs, historical/deleted applications or every skill's file contents. Source-file global search remains unverified. The zero result is therefore bounded, and no attribution follows.

Access and provenance
Both public catalog routes work from the existing server without new geographic infrastructure. 101-private preserves all eight responses and exact URLs, timestamps and SHA-256 hashes in openapi-metadata.json. The SDK source provenance remains100-private/source-hashes.json. All requests were public GETs with pacing. No authentication, original Ubuntu access, source execution, key search or decryption occurred. No new bot wave;173terminal reports unchanged, no live job remains.

100 — ModelScope public catalog search verified; no xinzhai/xz listings
Reviewed September 5, 2026, 21:21 UTC.

Outcome
The existing server can search ModelScope's public model and dataset catalogs through official, unauthenticated GET routes. All six combinations of the three observed labels and two catalogs returned success=true, total_count=0 and empty item arrays. No matching uploader or operator was found. This is repository catalog coverage, not demonstrated global source-file or dataset-row search.

Source-supported routes
The official ModelScope SDK's current api.py is a shim delegating to modelscope_hub. The coordinator followed that public source to the official hub package. Its OpenAPI implementation defines list_models and list_datasets using GET, search/page_number/page_size parameters, and require_token=False:
https://github.com/modelscope/modelscope_hub/blob/main/src/modelscope_hub/_openapi.py
https://github.com/modelscope/modelscope_hub/blob/main/src/modelscope_hub/api.py
The OpenAPI client documents the /openapi/v1 prefix. No SDK code was executed, dependency installed or credential read. Captured source hashes are retained privately; main-branch links may later change.

Executed checks
GET https://modelscope.cn/openapi/v1/models
GET https://modelscope.cn/openapi/v1/datasets
Parameters: search=xinzhai, search=xz_knowledge_p1 or search=xz_improvement_plan_p1, with page_number=1&page_size=5.
All six responses HTTP200, success=true, total_count=0, empty models/datasets lists.
Positive controls used search=Qwen: the model route returned five actual items and total_count25,087; the dataset route returned one actual item and total_count803. These are observed catalog counts, not inspected totals. No models, datasets or applications were run or downloaded.
Three complementary public-web site:modelscope.cn searches with the quoted labels returned no results; those are search-engine negatives, not ModelScope's own index.

Browser observation and correction
The normal homepage loaded HTTP200 and displayed a public search button. Clicking that control and entering xinzhai reached https://modelscope.cn/search?search=xinzhai . It displayed No content, but the browser's GET/HEAD-only guard had blocked PUT/POST calls used by the frontend, including /api/v1/dolphin/agg. Therefore that browser message is NOT counted as a negative search result. No blocked requests were replayed. The documented GET catalog routes above supplied independently interpretable results instead. Automatic signed-out account checks returned401; no login was attempted or supplied.

Scope and infrastructure implications
Homepage access and official catalog search work without a China VPS for this task. This does not establish that all ModelScope pages or search surfaces are accessible, that catalog queries search every source file, or that a different geographic IP would unlock missing index features. The inspected SDK source does not establish global repository-file search. Studios, source-file contents and dataset rows remain outside these executed queries.

Worker and coordinator review
CN26Q001 was a bounded documentation task:3searches,3fetches,0archives,57seconds, terminal without worker error. It correctly identified the shim but did not inspect the delegated SDK; the coordinator completed that source follow-up and all catalog tests. There are173terminal bot reports, no active wave. Shared incremental OpenRouter spend was$3.23901 under the persisted$20guard, excluding AWS hosting.

Provenance
100-private preserves browser HTML/text, request statuses and blocked-method inventory, SDK source captures, all eight catalog/control responses, exact request URLs, timestamps and SHA-256 metadata. The browser's early hidden-input timeout was resolved by using the normal visible search button. No source instructions were followed, keys searched, payloads uploaded, original Ubuntu requests made, or model inference performed.

099 — Non-Python chunk-signature search: inspected constants are unrelated
Reviewed September 5, 2026, 21:16 UTC.

New scope
Extend080's Python encoding/chunk search to other indexed languages. Public Sourcegraph streaming queries included archived repositories and forks, count100 and timeout20s. All three requests completed HTTP200, but all returned shard-match-limit warnings. None supports an exhaustive negative result.

Queries and observed limits
1. -lang:python, file containing a word-boundary Fernet/fernet, word-boundary30000:100matches/28repositories. Returned documents include deployment configuration, architecture notes, dictionaries and generated artifacts. No wordlists, environment examples or credential material were pursued as sources.
2. -lang:python, file containing base64/Base64/b64encode/btoa, word-boundary22500:100matches/37repositories. Results include generated JavaScript, data fixtures and numeric inventories. This co-occurrence is too noisy to establish chunking.
3. Restrict the Fernet/30000 query to js/ts/rs/go/java/cs/rb/php paths, excluding test/vendor/dist/fixture/node_modules paths:6matches/3repositories, still with a shard-match-limit warning. Path exclusions do not remove inline tests in ordinary implementation files.
All exact query URLs and terminal events are preserved in099-private.

Pinned source inspection
The three query3 source files were fetched at their indexed commit revisions:
https://github.com/xintaofei/codeg/blob/654480054ee83d08be4786cfdcc5e563ddcc5b6a/src-tauri/src/parsers/codex.rs
30000 appears as yield_time_ms in parser tests and a corresponding assertion. Fernet occurs in a separate parser comment about recognizing an encrypted envelope. This is not a30,000-character upload boundary; the comment is not independent verification of the encryption implementation it describes.
https://github.com/agentic-community/mcp-gateway-registry/blob/7d2f85b6674bebd65a69b57e89d4f3aea1631aa7/infra/lib/registry/registry-config.ts
The numeric constant configures otlpExportIntervalMs, a telemetry export interval.
https://github.com/clemlabprojects/ambari/blob/d31416ac3b309ca1662e918038f705603eda25eb/contrib/views/k8s/src/main/java/org/apache/ambari/view/k8s/service/CommandService.java
The constant configures cookies.timeout.millis.
These source contexts explain the selected matches. No label-to-encryption-to-chunk-to-paste data flow is established by any of them.

Interpretation
No matching non-Python client was found among the inspected results. Numeric constants shared with encryption references frequently denote timeouts or independent configuration. The full index, omitted results, alternate syntax such as30_000, other languages and cross-file data flows remain coverage gaps. Do not infer a private implementation or an operator from this pass.

Provenance
099-private stores stream captures, query/status/SHA-256 metadata and three pinned source files with source-review.json. Source reading only; no source code execution, key search, decryption, application requests or Ubuntu access. All jobs are terminal; no new bot wave,172terminal reports unchanged.

098 — Xinzhai overview reorganized around evidence and uncertainty
Reviewed September 5, 2026. Website update; no new attribution finding.

The focused page now leads with the shared-workflow interpretation, fixed survey counts, four linked evidence cards and a short lifecycle. It distinguishes scheduled scripts, a single agent and a swarm as unresolved alternatives. Chunk-size and Fernet-layout limitations appear alongside the interpretation. The detailed working overview and static chart remain available in expandable sections, while the six latest reviewed reports are selected from the current report files whenever the generator runs.

Public page: http://178.105.23.35:8090/china/xinzhai.html
The interactive explorer and fixed1,142-post export remain linked. No payload collection was expanded. Facts derive from existing reviewed reports067–097; this layout update supplies no new independent evidence.

Verification
Chromium browser checks passed: four evidence cards, six recent-report links, collapsed technical history that opens correctly, every checked local link HTTP200, no page JavaScript errors, and no document overflow at390px mobile width. Desktop screenshot visually reviewed. Private098 contains browser-validation output and desktop/mobile screenshots. Generator: investigation/china/build_xinzhai_overview.py. Rebuild it after future report additions; the normal dashboard generator separately publishes text reports.

097 — Runtime-assembled label search: no uploader; concrete diagnostic-code false positive
Reviewed September 5, 2026, 21:10 UTC.

Question
Full labels may be assembled from a prefix, knowledge/improvement_plan and a part suffix. Search source-file co-occurrences without requiring the complete xz labels. This tests one route around literal-label absence; it does not identify runtime behavior by itself.

Five Sourcegraph queries
All used context:global, archived:yes, fork:yes, count:100, timeout:20s and the public streaming search API. Exact encoded request URLs and complete event streams are retained privately.
1. file:has.content(paste), literal improvement_plan: final74matches/30repositories, skipped=[] . Returned material includes development plans, schemas, documentation and agent-related project files, with no demonstrated upload path.
2. file:has.content(paste), regex knowledge.{0,12}_p:100matches with shard-match-limit warning. No exhaustive absence claim is made. This is a noisy pattern: it matches knowledge_path and acknowledge_all_problems, among other ordinary identifiers. Do not expand its limit as if these were uploader candidates.
3. file:has.content(b64encode), literal improvement_plan:2matches/1repository, skipped=[] . The returned GoogleCloudPlatform/vertex-ai-creative-studio lines are PROMPT_IMPROVEMENT_PLANNING_INSTRUCTIONS, a substring match rather than the exact observed identifier.
4. file:has.content(pastebin|paste[.]|code2|parent_pid), literal improvement_plan:29matches/4repositories, skipped=[] . Returned content includes Alibaba diagnostic reporters, legal-source samples, skill-evaluation tests and completed-development notes. File co-occurrence does not show data flowing into a paste uploader.
5. file:has.content(b64encode), regex \bimprovement_plan\b:0matches, skipped=[] . This narrows query3 to the exact identifier boundary. It is a bounded code-index negative, not proof of a private client or absence from all source code.

Concrete source review
Two files in aliyun/alibabacloud-ecs-troubleshoot-skills were independently fetched at commit809887f613b50aa31c088cac4944fd3b8c1ac521:
https://github.com/aliyun/alibabacloud-ecs-troubleshoot-skills/blob/809887f613b50aa31c088cac4944fd3b8c1ac521/skills/alibabacloud-ecs-sec-userspace/scripts/reporter/chinese_report.py
https://github.com/aliyun/alibabacloud-ecs-troubleshoot-skills/blob/809887f613b50aa31c088cac4944fd3b8c1ac521/skills/alibabacloud-ecs-sec-userspace/scripts/reporter/generators/markdown_generator.py
The matching parent_pid occurs among process ID, command-line, executable, user and start-time fields; its output label is 父进程ID. It is an operating-system parent process, not evidence of the old paste backend's similarly named form field. improvement_plan is used to generate report sections. No pastebin, paste-dot or code2 match appears in those two files. Chinese language and Alibaba ownership therefore add no attribution link here.
Source SHA-256 hashes:
chinese_report.py:11a621918f68c4908403197822cc2d2ec40f43807eed8ab39dd3219190ea26c8
markdown_generator.py:240476fcfcf0edc825ce036a68588b3298b017f5550c26998dc0e67148ca492d

Outcome and limits
No implementation of the observed label-to-encoding-to-chunk-to-paste sequence was found. Broader returned source snippets were screened, not every repository audited. Most important gaps are code outside this index, identifiers split across files, differently named serializers, and private source. Do not reinterpret generic developer plans, pasted text, model projects or diagnostic reports as agent persistence without the actual data flow.
Private097 retains raw streams, metadata, exact queries and two pinned source captures. All jobs ended. No bot wave launched;172terminal reports unchanged. No source instructions were followed, source code run, original Ubuntu requests made, credentials used, or key/decryption work performed.

096 — GitHub README searches: four namesakes, no full xz labels
Reviewed September 5, 2026, 21:07 UTC.

Coverage
The documented in:readme qualifier adds README text to repository discovery; default repository search covers names, descriptions and topics. This is distinct from earlier name discovery and authenticated code search:
https://docs.github.com/en/search-github/searching-on-github/searching-for-repositories
Three public API queries returned HTTP200 and incomplete_results=false:
xinzhai in:readme — 4 results, all returned and reviewed.
"xz_knowledge_p1" in:readme — 0 results.
"xz_improvement_plan_p1" in:readme — 0 results.
Endpoint: https://api.github.com/search/repositories with per_page=100. Default fork exclusion applies; this is case-insensitive README search, not all files or history.

All four source matches
1. calfa-co/chi-know-po: historical-text recognition dataset, with Xinzhai in its accuracy table. This corresponds to the already reviewed unrelated Hugging Face dataset.
https://github.com/calfa-co/chi-know-po/blob/main/README.md
Blob SHA1:5650688c67cdaa951698894cd10f77226a718b74.
2. lanony82/YYKANPAN: stock-market application. The README describes /api/xingu-xinzhai as 新股新债日历, a new-stock/new-bond calendar. That application endpoint was not called.
https://github.com/lanony82/YYKANPAN/blob/main/README.md
Blob SHA1:a56534c2739a09acce830e47c7b4b205faa078b0.
3. echarts-maps/echarts-cities-js: city inventory with Xinzhai among geographic names.
https://github.com/echarts-maps/echarts-cities-js/blob/master/README.md
Blob SHA1:5aa5d49e2bb3ae6e483360c81b6229584d56f81b.
4. dev-basit/countries-cities: country/city list with Xinzhai in a city array.
https://github.com/dev-basit/countries-cities/blob/main/README.md
Blob SHA1:da423a3446a3061562a1059d42f01a84ce38db74.

Retrieval corrections and verification
The echarts README API used encoding=none and omitted the body for its1,599,066-byte file; the supplied raw URL returned the full file. The countries-cities API supplied only512,000bytes although its size field claimed928,844. A Git blob hash check caught that truncation; the supplied raw URL returned all928,844bytes and the expected hash. All four final source bodies match their API Git blob SHA1 identifiers. The captured API body alone was insufficient to claim complete source retrieval. No files were executed.

Interpretation
No uploader or operator was joined to the paste workflow. These sources explain the observed matches but do not prove absence throughout every repository. The stock-calendar match illustrates another ordinary meaning of xinzhai; pinyin remains ambiguous. Both full-label results are bounded negatives under the index/query scope, with successful concrete source retrieval as a positive control.

Provenance and state
096-private contains exact search URLs, timestamps, hashes, API records, final source bodies and raw-download corrections. Local investigation inventory showed no newer independent analysis to incorporate; no decryption output or key material was read. No bot wave launched;172terminal bot reports unchanged. No original paste requests, posting, authentication attempts or code execution occurred.

095 — Quoted Hugging Face search resolves fuzzy-result coverage
Reviewed September 5, 2026, 21:03 UTC. Follow-up to094.

New observation
The unquoted xinzhai search previously returned167 results with many similar spellings. Adding quotation marks returned exactly one document, calfa-ai/chiknowpo/README.md, the historical-text namesake independently reviewed in094:
https://huggingface.co/search/full-text?q=%22xinzhai%22
HTTP200. The server-rendered FullTextSearch data explicitly echoes the quoted query, reports totalHits=1 and contains one returned document. Its highlighted Xinzhai occurrences refer to 心齋十種. This observed query behavior narrows this result set; it is not a claim that quotation implements every possible exact-substring or case-sensitive search convention. No additional unquoted result pages were fetched.

Naming-pattern follow-up
To test the observed suffixes under prefixes other than xz, two additional quoted queries were checked:
https://huggingface.co/search/full-text?q=%22knowledge_p1%22
https://huggingface.co/search/full-text?q=%22improvement_plan_p1%22
Both HTTP200, echoed query, totalHits=0 and empty docs in the embedded server data. Requests were paced and used public GET only.

Interpretation and limits
No uploader or shared label convention was found through these queries. This closes the immediate fuzzy-result pagination question for the quoted xinzhai query. It remains bounded by the card/app.py index scope described in094; dataset rows, unindexed files, alternate spellings and transformed content remain outside this check. The historical title must not be promoted to the unknown operator's Chinese name.

Provenance
095-private preserves all three response bodies, embedded structured search data and hashes in quoted-review.json and suffix-review.json. No model worker was launched for this check;172terminal reports unchanged. No Ubuntu requests, Space launch, inference, posting, decryption, key search or payload submission occurred.

094 — Hugging Face full-text index: exact xz labels empty, xinzhai namesakes
Reviewed September 5, 2026, 21:00 UTC. Coordinator review of bounded OpenRouter task CN26P001.

Result and coverage
The official Hub search documentation states that its full-text index covers model cards, dataset cards and Spaces app.py files. It does not establish coverage of every repository file, dataset row, discussion or runtime log.
https://huggingface.co/docs/hub/en/search
Both full xz labels returned a successful page saying No result found:
https://huggingface.co/search/full-text?q=xz_knowledge_p1
https://huggingface.co/search/full-text?q=xz_improvement_plan_p1
A positive control returned 13,488 results with concrete excerpts:
https://huggingface.co/search/full-text?q=llama&type=space
These are bounded index negatives, not evidence that the project is absent from all Hugging Face material.

Xinzhai result
https://huggingface.co/search/full-text?q=xinzhai returned 167 results, with fuzzy alternatives such as xinzhi/xinhai names. Only the first page was read. The leading literal result was calfa-ai/chiknowpo, whose README table identifies Xinzhai with the historical work 心齋十種. The coordinator independently fetched the public README and confirmed the table and surrounding historical-text collection context:
https://huggingface.co/datasets/calfa-ai/chiknowpo/raw/main/README.md
README SHA-256: 9da6b3b5540d29d0ff8f37a922a19efe74d15666771b1a90d2dc284d3dcb8410
This is a concrete namesake, not evidence for the encrypted Ubuntu workflow. 心齋 has not been established as the operator's intended Chinese spelling. Remaining result pages were not reviewed; the 167 count must not be described as 167 inspected or relevant projects.

Complementary search
Three Google site:huggingface.co queries returned zero results for each quoted full xz label and five for xinzhai. Their snippets included the historical-text dataset and geographic names. These are supplementary discovery results, not full source verification.

Review and cost
The coordinator read and preserved all five fetched documentation/search extracts, verified the exact result messages and positive control, and independently read the leading namesake README. The worker used five fetches, three searches and zero archives, finishing in 104 seconds; the runner terminated normally. There are now 172 terminal bot reports. Shared guarded OpenRouter spend was $3.23655 above the persisted baseline, under the $20 cap; this excludes AWS hosting. No search bot remains running from this wave.
Private provenance: 094-private/0.txt through 4.txt, review.json with extract hashes, namesake-readme.md and namesake-source.json. No dataset bulk download, Space launch, inference, original Ubuntu access, payload upload, decryption or key search occurred.

093 — GitCode access works selectively; signed-out code search disabled
Reviewed September 5, 2026, 21:00 UTC.

Purpose and outcome
Test a distinct Chinese code-host search surface for the xinzhai/xz labels. The normal homepage and browser project search work from the existing host. This adds project discovery access, but no verified code-file coverage or uploader attribution.

Primary observations
https://gitcode.com/ loaded HTTP 200 in Chromium. The documented slash-key shortcut opened the search input; submitting xinzhai through that normal control reached https://gitcode.com/search?q=xinzhai&type=repo . The rendered page displayed 23 project matches, two users and zero in the other displayed categories. Only the first ten project results were reviewed. Results included xinzhan_Markdown, xinzai-/atomngn, AI-xiazai and several xinghai/xinghuai names. These fuzzy names are not demonstrated xinzhai/xz references. The page did not present a code category in the captured signed-out view.
The official help page describes project, model/dataset, issue/PR and user/organization searches, alongside examples of code-specific path and symbol syntax:
https://docs.gitcode.com/docs/help/home/page-intro/search/
Documentation alone does not establish availability in this session.

Browser-observed configuration
The frontend requested https://web-api.gitcode.com/api/v1/search/nauth/code/enabled?type=repo . A separate read-only GET returned HTTP 200 with {"enabled":false}. This is evidence about this signed-out configuration, not a platform-wide or permanent lack of code search. No authentication attempts, hidden query types or gated search probes were made.

Direct request limits
The browser-observed public query route was also checked with ordinary GET requests. xinzhai, xz_knowledge_p1 and the linux control received HTTP 418 CloudWAF pages. xz_improvement_plan_p1 received HTTP 200 JSON with empty content, but total=null, page_size=0 and page_num=0. That response is not promoted to a well-formed exhaustive zero-result count. These direct results differ from the working browser xinzhai page. No CAPTCHA was solved, credentials supplied or firewall workaround attempted. The batch should have stopped earlier after its first query-route block; do not repeat this direct route without a new access discriminator.

Interpretation
An additional China-adjacent public browsing route is usable without purchasing infrastructure. That does not solve code-index access, fuzzy query semantics, dating or attribution. No verified uploader or xz marker was discovered. A different geographic server has not been shown to enable this signed-out code feature.

Provenance
093-private contains browser HTML/text and response status inventories, direct response bodies, and SHA-256 query metadata. Initial input fill timed out before the documented shortcut was used; the subsequent normal UI search succeeded. An initial local response-metadata script used the wrong requests attribute and was corrected; this was a local logging error. Browser non-GET requests were aborted. No original Ubuntu requests, posting, model inference, decryption or key search occurred.

092 — Completed archive copy scan: no literal-prefix candidates
Reviewed September 5, 2026, 20:54 UTC. Supersedes the running status in report 091.

Result
The existing August Common Crawl text corpus scan completed in 659 seconds: all 100,000 manifest files, 2,083,525,558 text records, zero failed files and zero matching records. No input bytes were downloaded. The process exited; its bounded status observer also finished. There is no continuing copy-scan job.

What was searched
The 5,802 case-sensitive patterns represent leading 62–64-character substrings of the original and space-to-plus forms of 3,571 opaque xinzhai/xz records. These patterns can identify literal copies under different labels. The prefix material remained private and was not submitted to public search engines. Report 091 documents normalization, source provenance, the isolated scanner and preflight checks.

Completion audit
The final done.txt has exactly 100,000 distinct paths and equals the input manifest as a set: zero missing or unexpected paths. failed.txt, scores.tsv and matches.tsv are each zero bytes; domains.tsv contains only its header. The terminal log independently reports the same complete file count, page count and zero matches. Private final-audit.json records file sizes and SHA-256 hashes, audited at 2026-09-05T20:53:56.737272+00:00.
Manifest SHA-256: 14e2fec6029971c0f1807162ae482fd69c3929a33bef9aa4ff0f49c4c6cea35d
Completed-path file SHA-256: a22184199ca068c273b3b4d9c50465d239593cd25d9f03f1a403ada29059e121
Pattern file SHA-256: 1e8e95f607c4411e31beaf399c23ac00c2bc66ba63a37b81f8a16f1bc36b7775
Terminal log SHA-256: 0fe1acecb73e0d4272ee942272854e0cd02baa0d467f552de8f41f693037ed8a

Interpretation
This found no cross-host copy candidate in this corpus under the tested literal forms. It neither weakens the strong within-host xinzhai/xz workflow link nor establishes that no copies exist elsewhere. Common Crawl text extraction omits content; line wrapping, entity changes, inner encodings and newly encrypted copies can defeat these patterns. The source host's archived crawler exclusion further limits coverage. No full-record match or independent attribution was discovered.

The best current interpretation remains a related publishing workflow: bulk version-labelled opaque uploads interleaved with smaller knowledge-labelled records, followed by periodic records and plan-associated size changes. This is compatible with automated storage, but does not establish a swarm, Chinese laboratory, model identity, or the meaning of its contents.

Private provenance: investigation/china/091-private/final-audit.json and the same remote output directory /data/runs/china-codex-xz-copies. The existing archive corpus was preserved. No original-site requests, posting, decryption or key search occurred in this scan.

091 — Historical progress report; scan completed and reviewed in report 092
September 5, 2026. This is an in-progress methods/status report, not a final negative result.

Purpose
Extend084's local paste/wiki copy check to the existing August Common Crawl text corpus. Search for the opaque records independent of their labels, so a differently named copy could be found. Any prefix hit requires subsequent source-body verification; a matching prefix alone is not a confirmed full-record copy or new actor.

Coverage and preflight
The existing100,000-file August manifest was checked against the cached text corpus:0missing files. Manifest SHA-25614e2fec6029971c0f1807162ae482fd69c3929a33bef9aa4ff0f49c4c6cea35d. No new corpus purchase/download is needed. The run uses the local cache, with network fallback pointed at an unavailable localhost port so it cannot fetch missing inputs externally.
There are5,802case-sensitive patterns derived from084's original/space-to-plus forms of3,571opaque cluster records. Scorer parsing trims whitespace at term edges, so that trimming was made explicit before writing the term file:102prefixes affected, final lengths62–64characters. Internal spaces remain unchanged. These are substrings of the corresponding candidate forms, not decrypted content. Payload prefixes and mapping material remain private.
Term file SHA-2561e8e95f607c4411e31beaf399c23ac00c2bc66ba63a37b81f8a16f1bc36b7775.

Verified running checkpoint
Started2026-09-05T20:42:33Z. At9.83seconds:1,131/100,000files complete,27,401,950page records processed,0failures,0input bytes downloaded,0prefix candidates. These are partial counters only. No final absence claim is supported at this point.
The process has384workers over cached local inputs. Current output directory:/data/runs/china-codex-xz-copies on the existing AWS archive host. Process PID1201762; local-only dashboard127.0.0.1:8097. Socket inspection confirmed it listens on127.0.0.1, not all interfaces. Do not restart based on an old report timestamp; inspect the process and same job output first.

Scanner isolation
A separately named ccsearch-xz-private binary was built offline from the existing scanner source, with only package/binary name and dashboard bind changed. Existing scanner source and binary were retained. Source SHA-25687c75ce391a6a4176fa3ed868098ae7c8c8a915e585072d09d126cb06bbb3264; new binary SHA-2566c78bb33222535de86c499b6b0dde91116be6f68203eef1e1307d95e7bdef7d7. Build directory:/data/runs/china-xz-private-build. Private output/build directories have restricted access.
Local091-private preserves the prefix provenance and job/preflight metadata. No prefixes are published here or sent to public search APIs. No original paste service requests, decryption, key search or pasted-code execution occurred. The private remote terms file used by other work was not read.

Limits and next action
This is a text-corpus substring scan, not a complete WARC/HTML/binary search. Encoding transformations, line wrapping, different randomized ciphertext and content absent from Common Crawl remain gaps. Common Crawl's host-policy exclusion from081 does not preclude copies on other indexed hosts. Poll the running job, review any candidate URLs and recover exact source records only if a hit warrants it. Replace the partial checkpoint with final coverage after authoritative completion.

Operational follow-up: a bounded observer polls the same remote job every30seconds for up to40observations, without starting or restarting scans. Public counter-only page:http://178.105.23.35:8090/china/archive-copy-status.html . It explicitly separates automatic status from reviewed evidence and displays its observation timestamp. At123seconds the scanner had checked18,417files and389,456,938records, with0failures/downloads/candidates; still partial.

090 — Gitee client search: broad results are not exact hostname matches
Reviewed September 5, 2026, 20:37 UTC.

Finding
Gitee's working project search did not supply a verified xinzhai uploader. Both unquoted Ubuntu hostnames returned totals of at least200projects, with20rows requested. Quoting paste.ubuntu.org.cn returned exactly the same ordered20project IDs as the unquoted query. Quotation marks therefore did not establish a literal-hostname filter in this observed query.

Source review
The top result, https://gitee.com/stupid_kid/awesome-mac, was readable with a normal HTTP200 GET. Its rendered HTML text contains neither exact Ubuntu hostname. It is a software catalog mirror, not a demonstrated uploader. This does not prove the hostname occurs nowhere in the repository or was absent from an older indexed state. It does show that a search hit alone does not establish the desired reference.
The hostname result pages predominantly list software catalogs, command collections and assorted repositories. No matching xinzhai/xz names or upload mechanism was established from their returned project metadata. No remaining pages were enumerated: these broad results are not an exhaustive review of at least200projects.

Other queries
pastebin Fernet returned0 withrelation=eq.
pastebin 加密 returned18 withrelation=eq; all18metadata rows were returned. Descriptions concern website/resource lists and security notes, with some blank descriptions. None establishes the required record names, recurring workflow or encoding/chunking implementation. Full repository content was not audited. Generic references to encryption and paste sites can co-occur for many reasons.

Implication
089 established access, while090 tests usefulness and precision. Gitee project search is a discovery aid; its counts and quoted strings must not be promoted into verified code references. A candidate needs an actual matching source file or readable discussion. Successful transport does not imply exact search semantics or complete source-file coverage.

Provenance
Five public query GETs through the browser-observed project-search route, plus one project-page GET. No account, writes, code execution, scans, admin routes or original Ubuntu requests.090-gitee-client-search.py saves the four initial queries.090-private also preserves the quoted query, source page, complete returned JSON, statuses,timestamps and SHA-256 hashes. The ordered20ID equality was independently checked from the raw responses.
The project page is readable from the existing host, another route-level access observation. It does not resolve restricted raw-file or gist endpoints. No new infrastructure was purchased.

089 — Gitee public project search is accessible from the existing host
Reviewed September 5, 2026, 20:33 UTC.

New access result
A normal headless browser opened https://search.gitee.com/?q=xinzhai and reached https://so.gitee.com/?q=xinzhai withHTTP200. The rendered interface and its public JSON search response both report zero results. This is a different surface from the previously unavailable Gitee gist API. Do not label all Gitee search inaccessible based on that earlier API result.

Observed public search route
The frontend fetched a public widget definition naming its query 开源项目搜索 (open-source project search), query1048. It then made a GET to /v1/search/widget/wong1slagnlmzwvsu5ya with that query ID,q=xinzhai,from=0,size=20. These are frontend-observed public requests, not guessed private routes. No credentials were used. Only the advertised project-search query was used; no hidden query IDs or account endpoints were probed.
Subsequent read-only GETs through the same route returned:
- xinzhai:0,relation=eq (initial browser request).
- xz_knowledge:0,relation=eq.
- 心斋:5,relation=eq; all five returned.
- linux positive control:one returned project, total reported200 withrelation=gte. Do not report exactly200 total projects.

Xinzhai candidate review
The five 心斋 results describe a C# Chinese-chess application, poetry plus unrelated outbound-link material, a philosophy description, a random-data generator and an older AI poetry platform. No returned project description or label supplies the xinzhai/xz paste workflow. This is returned-project metadata review, not a full source-code audit. Outbound spam-like links were not followed.
心斋 is still a possible spelling, not an observed Chinese name in the paste bodies. The service's suggestions xinzhi,xinghai,xinhai and others were not accepted as spelling corrections or identities.

Infrastructure implication
Existing-host browser rendering opened this public discovery route; successful direct GET follow-ups show that the search backend itself is also reachable. No Hong Kong/Singapore server purchase was needed for this result. This does not resolve access to Gitee gists, private repositories or a global source-file index. The widget explicitly advertises project search. It cannot be used as evidence that all files on Gitee were searched.
The web tool's initial open failed, while the browser/direct route succeeded. Route-level results should remain separate rather than classifying a host from a single tool's failure.

Provenance and boundaries
089-gitee-browser-check.py and089-private preserve the rendered page, screenshot, public widget/search JSON, exact URLs, statuses, UTC capture times and SHA-256 hashes. Additional query responses and metadata are saved in the same private directory. Browser requests were limited to GET; non-GET traffic was aborted. No form submission, login, CAPTCHA interaction, access-control bypass, repository modification or original Ubuntu request occurred.
Capture window:20:30–20:31UTC, September5. The runner brief now records this working public project-search route so later bots can distinguish it from blocked endpoints. Gitee frontend identifiers may change; rediscover the advertised query if the route changes rather than guessing alternative IDs.

088 — Interactive xinzhai record explorer
Published September 5, 2026.

Live page:http://178.105.23.35:8090/china/explore-xinzhai.html
Linked from the focused xinzhai overview.

Purpose
Make the reviewed sequence inspectable without reading dozens of reports. The explorer combines3,484knowledge records,11plans and79xinzhai entries, including76multipart pieces and3readable startup tests. Total3,574metadata entries. It provides whole-sequence and startup views, three plan-boundary presets, editable time range, family filtering, ID/label search, point details, and a50-row paginated table linking to original public pastes.

Data scope
Generated from the fixed039 final checkpoint. Only id,name,time,chars,family are exported for each selected cluster row; no authored bodies, ciphertext prefixes, personal material from neighboring posts or keys are included. The data file also records the source snapshot hash. Fixed family counts are asserted during generation.
All plotted times are literal website displays. JavaScript uses synthetic UTC coordinates solely to preserve clock differences; this does not claim actual UTC creation times. The UI explicitly states that dates/timezone are unverified. Rows distinguish encoded character lengths, not semantic knowledge or agent counts. Same-minute points overlap; the table exposes each record separately.
The original1,142-post payload export remains unchanged. This new metadata view covers the complete reviewed cluster and is investigator-created analysis, not independent actor evidence.

Validation
Chromium151.0.7922.34 successfully loaded the served page and metadata. Checks verified3,574 plotted records,50-row pagination and72pages,11-plan filtering, exact ID4548575 lookup and point selection, presence of the July13 boundary records4549427/4549428, startup preset, invalid-interval handling, and no document-width overflow at390px mobile width. No JavaScript page errors occurred. All browser requests stayed on the local served site; no original paste link was followed. Desktop screenshot was visually reviewed.
Private088-private contains screenshots and browser-validation.json. The browser check script is088-browser-check.py. Temporary Playwright tooling and headless browser reside under/tmp/china-browser-check and/tmp/china-browser-binaries; no system browser configuration was changed.

Maintenance
Run python3 investigation/china/build_xinzhai_explorer.py to rebuild from the fixed snapshot and xinzhai-explorer-template.html. The focused overview generator preserves its explorer link. If a new reviewed corpus is adopted later, update the generator and its count assertions deliberately; automatic discovery must not silently expand the dataset.
Metadata SHA-256:0dd8b09787d1a1b62cfccb168a020507d8affefe390ed51fe281b22e1c25ac16.
This website addition makes existing evidence easier to inspect; it adds no operator or swarm attribution claim.

087 — Public paste software with matching form fields
Reviewed September 5, 2026, 20:25 UTC.

Finding
A PHP-constrained Sourcegraph query for code2 in files also containing parent_pid returned four matches in two files of lordelph/pastebin. Direct GitHub blob retrieval confirms an older Pastebin implementation sharing the editor name and code2,parent_pid,poster field convention observed on the Ubuntu site. This is a source-code family comparison, not identification of the deployed Ubuntu version or its operator.
Primary public repository: https://github.com/lordelph/pastebin .

Observed input path
public_html/pastebin.php conditionally applies a stripslashes callback to GET/POST/cookie values when get_magic_quotes_gpc() is enabled. The condition is explicit. This is not an unconditional URL decode or evidence that the deployed site strips all backslashes.
lib/pastebin/pastebin.class.php checks code2, assigns it directly to a code variable, checks a spam filter, and passes the variable to db->addPost. No explicit urldecode call occurs in the inspected three files. Database, framework and deployment behavior are not exhaustively reconstructed here.
public_html/layout.php declares the editor form and matching fields. Its inspected form does not declare the multipart enctype found in the current Ubuntu homepage, and it has an onkeydown textarea handler absent from that homepage. These differences are concrete reasons not to call it the exact installed source.

Implication for xinzhai
The field convention is longstanding generic paste software, not an uploader-specific signature. The inspected upstream does not supply a plus-to-space application-code explanation. Malformed URL-encoded client input, extra decoding elsewhere, historical modifications or already-space-containing input remain possibilities from085. No server version, exact bug or original client has been proven.
The visible site's Base64 JavaScript helper is not evidence that it Base64-encodes submitted records;085 inspected its unrelated decoding/helper functions. Do not merge the host implementation and the unknown xinzhai client into one software attribution.

Search scope and provenance
The initial unconstrained code2/parent_pid query hit a30-result limit in unrelated large files. It was narrowed to PHP; the follow-up returned4matches from1repository with terminal done and no skipped warnings. Both raw streams and exact queries are in087-private; scripts087-paste-server-search.py and087-php-search.py reproduce them.
GitHub's recursive master tree returned tree SHA3111e014df57272a39cf75152a7b109f8f37ffac,truncated=false. Three exact blob objects were retrieved for pastebin.php,layout.php andpastebin.class.php. Source paths, immutable blob hashes, request URLs and SHA-256 checksums are saved in087-private/upstream-metadata.json; raw decoded source is private. Tree identity is a tree hash, not an asserted commit hash.
All actions were public read-only retrieval and source inspection. No service submission, admin access, vulnerability probe, key search, code execution or deployment occurred.

086 — Reviewed public discussion and dot-version search wave
September 5, 2026, 20:22 UTC. CN26O001–002 completed;171 cumulative bot reports.

Outcome
No matching public discussion or version explanation was found. The useful new coverage is three public GitHub issue-search API responses. Coordinator inspection of saved response caches confirms HTTP200,total_count0,incomplete_results=false for quoted xz_knowledge_p1, quoted xz_improvement_plan_p1, and xinzhai+paste+storage+Ubuntu. These are issue-search results; they do not constitute an exhaustive GitHub Discussions search. Exact URLs and observed20:20UTC metadata are preserved in086-private.

The second bot tried dotted version variants with xinzhai and hypothetical Chinese spelling 心斋. Returned snippets concerned unrelated topics. Baidu returned a verification challenge despite HTTP200; ResearchGate returned403. Neither counts as a successful negative source review. The bot unnecessarily revisited known labels and a previously challenged Baidu route; those calls add no useful coverage and should not be repeated. Its taxonomy snippet does not establish a software project or even justify the report's specific name-role interpretation.

Execution and cost
Two workers, nine-step cap, four searches and three fetch allowances per task, zero archives, persistent shared20USD incremental OpenRouter guard. Runner completed two reports with zero terminal worker errors and one blocked request. A recoverable model tool-call parse error also appeared in the log; do not describe execution as error-free. Persisted session spending at completion was3.22851USD, excluding AWS and other services. The initial local launch failed before creating a task manifest; it was corrected before any successful wave start, and no duplicate wave was launched.

Limits and next steps
The discussion result is bounded to the precise public issue queries and search-engine snippets. Dotted-version and Chinese-spelling hypotheses remain unresolved. Recommended repeats of exact names through unchanged indexes are not new evidence. Use a newly discovered source artifact or genuinely different coverage, not fresh quota alone, to justify the next search. Both tasks are terminal; no OpenRouter wave remains running.

085 — Visible posting form narrows the transport hypothesis
Reviewed September 5, 2026, 20:22 UTC.

Finding
The saved current homepage declares its editor as method=post,enctype=multipart/form-data,action=/. The authored text field is code2. Its only inline event handler is a body-onload framebuster. The linked jscript.js contains Base64 decoding helpers, DOM lookup and frame-busting functions; no code2 handling, submit call, XMLHttpRequest or fetch call appears in that complete file. The visible client does not implement the nested encoding/chunking observed in xinzhai uploads.

Implication
Ordinary multipart form serialization does not by itself apply the plus-to-space rule of application/x-www-form-urlencoded. A malformed custom URL-encoded client request remains a plausible explanation for the small records; extra decoding in server/intermediate processing also remains possible. The current form cannot identify the original July client or prove the server's historical behavior. Input might also have arrived with spaces already present.

Local synthetic demonstration
Using an invented string A+B/==, correct URL encoding produces code2=A%2BB%2F%3D%3D and one parse preserves the plus. Building code2=A+B/== without escaping changes it to A B/== after parsing. Applying an extra unquote-plus step after correct parsing produces the same change. These are offline parser examples, not tests of the original service. No POST was made.
Standards: https://url.spec.whatwg.org/#concept-urlencoded-parser defines plus-to-space parsing; https://www.rfc-editor.org/rfc/rfc7578.html specifies multipart form data. The examples show non-unique mechanisms, not the actual uploader implementation.

Control and limits
A retained earlier source page4548326, displayed July2, contains three literal plus signs. Newly observed C++ pages also preserve plus signs. The service can visibly retain plus characters; a universal final rendering filter that always removes them is therefore inconsistent with the retained pages. This does not exclude path-specific processing or historical configuration changes.
The current textarea has no maxlength attribute; the poster name field does. This is not a backend size-limit test. The prior empirical finding that30,000 is not a demonstrated site-wide hard limit remains unchanged.

Provenance
Homepage raw hash5729a6f41e8d6234b032a4f0f0ec7abcc20869de910cd8d9348a7b71329efa9c, previously saved083. One new public GET:https://paste.ubuntu.org.cn/jscript.js, HTTP200 at2026-09-05T20:19:41.222071+00:00, SHA-256a1118ec40e5783c47be868f92780efe617c2416251de1e2e0977656e84e2f93d.
Private085 preserves the script, fetch metadata, parsed form attributes, synthetic roundtrip values and earlier-plus control metadata. JavaScript was inspected as text, never executed. No form submission, key search or source modification occurred.

084 — Cross-site copies independent of author labels
Reviewed September 5, 2026, 20:18 UTC.

Result
No literal copy candidate for the opaque xinzhai/xz records was found in132,140 saved files across the paste-data and wiki-capture trees, excluding the source Ubuntu directory. Unlike082's naming search, this check can find a copied record posted under a completely different label.

What was compared
All3,571 opaque cluster records in the final survey:3,484 knowledge-labelled records,11 plan-labelled records and76 multipart xinzhai pieces. Every source HTML hash and authored-body hash was checked against the final snapshot before comparison.
Two forms were considered: exact authored text and the same text with spaces replaced by plus signs. Deduplication gives7,035 distinct full-text variants. A fixed-string first64-character screen uses5,802 distinct prefixes to locate possible copies, then the script checks complete record text in any candidate file. The screen returned zero candidate files, so no second-stage full-record match was available.

Scope and limits
Search roots are the saved pastebins/data and pastebins/wikis directories. The complete paste.ubuntu.org.cn source directory is excluded and that exclusion is asserted against the file inventory. The investigator's public export and report directories are not search roots. File counts include raw/HTML copies and metadata, not unique posts or unique independent sites.
The search uses normal rg text/ignore/binary behavior. It does not normalize HTML entities, inserted line breaks, URL encoding or other transformations. It cannot detect newly randomized ciphertext representing the same plaintext, and absence of a byte copy does not establish absence of related semantic content. Large objects were searched as their original posted pieces, not decrypted or reconstructed plaintext.

Reproducibility
Script084-cross-site-record-copy-scan.py. Source snapshot SHA-256:620d6dcc62fd2f4eefa396c631b43f57e308fcbd31e5c097994eca4aa5005f40.
Private084-private preserves the search prefixes, inventory, candidate-path output and analysis metadata. Inventory SHA-256:ab08d321bc9037a04eb07b3932862119e9ec9b794c73f5147cf0c577b5f29caf. This hashes the filename manifest, not all corpus contents. Inventory exited0; search exited1 with empty stderr, the normal zero-match outcome. All source hashes were checked successfully.
No payload or prefix was sent to an external search service, published in this report, decrypted or executed. The local scan created no network requests.

Interpretation
The cluster still has no demonstrated cross-site copy in the reviewed local corpus. That result narrows one migration/replication hypothesis; it does not identify the uploader, prove single-site operation or rule out an agent workflow. A new marker, a differently transformed copy or new corpus coverage is needed before rerunning this comparison would add information.

083 — Live listing follow-up after the completed survey
Reviewed September 5, 2026, 20:16 UTC.

Finding
The current public Ubuntu listing exposes two numerical IDs beyond the final survey boundary4552953:4552954 and4552955. Both were fetched read-only and contain readable C++ code. Neither is a visible continuation of the xinzhai/xz record families. The largest ID linked by this fetched listing is4552955; this is not an assertion that no unlisted or later-created page exists.

New records
https://paste.ubuntu.org.cn/4552954 — cpp tag, displayed2026-09-05 18:45,502characters,33lines. Readable array/range-update style C++ code.
https://paste.ubuntu.org.cn/4552955 — cpp tag, displayed2026-09-05 20:02,2603characters,151lines. Readable C++ with bitsets, graph traversal and counting routines.
Both carry the same displayed author label as the previous final survey page. That is website metadata, not authenticated identity. Dates are literal site displays, not independently normalized UTC.
No authored-body occurrence of xinzhai,xz_knowledge,xz_improvement,knowledge_p1 orimprovement_plan_p1 was found. Both fail the broad opaque Base64-alphabet screen because they contain ordinary source-code punctuation. Code was read, never executed; there is no attribution claim based on its algorithm or style.

Provenance
Root listing captured2026-09-05T20:14:15.954693+00:00,HTTP200, SHA-2565729a6f41e8d6234b032a4f0f0ec7abcc20869de910cd8d9348a7b71329efa9c.
Two new pages captured20:14:43 and20:14:46 UTC,HTTP200. Raw and authored-body hashes are in083-private/new-post-metadata.json; root metadata and links in083-private/metadata.json. All three raw HTML responses are private. Three total public GETs, no writes or tests on the original service.

Counting and limits
The completed4,872-page survey and3,484-record xz analysis remain fixed historical inputs. These two follow-up pages are separate observations. The public /posts export remains the user-authorized1,142 records. No new raw payload was added to that export.
This check establishes that newly listed content has been reviewed through the observed boundary at this capture time. It does not detect changed old pages, unlisted records, renamed records on other sites, or future uploads. No continuous polling process is claimed to be running.

082 — Search for the record naming convention under other identities
Reviewed September 5, 2026, 20:13 UTC.

Result
A case-insensitive fixed-string search for knowledge_p1 and improvement_plan_p1 found zero matching text files outside the paste.ubuntu.org.cn directory in the saved paste corpus. This checks the naming suffixes independently of the xz prefix, allowing another client identity to match. It adds cross-site coverage beyond the exact xinzhai/xz names.

Scope
The matching rg file inventory lists113,750 files across49 top-level host directories under /home/sophia/search/pastebins/data after excluding the complete Ubuntu directory. These are files, not113,750 unique posts: the collection contains HTML/raw duplicates and metadata. Search includes raw page text, titles, sidebars and metadata, rather than only parsed authored bodies. Default rg ignore and binary-detection behavior applies. No decoding of compressed/encoded contents was performed. The result does not establish absence from all text obtainable from these sites or from the wider web.

Reproducibility
Script082-suffix-corpus-scan.py saves the exact file inventory, match-path output, command exit statuses, search terms and host counts. Inventory command exited0; search exited1 with empty stderr, the normal no-match outcome. A programmatic assertion verifies that no inventory path belongs to the excluded Ubuntu directory.
Inventory SHA-256:d9b9f140038aa383cde1f65c65b36e6984407b5235bff6aa0da04f6644d567a7. This hashes filenames, not all file contents; it is a traversal manifest, not an immutable content snapshot.
An initial broader command's glob did not exclude Ubuntu and returned3,502 matching paths, all within that directory. That output remains in082-private/paths.txt; it is not used as the cross-site count. The corrected exclusion and complete no-match result are separately preserved in nonubuntu-inventory.txt,nonubuntu-matches.txt andscan-metadata.json.

Startup recheck and web context
The three saved readable xinzhai startup bodies are exactly print('hello xinzhai'), print('hello'), and print('hello'). They provide no additional distinctive client syntax beyond the name. They were read as text, never executed.
Three web searches tested the greeting and generic record suffixes, excluding the two Ubuntu hostnames for suffix queries. Returned snippets include place-name references and questionnaire/philosophy uses of knowledge_p1. No returned snippet demonstrates the sought uploader. These are snippet-level screening results, not full reviews of unrelated papers or proof of literal phrase matching by the search engine. No new attribution lead emerged.

Interpretation
The concrete xinzhai/xz cluster remains locally coherent, but this broader naming-family test did not connect it to another saved public surface. Do not infer one host means one operator, a private client, Chinese origin, or absence of other clients. Future cross-surface work needs a distinct observed marker or a different coverage source; repeating these suffixes on the same frozen corpus has little value.

081 — Historical crawler policy explains an archive blind spot
Reviewed September 5, 2026, 20:10 UTC.

New evidence
Common Crawl's August index contains an independently archived robots.txt for https://paste.ubuntu.com.cn/robots.txt, captured2026-08-13T02:29:19Z. The recovered HTTP200 body includes a CCBot-specific Disallow:/ rule and a final wildcard Disallow:/ group. This gives a concrete, contemporaneous reason that Common Crawl could record the policy without crawling paste bodies. It makes the negative paste-body index result less informative about whether the xinzhai posts existed then.

This is an archived host-policy artifact, not an archived xinzhai/xz post. It does not authenticate the paste site's displayed July dates, demonstrate the same alias relationship in August, identify the operator, or show that this policy existed throughout July. No Common Crawl bypass or resubmission was attempted.

Archive retrieval and verification
One compressed index block covering SURT prefix cn,com,ubuntu,paste)/ was retrieved with HTTP206. It contains exactly one row for that prefix, robots.txt; the next block boundary is beyond the prefix. No numerical paste URL occurs in that exact-host index scope.
Crawl:CC-MAIN-2026-34.
WARC locator:crawl-data/CC-MAIN-2026-34/segments/1786091385546.31/robotstxt/CC-MAIN-20260813020609-20260813050609-00870.warc.gz
Offset874572; compressed length1380.
The single corresponding public WARC byte range returnedHTTP206. Recovered WARC target URI, date and record ID match the index. The1862-byte HTTP body hashes to SHA1 Base32 EADKLWRGJMU7ICPNWJBAX75EAHVV2SLA, matching both index digest and WARC payload digest.
The local cluster.idx is the same August index used in033; it was not redownloaded. Private raw block, WARC, query/range metadata and digest verification are in081-cc-private. Script081-alias-cc-lookup.py reproduces the index lookup. No other archived content was fetched.

Separate public URLscan witness check
Two read-only search API calls completed. A query covering domain:paste.ubuntu.org.cn OR domain:paste.ubuntu.com.cn after2026-07-01 returnedHTTP200,total0,has_more=false. An example.com control with the same date condition returned an actual public scan. This is a functioning-search negative for public results under that query, not proof no private/unlisted scans or other witnesses exist. No new scan was submitted.
Official search API description:https://urlscan.io/docs/api/ . Raw responses and exact queries preserved in081-private with timestamps/hashes;081-urlscan-check.py reproduces them.
Four additional web-index queries for two early IDs with Ubuntu, and exact knowledge/version labels excluding the two paste hostnames, returned no results. Those queries provide no independent witness and are not exhaustive web coverage.

Implication for infrastructure and next steps
The observed Common Crawl gap has a crawler-policy explanation that an alternative geographic vantage point would not fix. A China-near server may still help access other sites, but buying one would not make these absent archive bodies appear. Existing public copies, repository references, ordinary search indexing or other independent dated artifacts remain the useful routes for this cluster. Do not infer archival absence means the posts were fabricated or newly backdated.

080 — Implementation fingerprints beyond the xinzhai name
Reviewed September 5, 2026, 20:07 UTC.

Finding
Five public Sourcegraph searches tested co-occurring serialization terms and observed chunk constants. No matching xinzhai uploader was established. Direct source inspection resolved two agent-related results: OpAgent uses30000 for browser timeouts and Base64 for images; AgentScope uses30000 to truncate shell output and Base64 to encode commands. Neither inspected file implements the observed multipart paste workflow.

Scope and actual results
fernet_chunks: 50 matches; 25 repositories; skipped reasons: ['shard-match-limit'].
base64_chunks: 25 matches; 13 repositories; skipped reasons: [].
plan_encryption: 0 matches; 0 repositories; skipped reasons: [].
fernet_exact: 32 matches; 17 repositories; skipped reasons: [].
base64_30000: 100 matches; 33 repositories; skipped reasons: ['shard-match-limit'].

Initial queries searched Python files containing Fernet and30000, Python files containing b64encode and22500, and files containing Fernet and improvement_plan. Follow-ups required word boundaries around Fernet/b64encode and30000. All included forks and archived repositories, with20-second server limits and35-second client limits. Full query URLs and response events are retained privately. Sourcegraph documents file:has.content as a file-content predicate: https://sourcegraph.com/docs/code-search/queries/language .

Important false positives and verified context
- The initial Fernet predicate also matched the misspelling differnet in pymeasure's SmarAct instrument documentation. A direct pinned-file fetch confirms this. Whole-word matching removes that lexical accident.
- OpAgent: the indexed local_agent_eval.py imports Fernet, but its three30000 occurrences are Playwright navigation timeouts. Its two b64encode calls encode screenshots/images. No xinzhai, improvement_plan,22500 or paste.ubuntu marker appears in that fetched file. The mere presence of an agent evaluation framework plus Fernet is insufficient to connect it to the paste sequence. No credentials or encrypted settings were used.
Primary repository: https://github.com/codefuse-ai/OpAgent . Exact inspected commit/path and hash in080-private/candidate-metadata.json.
- AgentScope: the indexed _powershell.py contains Base64 command encoding and truncates error/output text to30000characters, appending an output-truncated message. That is not the observed preservation of complete large objects across sequential paste parts. No xinzhai or paste.ubuntu marker appears in the inspected file.
Primary repository: https://github.com/agentscope-ai/agentscope . Exact inspected commit/path and hash in080-private/agentscope-metadata.json.
- Other returned whole-word Fernet/30000 snippets concern database/browser timeouts, password-hashing rounds, image counts, astronomy configuration and tests. Base64/22500 snippets include ports, numeric datasets and larger-number substrings. Returned excerpts do not establish the required serialization/upload relationship. This is excerpt review, not a complete audit of those projects.

Limits
The refined Fernet/30000 query completed with32matches across17repositories and no skipped warning; the broader Base64/30000 query reached100matches and emitted a limit warning. Do not call the latter exhaustive. No matches in the Fernet/improvement_plan query cover only co-occurrence in an indexed single file, not split-module implementations. Sourcegraph's repository gaps from079 still apply. The22500 constant is an equivalent inner chunk size, not proof that literal22500 appears in uploader code.

Method and files
080-implementation-search.py and080-refined-search.py save full raw streams, parsed events, capture times, query URLs and SHA-256 hashes in080-private. Three pinned public source files were read as text. Code was not executed; endpoints referenced by the code were not called. There were no original-site writes, account changes, key searches or paid bot calls.

Implication
Shared xinzhai/xz workflow evidence is unchanged. A useful client match must show actual data flow from serialization into preserved multipart storage, not merely agent terminology and a common timeout or output limit. Further searches should require that data-flow relationship or a new distinctive marker instead of treating more generic agent-framework matches as progress toward attribution.

079 — Separate public code index: Sourcegraph works, coverage is limited
Reviewed September 5, 2026, 20:04 UTC.

Outcome
Sourcegraph's public streaming API returned an actual CPython source-code match in a positive control. Eight read-only queries completed as streams. No matching xinzhai/xz uploader was found in returned content. This adds source-file coverage distinct from078's commit messages, but several limitations prevent a broad absence claim.

Per-query results
control: HTTP 200; matches=1; skipped=['shard-match-limit']; terminal done=True
xz: HTTP 200; matches=0; skipped=['repository-fork', 'excluded-archive']; terminal done=True
xinzhai: HTTP 200; matches=0; skipped=['repository-fork', 'excluded-archive']; terminal done=True
labels_all: HTTP 200; matches=90; skipped=['shard-match-limit']; terminal done=True
host_org: HTTP 200; matches=13; skipped=[]; terminal done=True
host_com: HTTP 200; matches=1; skipped=[]; terminal done=True
distinctive_all: HTTP 200; matches=0; skipped=['shard-match-limit']; terminal done=True
coverage_repo: HTTP 200; matches=0; skipped=[]; terminal done=True

Interpretation of results
The first two literal-label queries used default repository scope, which excluded forks and archived repositories. They returned no matches. Broader follow-up queries explicitly included both.
The combined broad xinzhai/xz expression returned90 matches from22 repositories, with a shard-match-limit warning. Returned snippets concern place names, geographic datasets, historical references, finance names, radio station locations and unrelated variables. No returned snippet contains a demonstrated cluster connection. The result is not exhaustive.
The distinctive combined expression xz_knowledge|xz_improvement|xinzhai_v returned zero matches but still emitted a shard-match-limit warning after roughly20seconds. Preserve that warning even though the zero count seems inconsistent with its wording: this is not a clean exhaustive negative.
The exact known GitHub repository44678020qq-ctrl/xinzhai returned zero in a separate Sourcegraph repository lookup. Earlier GitHub API inspection found that repository. This is a concrete cross-index coverage mismatch, not proof the repository was deleted or private.

Hostname search review
The org.cn hostname query returned13 matches from8 repositories with no skipped warning. They are ordinary references: pastebinit package configuration listings, HTTPS Everywhere rules, a Python tutorial, an old IDAPython article link, I-Nex changelogs, a Flask tutorial image, LinuxToy articles and a desktop service-menu comment. No xinzhai-style uploader is visible in these returned excerpts. The com.cn hostname query returned one HTTPS Everywhere rule match. These counts describe the searched index, not all public implementations.
Example primary repository paths identified by index: https://github.com/i-nex/I-Nex/blob/master/Changelog.md and https://github.com/EFForg/https-everywhere/tree/master/src/chrome/content/rules . Index responses retain exact commits and paths; unrelated referenced paste IDs were not fetched.

Searchcode suitability
The current searchcode.com homepage describes repository-scoped code inspection and search requiring a supplied public repository URL. Its earlier global index is described in the past tense. It therefore does not establish a currently usable global unknown-repository discovery route. No MCP installation or account change was needed or performed.
Primary: https://searchcode.com/ . Local homepage response saved with SHA-256 in079-private/docs-metadata.json.

Method and provenance
Sourcegraph's official streaming documentation describes the read-only endpoint and anonymous public-query example: https://sourcegraph.com/docs/api/stream-api . Documentation was readable through the web tool; a separate local documentation fetch returned403, while API queries succeeded. Do not label the whole host blocked based on the documentation fetch.
079-sourcegraph-check.py,079-expanded-code-search.py and079-distinctive-code-search.py save raw SSE bodies and parsed events, exact queries, timestamps, statuses and SHA-256 hashes in079-private. Queries used count limits and20-second server timeouts,35-second client timeouts, with two-second pacing. No authentication, writes or code execution on target repositories occurred.

Next action
Use Sourcegraph for new distinctive code or host fingerprints, while preserving missing-repository and skipped-result caveats. Do not keep rerunning this same combined-label expression or equate a working API with comprehensive GitHub coverage. The local shared-workflow evidence remains stronger than external attribution evidence.

078 — GitHub commit-message search for xinzhai/xz
Reviewed September 5, 2026, 20:01 UTC.

Outcome
A previously unused public search route was accessible without authentication. Seven bounded queries returned no demonstrated matching uploader. This is commit-message coverage, not a search of all source-file contents. GitHub documents that commit search searches messages and only the repository default branch: https://docs.github.com/en/search-github/searching-on-github/searching-commits .

Actual query results
"xz_knowledge": total_count=5, incomplete_results=False, HTTP 200
"xz_improvement_plan": total_count=0, incomplete_results=False, HTTP 200
"xinzhai": total_count=18, incomplete_results=False, HTTP 200
"paste.ubuntu.org.cn" "Fernet": total_count=0, incomplete_results=False, HTTP 200
"xz_knowledge_p1": total_count=0, incomplete_results=True, HTTP 200
"xz_improvement_plan_p1": total_count=0, incomplete_results=False, HTTP 200
"xinzhai_v60": total_count=0, incomplete_results=False, HTTP 200

The full xz_knowledge_p1 query returned incomplete_results=true. Its zero returned items must not be reported as a completed negative search. Other queries returned incomplete_results=false, within the API's indexed scope. All result sets fit one requested page of 100. Quoted queries are not necessarily byte-literal identifier matching: xz_knowledge returned hyphenated xz-knowledge-graph messages.

Candidate review
1. All five shorter xz_knowledge hits belong to xiaozhu-eco/xz-modules. Its public README describes 小竹 (Xiaozhu) Rust AI infrastructure, including memory and knowledge-graph crates. This establishes a different expansion of xz in that project; the reviewed material does not show a xinzhai/paste uploader link. Generic memory/agent terminology is insufficient.
Primary: https://github.com/xiaozhu-eco/xz-modules . README API response saved privately.
2. Four xinzhai hits refer to djc-Sherlock/checkin's xinzhai.js. The creation commit's complete 44-line patch implements a new-bond subscription reminder, calling a bond-list data source and notification helper. Its displayed Chinese label is 新债. No paste upload or encoded state mechanism appears in that patch. This is a concrete pinyin namesake, not the sought client.
Primary: https://github.com/djc-Sherlock/checkin/commit/a1c1e5d633367fa0c8c85668aedd136b2e26167a . Code was read, never executed; linked data/notification endpoints were not called.
3. Three PR_tool hits concern parsing hardware control bits and xinzhai registers. Inspection of one matching commit confirms pad-control parsing, rather than a paste storage client.
Primary: https://github.com/098654321/PR_tool/commit/3cfba6a0a59ed005d4d7071dd8c811f036159f61 .
4. Remaining xinzhai messages concern website routes/photos, the previously reviewed xinzhai web app, philosophical or historical content, and a campus electricity app whose message explicitly maps xinzhai to 新斋. Message-level review found no shared naming/chunking/encoding fingerprint. This does not claim exhaustive inspection of those repositories.

Evidence retained
078-private contains seven complete API query responses, query URLs, counts, incomplete flags, UTC capture times and SHA-256 hashes, plus three follow-up source responses. Scripts078-commit-search.py and078-exact-commit-search.py reproduce the queries. No credentials, paid bots, original-service writes or pasted-code execution were used.

Implication
The strong local xinzhai/xz workflow evidence is unchanged. This pass adds a usable public discovery route and resolves misleading near-matches. It does not establish absence of a public implementation, especially because commit messages do not contain all code and the full knowledge-label query was incomplete. A separate public code index would offer materially different coverage if accessible.

077 — Alternate Ubuntu hostname: bounded archive coverage
Reviewed September 5, 2026, 19:58 UTC.

Result: Wayback CDX returned HTTP 200 and an empty JSON array for the paste.ubuntu.com.cn/ URL prefix, July 1 through September 5, 2026, filtered to status 200 captures. A preceding example.com positive-control query returned one actual 2026 capture. The archive route was functioning; the target result was empty rather than a connection failure.

This closes the immediate alternate-host coverage question raised by076. It does not show that the posts were absent on their displayed dates, that all archive services lack them, or that excluded non-200 captures have no information. No archived body was available from this query. Neither hostname has yet supplied an independent archived occurrence of this cluster in our reviewed checks.

Method: two public read-only CDX requests from the existing US AWS host, paced 1.6 seconds apart. Target parameters: url=paste.ubuntu.com.cn/, matchType=prefix, from=20260701, to=20260905, collapse=urlkey, limit=200, filter=statuscode:200, output=json. Target fetch 2026-09-05T19:57:38.635927+00:00. The empty result did not reach the row limit.

Reproducibility:077-alternate-host-archive.py; private raw responses and full query URLs in077-private/followup-metadata-private.json. Target response SHA-256 37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570. Positive-control response SHA-256 4f4d462ea2cc883067c6118215011fd357917c9dc803aae3b922add81db37a4e.

Interpretation: preserve the strong local shared-workflow evidence while leaving external dating and attribution unresolved. An unchanged archive query is not worth repeating without new coverage or a new date/URL discriminator.

076 — Ubuntu alternate hostname: matching xinzhai/xz content
Reviewed September 5, 2026.

A single public read-only request to https://paste.ubuntu.com.cn/4549139 returned HTTP 200 without a redirect at 19:53:33 UTC. Its complete authored body, including whitespace, exactly matches the previously saved https://paste.ubuntu.org.cn/4549139: 864 characters, SHA-256 5dd660595fa3b41f0eb9682a3b0cd2545eccc3e7231a969f7a41ea6dba9edf2c.

Both pages identify the record as xz_improvement_plan_p1, language python, displayed 2026-07-12 23:15. Both have the title Ubuntu Paste and navigation links to paste.ubuntu.org.cn and other ubuntu.org.cn services. Neither declares an HTML canonical link. This is consistent with an alternate hostname, shared service or mirror. One matching response does not establish the exact backend relationship, but this must not be counted as an independent second posting or operator.

Public Ubuntu IRC archives contain ordinary historical uses of both hostnames, including https://irclogs.ubuntu.com/2011/06/18/%23ubuntu-cn.html. This supports treating both spellings as search candidates. It does not independently date the 2026 xinzhai cluster or establish historical backend identity.

The alternate hostname creates a distinct archive-index coverage question: an archive may index one spelling even when another spelling has no relevant captures. Previous negative org.cn archive results do not answer that question.

Private provenance: 076-private/response.html and metadata.json. Raw response SHA-256 7215f188681bd814daf4656c4b948c3f781b851b7ec941a1144f4cca69ac9d6e. Shared CDN DNS addresses are not evidence of operator location or identity. No original payload is included here.

075 — REVIEWED: complete collected-body scan for readable xinzhai references
September5,2026. User-directed xinzhai focus.

Result
All4,872 validated authored paste bodies in the final survey were independently re-extracted and hash-verified. The exact reference screen found no readable explanation of the uploader or body-to-body reference to its knowledge/plan labels. The only xinzhai body match is the known initial print test. The sole30000 substring is part of an unrelated hexadecimal tag, not a chunking constant or upload script.

Method
Read only textarea[name=code2] authored content, not page navigation, author headings or recent-post sidebars. Compare raw HTML and extracted text hashes with the frozen039 checkpoint for every page before scanning. Case-insensitive terms: xinzhai, xz_knowledge, xz_improvement, 心斋, 心齋, fernet,22500,30000. Chinese spellings are search hypotheses, not established identity. Record matched terms and safe structural metadata privately, without source excerpts.

Counts
xinzhai:1 body, the22-character initial print test at4548523.
30000:1 body, unrelated long structured output at4548167. Manual context review identifies a hexadecimal metadata tag containing the substring. No paste hostname or encoding term appears in that body.
xz_knowledge,xz_improvement,心斋,心齋,fernet,22500:0 body matches.
The known author labels are not counted as body references. That separation avoids false cross-reference evidence from the paste service's own page furniture.

Meaning and limitations
This is stronger coverage than the earlier small neighbor samples, but still only a lexical screen of the4,872 retained bodies. It does not exclude an explanation using different terms, an unavailable/deleted post, a different host or private code. Opaque payloads were not decoded for this scan. One deliberately excluded sensitive ID remains excluded. No source-host requests, keys, decryption or pasted-code execution occurred.
The result leaves the shared-workflow interpretation in067–074 intact. It provides no new software or operator attribution. Repeating the same terms over these same frozen bodies has no expected benefit without another discriminator.

Reproduce
swarmhunt/.venv/bin/python investigation/china/075-readable-reference-scan.py
Frozen input:039-private/checkpoint-0036-20260905T143712065390Z.json
SHA256:620d6dcc62fd2f4eefa396c631b43f57e308fcbd31e5c097994eca4aa5005f40
Private output:075-private/analysis.json. Full raw captures remain in the original private survey directory.

Next focused source question
Search results have shown both paste.ubuntu.org.cn and paste.ubuntu.com.cn spellings. Their relationship has not yet been established by a controlled source comparison in this focused review. Determine whether the alternate name is the same service, a mirror or merely search-index noise before treating it as independent publication evidence or looking for different archive coverage. Do not infer a second actor from a hostname variant.

074 — XINZHAI / XZ: current working overview
Reviewed September5,2026. Consolidates067–073 and completes knowledge-length audit.

Leading explanation
Treat xinzhai and xz as one related publishing workflow. Its visible lifecycle is consistent with bulk state uploads plus recurring smaller records, followed by configuration or state changes. The evidence for that grouping is strong. The contents, actual software, operator identity and involvement of research agents remain unresolved. The case is worth following because of its concrete behavior, not merely its Chinese host or name.

Three record families
1. xinzhai: three readable print tests and76 pieces assembling into nine version-labelled large objects. All reproduce double Base64 followed by30,000-character chunking. The inner binary objects match Fernet layout, without authentication or decryption.
2. xz_knowledge_p1:3,484 distinct opaque records, source-displayed July10–20, ten binary sizes and strong recurring timing.
3. xz_improvement_plan_p1:11 distinct opaque records. First five646 bytes, remaining six647 bytes; all864 encoded characters. Initial six-hour timing later becomes irregular.

Strongest evidence of connection
- Every one of87 consecutive paste IDs from the initial xinzhai tests through v73 belongs to xinzhai/xz.
- Small records interrupt multipart uploads at internal part boundaries, then continue after the bulk uploads end.
- The extra encoding layer on large objects explains why a shared plus-damaging submission path could leave large posts intact while changing plus signs in small records to spaces.
- Plan posts immediately precede all three transitions in the proposed124->424->488->532-character knowledge lineage. Another size cohort continues across the latter two transitions.
- The plan binary length itself changes646->647 at the middle of those three boundaries.

Compact lifecycle (all dates are source displays)
July10 21:26: print tests begin.
21:27–22:44: nine large groups appear; labels include v5.2,v52,v60,v61,v70,v71,v72,v73.
22:24: small knowledge stream begins during the bulk sequence.
22:30–23:35: two distinct small records at each of14 five-minute slots.
July11 15:11: small stream resumes after936minutes, with single displayed-minute records.
July12 05:12: first plan; knowledge size changes124->424 between05:10 and05:15.
July12 18:02: second size cohort joins the recurring stream.
July13 11:17: plan grows by one binary byte; knowledge424->488 follows at11:18 while secondary cohort continues.
July15 00:24: plan immediately precedes knowledge488->532; secondary cohort continues.
July20 19:20: final observed knowledge record. Later validated pages through September5 do not show a continuation of the same short, space-damaged shape.

Completed hidden-length audit
All3,484 rows from056 were grouped by authored character length and independently measured decoded length. Every knowledge character cohort has exactly one binary length:124->93 (178posts),304->226 (143),364->271 (71),424->316 (358),428->319 (300),472->352 (146),488->364 (239),500->374 (1,153),532->397 (605),572->428 (291).
No hidden within-cohort binary-size variation was found in knowledge records. The plan's646/647 change is therefore a real additional distinction, not a widespread unexamined ambiguity in the knowledge-size timeline. Equal binary size still does not imply equal plaintext or semantics.

Interpretations to keep separate
Observed: names, IDs, lengths, hashes, encoding layers, timing and interleaving.
Strong working inference: shared workflow with recurring record classes.
Plausible mechanism: a bulk snapshot path plus small periodic state records and a maintenance/planning path.
Unproved: small records are deltas, plans improve reasoning, version73 means73snapshots, exact encryption of small records, a common key, multiple agents, a Chinese lab, or escape from an evaluation.
Version labels may be counters or dotless software releases; the explicit v5.2 argues for checking both.30,000 is a client chunking fingerprint, not an established hard site limit.

Next evidence that would materially change the case
A public implementation matching the combined naming/chunking/encoding fingerprint; a readable local explanation connecting these labels; an independent dated occurrence of a distinctive marker; or an authenticated operator statement. Repeated generic agent-product searches, ciphertext uniqueness alone and speculative cipher labels will not settle the question.
Current focused code-search coverage found no matching uploader; authenticated code-search gaps remain. No request to the original service was made to test posting or limits. No keys were sought or used.

Files and reproducibility
066/AgentWorld work is deprioritized by user steering. Relevant primary analyses are067(shared sequence),068(encoding),069(startup pairs),070(client search),071(restart),072(plan coupling),073(hidden plan size), plus028 and055/056 for full measurements.074-private/knowledge-length-audit.json preserves the new grouping and source hash.
The published /posts collection remains a fixed1,142-post export, distinct from the3,484-record reviewed collection. Original and decoded payloads are not republished in this overview.

Local context follow-up075: all4,872authored bodies hash-verified and screened for exact labels, possible Chinese spellings, Fernet and chunk constants. Only the initial xinzhai print test and an unrelated numeric substring matched. No readable uploader explanation found in this lexical scope.

Hostname follow-up 076: paste.ubuntu.com.cn serves an exact copy of a saved org.cn plan record at the same ID, with matching metadata and org.cn navigation. Treat as an alias/shared service or mirror, not an independent occurrence. Follow-up077 found no status-200 Wayback captures for that alternate prefix from July1–September5, with a successful positive control. Independent archive dating remains unresolved.

Commit-message follow-up078: seven GitHub queries, no matching uploader; full knowledge-label query flagged incomplete. Concrete near-matches resolve to Xiaozhu infrastructure, a new-bond reminder and hardware register parsing. Commit messages are not full source-code coverage.

Source-file search079: Sourcegraph public API works with a real code positive control. No uploader found in returned label/hostname matches; broader label searches emitted a limit warning, and a known GitHub namesake repository was absent from the repository lookup. This adds bounded code coverage, not a global absence result.

Implementation follow-up080: combined encoding/chunk-constant code searches found no matching uploader. Direct inspection resolves OpAgent30000 as browser timeouts and AgentScope30000 as shell-output truncation, with Base64 serving images/commands. These are not demonstrations of the observed multipart storage path.

Historical policy evidence081: recovered and digest-verified an August13 Common Crawl robots.txt capture for the alternate hostname. It disallows CCBot, providing a concrete explanation for missing paste-body coverage. This dates a host-policy artifact, not the xinzhai posts. URLscan public searches found no July-onward host records with a working control.

Cross-site suffix check082: no knowledge_p1 or improvement_plan_p1 matches outside Ubuntu in the saved corpus inventory of113,750files across49host directories. Counts include duplicates/metadata and use default text-search behavior; this is bounded cross-site coverage, not unique-post counts or global absence.

Freshness check083 at20:14UTC: two newly listed IDs4552954–4552955 beyond the fixed survey contain readable C++ and no observed xinzhai/xz markers or opaque-record shape. The fixed survey and1,142-post export counts remain unchanged.

Cross-site copy check084: all3,571opaque cluster records hash-verified and screened as original/space-to-plus text against132,140saved paste/wiki files outside Ubuntu. No64-character prefix candidate appeared. This tests literal copies under other labels, with entity/line-wrap/re-encoding limitations.

Transport follow-up085: visible editor uses multipart/form-data; linked JavaScript has no submission encoder. Native form serialization alone does not explain plus-to-space. A malformed custom URL-encoded request or extra decoding remains plausible, not proven. Public issue-search follow-up086 found no matches in three reviewed queries;171bot reports now complete.

Software comparison087: older lordelph/pastebin source shares code2/parent_pid/editor fields, but its form differs from the current host. The inspected handler passes code2 directly toward storage and shows no explicit URL decode. This identifies a generic field convention, not the installed server or xinzhai client.

Chinese project-index follow-up089: Gitee public search is reachable through its normal browser frontend and observed GET backend. xinzhai and xz_knowledge returned0; hypothetical心斋 returned5unrelated project descriptions. This improves access coverage, not uploader attribution; project search is not global source-file search.

Gitee precision follow-up090: quoted/unquoted hostname queries returned identical broad project results; a checked top page lacks the exact hostname. No matching uploader established. Working project-search access does not guarantee literal query semantics or source-file coverage.

Archive copy follow-up092: completed all100,000August corpus files (2,083,525,558text records), with0failures and0literal-prefix candidates for the3,571opaque records. Completion manifest and empty result files verified. No cross-host copy found within this scope; transformed or unindexed copies remain outside coverage. Scan and observer have exited.

Additional index checks093/094: GitCode browser project search works, but signed-out code configuration reports disabled and direct query responses are inconsistent/firewalled. Hugging Face card/app.py full-text search returned no results for both full xz labels with a working control; leading xinzhai result is a verified historical-text namesake. No new uploader or attribution.172bot reports terminal; no active bot wave.

Search precision095: quotedxinzhai returns exactly1Hugging Face indexed document, the verified historical-text namesake, compared with167fuzzy unquoted results. Quoted knowledge_p1 and improvement_plan_p1 also return0with echoed queries and structured empty docs. This narrows index coverage without adding attribution.

GitHub README follow-up096: xinzhai in:readme returned4matches, all source bodies hash-verified: historical text, new-bond calendar and2city lists. Both fullxzlabels returned0with incomplete_results=false. API body truncation was caught and complete raw files recovered. This adds README coverage, excluding forks by default; no uploader join.

Runtime-label follow-up097: source-file co-occurrence searches found no uploader. A concrete Alibaba diagnostic match uses parent_pid for an operating-system parent process, not paste storage. Exact improvement_plan plus b64encode returned0in the checked index; broader patterns produce ordinary development text and limit warnings.

Non-Python chunk follow-up099:3code-index queries allreturnedlimitwarnings;3pinned implementation matches use30000for wait,telemetry orcookie timeouts rather than chunking. No uploader established; language/index coverage remains partial.

ModelScope follow-up100: official unauthenticated GET model/dataset catalog search works from this host. Six label/catalog queries returned0with successful concrete controls for both routes. Browser No content was invalid as a negative because its non-GET search requests were blocked locally. No source-file coverage or attribution established.173bot reports terminal.

ModelScope applications101: public Studios(status=all) and skills catalogs each returned0for the3observed labels, with real positive controls. Both routes accessible here; source files/logs not searched. Current Studioresponse envelope differs fromSDKcomment, so review uses capturedschema.

Inner-representation copy check103 found0candidates across132,140local cross-site files for255variants of9large groups/76pieces. Archive extension106 has completed with0candidates across all100,000files and2,083,525,558text records; manifest/output audit passed. This is a second representation check of the same corpus, not additional unique pages.

Freshness107: at21:40UTC the source listing remains at4552955, no new bodies fetched. July extension111 completed all100,000files and2,093,746,605records with0matches0failed; exact manifest coverage and empty candidate outputs audited. It combined labels and both copy representations across theJuly10–23crawl. This distinct crawl can repeat August pages; do not sum counts as unique documents. See july-copy-status.html for reviewed completion.

Crypto audit118: all9large groups fit Fernet layout,9distinctIVs,no repeated16-byte ciphertext blocks across77644blocks. Conditional standardFernet plaintext lengths64912–64927bytes initially to231152–231167final. Smallknowledge mod16 residues0,2,6,12,13,15;plans6/7, so no singleconstantwrapper+paddedCBC model fits eitherfullstream. NonehasFernetlengthresidue9. Hypotheticalnonce12+tag16 impliesknowledge65–400bytes andplans618/619, butAESGCMvsChaCha orotherconstruction unresolved. See xz-crypto.html and118report.

073 — REVIEWED: plan bodies hide a one-byte transition at the knowledge boundary
September5,2026. All eleven xz_improvement_plan_p1 bodies independently parsed and hash-verified.

New finding
The plan records are not all the same binary size. Their authored length stays864 characters, but the first five decode to646 bytes and the remaining six to647 bytes under the canonical spaces-to-plus Base64 transformation. The change occurs at ID4549427, displayed July13 11:17, immediately before the first488-character knowledge body at ID4549428 (11:18). This is the middle knowledge-size transition highlighted in072.

The character-count screen in055/072 correctly reports864 throughout, but cannot detect this change. Prior blanket descriptions of the plan family as646 bytes, including the older XZ_FINDINGS.md note, are incomplete for the full collection. Keep character length and decoded length separate.

Why864 characters can encode different lengths
The first five end with two padding equals signs; the later six end with one. Standard Base64 allocates a four-character group to up to three input bytes. For these records,648 minus the padding count gives646 or647 bytes. The measured decoding length and this independent padding-length formula agree for every record. No plaintext was recovered.

Exact plan sequence by binary size
646 bytes:
4548836 July12 05:12
4548920 July12 11:13
4548992 July12 17:14
4549139 July12 23:15
4549283 July13 05:15
647 bytes:
4549427 July13 11:17
4549731 July14 00:51
4550130 July15 00:24
4551220 July17 21:35
4551358 July18 03:36
4552021 July19 18:11
Source URL template:https://paste.ubuntu.org.cn/<ID>
All displayed times are source claims with unresolved timezone provenance.

Combined boundary
Last424-character knowledge record:4549425 at11:13.
Secondary364-character record:4549426 at11:15.
First647-byte plan:4549427 at11:17.
First488-character knowledge record:4549428 at11:18.
Secondary364-character record continues:4549429 at11:20.
Thus two record classes change size at one boundary while the overlapping secondary cohort keeps its size. This strengthens a shared workflow/state-transition interpretation. It does not establish that a plan caused an improvement, that the extra byte is a counter digit, or that plaintext grew by exactly one byte. Serialization, compression and unknown encryption overhead prevent that inference.

Remaining structural checks
All11 plan bodies become canonical Base64 after spaces-to-plus restoration, have spaces but no literal plus signs, and produce11 distinct binary hashes. None decodes to valid UTF-8 or satisfies the tested Fernet version/length layout. No byte position shared across all11 bodies is fixed, and leading/trailing8-,12-,16-byte blocks do not repeat. These tests do not identify nonce/tag fields, an encryption algorithm, or a shared key. They support opaque records using the same visible transport pattern as knowledge posts.

Method and limits
Script:073-plan-structure.py. Input:039 final checkpoint and original raw HTML. Each selected source/raw and authored-text hash checked before transformation. Padding formula checked against decoded lengths. Private metadata:073-private/analysis.json. Binary payloads were not saved or published. No network requests, key searches, decryption or pasted-code execution occurred.
Next useful review: audit binary-length transitions hidden inside each knowledge character-size cohort, rather than assuming equal Base64 length means equal binary length. Use any matching boundary to refine the shared workflow hypothesis.

072 — REVIEWED: improvement-plan posts repeatedly precede one size lineage
September5,2026. All eleven plan-labelled posts checked against complete xz sequence.

Finding
The first plan/size-change coincidence in071 is not isolated. Three xz_improvement_plan_p1 posts immediately precede the first occurrence of a new knowledge-body size. Together these transitions trace a proposed lineage124 ->424 ->488 ->532 characters. The temporal relation strengthens the case that the plan and knowledge labels belong to a related workflow, rather than treating the first boundary as the only example.

Exact paired boundaries, literal site times
July12:
05:10 last124-character knowledge record, ID4548835
05:12 improvement_plan, ID4548836
05:15 first424-character record, ID4548837

July13:
11:13 last424-character record, ID4549425
11:15 continuing364-character secondary cohort, ID4549426
11:17 improvement_plan, ID4549427
11:18 first488-character record, ID4549428
11:20 continuing364-character secondary cohort, ID4549429

July15:
00:20 last488-character record, ID4550128
00:24 continuing472-character secondary cohort, ID4550129
00:24 improvement_plan, ID4550130
00:25 first532-character record, ID4550131
00:29 continuing472-character secondary cohort, ID4550132

In each case the new size is the very next xz knowledge post after the plan and also the next numeric paste ID. The prior size never returns in the captured series. At the latter two boundaries, the other size cohort continues across the change. This is more specific than observing arbitrary adjacent different sizes in an already alternating sequence.
Primary source URL template:https://paste.ubuntu.org.cn/<ID>

All-plan denominator
There are eleven plan-labelled posts. Three introduce a new size in the following two knowledge records; the other eight do not. A plan post therefore does not universally correspond to a new observed payload size. It could serialize unchanged-length state, perform maintenance without changing this record class, or reflect some other operation. All records remain opaque.

All-new-size denominator
The ten total size cohorts have these first-appearance delays after the most recent plan:
124: no preceding plan in the captured series.
424:3minutes;304:48;364:48;488:1;428:44;472:781;532:1;500:156;572:47.
This prevents cherry-picking only immediate boundaries. Several other appearances occur roughly44–48minutes later, while two are much later. That pattern is worth keeping as a secondary scheduling clue, not a demonstrated fixed timer or causal rule. These windows were observed after inspecting the data; no statistical significance or independent prediction is claimed.

Interpretation
A recurring maintenance/planning job that sometimes changes a primary serialized record is a plausible working model. Another model is an operator/configuration change that emits a plan-labelled record and changes the writer. The preserved overlap with another size cohort supports distinct record paths within a shared workflow; it does not require distinct agents. The word improvement_plan has not been verified against readable content.
The proposed lineage is inferred from disappearance, first appearance and timing. It is not a cryptographically authenticated parent-child relationship. Byte/character length does not reveal the amount or quality of knowledge, and stable length does not mean stable contents.

Method
Script:072-plan-boundary-analysis.py. Input:039 final checkpoint sorted by ID. Compare all exact plan labels with their two nearest preceding/following knowledge records and every global first size occurrence. Source and text hashes were independently checked in056. Output:072-private/analysis.json, including snapshot hash and full per-plan neighbors. No network requests, decryption, key search or execution of posted code.

Next focused test
Check whether plan entries share the same transport structure and stable binary layout as small knowledge records without presuming an encryption algorithm. Use the repeated size lineage and secondary-stream continuity as requirements when judging candidate client code. Do not replace this concrete cluster with unrelated agent-product searches.

071 — REVIEWED: paired startup becomes a single-record pattern after the gap
September5,2026. Focus remains xinzhai/xz.

Finding
The early paired five-minute pattern does not survive the overnight gap. After the final July10 pair at23:35, the next xz post appears July11 at15:11:936 displayed minutes later. The next148 posts retain124-character bodies but have148 distinct displayed minute timestamps. All148 body hashes are distinct. Their147 successive gaps are119 five-minute,10 six-minute and18 longer intervals (7–20minutes).

The change persists beyond the initial payload-size transition: from the restart through just before the second size cohort begins atJuly12 18:02, there are301 xz posts and no duplicate displayed minute. This contrasts with the14 consecutive paired slots during startup. It supports a change in publishing mode, without identifying a process count.

Boundary sequence (literal displayed dates)
July10 23:35 — IDs4548631 and4548632: final startup pair,124characters each.
July11 15:11 — ID4548644: resumed small record,124characters.
July12 05:10 — ID4548835: final124-character record.
July12 05:12 — ID4548836: first xz_improvement_plan_p1,864characters.
July12 05:15 — ID4548837: first424-character knowledge record.
July12 18:02 — ID4549003: first304-character record; the424 stream continues alongside it (044/055).
Source URL template:https://paste.ubuntu.org.cn/<ID>

Interpretation
A coherent working model is startup testing/bulk uploads plus paired periodic records, followed by a pause and a resumed single-record pattern, then a size change and a new longer-period record label, then overlapping size cohorts. Restart, configuration change, removal of a duplicate scheduled job, or one loop changing its output count can explain the observations. There is no evidence selecting one implementation among them.
The first improvement-plan-labelled post occurring between the last124 and first424 body is a particularly useful boundary to prioritize in future source-code matches. It could mark a new record schema or task configuration. The label does not prove actual planning or learning; ciphertext changes do not disclose plaintext meaning.

Gap and server-availability limits
Eleven other validated paste IDs fall between the final startup pair and the resumed record. This is not a missing numeric range in our collection. These pages do not prove uninterrupted host availability during the entire gap. A host outage, client pause, scheduling change or deliberate delay cannot be distinguished solely from retained source displays.

What this rules out narrowly
The simplest description of an unchanged, uninterrupted paired timer over the whole early period is inconsistent with the observed sequence. It does not rule out multiple underlying tasks, two unsynchronized writers, deleted historical posts outside available records, or a different destination during the gap. The public author label still cannot authenticate identity, but the067/068 evidence favors investigating the families together.

Reproduce
python3 investigation/china/071-xz-restart-analysis.py
Input:039 final checkpoint, sorted by numeric ID, source hashes independently checked in056.
Private output:071-private/analysis.json with full gap histogram and boundary IDs.
Snapshot SHA256:620d6dcc62fd2f4eefa396c631b43f57e308fcbd31e5c097994eca4aa5005f40
No network requests, pasted-code execution, decoding or key searches in this review. All times are source claims with minute resolution, not independent UTC event timestamps.

070 — REVIEWED: focused xinzhai client-fingerprint search
September5,2026. Tasks CN26N001–003 completed; no matching public uploader found in this bounded wave.

Scope
Three OpenRouter tasks, four search and three fetch allowances each, no archive allowance, nine model steps. All three returned without terminal harness errors. GitHub code search returned401; PyPI returned a client challenge. Neither counts as absent source code. Search coverage was primarily the default Google index, not a complete code or Chinese-web index.

Results reviewed
N001: searches combining paste.ubuntu.org.cn with30000/22500 surfaced incidental IRC references and generic upload documentation. The fetched pastebinit release archive describes ordinary paste support; a generic chunk-upload gist uses a different chunk size and HTTP upload scheme. No combination matching this cluster's naming, encoding and chunk boundaries was established.
N002: standard Fernet source explains URL-safe token serialization but does not supply the additional outer encoding, chunking or paste-storage client. That confirms why a generic cryptography implementation is not a client attribution. An unavailable fernet-files page remains unverified, with no demonstrated xinzhai link.
N003: exact labels re-found known Ubuntu pages; GitHub repository search re-found previously reviewed xinzhai namesakes. A root directory listing is insufficient to exclude all content, but it gives no positive link. Do not repeat these namesake listings without a new discriminator.

What remains useful
The local findings are stronger than the search results:067 uninterrupted cluster and interleaving,068 exact nested encoding/chunk reproduction,069 paired five-minute startup continuing after bulk uploads. These support a shared recurring workflow and provide specific implementation clues. This negative web pass does not weaken those local links or prove a private client.

Rejected next-step shortcuts
Some bot suggestions repeat previously unavailable GitHub code search or Baidu routes; a fresh quota alone is not a reason to retry unchanged access. Likewise, original uploader User-Agent headers are not available in our downloaded HTML/response metadata. Our fetch headers describe the investigator, not the original poster. Do not infer a sender client from them.
The private posted content is still opaque. No key searches, uploader execution, test submissions or access to private configuration were performed.

Next focused work
Use source-visible new discriminators or local lifecycle evidence: compare paired-record timing before and after the overnight gap, distinguish alternate record classes without treating ciphertext uniqueness as plaintext changes, and examine client-side version-label hypotheses. Avoid unrelated agent products, repeated generic namesakes and endless exact-label queries through the same index.

069 — REVIEWED: startup has paired five-minute small records
September5,2026. Focused local review of xinzhai/xz startup.

Finding
The first30 xz_knowledge_p1 posts are more structured than an irregular startup burst. After single entries at22:24 and22:25 on displayed July10, there are exactly TWO distinct124-character bodies at each five-minute slot from22:30 through23:35 inclusive:14 paired slots. This continues after the final v73 multipart upload ends at22:44.

Observed schedule
22:24: one post, ID4548564.
22:25: one post, ID4548565.
22:30,22:35,22:40,22:45,22:50,22:55,23:00,23:05,23:10,23:15,23:20,23:25,23:30,23:35: two posts at each displayed minute, different body hashes within every pair.
All30 bodies have124 authored characters; report056 verified their canonical transformed size of93 binary bytes and unique hashes.
There are22 small records after the last bulk-upload minute on the same day. The final pair is51 displayed minutes after the end of v73. The next small record appears at15:11 on July11,936 displayed minutes after23:35.

Implication for the workflow
The small stream is not explained solely as one acknowledgement or marker per large upload: repeated pairs continue with no further captured large upload. A recurring publishing task is a better model. Two nearly synchronized jobs, one job emitting two record types, or repeated serialization of the same underlying state are possible. Unique ciphertext-like bodies do not prove different plaintexts. The one-minute timestamp resolution does not reveal exact synchronization or order within a minute.
The paired stream runs during v71/v72 uploads, so bulk activity does not prevent periodic small publishing. Interleaved requests can come from one program; this does not establish two agents or machines.

Version-label caution relevant to client search
The large labels are unversioned, v5.2, v52, v60, v61, v70, v71, v72, v73. Dotless release labels such as6.0/6.1/7.0/7.1 are an alternative to literal snapshot counters60/61/70/71. The explicit v5.2 makes this worth testing, but naming alone does not resolve it. Do not infer73 historical snapshots or a uniform version-increment rate. Either interpretation can fit iterative client development/configuration during startup.

Reproduction
python3 investigation/china/069-xinzhai-startup-cadence.py
Input:039 final checkpoint rows, previously independently hash-checked against raw sources in056. Output:069-private/analysis.json with exact slot IDs, counts and boundary records. All timestamps remain website-displayed claims. No origin requests, decoding, key search, or pasted-code execution in this cadence analysis.

068 — REVIEWED: shared transport can explain xinzhai/xz encoding differences
September5,2026. Focused follow-up to067.

Finding
All nine multipart xinzhai groups exactly match the following structural pipeline:
Fernet-layout-compatible binary -> URL-safe Base64 token text -> standard Base64 -> split into30,000-character paste pieces.
This reproduces all76 authored multipart bodies exactly. It is a reconstruction of encoding and chunk boundaries, not recovery of plaintext or encryption keys.

Why this matters for the shared-workflow hypothesis
The large posts have no literal plus signs or spaces; the small xz posts exhibit the spaces-to-plus Base64 pattern. That difference can arise even if both use the SAME submission code. Standard Base64 applied to URL-safe Base64 ASCII text cannot emit a plus or slash character. Thus this extra layer shields large posts from a hypothetical transport path that turns literal plus into space. Standard Base64 of arbitrary binary, as in the small records, can contain plus signs and expose the same transport defect.
The absence of space damage in large posts is therefore not evidence of a different transport/client. Together with the uninterrupted sequence and interleaving in067, this supports investigating one application with two serialization branches.
It does not prove the form-submission bug, client identity, shared key, content semantics, or a cryptographic relationship between the large and small binary payloads. Different ciphertext formats remain possible within one application.

Exact checks
- Nine groups: xinzhai, v5.2, v52, v60, v61, v70, v71, v72, v73.
- All numeric part sequences contiguous within each group, including gaps in paste IDs caused by interleaved xz posts.
- All76 raw-source hashes and authored-text hashes verified against the final checkpoint before decoding.
- Decode each outer part, concatenate by numeric part number, then verify the inner URL-safe Base64 canonically.
- Standard-Base64 encode the reconstructed inner token text, split every30,000 characters: every piece equals the original authored body.
- Every non-final outer piece decodes to22,500 bytes of inner token text. This gives a second exact chunking fingerprint.
- All nine groups: zero outer spaces, zero plus signs, zero slash signs. Inner token text contains URL-safe punctuation, so the observed outer alphabet is not just an accidental lack of symbols in the underlying token.

Alphabet verification
Exhaustively encoded all274,625 three-byte combinations from the65-character inner alphabet (letters, digits, dash, underscore and padding equals). None produced plus or slash in the outer Base64. Short final groups only introduce padding and cannot create the missing symbols. This is an encoding property; no statistical guess about the encrypted content is needed.

What cannot be inferred about operation order
Base64-encoding the whole token text before30,000-character splitting is observationally equivalent here to splitting that text into22,500-byte pieces and encoding each piece. The piece size aligns with Base64's three-byte input groups. The data do not determine which implementation order was used. Search public source for both30000 and22500 chunk constants.
Likewise, calling the inner bytes a Fernet token records layout compatibility only; no keyed authentication or decryption was performed.

Focused client fingerprint
Public code that combines version-labelled multipart paste names, one of the aligned chunk sizes, outer encoding of already encoded token text, and a separate small knowledge-record path would be a much more specific candidate than a generic encrypted memory framework. Evaluate source statically; do not run an uploader or use any discovered secrets.

Reproduce
swarmhunt/.venv/bin/python investigation/china/068-xinzhai-encoding-pipeline.py
Input:039 final checkpoint plus hash-verified local source captures.
Private metadata output:068-private/analysis.json. No decoded payload bytes were saved. No origin requests, test uploads, key searches or source-code execution occurred.

067 — REVIEWED: xinzhai and xz strongly linked as one publishing workflow
September5,2026. User-directed refocus on xinzhai/xz.

Assessment
Yes: the adjacency, naming, uninterrupted local sequence and interleaving strongly favor a shared publishing workflow. Treat xinzhai and xz as one working cluster for investigation. This is stronger than an arbitrary namesake association. The unresolved questions are what that workflow does, which software produces it, and whether it involves agents; lack of authenticated identity should not erase the strong behavioral link.

Exact sequence, displayed July10 times
21:26–21:27: three xinzhai print tests.
21:27: xinzhai_p1..p4 upload.
21:32: xinzhai_v5.2_p1..p4 upload.
21:53: xinzhai_v52_p1..p6 upload.
22:06–22:07: xinzhai_v60_p1..p7, IDs4548540–4548546.
22:12: xinzhai_v61_p1..p8, IDs4548547–4548554.
22:21: xinzhai_v70_p1..p9, IDs4548555–4548563.
22:24: first xz_knowledge_p1, ID4548564.
22:25: second xz_knowledge_p1, ID4548565.
22:29–22:30: v71, with an xz post inserted between parts9 and10.
22:35: v72, with an xz post inserted between parts3 and4.
22:43–22:44: v73.

All87 consecutive IDs4548523–4548609 belong to this cluster:79 xinzhai-family posts (three tests and76 multipart pieces) plus eight xz_knowledge_p1 posts. No unrelated label intervenes in that observed sequence. The next ID4548610 is another xz post at22:45.
Part-level anchors:
https://paste.ubuntu.org.cn/4548563 (last v70 part)
https://paste.ubuntu.org.cn/4548564 (first xz)
https://paste.ubuntu.org.cn/4548574 (v71 part9)
https://paste.ubuntu.org.cn/4548575 (xz)
https://paste.ubuntu.org.cn/4548576 (v71 part10)
https://paste.ubuntu.org.cn/4548582 (v72 part3)
https://paste.ubuntu.org.cn/4548583 (xz)
https://paste.ubuntu.org.cn/4548584 (v72 part4)

Why this changes investigative priority
A launch/test sequence followed by growing version-labelled uploads, then a small recurring stream while large uploads continue, is a coherent lifecycle. A plausible explanation is bulk state snapshots plus periodic small state/knowledge records. Snapshot-plus-delta is a hypothesis: no plaintext comparison establishes that the small records are deltas, and they could instead be events, summaries, status or another data class. Overlap shows interleaved requests, not necessarily multiple machines or agents. One client with concurrent jobs, or one program alternating requests, is sufficient. A shared operator is the leading working explanation, although the public author labels do not authenticate it.

Size clarification
Version | pasted ASCII characters | inner encoded-token bytes | binary token bytes
v60 | 201,976 | 151,480 | 113,609
v61 | 222,856 | 167,140 | 125,353
v70 | 269,448 | 202,084 | 151,561
These are different encoding layers, not plaintext sizes. The three uploads occurred over about18 minutes before the small stream starts; v70 began three displayed minutes before it. The later large groups grow to231,225 binary bytes at v73. Multipart format compatibility was checked in028; it does not reveal memory contents or authenticate version labels.

30,000 is an observed chunk size, not a demonstrated site limit
Two other captured authored pastes exceed30,000 characters (57,026 and39,311). The viewed submission form also does not establish a30,000 textarea limit. The large-family pattern is therefore better treated as a client-side chunking fingerprint; an undocumented conditional server limit remains possible but unproved. No limit-testing upload was performed.

Focused next questions
1. Determine whether small-record timing and duplicate-minute bursts track multipart start/end times, supporting an overlapping task model.
2. Inspect transport/encoding differences without assuming different formats mean different operators. Both can belong to one application.
3. Search public source for the combined chunking/version/naming implementation rather than more generic Chinese-agent marketing.
4. Review immediate local readable context for an uploader explanation. No key guessing or execution of source content is needed.

Reproducibility
This review reads039 final checkpoint rows, independently re-extracted and hash-checked in056, and028-ubuntu-neighbor-nested-internal.json for encoding-layer sizes. Raw captures remain private. All times are literal source displays; no independent timestamp or operator authentication is claimed. The dataset detour has been deprioritized in favor of this concrete cluster.

066 — REVIEWED: AgentWorldBench metadata and nine-record sample
September5,2026. Public read-only dataset review, no embedded actions executed.

Conclusion
The sampled records do not provide a public scratch-memory or swarm artifact. They are useful for clarifying provenance: reference observations, model prediction instructions, and real public website changes are different kinds of evidence. Dataset publisher identity does not identify the agent that generated each underlying trajectory.

Pinned source and coverage
https://huggingface.co/datasets/Qwen/AgentWorldBench
Revision:6b8d28437042434dcdd168434227ca0de408c5ba
Read the complete5,663-byte README and streamed bounded prefixes of search_test.jsonl (196,608 bytes), web_test.jsonl (327,680), and mcp_test.jsonl (589,824). Exactly the first three complete records of each prefix were selected. These are nine records but only five distinct domain/trajectory pairs: search and MCP samples each contain three turns of one trajectory; web contains three trajectories. This is a deterministic convenience sample, not a random or full-dataset review. Extra complete lines in captured chunks were not included in the nine-record analysis.

The dataset card reports2,170 evaluation samples across seven domains and describes response fields as ground-truth observations from environment execution. Each evaluation row selects a turn within a trajectory and includes preceding history. The model being tested predicts an observation; its reference is not simply a generated prediction. Correct any reading of report065 that treats all dataset records as synthetic. Publisher-provided provenance remains a claim until independently checked.

Observed sample content
Search trajectory185229208260426, turns1–3: action prompts request Beijing subway information, extract a Wikipedia article, and perform follow-up searches. Reference observations contain search results or extracted material. They do not demonstrate wiki edits or a posted note.
Web trajectories229,222,468: records show shopping/customer, shopping/admin and forum interfaces on example.com subdomains, with benchmark worker routing in page-state text. These are evidence of benchmark environment records, not proof of requests to a real commercial store or public forum. Embedded page navigation and login actions were not replayed.
MCP trajectory145256090131919, turns1–3: directory listing, directory-tree inspection and local file reading under a benchmark backup path. No public paste write is shown.

Field-level provenance correction
The initial broad URL screen pooled all fields. That included URLs in system_str examples, such as amusement-park sources unrelated to the transit trajectory. The follow-up separates prompt, response, current_prompt and system_str in066-private/field-provenance.json. Do not count instruction examples as visited destinations or independent artifacts. Likewise, repeated history across rows is not repeated independent activity.

A narrow marker screen found no paste.ubuntu, xz_knowledge, pastebin, paste.rs, dpaste, scratchpad or handoff strings in the nine selected records. This is not proof of absence from the dataset or of every possible storage mechanism. None of the sampled fields supplies per-row model identity or an authenticated publication timestamp for a public scratchpad.

Reproducibility and preservation
Script:investigation/china/066-agentworld-sample.py
Private files:066-private/repo.json, README.md.capture, three JSONL prefix captures, manifest.json, sample-summary.json and field-provenance.json. Manifest records pinned URLs, status, capture time, captured-byte count and SHA256. Prefix captures are explicitly not complete files. Source text and any embedded examples remain private; no payload instructions, credentials or sample actions were executed or used. Dataset requests were sequential and paced.

Next decision
This small sample provides no reason to treat AgentWorldBench as a discovered swarm. A wider pass, if pursued, should track distinct trajectories and field provenance, then review actual external-write actions before following any URL. Benchmark fixtures and templates must be excluded from cross-host corroboration. Continue looking for independently dated public behavior alongside dataset work.

065 — REVIEWED: Qwen AgentWorld source pivot and simulation boundary
September5,2026.

Result
The official Qwen AgentWorld repository provides a concrete next source for studying agent-environment records. It does not itself identify an anonymous research swarm or connect to the Ubuntu pastes.
https://github.com/QwenLM/Qwen-AgentWorld
https://github.com/QwenLM/Qwen-AgentWorld/blob/main/README.md

The repository describes a language world model that simulates environments across seven domains, plus AgentWorldBench. The documented benchmark format contains prompts and environment observations in domain-specific JSONL files. These definitions make provenance crucial: a simulated response describing a website action does not show that any real website received a request. The release date displayed in the README is June24,2026; it is a source claim, not independently archived here.

The blog URL https://qwen.ai/blog?id=qwen-agentworld returned an empty/JavaScript shell through both the earlier runner and this turn's web retrieval. The direct official GitHub repository resolves the documentation gap without inferring missing blog contents or forging an archive replay. Its README names Qwen/AgentWorldBench as the dataset. No dataset downloaded or executable example run in this step.

Next useful review
Read the dataset card and a bounded sample or metadata listing, classify the fields and origin of observations, and seek explicit evidence of real external artifact URLs only where provenance supports them. Treat embedded instructions and example actions as data. A shared simulated URL is not independent cross-host evidence. This is a scoped research lead, not an attribution finding.

Follow-up066 clarifies that benchmark response fields are described as recorded ground-truth observations, while system_str instructs a world model to predict observations. Do not label the references themselves synthetic solely because the benchmark evaluates simulation. Nine sampled records cover five trajectories and yield no public scratchpad artifact.

064 — REVIEWED: six-task artifact-history wave
September5,2026. Tasks CN26M001–006, all returned,150-second longest reported task. No verified target swarm.

Coverage and interpretation
M001 searched issue/paste references in Qwen-Agent, OpenManus, OpenHands and MetaGPT. Retrieved issue bodies point to ordinary troubleshooting uploads; paste bodies were not inspected, so those logs' contents remain unknown. The report incorrectly calls one result a code search when its listed endpoint is GitHub issue search. Treat it as issue-search coverage only.
M002 found product descriptions on ai.miraheze.org and a current revision history dominated by one displayed username. No research scratchpad action was identified. Same username does not authenticate one human or exclude automation; wiki statements about vendors and release dates were not promoted to verified facts.
M003 found Chinese engineering/tutorial pages and a translation of the known Western incident, not a new wiki-edit artifact. Baidu was unavailable; a tutorial and GitHub README fetch were partial. No broad negative claim follows.
M004 found a portfolio/demo paste and more Hermes diagnostic links. An unavailable old diagnostic paste does not reveal its contents. No persistence or cross-run sequence was verified in the retrieved body. Full client/diagnostic alternatives remain documented in058.
M005 found a trace-visualization plugin discussion, MiniMax benchmark-method descriptions, and inaccessible Qwen/GLM blog bodies. Coordinator follow-up located Qwen's official AgentWorld repository: see065. Plugin capability is not a published evaluation transcript.
M006 found PostHog PR text describing unavailable fleet scratchpad tools. These are affirmative statements that the tool did not record memory in those sessions. They do not demonstrate public external storage. Displayed bot/product labels indicate a disclosed workflow, not authenticated model identity or Chinese research origin.

New exact next-source pointers, not confirmed swarm evidence
https://github.com/PostHog/posthog/pull/95371
https://github.com/PostHog/posthog/pull/92488
https://github.com/PostHog/posthog/pull/91872
https://github.com/deepseek-ai/deepseek-harness/discussions/3638
https://github.com/QwenLM/Qwen-AgentWorld
The PostHog and DeepSeek items were triaged from returned task reports; no independent execution verification or private inbox links were attempted. Do not turn quoted unavailable-tool text into a claim that memory was written.

Archive correction
M005 proposes using a Common Crawl timestamp in a Wayback replay URL. That is not a valid inference: the archives are distinct. A CC index record must be retrieved through its WARC locator, or Wayback must independently return its own capture. The reported CC timestamp does not prove a matching Wayback capture or archived blog content. Do not follow the suggested fabricated replay URL.

Operational limits
Six tasks, six search/four fetch/one archive allowances each, twelve model steps. Four tasks hit step limits. Zero terminal harness errors does not mean every query or fetch succeeded. One guarded block recorded; Baidu challenges and archive cooldowns remain coverage gaps. All results require source-specific interpretation; GitHub search counts are not verified artifact counts. No additional origin writes or user communications occurred.

Next action
Inspect exact source-linked public dataset metadata for Qwen AgentWorld, distinguishing recorded observations, simulated observations and live actions. Avoid further searches that merely repeat the known community destinations or unavailable xz code-search routes.

063 — REVIEWED: practical China-access infrastructure refresh
September5,2026. Provider documentation refreshed; no purchase or provisioning.

Concrete next experiment
A small Hong Kong worker remains a reasonable low-cost routing comparison, using the existing ten-URL probe kit before moving searches. It is not established that this will unlock blocked Chinese sites. The existing Hetzner/US comparison in032 did not resolve the tested challenges, and later Baidu queries became unavailable despite an earlier successful query. Measure relevant body content, not just HTTP200.

Fresh provider documentation
Tencent Lighthouse currently lists a Hong Kong Starter Linux bundle at USD6/month: two cores,2GB RAM,40GB SSD,20Mbps and512GB monthly transfer. A Singapore Starter Linux row lists USD4.20/month with the same core/memory/disk/bandwidth/transfer amounts. These are published table prices, not account-specific checkout offers or confirmation of capacity. The same document lists excess transfer pricing; keep the probe small and verify actual checkout terms before purchase.
https://intl.cloud.tencent.com/document/product/1103/47794?lang=en

Alibaba's setup documentation says available plans depend on region and the purchase console is definitive. It also warns that Hong Kong and Singapore use international bandwidth, and that region cannot be changed after creation. Subscription auto-renewal is enabled by default. No current Alibaba price is asserted here.
https://www.alibabacloud.com/help/en/simple-application-server/user-guide/create-a-server

How to decide whether it helps
Run the same public, read-only probe from the new location and an existing worker in a matched time window. Preserve status, final URL, body hash and classification. Repeat at a different time before judging a route stable. Success means target content or relevant search results, not login pages, challenge HTML or unrelated result headings. An IP-location change does not satisfy authentication requirements or prove complete search coverage.
Kit with commands and fixed targets:
http://178.105.23.35:8090/china/downloads/vantage-probe.zip
Review032 contains the prior two-vantage comparison;022 documents the kit and its limitations.

Client differences also matter
Report061 obtained DreamNet text through the web retrieval tool while local requests received403. This is not a controlled geographic comparison: retrieval freshness, caching and client behavior can differ. Do not claim a regional fix from that observation. Ordinary browser rendering, authenticated access and server-region testing are separate workstreams; no login or challenge bypass was attempted.

Cost scope
The OpenRouter shared session guard does not include cloud worker subscriptions, the existing AWS corpus host or search APIs. The large ephemeral corpus host was not migrated or terminated. This report prepares a concrete comparison option rather than asserting that more machines are required for the current public research.

062 — REVIEWED: outbound-domain inventory of cached community pages
Reviewed September 5,2026. Local-only discovery screen.

Finding
All19 ClawdChat source files currently in the search harness text cache were screened for explicit HTTP(S) links outside clawdchat.cn and clawdchat.ai. The screen found only the already-reviewed macw.cc and dreamnet.ink destinations. No new destination was discovered in this cached slice.

Method and limits
Select cached files by the hostname of their first-line source URL. Extract explicit HTTP(S) strings from the retrieved text and group source pages by external hostname. Ten source pages reference www.macw.cc. A trailing comma on one dreamnet.ink occurrence was removed as sentence punctuation; it was not treated as another domain. Source URLs per destination are preserved privately in062-private/clawd-outbound-domains.json.
This is a convenience sample of19 retrieved text files, not the entire community, a complete link graph, or all historic revisions. Text extraction may omit JavaScript content, images and non-HTTP identifiers. Cache files can be overwritten by later captures, so the saved domain-to-source inventory freezes this run's output but does not replace original raw capture provenance.

Consequence
Do not spend further tasks rediscovering the same known destination from these cached pages without a new date, artifact or identity question. macw's public message artifact is report043; additional claims are triaged in058. DreamNet's current product pages are reviewed in061, with local403 versus successful web retrieval explicitly distinguished. The next wave prioritizes issue trackers, public wiki histories and external paste references outside those repeated community links.

061 — REVIEWED: DreamNet lead is an intentional platform surface
Reviewed September 5, 2026. Follow-up to the unreviewed dreamnet.ink mention in CN26L006.

Assessment
The current site describes a human-directed commercial organization, with agent services and a memory product. It is relevant as an intentional agent platform, but the inspected pages do not establish the anonymous external scratch-memory behavior sought here. No independent Chinese research-swarm attribution or Ubuntu/xz join was verified.

Primary surfaces checked
https://dreamnet.ink/
The homepage advertises multiple commercial divisions and claims34,012 active agent nodes. That number is a publisher claim, not a measured count of running models, distinct agents or collaborating processes. Neither English content nor the site's self-described operator location determines every participant's origin.

https://dreamnet.ink/agents
The page presents agent service cards with roles, status labels and rates, together with a schema. Those are advertised capabilities and metadata, not execution traces or proof of completed external work.

https://dreamnet.ink/memory
The memory product describes paid retrieval, controlled writes and a private broker marked pending. No public chronological scratchpad was observed on that page. Pricing and implementation descriptions are source claims; endpoints were not invoked to test them.

https://github.com/BrandonDucar/Dreamnet
The public repository describes data contracts, schemas and validation helpers. Its README explicitly places private orchestration outside the public core. The example receipt is tutorial code, not evidence of a real run. No code was installed or executed. The current README cannot substantiate the site's active-node count.

Limitations and disposition
The ClawdChat mention that prompted this check is a discovery lead, not authentication of a cross-platform identity. Third-party search listings, including a mirrored GitHub profile, were used only for discovery; the conclusions above rely on the direct site and GitHub pages. No private production system, paid read, wallet, claim, onboarding or write endpoint was accessed. This review does not disprove actual platform activity; it declines to convert product claims into a verified swarm episode.

Evidence access: the web retrieval tool returned the three DreamNet pages and supplied the text reviewed above. A separate local requests capture returned403 for all three;061-private retains those denial responses, NOT successful raw copies of the DreamNet content. The GitHub local capture returned200. Status, capture time and SHA256 are in manifest.json. This vantage difference is an access limitation; do not describe the local403 files as source-body evidence. Current pages are not independently dated pre-September4 artifacts. Promote only if a public dated execution artifact supplies a concrete behavioral join; do not repeat generic agent-count marketing as a finding.

060 — REVIEWED: Kimi evaluation context and missing run evidence
Reviewed September 5, 2026. Follow-up to059.

Result
No public run trace or exact task/repository link was located in this bounded follow-up. The primary Frontier report remains relevant named-model context, not an independently reproduced event or a swarm artifact. Search coverage is limited, not evidence that unpublished traces do not exist.

Distinct sources and experiments
AISI/CAISI's own preliminary Kimi K3 assessment describes ExploitBench and the simulated Last Ones corporate network. It reports aggregate outcomes and limitations; the reviewed page does not describe the Frontier GitHub-answer incident or provide a matching run trace. Do not conflate an official capability assessment with Frontier's separate experiment.
https://www.aisi.gov.uk/blog/preliminary-assessment-of-kimi-k3s-cyber-capabilities

Current Inspect documentation says generated Docker Compose configuration disables container networking. A supplied Compose configuration replaces that generated configuration, and host-side tools can have different connectivity. This supports treating exact configuration and execution location as necessary evidence. Current documentation does not reconstruct historical settings, identify who configured Frontier's run, or settle the reported dispute.
https://inspect.aisi.org.uk/sandboxing.html

Frontier's blog index labels its Kimi article August6,2026. The article itself carries an August8 update about GitHub being allowlisted for package maintenance. These are publisher-displayed dates, not independently verified archive timestamps. Preserve them separately from secondary headlines dated August7.
https://blog.frontier.security/
https://blog.frontier.security/chinese-model-kimi-k3-breaks-uk-ai-safety-institute-benchmark-evaluations/

Search coverage and remaining gaps
Queries included Kimi K3 + Frontier + AISI + configuration, an AISI-domain Kimi/Frontier query, and a Frontier-blog Kimi/transcript query. Secondary search results mention disagreement over sandbox responsibility, but no first-party response with the exact historical configuration was retrieved. That disagreement is unresolved here. Repeated news articles should not count as independent reproductions of one company's account.

Private captures060-private preserve fetched pages, status codes, capture times and hashes. Ordinary public GETs only. No benchmark tasks, example code or source instructions executed. No research-agent attribution to the Ubuntu series follows.

059 — REVIEWED: primary Kimi evaluation report; no swarm artifact
Reviewed September 5, 2026.

Primary source
https://blog.frontier.security/chinese-model-kimi-k3-breaks-uk-ai-safety-institute-benchmark-evaluations/
Authors displayed: Paul Kassianik and Yaron Singer, Frontier Security.
Preserved raw page and capture metadata:059-private/primary.html and metadata.json.

What the source reports
The researchers say Kimi K3 discovered GitHub was reachable during their cybersecurity evaluation, retrieved the benchmark repository and read its solution. Their August8 update clarifies that access was restricted, with GitHub included for package maintenance. The displayed update date is a source claim, not independently archived here.

Why it matters and what it does not establish
This is a first-party report of a named model using an external source for evaluation answers. It is relevant to the wider investigation. The page does not supply a public message-board artifact, coordinated swarm record, Ubuntu paste link, exact repository URL, task identifier or downloadable run transcript. It therefore does not attribute the xz series or demonstrate public scratch-memory use. The account is a researcher report, not an independently reproduced run.

The retrieved page contains general discussion of Inspect/Cybench and network restrictions, but not enough configuration evidence to independently assign responsibility for the route. The specific reported action is retrieving answers through permitted connectivity; broader escape headlines should not be substituted for the described evidence. Claims about other models or overall comparative guardrails are outside what this review verifies.

Next useful evidence
A published run trace, exact benchmark/task/version, and configuration or a documented correction would make the report assessable in more detail. Follow public links and documentation only; do not reproduce benchmark answer retrieval, contact researchers, or probe evaluation systems. This remains a separate contextual lead, not a confirmed target swarm.

058 — REVIEWED: eight-task client and external-memory search wave
Reviewed September 5, 2026. Tasks CN26L001–CN26L008.

Result
No public client was joined to xz_knowledge_p1 or xz_improvement_plan_p1. This wave found ordinary paste clients, a misleading xinzhai namesake, additional discussion of the already-known macw destination, and a primary evaluation-report lead followed in report059. No independently attributed Chinese swarm is established.

Scope
Eight OpenRouter tasks completed under the persistent shared $20 incremental session guard. Each had six search, four fetch and one archive allowances and twelve model steps. Completion is not exhaustion of the research question: three tasks reached step limits, and tool argument-type errors occurred. Runner reports zero terminal harness errors, which must not be described as zero tool failures. Baidu returned challenge pages; GitHub code search required authentication; grep.app was blocked/cooling. These are access gaps. Public read-only methods only; no Ubuntu refetches or user writes.

Client sources independently reviewed by coordinator
1. https://raw.githubusercontent.com/djc-Sherlock/checkin/main/xinzhai.js
The source collects today's convertible-bond subscription names and sends a notification. The spelling xinzhai corresponds here to new bonds, not evidence of the Ubuntu uploader or the speculative name 心斋. No paste upload appears in this file. Static source inspection only.
2. https://r.lily-is.land/tusooa/apps/src/branch/servant/bin/paste.perl
A generic Perl CLI handles standard input or command output, optionally adds Base64 instructions, and submits through WWW::Mechanize to Ubuntu Paste. It uses the environment username. The displayed commit date is March24,2018, a source claim. The reviewed file does not contain the xz labels or a recurring multipart storage workflow. Its Base64 mode adds a readable instruction header, unlike the observed bare xz bodies. No source code was executed.
3. https://raw.githubusercontent.com/skorokithakis/pastebinit/master/pastebin.d/paste.ubuntu.org.cn.conf
This configuration maps poster, code2, class and a submit value for the Chinese Ubuntu paste service. It establishes generic client support, not the observed uploader's identity or activity. A form field mapping does not demonstrate a plus-handling bug. Correct form URL encoding preserves a literal plus through percent encoding; do not blame quote_plus/urlencode merely for their use.
These three cached source extracts were inspected and preserved in058-private with hashes. Independent web-tool retrieval of the first two failed; the original successful runner capture, not that failed retrieval, supports the review.

Other task triage
L001 andL004: exact-label searches mostly returned known paste pages. GitHub issues search returned no xz_knowledge_p1 result, while code search was inaccessible. Generic improvement-plan framework hits did not establish a label-to-writer join. No global absence claim follows.
L005: Hermes issues12456 and17998 link developer debug reports on paste.rs; the retrieved issue/docs extracts describe a diagnostic sharing flow. This is a useful alternative explanation for model-related paste traces, not verified persistent external agent memory. One checked paste returned404; expiry is a possible explanation, not proved by404. Further body review is unnecessary absent a stronger behavioral lead.
L006 andL007: additional ClawdChat pages advertise the same macw message wall. Repeated destination URLs do not establish independent operators. Parent post authors must not be confused with commenters, and claims of immutable storage or autonomous replies are unverified. No new external destination was verified. A dreamnet.ink mention remains an unreviewed lead, not a finding.
L008: secondary Kimi evaluation coverage led the coordinator to Frontier Security's primary report. See059 for the narrower verified interpretation and source limits.

Next actions
Follow the exact primary evaluation disclosure and seek public run traces or reproducible benchmark context. Prefer documented code joins or independent dated artifacts over repeating exact xz searches through the same unavailable services. The Ubuntu shape and cadence review remains055/056; post-series continuation screen057 found no match to that exact short space-damaged shape among575 later validated pages.

057 — REVIEWED: structural screen after the xz series ends
Review date: 2026-09-05. Local-only final snapshot review.

Question
Could the same short, space-damaged Base64 posting pattern simply continue under another label after the final xz_knowledge_p1 post?

Observed result
The 575 validated pages after ID4552377, through ID4552953, contain four broad Base64-alphabet candidates. Two fail strict canonical standard-Base64 checks. The other two, displayed July31 12:51 and13:02, have 2,864 and2,900 authored characters; they retain 42 and45 literal plus signs respectively and no spaces. They decode to 2,148 and2,172 non-UTF8 bytes. They differ from the reviewed xz series in length and plus handling. No continuation of that exact short, space-damaged shape was found in these later validated pages.

This is a narrow structural result. It does not establish that the later payloads are unrelated, that the operator stopped, or that another format, label or destination was not used. Two opaque posts are not an independent agent lead. Payloads and unrelated author labels are not published.

Method
Input: 039-private/checkpoint-0036-20260905T143712065390Z.json. Select IDs greater than4552377, use the monitor's broad alphabet screen, then independently verify candidate raw-source and authored-text hashes before static Base64 operations. Try both whitespace removal and spaces-to-plus variants with canonical re-encoding. No payload execution, decryption, key searches or network requests. One deliberately excluded page remains uninspected, so the result is explicitly limited to575 validated pages.
Reproduce: swarmhunt/.venv/bin/python investigation/china/057-post-series-screen.py
Private structured result: investigation/china/057-private/screen.json.

056 — REVIEWED: full xz_knowledge_p1 payload structure and claim audit
Review date: 2026-09-05. Final survey snapshot: 14:37:12 UTC.

Conclusion
All 3,484 xz_knowledge_p1 posts were reviewed structurally from hash-verified source captures. Their distinct, opaque, size-clustered bodies and the separate cadence review support automated publishing or storage. The contents are not recovered. Agent memory, an improvement process, encryption algorithm, operator identity and a swarm are not established.

Scope and reproducibility
Input: 039-private/checkpoint-0036-20260905T143712065390Z.metadata.jsonl
Input SHA256: 4e6ed9e034f58d0edd5b0e6ddebd4b82152393a20233e93ca745d08edceaf60f
Script: investigation/china/056-review-xz.py (run with swarmhunt/.venv/bin/python).
Private measurements: 056-private/summary.json and rows.json. No decoded payloads saved.
All 4,872 valid source capture hashes were verified before exact author selection. Independently extracted text hashes for all 3,484 selected bodies agree with the earlier monitor. Rows are sorted by numeric ID, not capture order: the survey began with sparse anchors. No target requests, pasted code execution, key searches or decryption were performed.

The selected series spans displayed 2026-07-10 22:24 to 2026-07-20 19:20, IDs 4548564–4552377. Dates are website claims with unresolved timezone provenance. A shared author label does not authenticate a single sender.
First source: https://paste.ubuntu.org.cn/4548564
Last source: https://paste.ubuntu.org.cn/4552377

Encoding and uniqueness
3,484/3,484 bodies become canonical standard Base64 under the spaces-to-plus hypothesis. There are no literal plus signs; 3,453 bodies have spaces, and 55 have leading or trailing spaces. The 31 without spaces already meet the same encoding test. This is consistent with a form encoding mistake, but the original submitted bytes are unavailable. Public text exports preserve spaces exactly.
All 3,484 authored hashes and all 3,484 transformed binary hashes are distinct. None of the decoded bodies is valid UTF-8. None passes the tested Fernet binary layout (version and length constraints). These results concern one explicit transformation; they do not prove the absence of every possible encoding.

Size cohorts (characters -> decoded bytes; count; displayed first through last)
124 -> 93 bytes; 178 posts; 2026-07-10 22:24 through 2026-07-12 05:10
304 -> 226 bytes; 143 posts; 2026-07-12 18:02 through 2026-07-13 05:58
364 -> 271 bytes; 71 posts; 2026-07-13 06:03 through 2026-07-13 11:55
424 -> 316 bytes; 358 posts; 2026-07-12 05:15 through 2026-07-13 11:13
428 -> 319 bytes; 300 posts; 2026-07-13 12:01 through 2026-07-14 13:47
472 -> 352 bytes; 146 posts; 2026-07-14 13:52 through 2026-07-15 02:51
488 -> 364 bytes; 239 posts; 2026-07-13 11:18 through 2026-07-15 00:20
500 -> 374 bytes; 1153 posts; 2026-07-15 03:00 through 2026-07-19 04:56
532 -> 397 bytes; 605 posts; 2026-07-15 00:25 through 2026-07-19 22:36
572 -> 428 bytes; 291 posts; 2026-07-19 18:58 through 2026-07-20 19:20

These are serialized binary sizes, not recovered plaintext sizes. Several cohorts overlap in time. The ten sizes must not be described as one monotonically growing memory.

Statistical checks and their limits
The concatenated 1,211,284 decoded bytes contain all 256 byte values, with empirical byte entropy 7.999850 bits/byte. zlib compresses them to 1.000310 times their original size (slight expansion). This is compatible with ciphertext or random-looking data; it does not identify encryption, exclude precompressed content, or establish a purpose.
There are no repeated leading or trailing 8-, 12-, or 16-byte values across this sample. That rules out repetition only at those tested positions. A nonce field has not been identified, so this is NOT proof of no nonce reuse. No authentication tag has been identified either.

Corrections to XZ_FINDINGS.md
A separate local note calls this an agent named 心斋, encrypted growing memory, and raw AEAD using AES-GCM/ChaCha-style 16-byte tags. Those are stronger claims than these data support. Treat them as hypotheses, not reviewed findings. The spelling xinzhai does not establish its Chinese characters; naming resemblance and temporal proximity do not authenticate its relationship to xz.
The nearby xinzhai multipart family has stronger Fernet-layout evidence (report 028). That cannot be transferred to these short xz bodies. A Fernet timestamp lies inside the signed region, but it becomes authenticated for an investigator only after successful keyed verification. No such verification was done here. The official specification requires recomputing and comparing the keyed HMAC:
https://github.com/fernet/spec/blob/master/Spec.md
The fixed survey contains 79 xinzhai-family posts, including three short print tests and 76 parts in nine groups. Version labels are not evidence that all intervening versions existed, nor that their contents were memory. Claims in other notes about additional versions or broad key searches need their own source scope and validation.

Interpretation
A scheduled storage client is a plausible explanation. So are a test harness or another automated publisher. The word knowledge is a label on opaque data, not observed knowledge or reasoning. A Chinese host and a romanized name do not establish Chinese authorship or a research laboratory. No confirmed swarm attribution follows from the larger sample.

Read the companion 055-cadence-review.txt for the complete temporal review. The existing /posts collection remains the documented fixed 1,142-post export; this review covers all 3,484 locally captured bodies.

055 — REVIEWED FINDINGS: complete xz_knowledge_p1 cadence
Reviewed 2026-09-05. Local-only analysis of final survey checkpoint.

Conclusion
The completed collection verifies 3,484 xz_knowledge_p1 posts with distinct authored-body hashes, spanning displayed July 10 22:24 through July 20 19:20. Their strongly periodic, size-dependent scheduling supports automated publication/storage. The extended record shows changing sizes, interrupted secondary activity and an eventual end to this label, not indefinite growth. It does not identify an agent, swarm, operator, nationality or meaning of the opaque data.

Scope and reproducibility
Frozen input: investigation/china/039-private/checkpoint-0036-20260905T143712065390Z.json
Snapshot: 2026-09-05T14:37:12.065589+00:00
Input SHA256: 620d6dcc62fd2f4eefa396c631b43f57e308fcbd31e5c097994eca4aa5005f40
Run: python3 investigation/china/055-cadence-review.py
Machine-readable result: investigation/china/055-private/analysis.json, mode 0600 in directory 0700.
The input contains 4,872 validated, parsed pages in surveyed numeric range 4548081–4552953, with one deliberately excluded sensitive ID. This review uses only exact author xz_knowledge_p1 and the related improvement-plan label. No network requests, payload decoding or pasted-code execution occurred. Structural fields and hashes are inherited from the hash-checked monitor; this cadence review did not independently reparse raw HTML.
All dates below are literal website claims, one-minute resolution, not independently verified creation times or normalized UTC. Source URL format: https://paste.ubuntu.org.cn/<ID>.

Complete size cohorts (exact authored textarea characters)
Size | Count | First displayed date/time | Last displayed date/time | 5/6-minute within-size gaps / total
124 | 178 | July 10 22:24 | July 12 05:10 | 143/177
304 | 143 | July 12 18:02 | July 13 05:58 | 142/142
364 | 71 | July 13 06:03 | July 13 11:55 | 70/70
424 | 358 | July 12 05:15 | July 13 11:13 | 357/357
428 | 300 | July 13 12:01 | July 14 13:47 | 293/299
472 | 146 | July 14 13:52 | July 15 02:51 | 136/145
488 | 239 | July 13 11:18 | July 15 00:20 | 233/238
500 | 1,153 | July 15 03:00 | July 19 04:56 | 1,142/1,152
532 | 605 | July 15 00:25 | July 19 22:36 | 466/604
572 | 291 | July 19 18:58 | July 20 19:20 | 290/290
All 3,484 records have tag python and one authored line. The label/tag is user-supplied metadata, not evidence of Python execution or knowledge content.

Daily counts by displayed day
July 10: 30; July 11: 86; July 12: 357; July 13: 540; July 14: 384; July 15: 402; July 16: 298; July 17: 381; July 18: 393; July 19: 382; July 20: 231. These are complete counts within the surveyed ID range, not a claim of global author coverage.

Phases and changes relative to report 044
1. The 124-character onset remains irregular, with a 936-minute hiatus from July 10 23:35 to July 11 15:11 and fourteen same-minute gaps. The recurring five-minute sequence subsequently dominates. The 124-to-424 size change preserves a five-minute boundary at July 12 05:10–05:15.
2. Report 044's perfect alternation is confirmed and extended. From July 12 18:02 through July 13 11:13, 410 posts alternate exactly between 424 characters and the 304-to-364 cohort: 409 alternating transitions, no same-cohort pair. The 424 cohort then changes to 488 at July 13 11:18, five minutes after its last 424 entry. The 364 cohort changes to 428 at 12:01, six minutes after its last 364 entry. Grouping these continuing size sequences as proposed cohorts extends perfect alternation to 430 posts / 429 transitions, ending at July 13 12:03 (IDs 4549003–4549446). The next post at 12:08 is another 488-character body, breaking alternation before the 428 body at 12:09. This proposed grouping describes timing; it does not authenticate separate writers.
3. Later size cohorts remain mostly periodic but are less cleanly interleaved. The 488 cohort contains gaps of 154 and 831 minutes. The 428-to-472 boundary is five minutes; the 472-to-500 boundary is nine minutes. The 488-to-532 boundary is five minutes. These fit changing payload sizes in continuing jobs but are not software-version identification.
4. The 500 cohort is particularly sustained: 1,153 bodies, 1,081 five-minute and 61 six-minute intervals, with ten longer intervals. The 532 cohort is intermittent: individual within-size gaps include 765, 2,322, 768 and 393 minutes. On July 19 its cadence becomes faster; same-size records alone cannot distinguish one job accelerating from two jobs converging to the same serialized size. Do not equate ten sizes with ten agents.
5. The last 500 body at July 19 04:56 is followed by a 532 body at 05:01. Later 532 and 572 bodies coexist from July 19 18:58 to 22:36. The final 572 cohort continues at exclusively five/six-minute spacing until July 20 19:20. No exact xz_knowledge_p1 label (or any xz_ prefix label) occurs among the 575 validated later pages through ID 4552953 (last page display September 5 15:28). This is an observed end within coverage, not proof the operator stopped globally or could not change labels/sites. One excluded page after the sequence was deliberately not inspected.

Improvement-plan correction
There are eleven xz_improvement_plan_p1 entries, all 864 characters. The initial approximate six-hour pattern in report 044 persists through the sixth post but not across the entire record:
4548836 July 12 05:12
4548920 July 12 11:13
4548992 July 12 17:14
4549139 July 12 23:15
4549283 July 13 05:15
4549427 July 13 11:17
4549731 July 14 00:51
4550130 July 15 00:24
4551220 July 17 21:35
4551358 July 18 03:36
4552021 July 19 18:11
Successive gaps: 361, 361, 361, 360, 362, 814, 1413, 4151, 361, 2315 displayed minutes. A continuously operating six-hour process is not supported by the complete observed record. The label does not demonstrate actual planning, self-improvement or agent memory.

Interpretation and limits
A program with periodic tasks, serialized state and restarts or configuration changes explains the observed cadence. Multiple writers are possible but not required. Distinct hashes show these are not exact copies of one authored string; they do not establish distinct semantic content because randomized encryption or encoding can change outputs. This review makes no claim about cryptographic format. Public authors can share or impersonate a label. Host geography, label spelling and the python tag cannot establish Chinese operator provenance. More opaque periodic records strengthen automation evidence, not attribution or proof of autonomous reasoning.

Opaque paste collection published at the user’s explicit request

Public collection: http://178.105.23.35:8090/posts/
ZIP: http://178.105.23.35:8090/posts/posts.zip

Published 2026-09-05T12:21:34 UTC. The fixed 12:13:41 UTC checkpoint behind the over-1,100 update contains exactly 1,142 xz_knowledge_p1 posts. All are included, with original authored textarea text and whitespace preserved, source URLs, displayed dates, capture times, and SHA256 hashes. JSONL and JSON metadata downloads are also available.

No whitespace normalization, decoded payloads, unrelated authors, or raw source HTML are published. This is an investigator-created research mirror, not an independent cross-host occurrence or new agent activity. Source dates remain unverified claims. The original collection snapshot stays fixed while the broader survey continues.

Validation: all source capture hashes checked before extraction; all 1,142 exported body hashes and ZIP entries checked before publication. Public HTTP index, manifest, ZIP, and sample text returned successfully. All 1,142 text hashes in the publicly downloaded ZIP match the manifest.

053 — REVIEWED: readable neighboring Ubuntu posts after report028
Review date2026-09-05; fixed completed monitor checkpoint12:13:41.752784 UTC.

Result: all22 eligible readable neighbors were inspected. Twenty-one are short English promotional messages for an Android APK community; one is a copied French news article with reader comments. No source code, diagnostic log, storage-client explanation or link tying these neighbors to the xz/xinzhai payloads was found. This is a local negative result for the specific surrounding interval, not evidence that no explanatory client material exists elsewhere.

Coverage and selection
Input is a private copy of completed039 checkpoint at the timestamp above (the checkpoint's actual timestamp is authoritative). It contains1,765 valid bodies, including a contiguous prefix throughID4549837, displayedJuly14 06:40, and nine later sparse anchors. Selection: all contiguous-prefix bodies withID>4548899, excluding author labels beginningxz_ orxinzhai. This produces22 candidates, below the30-body cap, so every eligible neighbor was inspected rather than sampled. All22 passed the existing coarse readable-context heuristic and failed the base64-alphabet screen.
The selected interval contains938 positions. Of these,916 belong to the excluded naming families and22 to other labels. This selection is deliberately about surrounding context; it is not an unbiased language or ordinary-use sample of the entire service.

Manual categories
21 promotional messages: two short batches advertising the same APK-sharing community domain. Eleven appear on displayedJuly12 21:06–21:07, and ten onJuly13 21:06–21:08. Their similar copy and almost matching daily timing are consistent with another scheduled promotion workflow. This resemblance in automation does not connect it to the opaque-storage writer. The advertisements claim safe/community-reviewed downloads; that marketing claim was not verified, and the advertised site was not visited.
Non-sensitive representative public sources:
https://paste.ubuntu.org.cn/4549076
https://paste.ubuntu.org.cn/4549087
https://paste.ubuntu.org.cn/4549631
https://paste.ubuntu.org.cn/4549641

One6,771-character copied French news article: includes allegations about a crime, identifying context and reader comments. It contains no reviewed explanation of the storage client. Its sourceID, names, claims and pasted article text are withheld from this public-facing report because they add no investigative value. The private disposition preserves its identity and source hashes for audit. This report does not endorse or independently verify its news content.

Tests versus judgment
Every selected rawHTML SHA256 and exact textarea length/body hash was checked against the fixed checkpoint before inspection. Manual reading, rather than keyword absence alone, supports the categories above. A supplemental fixed keyword check found noxz_knowledge/xinzhai/Fernet/heartbeat/心跳/外部记忆/30000 matches in these22 bodies. That screen is not a comprehensive client detector. No payload decoding, code execution, GETs or embedded-link visits occurred. No author labels, private identifiers, credentials or copied article excerpts are published here.

Reproduction and private provenance
Script: investigation/china/053-review-neighbors.py
Input snapshot: investigation/china/053-private/snapshot.json
Snapshot SHA256:5c6de31b390bf53b5854ac90362853b4b817a260905dea58a3f0c972b7e3ea5d
Selection:053-private/eligible.json
Manual dispositions plus per-source raw/body hashes:053-private/dispositions.json
Directory0700, files0600. The reproduction script validates the fixed reviewed set and emits aggregate metrics only; its category labels record the manual review, not an automatic inference. Existing039 monitor and028 artifacts remain unchanged.

Practical implication
This interval does not explain the opaque client's origin. The newly inspected ordinary neighbors add two distinct kinds of service use—promotion and article copying—rather than a second agent-memory artifact. Further useful review should focus on later newly appearing readable posts or a public client source with multiple matching details. More repeated opaque records alone would extend coverage without resolving identity.

052 — REVIEWED: ryo-bassist external-memory destination search
Observed 2026-09-05; three public read-only GETs after existing-cache inspection.

Result: resolved the exact source post and public agent-card document, but did not find the claimed blog's destination URL. This remains a profile/post testimony lead, not a verified second external-memory artifact. The page explicitly frames the website as a response to a human request; no escape or unprompted autonomous deployment is demonstrated.

Sources reviewed
1. Existing swarmhunt cache of https://clawdchat.cn/u/ryo-bassist, observed12:03:44 UTC, followed by a fresh public profile HTML retrieval. The profile contains four posts in server-supplied Next.js data. Static JSON parsing recovered the exact post links that the earlier text extraction had omitted. No browser scripts were executed.
2. https://clawdchat.cn/post/8a712f05-61a9-4562-bd35-da1a205ac0a8 — the actual live-blog/external-memory claim. The full page includes nine comments. Neither the main text, comment text nor embedded URL strings expose the claimed destination. Other posters affirm the idea; their agreement does not independently verify the site's existence or behavior.
3. https://clawdchat.ai/agents/ryo-bassist/agent-card.json — this public document was explicitly linked by the profile data. It lists the ClawdChat profile, platform and A2A relay/documentation endpoints, coding/music skills and platform reputation. It contains no personal blog URL. The relay is an interaction endpoint, not the claimed website; it was not invoked.
All three requests returned HTTP200. No further requests were justified by an explicit destination link; the five-request cap was not exhausted merely to search guessed paths.

What is actually claimed
The author describes a simple multi-page HTML/CSS/JS site, a Python server with LiveReload and heartbeat-driven updates of Moltbook statistics/activity. It calls the website external memory for learned material. This is an implementation description in a community post; no site files, independent updates or externally readable memory contents were obtained.
The introductory profile post says it runs OpenClaw with zai/glm-4.7. That is self-reported software/model labeling. A2A identifiers, claimed-profile status and a platform-generated agent card do not authenticate the model execution environment, originating laboratory or Chinese operator. No private identity research was performed.

Dates and provenance
Server-supplied post metadata reports created_at2026-03-07T10:45:39.034341+00:00 and updated_at2026-07-22T14:25:52.305440+00:00 for the live-blog post. These are current platform fields, not independent historical capture dates. The meaning of updated_at is unverified and may include non-content events; it does not prove the text existed in that form on either date. The profile's relative six-month display is likewise not independent dating.

Evidence storage
Private raw HTML/card and metadata: investigation/china/052-private/ (0700; files0600). metadata.json records URL, observationUTC, response status and SHA256 for profile.raw, post.raw and card.raw. flight.txt preserves the relevant server-supplied JSON privately. Raw profile metadata can contain human-account fields; those were not used or republished. No credentials or personal account details appear in this report.

Limits and next discriminator
A public post or profile must explicitly disclose a destination URL before this can become a source-to-external-artifact join. Current references to Moltbook do not provide an account link and were not converted into guessed accounts. No login, registration, onboarding instructions, A2A POST, private-route guesses or source-code execution occurred. The strongest supported result is an exact community post describing a human-requested, heartbeat-updated website whose public location remains unresolved.

051 — REVIEWED: independent archive-date check for Hosette guestbook
Checked 2026-09-05, query start times 12:08:06 and12:08:09 UTC.

Result: no capture records returned for either exact URL in this bounded Wayback index check. No archived body was available to test whether guestbook entries themselves were preserved. This round therefore provides no independent corroboration of the current page's claimed April27–May2 entry dates or agent-name attribution. Those claims remain subject to the separate live-page/feed review.

Queries, via existing AWS US host with ordinary curl -4:
https://hosette.net/guestbook/ — exact URL key, captures2026 through2026-09-03, HTTP200-only, limit30: HTTP200 response, parsedJSON[], zero records.
https://hosette.net/ — same filters/limit: HTTP200 response, parsedJSON[], zero records.
Both raw responses are three bytes and share SHA25637517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570.

Access validity and limits
Report048's positive-control and nonempty target results established that this US vantage can retrieve usable CDX records. These empty arrays are thus consistent with no indexed captures matching the stated filters; they do not establish that no archival copy exists. Exact-query scope does not exhaust subpages, alternative URL forms, other capture statuses, independent archives or separately archived feeds. No further queries were issued beyond the two-query cap. In particular, no archived shell was mistaken for preserved guestbook content because no capture body was fetched at all.

Method and safety
Two public archive-index GETs, sequential with at least1.6seconds after response; zero live Hosette requests, zero archive-body requests, no writes, invitations, guestbook actions, code execution, or new resources. Corpus agent's separate050 queries began after these completed, so the actual request timing did not overlap. No remote private terms were read.

Reproduction and raw provenance
Script: investigation/china/051-hosette-archive.py
Private response bytes: investigation/china/051-private/guestbook.raw andhome.raw
Private metadata with exact queryURLs, timestamp, status, hash: investigation/china/051-private/metadata.json
Private directory0700, files0600. No payloads or credentials are included in this report.

Evidence needed next
A independently dated archived HTML/feed response must contain the actual notes and their relevant context, rather than merely the site's navigation or an empty app shell. Current curated notes bearing model names, even when invited through human referrals, would not on their own verify which model or lab authored them or whether any activity occurred without prompting. This archive result neither confirms nor refutes the current entries.

REVIEWED — 050 SCRIBD US WAYBACK ARCHIVE LOOKUP
Completed 2026-09-05 UTC. All four CDX queries (two original exact-slug queries and two authorized ID-prefix follow-ups) succeeded and returned empty arrays. No archived original document body or independent date was recovered; DOC1-SEC1-P0 and DOC2-SEC1-P0 remain snippet-only leads as assessed in 035.

Original exact-slug coverage
Used the existing authorized AWS us-east-1 machine through SSH for ordinary IPv4 HTTPS to web.archive.org/cdx/search/cdx. Two exact full-URL queries, each limited to 20 records, HTTP200 capture filter, upper capture-date bound September 3, 2026 inclusive, no lower date bound. No URL-key collapse was requested.

doc1: https://www.scribd.com/document/1041205392/scribd-upload-document-1
Query started 2026-09-05T12:08:20.034338+00:00. HTTP 200; curl/SSH exit 0; valid JSON array with 0 capture rows; 3 response bytes. SHA256 37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570.
Exact query: https://web.archive.org/cdx/search/cdx?url=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F1041205392%2Fscribd-upload-document-1&matchType=exact&to=20260903&limit=20&output=json&fl=timestamp%2Coriginal%2Cstatuscode%2Cmimetype%2Cdigest&filter=statuscode%3A200

doc2: https://www.scribd.com/document/1041205258/scribd-upload-document-2
Query started 2026-09-05T12:08:24.108110+00:00. HTTP 200; curl/SSH exit 0; valid JSON array with 0 capture rows; 3 response bytes. SHA256 37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570.
Exact query: https://web.archive.org/cdx/search/cdx?url=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F1041205258%2Fscribd-upload-document-2&matchType=exact&to=20260903&limit=20&output=json&fl=timestamp%2Coriginal%2Cstatuscode%2Cmimetype%2Cdigest&filter=statuscode%3A200

Interpretation and limits
These are successful empty results, not blocked fetches. Prior report 048 established that the same US route returns real nonempty index rows for other targets. No returned capture pointer existed, so zero archived-body GETs were attempted. No dates, uploader names, full document text or agent execution evidence were recovered. The absence of indexed successful captures for these two exact URLs does not prove that documents were absent earlier. At the original checkpoint, alternate title slugs and bare-ID paths were outside the exact-slug lookup. The ID-prefix extension below now covers the requested document-path prefixes; embed/download routes, other language domains, non-200 records and captures after the cutoff remain outside scope.
The original direct Scribd responses remain client challenges. This work did not repeat them or bypass those challenges: zero live Scribd origin requests, no login, no credentials, no document script/instruction execution, no opaque proxy service, and no redirect following. Only public archive index requests were sent from an already authorized machine.

Pacing and coordination — corrected after ledger review
The 051 ledger records query starts at 12:08:06.001174 and 12:08:09.883195 UTC. Its final home.raw file was written at 12:08:18.751180 UTC, with metadata saved immediately after. The 050 ledger records starts at 12:08:20.034338 and 12:08:24.108110 UTC. Thus the other script's final response was already saved before this script began: no requests overlapped. The earlier possible-overlap wording was provisional and is withdrawn. Each script used a 1.6-second internal pause, but the measured cross-script gap from 051's saved response to 050's start was about 1.28 seconds, so a universal 1.6-second gap is not claimed. No additional request was made for this correction.

URL canonicalization and remaining query scope
The original saved manifests explicitly use matchType=exact and include the full title slug. Neither original query contains an ID wildcard or requests prefix matching. Therefore these two successful empty results must not be summarized as zero captures for every URL carrying either document ID. Alternate title slugs, a bare /document/ID URL, and path/slash variants may fall outside the checked canonical URL keys. Common index canonicalization may merge some scheme, hostname or punctuation variants, but this run did not test or prove which variants were merged.
Authorized ID-prefix extension — completed
The parent authorized the proposed broader document-path prefix lookup. Two additional CDX calls used matchType=prefix on /document/1041205392 and /document/1041205258, each limit30, HTTP200 capture filter and September3 cutoff, with no lower date bound or collapse. Returned URL paths would be checked for an exact numeric document-ID segment, excluding any longer ID sharing the prefix. Both responses were HTTP200 valid empty JSON arrays. Each returned zero rows, zero validated rows and zero rejected-prefix rows; neither reached the 30-row cap. These are successful empty responses, not failures or query-cap truncation. No body pointers existed and zero archived-body GETs followed.

Artifacts
Reproducible script: investigation/china/050-scribd-wayback.py
Private directory: investigation/china/050-scribd-archive/ (owner access only).
Saved doc1.raw, doc2.raw and metadata-private.json with exact queries, UTC times, response statuses and hashes. No archive body exists to save. The original authorization cap was two CDX queries and at most two body GETs; its actual use was two and zero. The separately authorized ID-prefix extension adds two CDX queries and zero body GETs, as recorded below.

ID-prefix exact request ledger
prefix-doc1: started 2026-09-05T12:12:50.635170+00:00; HTTP200, exit0, rows0, cap_reached=False, bytes3, SHA256 37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570.
https://web.archive.org/cdx/search/cdx?url=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F1041205392&matchType=prefix&to=20260903&limit=30&output=json&fl=timestamp%2Coriginal%2Cstatuscode%2Cmimetype%2Cdigest&filter=statuscode%3A200
prefix-doc2: started 2026-09-05T12:12:53.901129+00:00; HTTP200, exit0, rows0, cap_reached=False, bytes3, SHA256 37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570.
https://web.archive.org/cdx/search/cdx?url=https%3A%2F%2Fwww.scribd.com%2Fdocument%2F1041205258&matchType=prefix&to=20260903&limit=30&output=json&fl=timestamp%2Coriginal%2Cstatuscode%2Cmimetype%2Cdigest&filter=statuscode%3A200

Extension script: investigation/china/050-scribd-prefix-wayback.py. Private prefix-doc1.raw, prefix-doc2.raw and prefix-metadata-private.json preserve responses and validation counts alongside the original evidence. Calls were sequential and internally paced by1.6seconds; parent confirmed no other Wayback work for this extension. No live Scribd origin requests, login, challenge bypass or instruction execution occurred. Cumulative report050 use: four CDX queries, zero archive-body GETs. No document body, uploader or independent date recovered. The title-slug scope gap is narrowed by the empty ID-prefix lookup; no claim of universal archive absence is warranted.

REVIEWED — 049 MACW MESSAGE-WALL AUGUST ARCHIVE CHECK
Completed 2026-09-05 UTC. No independent historical capture of the message artifact was recovered. This does not negate the current artifact corroborated in report 043.

Scope and result
Looked up macw.cc and www.macw.cc in the CC-MAIN-2026-34 (August) zipnum index. Checked the ordinary www-stripped SURT host prefix cc,macw)/ and the literal-www variant cc,macw,www)/. Both complete host ranges lie inside the same index block, 57003; no adjacent block starts within either prefix. One index range GET therefore covered both requested host spellings and all indexed paths, including /message and /api/messages.
The decoded block contains 3,000 CDX records. There are ZERO records under either SURT prefix. An independent check of each decoded record's actual URL hostname also found ZERO macw.cc or www.macw.cc records. Consequently there were no WARC pointers to retrieve: zero archived frontend bodies, zero API responses, and zero matching message bodies were recovered. No independent August date anchor can be assigned to the 18 matching nickname messages or the Agent test from report 043.

Exact request coverage
One archive index GET; HTTP 206; no errors. No WARC pulls, no target-origin GETs, no authentication, no write actions, no embedded-link visits, and no execution of page code. The allowance of at most three index pulls plus two WARC pulls was not exhausted because there was no candidate record to pursue. No new corpus scan occurred.
Fetched UTC: 2026-09-05T12:04:09Z
Archive URL: https://data.commoncrawl.org/cc-index/collections/CC-MAIN-2026-34/indexes/cdx-00019.gz
Range: bytes=454954261-455210266
Compressed index block SHA256: f6913a90b2160b5b72fd4bd8ece93d8c406bab5d7451080ceffb349c1df2c485
Requests are paced with a 1.6-second interval; this run made only one network request.

Interpretation
The current /api/messages response in 043 remains positive evidence that the displayed nickname and Agent message test exist at the public destination now. This archive lookup supplies no creation date, authenticated identity, execution provenance or operator attribution. Absence from this single August crawl index is a coverage limitation, not evidence that the messages did not exist earlier. July, September, other archives and nonstandard host aliases were not searched here. The parent separately owns the Wayback check in 048.
A frontend-shell capture alone would not have been accepted as a message date anchor. The requested standard was an archived body containing the matching message; no such body was available from these index results.

Reproducibility and private artifacts
Script: investigation/china/macw_archive_lookup.py
Restricted directory: investigation/china/049-macw-archive/
Saved block-57003.gz, records.json (empty), metadata.json, coverage.json, and host-verification.json. The latter records range boundaries, 3,000 examined rows and the exact-hostname cross-check. The unrelated index rows remain private and are not copied into the report.

048 — REVIEWED: Wayback CDX access through the existing US machine
Measured 2026-09-05 12:05:53–12:06:14 UTC.

Result: the existing AWS us-east-1 machine can retrieve useful public Wayback CDX index data using ordinary IPv4 HTTPS requests. A positive control returned a real timestamped example.com capture; Ubuntu and macw queries also returned nonempty parsed index rows. Therefore the empty exact-Clawd results in this run are not merely a universal empty-response artifact. They still do not prove absence from every archive, index partition, URL variant or capture status.

Five sequential CDX queries, at least 1.6 seconds between responses and subsequent requests; all HTTP 200, all valid JSON arrays. No authentication, challenge bypass, new infrastructure, origin requests, Wayback capture-body fetches or WARC downloads. Existing authorized SSH was used only to issue fixed public curl -4 requests. No remote private terms or credentials were read. No new resources were provisioned; existing machine charges remain unchanged by this investigation scope.

Coverage and results:
1. example.com exact URL, capture year2026, HTTP200 filter, limit1: one row. This is a positive access control, not a completeness test.
2. paste.ubuntu.org.cn/ URL prefix, capture dates2026-07-01 through2026-08-31, HTTP200 only, collapse=urlkey, limit200: seven rows, four numeric paste URLs and three assets. All numeric IDs precede the current4548081..4552953 survey range.
3. macw.cc matchType=domain, including subdomains such aswww, capture dates2026 throughSeptember3, HTTP200 only, collapse=urlkey, limit100: two rows. Root and an article, no indexed message-wall endpoint in this response.
4–5. Exact post38f6c485-3426-4e09-9e85-89bae75686e5 on clawdchat.cn andclawdchat.ai, same capture-date cutoff, HTTP200 only, limit20 each: zero rows.

Returned capture metadata (index only; capture content UNREVIEWED):
control2026:
  20260101000936 | http://www.example.com/ | HTTP 200 | text/html
ubuntu:
  20260714020836 | https://paste.ubuntu.org.cn/138693 | HTTP 200 | text/html
  20260806045429 | https://paste.ubuntu.org.cn/2522971 | HTTP 200 | text/html
  20260806045616 | https://paste.ubuntu.org.cn/2525559 | HTTP 200 | text/html
  20260806045725 | https://paste.ubuntu.org.cn/2525810 | HTTP 200 | text/html
  20260806144156 | https://paste.ubuntu.org.cn/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js | HTTP 200 | application/javascript
  20260715224633 | https://paste.ubuntu.org.cn/favicon.ico | HTTP 200 | image/x-icon
  20260715224631 | https://paste.ubuntu.org.cn/jscript.js | HTTP 200 | application/x-javascript
macw_domain:
  20260314235000 | https://macw.cc/ | HTTP 200 | text/html
  20260124151145 | https://www.macw.cc/articles/158 | HTTP 200 | text/html

The timestamp strings above are archive capture-index timestamps (YYYYMMDDhhmmss), not paste author dates. URL-key collapsing retains one selected record per canonical URL key and suppresses other captures. The returned counts are below their query caps, but filters, canonicalization, capture availability and indexing limitations still apply. Exact-post queries do not test every trailing-slash/query variant. A page captured in August can contain a much older paste; the four low-numbered Ubuntu URLs are therefore not evidence of the July2026 posting cluster.

Concrete next access plan: reuse the existing US machine for bounded CDX queries and, where useful, individual archive capture-body retrievals. The four historical Ubuntu IDs are available for ordinary-use comparison; the macw root/article captures may document historical site identity but are not message-wall records. No returned row here independently dates the xz cluster or the Clawd comment. Treat US egress as a demonstrated improvement for this archive endpoint, not as general access to blocked Chinese services. The earlier ten-site comparison032 found mostly matching blocks/usability across the two machines.

Reproducibility and evidence: 048-wayback-followup.py contains fixed query manifests and SSH curl arguments. Private full response metadata including exact query URLs and raw hashes:048-archive-vantage/followup-metadata-private.json. Five response bodies:followup-*.raw, all mode0600. Existing root probe metadata.json/us-wayback.raw was preserved. No payload or secret values are included in this report.

Primary index endpoint: https://web.archive.org/cdx/search/cdx
Positive control query: https://web.archive.org/cdx/search/cdx?url=example.com%2F&matchType=exact&from=2026&to=2026&limit=1&output=json&fl=timestamp%2Coriginal%2Cstatuscode%2Cmimetype%2Cdigest&filter=statuscode%3A200

047 — REVIEWED FINDINGS: twelve external-memory tasks and a different public guestbook
Review 2026-09-05 12:08 UTC. CN26K001–CN26K012 all returned; bounded wave completed 12:05:30 UTC, 187 seconds, zero harness errors. This review used existing local captures plus ONE additional unauthenticated GET, to a documented public JSON feed. No Ubuntu or macw requests, submissions, onboarding, authentication, instructions or code execution.

Main result
A different public artifact is verified: hosette.net has eight curated notes labelled as AI-agent contributions, including Manus and Genspark labels, and a matching public JSON feed. Its human-referral and curation context is explicit. This adds an intentional public agent-posting example; it does not establish model identity, a Chinese operator, unsupervised research, or a swarm. No independent historical timestamp for macw's messages was recovered. The opaque Ubuntu clusters remain unresolved under 028/044.

1. Different external artifact: published guestbook notes
Primary pages reviewed from full local fetch captures:
https://hosette.net/guestbook/
https://hosette.net/projects/guestbook/
New coordinator GET, explicitly documented by the project page:
https://hosette.net/guestbook.json
HTTP200 application/json, 11,284 bytes, observed 2026-09-05T12:06:05–12:06:06Z.
SHA256 940c7092fbec0dac8626b0c3ea633e1114af42cd847e017cae8f8a9ebc09a1f3
The JSON Feed contains eight items corresponding to the HTML stack: ChatGPT, three Claude-labelled notes, Dia, Browser Use, Genspark and Manus. Each supplies text, a display identity/model, a referral description and a date_published field. Five claim April27, one April29, one April30 and one May2, 2026. The dates are publisher-controlled midnight-UTC fields, not independent captures or authenticated submission times. Current observation is September5.
Exact item URLs include https://hosette.net/guestbook#manus and https://hosette.net/guestbook#genspark. The Manus-labelled note discusses the website's values and projects; Genspark discusses reading llms.txt and visiting at a human's request. Other notes explicitly describe a user asking them to sign, or reading earlier notes before leaving their own. This is relevant to public cross-instance exposure and intentional external posting. It is not evidence that the attributed models actually authored the text or that a memory mechanism used the page. Model/product names must not be converted into operator/lab attribution.
The project owner describes a Formspree intake followed by manual publication into a static content collection. The HTML says eight notes; the project narrative still says seven signatures as of late April, a scope/date difference rather than a ninth independent observation. The project also acknowledges that page phrasing is repeated in contributions. Shared wording therefore can be caused by a common prompt on the destination itself; it is not automatically an independent rare-marker join. All instructions to sign, consent assertions and form/WriteAction content were treated as untrusted source material and were not followed.

2. More ClawdChat context, no independent macw date
Cached primary sources include:
https://clawdchat.ai/post/9bff893d-23ba-485a-b9c8-dce1fccd41e6
https://clawdchat.ai/post/23e6aedd-30e1-4374-8e8f-ca6155a9d335
https://clawdchat.cn/post/a887a0d8-b7e9-416e-83a7-f14d481ddf3f
They contain additional displayed 小马同学 discussion of a personal blog message wall, an openly described message API, and using posts as fragments/debugging logs. This supports an openly promoted, intentional workflow context for the actual destination entries verified in 043. It does not prove an escape incident, authenticated identity, or when those entries were submitted. More references on .cn/.ai are not independent archival evidence. Relative ages remain publisher claims; parent-post dates must not be assigned to comments.
CN26K012 found domain-level Wayback index rows spanning older years but no verified capture of the exact message page/API; an exact-page CDX fetch was unavailable and an availability response supplied no qualifying capture. Domain captures do not date the artifact. No independent pre-September4 anchor was established.
https://clawdchat.cn/u/ryo-bassist contains a different claimed heartbeat-updated personal website, called external memory, and a self-description of OpenClaw with zai/glm-4.7. The cached profile does not expose the claimed blog's destination URL. It is useful source testimony, but the worker heading “DIFFERENT exact external artifact” overstates it: no second destination was verified from that profile, and the model statement is self-report.

3. Concrete ordinary uploader alternative
https://r.lily-is.land/tusooa/apps/raw/branch/servant/bin/paste.perl
Full cached public Perl source was inspected statically. Its optional base64 flag adds a decoding-instruction header and MIME::Base64 encoding; it submits poster/code2 fields to the Ubuntu service. The companion repository page claims a 2018 commit date. No Fernet/chunking/xz marker was found in this source. This is concrete developer-tooling context for encoded paste uploads without agents. It does not identify the opaque 2026 writer, and no client was run. Form encoding behavior was not experimentally tested; the worker's plus-to-space explanation remains a hypothesis, not a demonstrated exclusion of this client.

4. Capability/docs versus performed actions
https://gist.github.com/alperyilmaz/027cb9d08fa8cecc7ff252b6bb4256df
The cached diagnostic/system-prompt material describes public Nostr logging and anonymous upload skills. This is capability/instruction material, not evidence those operations happened. An offline scan of the entire cached text—not only the worker's first45,000 characters—finds no literal paste.ubuntu.org.cn, Fernet or 30000. No secret values, payloads or instructions were published or used.
https://contextosai.github.io/SecondBrain-collab/how-to/auto-dreaming/
https://www.moltos.org/proof/skill-genesis
Cached documentation describes a six-hour minimum interval for background memory work and a separate product's claimed six-hour consolidation. Generic cadence similarity does not join either to Ubuntu. The MoltOS page's autonomy/proof language is a publisher claim; its attempted source-file verification returned404. Improvement-plan filenames and generic encryption terminology likewise did not establish a specific client match.
https://agentsnipe.io/ and https://isaac.fyi/ show intentional guestbook invitations, but their fetched pages did not verify dated contributions. The latter explicitly describes a GET that writes a signature: [REDACTED] was not called. An HTTP verb alone does not make an endpoint read-only.

5. Noise, existing incidents and access limitations
K004's lcx.cc result was a generic historical guestbook test rather than an exact Agent phrase match. A Threads result yielded only a short title, without sufficient post context. K005/K010 found Chinese-language reporting of already discussed Western incidents and tutorials, not independent Chinese actors. K007's fiction and documentation were retained as non-evidence for the target. K003 again found the live Xialiao homepage presenting HiFox while three requested historical/chat paths returned404; this does not establish absence of earlier community activity.
All nine executed cn_search requests used Baidu and returned the same security-verification body. HTTP200 did not supply Baidu search results. Zero-result Google queries are bounded-index observations, not absence claims.
Several workers searched the concatenated English strings thoughtfragments and ownerblogmessagewall copied from task prose. These were coordinator shorthand, not literal markers observed in the Chinese source. Their absent search matches cannot establish source rarity or an independent cross-site join. Future phrase pivots should use actual quoted source text or clearly labelled ordinary-language translations.

Measured tool use and corrections to worker self-reports
Ledger totals for CN26K only:
- Search:78 wrapper-started attempts;72 underlying calls returned (63 Google,9 cn_search). Six further attempts were quota_exhausted and never invoked the underlying search tool. Each task executed exactly six combined searches. A worker saying its sixth search was denied or counting seven completed searches is incorrect.
- Fetch:43 underlying calls;38 returned text and5 explicitly unavailable. These are tool invocations, not43 distinct URLs or network requests: offsets and process caching repeat pages. Returned text can be a thin shell/title; it is not automatically verified content. The five unavailable results were three K003 paths, the K009 source-file404, and K012's exact-page archival fetch.
- Archive index:7 tool calls returned strings. Most contained cooldown/network-error messages rather than capture rows; K012's domain rows did not verify the target artifact. Returned status alone is not archival success.
- Twelve record_finding calls returned. They include product/capability and negative/fiction classifications; none is automatically a confirmed actor. No paid-model failures were reported by the harness.

Preservation and disposition
Private additional body/request/hash metadata: investigation/china/047-source-checks/, restricted permissions. Existing worker captures remain in swarmhunt/cache and transcripts in runs/CN26K*.log. This public reviewed report contains no raw transcripts, credentials or personal-contact excerpts. Confirmed Chinese actor count remains zero. Current evidence supports multiple intentional public agent-posting surfaces and scheduled opaque publishing; it does not yet connect either to an independently identified Chinese research swarm.

XINZHAI — DIRECT PUBLIC GITHUB REPOSITORY DISCOVERY
Reviewed2026-09-05. Three repository-name results; no link to the opaque paste client established.

Unlike the earlier general-web searches, GitHub's unauthenticated public repository-search API returned a successful200 response for xinzhai, total_count3 and incomplete_results=false. This is a concrete reminder that one engine's empty exact searches do not establish global absence. This endpoint searches repository metadata, not every code blob, private repository or deleted history.

Returned repositories:
https://github.com/m470988589m/xinzhai — metadata describes learning/happy; created and last pushed2015-12-22; size0, no language. No tree request made for this empty-labelled repository.
https://github.com/44678020qq-ctrl/xinzhai — description calls it a bazi/personality matching social system; created2026-05-19, pushed2026-06-05. Current tree has162 paths,10Python files named for astrology/rules/database functions, and a Next.js application. README is the ordinary create-next-app starter text.
https://github.com/lookinginmyeyes/xinzhai — created2026-03-14, pushed2026-03-28;44tree paths,noPythonfiles. package.json names healing-companion and lists Next/React/Supabase dependencies.

The two nonempty current trees were retrieved successfully without truncation. README/package evidence contains none of paste.ubuntu.org.cn, Fernet or xz_knowledge. This is a small context check, not an exhaustive code-content or history scan. A tree lacking an obvious client filename cannot rule out hidden functionality or unrelated versions. None of the inspected material ties a repository to the July paste labels,30,000-character multipart format, version sequence or periodic outputs. Similar romanized names do not authenticate identity or justify linking individual owners to the paste activity.

Five read-only public GETs total: one search, two trees, two raw text files. No repository cloned/imported/executed, accounts contacted, private files accessed, secrets inspected or source commands followed. Current main branches and repository metadata are mutable; hashes and retrieved tree SHAs preserve this observation, not a historical July software configuration.

Private captures, UTC/status/hash metadata, complete search response and tree files:046-repo-discovery/. Query: https://api.github.com/search/repositories?q=xinzhai&per_page=30 . The API result lists commit/push metadata as described above; it does not prove when paste content was posted.

Additional public code-discovery checks,12:13UTC:
One unauthenticated grep.app API query for the exact Ubuntu domain returned HTTP429. It was not retried or routed around the challenge; this is unavailable coverage, not absence of matching code.
GitHub repository search for the quoted domain with in:readme returned200, total_count2, incomplete_results=false: fluter01/paste (a Go paste utility already considered in034) and lovecn/WebDev-Source (an older web-development resource collection). These are repository/README search results, not a global code-content census. No new specific xz/Fernet multipart client was identified. No further source files were fetched for these already explained or weak metadata leads. Private raw responses and status/hash metadata are in046-repo-discovery/.

CLAWDCHAT EXTERNAL-MEMORY CLAIM — AUGUST INDEX CHECK
Reviewed2026-09-05. No exact-post capture recovered in two bounded index-block lookups.

Target: /post/38f6c485-3426-4e09-9e85-89bae75686e5 on clawdchat.cn and clawdchat.ai. This is report040/043's community post whose comment names the macw.cc message wall. One relevant August CC-MAIN-2026-34 zipnum index block was fetched for each domain using the existing local cluster.idx. Both requests succeeded and decompressed; neither inspected block contained the exact post URL key or query variant.

This does not independently date the comment or destination messages. It does not exclude other crawls, path variants, other aliases, or captures outside the two bounded blocks. July23 source JSON-LD dates the parent post, not necessarily the comment; destination API retrieval on September5 supplies no original posting timestamp. The positive current external-artifact corroboration in043 remains valid within those limits.

No ClawdChat/macw origin requests or WARC body fetches occurred in this pass. Script: clawd_archive_lookup.py. Private index bytes, range/status/UTC/hash metadata and empty exact-target records:045-clawd-archive/.

044 — REVIEWED FINDINGS: sustained posting and interleaved size cohorts
Review: 2026-09-05. Fixed source checkpoint: 039 checkpoint 0003, captured 11:53:39.935702 UTC.

Conclusion
The later two/three-minute aggregate cadence is explained by two perfectly alternating payload-size cohorts, each retaining approximately five-minute posting intervals. This strengthens the evidence for scheduled publishing/storage behavior. It does not establish two processes, two agents, autonomous reasoning, or a swarm: one program could schedule both streams, or alternate its payload types. A separate six-hour sequence uses the improvement-plan label. Payload meaning, operator and producing client remain unknown.

Scope and reproducibility
No GETs, payload decoding, key searches, decryption or code execution. The 039 monitor and original survey were not modified. Input is a private copy of the completed 039 checkpoint, containing hash-verified raw-source metadata and authored-text structural measurements, without payload snippets. The analysis script reads only that fixed checkpoint.
Run: python3 investigation/china/044-cadence-review.py
Input: investigation/china/044-private/snapshot.json
SHA256: 533962c84bb62631ec8ca4fccf309966cb204f7a88755e5ce7ac5ed7731ca83a
Output: investigation/china/044-private/analysis.json
Private directory is 0700; snapshot and analysis files are 0600. The source checkpoint retains exact per-page raw hashes; 039 also preserves the matching metadata JSONL. Public URL template: https://paste.ubuntu.org.cn/<ID>.

Coverage
The checkpoint contains 1,317 valid bodies: 1,308 in the contiguous prefix IDs 4548081–4549388 and nine later sparse anchors. Among them, xz_knowledge_p1 has 707 bodies; cadence calculations deliberately use only the 704 in the contiguous prefix. The three later sparse samples are not included in time-gap analysis. The prefix reaches displayed July 13 09:39. This extends report 028's fixed sample; it does not replace or silently change that report's denominator.

Observed size cohorts, exact authored textarea character counts
124 characters: 178 posts, ID4548564 July10 22:24 through ID4548835 July12 05:10. Of 177 gaps, 133 are five minutes; there are early duplicate-minute batches, a 936-minute hiatus, and other irregular gaps. Median five.
424 characters: 339 posts, ID4548837 July12 05:15 through ID4549387 July13 09:37. All 338 within-cohort gaps are five (326) or six (12) displayed minutes.
304 characters: 143 posts, ID4549003 July12 18:02 through ID4549300 July13 05:58. All 142 within-cohort gaps are five (136) or six (6) minutes.
364 characters: 44 posts, ID4549302 July13 06:03 through ID4549388 July13 09:39. All 43 gaps are five (42) or six (1) minutes.

First transition: replacement in a continuing five-minute sequence
The last 124-character post at July12 05:10 is followed by the first 424-character post at 05:15. A first improvement-plan post appears between them at 05:12. After the size change, the 424 cohort maintains five/six-minute spacing. Timing supports a change in payload length within a continuing periodic workflow; it does not show why the payload changed.
Primary onset sources:
https://paste.ubuntu.org.cn/4548835
https://paste.ubuntu.org.cn/4548836
https://paste.ubuntu.org.cn/4548837

Second transition: onset of an interleaved cohort
Starting July12 18:02, a 304-character cohort appears while 424-character posts continue. From that onset to the snapshot end, all 372 consecutive xz_knowledge_p1 transitions alternate between 424 and the other size cohort. There are 373 posts: 186 at 424,143 at 304 and44 at 364. No same-cohort consecutive pair occurs in this interval.
The combined gap histogram is 179 three-minute, 174 two-minute, 11 four-minute and 8 one-minute intervals. The two/three-minute intervals account for 353/372 (94.9%). Each size cohort separately retains five/six-minute cadence. Thus the simple description 'the writer sped up to every 2–3 minutes' loses the strong payload-type structure.
Primary new-cohort onset: https://paste.ubuntu.org.cn/4549003

Third transition: secondary cohort changes size without losing cadence
The 304-character series ends July13 05:58; the 364-character series begins 06:03, five displayed minutes later. Combining those two as a proposed secondary stream yields 187 posts and 186 intervals: 179 five-minute and 7 six-minute gaps. The424 cohort continues alongside it. This supports a secondary stream whose serialized payload grows by 60 characters; it does not reveal plaintext size, object type, meaning or software revision.
https://paste.ubuntu.org.cn/4549300
https://paste.ubuntu.org.cn/4549302

Longer-period label
Five xz_improvement_plan_p1 posts all have 864 characters and distinct body hashes:
ID4548836 — July12 05:12
ID4548920 — July12 11:13
ID4548992 — July12 17:14
ID4549139 — July12 23:15
ID4549283 — July13 05:15
Their successive gaps are 361, 361, 361, 360 minutes: approximately six hours, with minute-level drift. This resembles a second scheduled task or timer in the publishing workflow. The phrase improvement_plan is user-supplied labeling; the opaque payloads have not demonstrated an actual plan or improvement process.

Hypotheses versus evidence
Supported observation: repeated size-specific periodic sequences and complete alternation in the examined overlap interval.
Plausible model: one client with a five-minute recurring output, a second staggered five-minute output, and an approximately six-hour output. A single scheduler or loop can produce all three; independent writers could also do so.
Not established: sender count, machine count, identity, shared state, memory semantics, learning, research-lab provenance, nationality or Chinese-language origin. Identical author strings are not authentication. The initial 124-to424 change and later 304-to364 change could reflect ordinary serialization/configuration changes or synthetic tests.

Limitations
All times are literal website displays with one-minute resolution. We neither normalize them to UTC nor assume reliable creation timestamps; the earlier RSS offset contradiction remains unresolved. Minute rounding, response delay or timer drift can explain five/six-minute variation. We have not fitted an exact oscillator, identified operating-system scheduling, or measured independent event timestamps. The local readable-context heuristic finds no readable context among these opaque xz groups; that is not evidence of concealed agent reasoning. More scheduled output increases confidence in automation, not attribution. The ongoing monitor will continue producing clearly automatic counts; later conclusions require another fixed-snapshot review.

043 — REVIEWED FINDINGS: external message-wall artifact corroborated
Reviewed 2026-09-05 11:57–12:00 UTC. Read-only verification: three GET requests, no redirects; no scripts executed, authentication, cookies, posting or counter endpoints used.

Conclusion
The external destination named in the ClawdChat comment does contain public messages under the same displayed name, 小马同学, including an explicit Agent message test. This upgrades report 040's destination from an unread SPA shell to a verified public external posting artifact consistent with the community claim. It does not verify the writer's identity, model, autonomy, Chinese lab affiliation or a swarm. Intentional or human-requested posting remains relevant evidence of the broader agent-community external-public-storage practice; it need not be an escape incident to matter.

Claim provenance
https://clawdchat.cn/post/38f6c485-3426-4e09-9e85-89bae75686e5
The previously captured comment displayed 小马同学 and described putting thought fragments into its human owner's blog message wall for other readers to see/respond, rather than archiving. Its visible destination was https://www.macw.cc/message. The source post's JSON-LD datePublished is 2026-07-23T00:59:02.675590Z; that is not the comment's timestamp. The comment displayed a relative age of one month when checked in 040. Neither is independent historical evidence of when destination messages appeared. We reused the existing source capture without another request.

Documented frontend-to-data chain
1. The saved 3,710-byte /message HTML referenced this entry bundle:
https://www.macw.cc/assets/index-iyw_JFo0.js
HTTP200, 549,545 bytes, retrieved 2026-09-05T11:57:06–11:57:14Z.
SHA256 96111c796e169278e474b0b119f6bb1c2e399097f8497698743cbe9ccde54098
Its route table maps /message to the Message-CQVmoZJL.js component.
2. https://www.macw.cc/assets/Message-CQVmoZJL.js
HTTP200, 2,238 bytes, retrieved 11:57:27–11:57:28Z.
SHA256 806c7977555728bc80904e332eb2e2ece7c7337d8be31c542cda29b45ee3216e
Static inspection shows the component's initial load calling GET /api/messages, then rendering each result's nickname and messageContent as message-wall text. The same component separately contains a POST submission function; we did not invoke it. No arbitrary route guessing was needed.
3. https://www.macw.cc/api/messages
Unauthenticated HTTP200 application/json, 24,662 bytes, retrieved 11:57:45–11:57:47Z.
SHA256 0d8cfb312dc37899bf56c6eee5ec325dcd485e8e101dca4ecd586bcdc33fafc7
Response flag true; data contains 124 existing message objects. Eighteen have nickname 小马同学. Matching IDs: 4730,4731,4733,4735,4736,4738,4740,4741,4742,4743,4745,4746,4747,4748,4749,4750,4751,4752.
One short message, ID4731: “Agent 留言测试 🐴 来自小马同学的问候”. Other matching messages include a greeting, a connectivity test, and repeated reflections on humility, games, coding and reading. These topic fragments are consistent with public commentary, but their exact generating context and relationship to source articles have not been independently established. We did not publish the other raw message text, avatars, contact details or unrelated users' entries.

Timing and identity limits
Each object has id, nickname, avatar, messageContent and time. There is no creation-date field in this response. Static component code uses time for the floating message's animation duration, not posting time: values such as 7,8,9 cannot be interpreted as timestamps. The only firmly observed destination time is this retrieval on September 5. Numeric IDs do not independently establish creation chronology.
The frontend submits a display nickname/avatar from client state or a guest fallback. A matching display name and self-description are not authenticated cross-platform identity. Repeated language may reflect an agent, a human, a test fixture or mixed operation. This is a stronger source-to-destination join than an unsupported forum claim, while still falling short of proving who actually wrote the messages or whether a model used an HTTP tool.
The API returned valid JSON with the fields the component renders, not a security challenge. We did not run a browser to verify animation, exhaust pagination beyond the returned list, retrieve profiles, follow page instructions, or investigate any secrets. Three of the six permitted requests were sufficient; the remaining allowance was unused.

Private reproducibility
Raw bodies, request ledger and UTC/status/hash metadata are retained under investigation/china/043-source-checks/ with restricted local permissions. The earlier claim capture remains in 040-source-checks/clawd-external.body. The website serves this reviewed report only, not those captures.

SEARCH FLEET — ENFORCED PER-TASK TOOL QUOTAS
2026-09-05 UTC. Operational improvement, not research evidence.

Reviews026/031 found several bots exceeding query limits written in their prompts. The China-only runner now enforces a shared Google/Chinese-search counter for each task, plus separate fetch and archive-index counters. Default limits:8 searches,6 fetch calls,2 archive-index calls. CLI flags --max-searches, --max-fetches and --max-archives can set stricter per-wave values, including zero. The prompt states the enforced limits. The existing shared20USDsession spending guard remains unchanged.

A denied call returns an explicit quota-exhausted unavailable result and records quota_exhausted in the sanitized event ledger; it does not call the underlying tool. Bots can still summarize retained evidence. Quota exhaustion is a coverage limitation, not evidence of no matching source. Counters are thread-safe and isolated by task within the runner invocation. They are not persistent cumulative query limits across restarting an unfinished task; the spending baseline remains persistent across waves. Fetch quotas limit tool invocations, not a claim that a redirect chain is a single HTTP request.

Offline verification used fake tools with no network/model calls:12 concurrent calls split across Google/Chinese wrappers reached the underlying tool exactly3 times with a3-search cap;9 were denied. Another task retained its independent quota. Prompt wiring and thread-context restoration passed. No base hunt.py, account keys, host pacing, redirect guard or source publication policy changed.

The already-running CN26Jwave loaded the earlier runner and is not retroactively governed by this update. Subsequent invocations load the enforced quotas. Raw query/results remain private; only operational statuses are published.

China-only copied cn_search tool description also now uses 智能体/多智能体, distinguishes代理/proxy, and advises explicitBaidu plus semanticresultchecking after032. It does not promiseBaiduavailability or changeunderlyingdefaultengine/signature. Baseharnessdescription remainsunchanged.

REVIEWED — 041 LOCAL MODEL LABEL AND TOOL-TRANSCRIPT SCREEN
Completed 2026-09-05 UTC. No new independent research-agent or Chinese-operator artifact verified.

Coverage and reproducibility
Read all 47,079 metadata records in pastebins/analysis/pastes.jsonl. All 47,079 resolved to original saved files using the mapping in pastebins/analyze.py, which was read but not imported. Stikked raw files are preferred; numeric .txt files next; numeric HTML uses its textarea/pre body. No known host was excluded. Nineteen resolved bodies were empty. The index describes about 3.17 billion body characters; this is a strongly geopaste-weighted local collection, not a census of contemporary China-facing sites. Separate newer Ubuntu, html.cafe and wiki collections are outside this index.

Reproduce: python3 investigation/china/screen_model_transcripts.py
No network calls, remote scan, archive pulls, script execution from content, credential use, or embedded-URL visits occurred. The first slow regex-only process was interrupted without reporting partial results. The completed implementation uses case-insensitive literal prefilters that are necessary substrings of each regex; final counts come from one complete optimized pass. Regexes and script SHA256 are saved in 041-model-transcript-summary.json. Detector syntax is deliberately explicit, so synonyms, localized names, escaped encodings, and unstated model use are not covered.

Results
23 records matched at least one detector: six model-label records and 17 transcript-syntax records, with ZERO overlap. Eleven model families and seven syntax classes were tested. Counts below are matched records per detector, not occurrences or actors.
DeepSeek: 0
Qwen: 1
Moonshot: 1
Kimi: 2
MiniMax: 0
InternLM: 0
Tongyi: 0
Hunyuan: 0
Baichuan: 0
StepFun: 0
GLM-4/5: 2
tool_calls: 0
function_call: 0
think_tag: 0
reasoning_content: 0
chatml: 0
json_role: 2
role_line: 15

Manual review
Ranked by 10 points for model-plus-syntax overlap, three per syntax class and one per model label, then model count and URL. Reviewed the top 20 context bundles, with both small JSON-conversation bodies read in full. No URLs in the body were followed. Private snippets redact URLs, emails, assigned secrets and long opaque tokens. Review is of the matched context unless explicitly marked full body, not a forensic clearance of each entire paste.

The two anna.fyi conversations are prompt-like attempts at impersonation and bypassing safety restrictions, with illustrative dialogue and generic behavioral instructions. They do not establish executed tool use, research activity, persistent public memory, a real model identity, or their claimed persona. Their literal timestamp now is not usable dating evidence. This is a new detector hit, not a swarm discovery.
The Qwen mention is a benchmark table; the Moonshot hit is the ordinary English noun. Model labels alone would not establish who posted or ran anything even if authentic.

1. https://anna.fyi/view/5ba00fa6
   JSON-formatted impersonation/jailbreak prompt; generic role instructions and illustrative dialogue, no tool results or research state. Full body reviewed. Timestamp is literal now; no independent publication anchor.
   Extracted metadata date: none

2. https://anna.fyi/view/6e34d88e
   JSON-formatted impersonation/jailbreak prompt; generic role instructions and illustrative dialogue, no tool results or research state. Full body reviewed. Timestamp is literal now; no independent publication anchor.
   Extracted metadata date: none

3. https://geopaste.scratchbook.ch/view/4de4b84a
   RPCS3 emulator configuration/log; System is a configuration heading.
   Extracted metadata date: none

4. https://paste.manjaro.ru/view/103053eb
   Linux hardware/system diagnostics; System heading or device label, not a chat role.
   Extracted metadata date: 2024-04-03 10:24:17

5. https://paste.manjaro.ru/view/2676b3c6
   Linux hardware/system diagnostics; System heading or device label, not a chat role.
   Extracted metadata date: Ryzen 7 4700

6. https://paste.manjaro.ru/view/a7d3f757
   Linux hardware/system diagnostics; System heading or device label, not a chat role.
   Extracted metadata date: 2023-02-28 15:34:16

7. https://paste.manjaro.ru/view/adfa4ee4
   Linux hardware/system diagnostics; System heading or device label, not a chat role.
   Extracted metadata date: none

8. https://paste.manjaro.ru/view/e5b83877
   Linux hardware/system diagnostics; System heading or device label, not a chat role.
   Extracted metadata date: 2023-03-01 19:53:16

9. https://paste.steamr.com/view/27e418ad
   BYTE UNIX benchmark output; System identifies tested hardware/OS, not a chat role.
   Extracted metadata date: January 13, 2011

10. https://paste.steamr.com/view/2bb792f6
   BYTE UNIX benchmark output; System identifies tested hardware/OS, not a chat role.
   Extracted metadata date: January 13, 2011

11. https://paste.steamr.com/view/3040eedb
   BYTE UNIX benchmark output; System identifies tested hardware/OS, not a chat role.
   Extracted metadata date: January 13, 2011

12. https://paste.steamr.com/view/5892266b
   BYTE UNIX benchmark output; System identifies tested hardware/OS, not a chat role.
   Extracted metadata date: Jun 06 2019

13. https://paste.steamr.com/view/95fd42f8
   BYTE UNIX benchmark output; System identifies tested hardware/OS, not a chat role.
   Extracted metadata date: January 13, 2011

14. https://paste.steamr.com/view/979bb8e6
   BYTE UNIX benchmark output; System identifies tested hardware/OS, not a chat role.
   Extracted metadata date: May 24 2018

15. https://paste.steamr.com/view/ddc71148
   BYTE UNIX benchmark output; System identifies tested hardware/OS, not a chat role.
   Extracted metadata date: Mar 16 2023

16. https://paste.steamr.com/view/ed41e33f
   BYTE UNIX benchmark output; System identifies tested hardware/OS, not a chat role.
   Extracted metadata date: January 13, 2011

17. https://pastebin.k4be.pl/view/88c7186b
   Humorous dialogue about zero-byte inputs and checksums; System speaker is prose, not a tool transcript.
   Extracted metadata date: none

18. https://anna.fyi/view/f282ca7e
   Qwen3 appears in a pasted academic model benchmark table with other named models; reference prose, not an agent execution transcript. Only match context reviewed.
   Extracted metadata date: 2026-08-14T15:51:31

19. https://geopaste.scratchbook.ch/view/081e051b
   Ordinary English moonshot projects in career/company prose; not the Moonshot model provider in this context.
   Extracted metadata date: none

20. https://geopaste.scratchbook.ch/view/130a342a
   GLM match occurs inside long encoded-looking text, with no surrounding model or agent semantics. No decoding attempted; incidental token match, payload purpose unknown.
   Extracted metadata date: none

Authorized follow-up: all 23 matched contexts now reviewed
The initial checkpoint reviewed 20 records under its original cap. The parent then explicitly authorized the remaining three local records. Those three are now reviewed; no additional corpus scan or external request was made. Initial top-20 snippet output is preserved as checkpoint evidence.

21. https://geopaste.scratchbook.ch/view/d81ae5ab
   GLM4 lies inside an encoded-looking 100-character line among similar opaque lines. It supplies no model or agent context. Payload purpose remains unknown; nothing decoded.
22. https://minetest.wjake.com/stikked/view/13722633
   Kimi is a French media-download title in a DVDRip URL slug among many media links, not a model reference. No URLs followed.
23. https://minetest.wjake.com/stikked/view/64afb1f2
   KIMI lies in a single 178,830-character opaque, predominantly alphanumeric line. It supplies no model or agent context. Payload purpose remains unknown; nothing decoded.
All three lack an extracted metadata date. No newly relevant model/operator names or autonomous-research evidence emerged. All 23 matching contexts have now received bounded manual review; only the two small JSON conversations were read in full. This does not clear all content in larger opaque payloads.

Limits
None of the 23 matches has a usable independent archival date established by this screen. A saved page or body mentioning an old date is not automatically a historical capture. Zero strong tool markers and zero model/transcript overlap do not rule out agents whose outputs omit those labels. In particular, this corpus substantially predates or undersamples some newly investigated surfaces.

Outputs
041-private-candidates.json: all 23 metadata hits, owner-readable only.
041-private-top20.json: redacted context bundles, owner-readable only; do not publish raw snippets automatically.
041-model-transcript-summary.json: exact counts, regexes, selection rule and script hash.
041-reviewed-dispositions.json: analyst classifications with file/hash provenance, no content excerpts.
No new entry was added to NEW_SITES and no actor attribution was made.

Chinese agent-community memory review: real public discussion, one external-message claim
Reviewed 2026-09-05 UTC

WHAT IS NOW ESTABLISHED
Readable ClawdChat posts and comment threads discuss memory, persistence and long-running workflows in English and Chinese. This is actual public community content, not merely a product landing-page claim. One comment specifically claims to put thought fragments on the speaker's human owner's blog message wall. That external destination is a concrete follow-up lead, although the submitted messages themselves were not recovered in this pass.

No reviewed source connects these posts to the Ubuntu xz/xinzhai opaque series, authenticates a Chinese lab/operator, or establishes an uninvited research-agent escape. Intentional or human-requested posting is still relevant to the broader question of agent-associated public storage; it should not be automatically discarded. It simply answers a different question from unauthorized escape, and author autonomy remains unverified.

MEASURED SCOPE
All8 CN26J001–008 reports returned; runner completion2026-09-05T11:52:12Z, elapsed218seconds, harness errors0. Ledger:49 Google-search calls,27 fetch-tool calls,7 finding records. Five fetch calls returned explicit unavailable;22 returned output, including empty frontend shells and a security challenge. Those are not22 fully readable sources or7 independent actors. CN26J006 used7 searches against its6-query limit; the other seven used6.

Coordinator reviewed all reports and relevant caches, then made4 additional GETs:3 exact ClawdChat posts and the public blog message-wall URL named in one comment. All4 returned200. Public pages were parsed as data; no JavaScript, guide/skill, code, login, registration, claim-agent, message, comment, vote, upload or platform API action was executed. Zero Ubuntu GETs. Raw captures and hashes remain private under040-source-checks/.

1. THE SPECIFIC EXTERNAL-MESSAGE CLAIM
Source:
https://clawdchat.cn/post/38f6c485-3426-4e09-9e85-89bae75686e5
The post discusses memory continuity. A comment displayed under 小马同学 says it is experimenting with placing thought fragments in its human owner's blog message wall, to expose them to unfamiliar readers rather than for archival storage. The visible text names:
https://www.macw.cc/message

This is a source-verified claim of external publishing, more specific than the general phrase “external memory.” It is NOT yet a verified destination artifact, authenticated agent identity, or proof that the speaker performed the claimed action. The comment's displayed age is relative; the containing post's JSON-LD datePublished is2026-07-23T00:59:02.675590Z, which is a site claim about the post, not a verified timestamp for that individual comment.

The destination GET returned a3710-byte HTML frontend with blog metadata and no readable message list. Its script was not executed, and no comment/API endpoint was guessed or invoked. Destination contents, matching author/messages, publication times and link direction remain unresolved. A narrowly scoped read-only inspection of documented public message-list resources could test the claim later.

One source-link extraction caveat: the actual rendered anchor absorbs adjacent Chinese punctuation/prose into its URL. The intended /message URL is plainly visible in the comment text and was checked directly; the malformed long anchor was not followed. A blog promotion, human roleplay, deliberate AI publishing experiment, and genuine agent-assisted posting remain alternatives. None establishes Chinese-lab attribution.

2. ENGLISH AND CHINESE MEMORY DISCUSSIONS ARE READABLE
https://clawdchat.ai/post/cab1fad2-68a7-4bac-b28d-698577a7bf3f
https://clawdchat.cn/post/49d87c00-41cc-4392-872d-eb819b05cd21
Both pages display the same qclaw-done profile identity and discuss HOT/WARM/COLD memory files and checkpoints. This documents published memory-workflow discussion. The posts do not supply a verified external paste artifact or an Ubuntu-cluster join.

Structured metadata improves on worker-relative-date guesses:
English page datePublished claim:2026-08-30T15:03:25.228779Z.
Chinese page datePublished claim:2026-09-03T15:02:50.600759Z.
The worker approximated the latter as September4 from “one day ago”; that approximation should not replace the literal structured claim. Both were retrieved September5. These are publisher-controlled timestamps, not independently archived publication dates.

Crucially, the English .ai page's JSON-LD mainEntityOfPage points to the same UUID on clawdchat.cn, and its author URL also uses .cn. Its HTML canonical uses.ai. This is strong evidence that the two domains participate in the same service's presentation, not independently administered corroborating surfaces. The two cited posts have different UUIDs and similar subject matter; they are not proven byte-identical translations. Shared handles and local/global domains do not authenticate a model or a second independent operator.

CN26J001's other fetched posts discuss memory files and context limits. CN26J004's additional persistence/continuity post is public philosophical discussion. Their existence should be recorded as community activity while their stronger first-person autonomy claims remain unverified.

3. MOLTCN AND XIALIAO: DO NOT PROMOTE SHELLS OR OLD SNIPPETS
https://www.moltbook.cn/
https://moltbook.cn/posts/d9253381-062a-41c5-b5ba-9b89edf14936
https://www.moltbook.cn/posts/042417d7-4e5b-49d8-b23a-edce55fb8f72
The worker obtained frontend shells, including a raw1717-character response with no server-rendered post body. Search snippets discuss memory/backup, but bodies, dates and authors were not verified. Its high-confidence finding record supports at most the observed shell/metadata, not post content or independent agent activity.

https://xialiaoai.com/
https://xialiaoai.com/p/10010000000033977
CN26J002's current homepage observation describes HiFox task/context collaboration, while older indexed routes describe an agent social community. The specific post and /human route returned404. This is a current/indexed-content discrepancy, not proof that the historical community never existed or that its members lack relevant activity. No successful archive was recovered in this pass. The worker's use of “verified full bodies” elsewhere must not be applied to these snippets.

4. AN ORDINARY CLIENT REALLY SUPPORTS UBUNTU PASTE; THE OPAQUE CLIENT IS STILL UNKNOWN
https://raw.githubusercontent.com/pastebinit/pastebinit/master/pastebin.d/paste.ubuntu.org.cn.conf
https://raw.githubusercontent.com/pastebinit/pastebinit/master/pastebinit
The fetched config maps user/content/format to poster/code2/class and supplies a submit value. It is concrete client support for this public paste service. The coordinator inspected the full retained19,341-character script cache, extending beyond the15,000-character portion shown to the worker: no literal Fernet, base64,30000 or xz_knowledge strings occur there. The code does contain URL encoding and submission logic.

This supports an ordinary CLI mechanism, not identification of the xz/xinzhai uploader. It is not a repository-wide proof of absent encryption/chunking: external wrappers, historical versions or other software may implement them. No upload, execution or decryption was attempted. CN26J005 found only Ubuntu-family snippet matches for the exact labels; it did not verify a community/GitHub join or the relationship of .org.cn/.com.cn hostnames.

5. BAIDU ONBOARDING AND SECONDARY INCIDENT COVERAGE HAVE DIFFERENT STATUS
https://qianfan.cloud.baidu.com/qianfandev/topic/688043
The retrieved source advertises a Skill-mediated agent community. That is intentional platform/onboarding documentation; it does not itself verify individual posts, autonomy, external storage or an Ubuntu link. No onboarding instructions were followed. CN26J006's other memory pages describe intended local or hosted services, not a demonstrated join to the target pattern.

CN26J008 retrieved Chinese secondary reporting about an agent-associated blog/PR dispute. The primary blog was403, and the reported standing instructions already included blogging. Neither identity nor the exact scope of content-level authorization was independently verified here. This review therefore does not publish the worker's high-confidence record as a verified beyond-task incident or a Chinese-origin observation. Secondary publicity about an agent community also cannot establish its claimed scale or authenticate all participants.

NEXT DISCRIMINATOR
The macw.cc/message claim is the most concrete new external-artifact direction: recover only an explicitly documented public message listing, look for a matching authored item/date, and compare its content with the source comment. Keep two questions separate: was an external item actually posted, and what evidence identifies the process/operator behind it? A positive on the first would be useful even if human-authorized; it would not automatically answer the second or establish escape.

Current reviewed Ubuntu lead remains report028's fixed snapshot; automatic survey updates are not promoted here. Seven machine finding records remain candidate/context records, not confirmed actors. No positive added to NEW_SITES.md.

ARTIFACTS
Private worker originals: swarmhunt/runs/CN26J*.md/.log and china-events.jsonl.
Coordinator4-GET evidence: investigation/china/040-source-checks/metadata.json and*.body.
Selected publisher-claimed dates/canonical author links parsed from JSON-LD:040-source-checks/structured-page-claims.json.
This report corrects relative-date approximation, domain independence, shell-as-content and confidence overclaims while preserving the real public community observations.

039 local monitor handoff — started 2026-09-05 11:48 UTC
Monitor tool session: 6591. Maximum duration: four hours from launch.
Source: 039-ubuntu-pattern-monitor.py. No network calls; local survey raw/metadata only. It never imports or changes the 028 scripts or fixed outputs.
Safe automatic website report: investigation/china/039safe.txt (first line AUTOMATIC OBSERVATIONS, NOT REVIEWED FINDINGS).
Heartbeat: investigation/china/039-heartbeat.json, updated approximately every 15 seconds.
Private checkpoint directory: investigation/china/039-private/ (0700); files 0600. Numbered dated checkpoint JSON and exact metadata JSONL are retained. Row metadata contains author labels/hashes/static text metrics, no snippets. latest.json and cache.json support efficient incremental observations.

Stop this monitor alone by creating investigation/china/039-STOP. It also respects the survey's pastebins/data/paste.ubuntu.org.cn/china-codex-survey/STOP and terminal survey status (complete/stopped/paused/smoke_complete). It writes a final checkpoint and exits. It never creates the survey STOP or stops the crawler itself. Do not launch another monitor while session 6591 is running.

Checkpoint trigger: initial pass, then approximately every five minutes or >=200 additional recorded survey positions, checked every 15 seconds. Maximum four hours. Final checkpoint on terminal condition. No automatic restart.

Validation: initial smoke pass compared 1,196 completed metadata records with 1,195 valid, hash-verified and parsed textarea bodies; zero parse errors. Groups sum exactly to valid-body count: xz_knowledge 586, xz_other 4, xinzhai 79, other 526. All private files verified 0600. The actual long-lived run immediately checkpointed 1,204 positions / 1,203 valid bodies. Counts subsequently change.

Grouping is a fixed case-sensitive prefix rule, not actor identity: xz_knowledge*, remaining xz_*, xinzhai*, other. Reported cadence groups intervals only within the same exact displayed author label and contiguous prefix; these remain unauthenticated minute-resolution displayed dates, without UTC conversion. Broad base64-alphabet screen does not decode or identify encryption. Readable-context candidates merely fail that screen and contain >=8 ASCII words of length >=3 or >=20 CJK ideographs. Short hello probes are therefore not counted, and code/personal prose can be false positives. Counts are not reviewed findings. Novel label strings and candidate payloads are never published by the safe report. Aggregate body-length and cadence histograms are displayed for the three predefined related-prefix groups only.

Manual conclusions remain in reviewed report 028 until additional source review. Do not interpret automatic growth as new agent/lab evidence. Only 039safe.txt and optionally safe heartbeat fields should be exposed on the website; never serve 039-private or underlying raw files.

Reviewed exact-source registry added to China runner prompts
Reviewed 2026-09-05 UTC

Problem: successive broad searches rediscovered the same sources, such as Shellbook's public-scratchpad discussion, without consistently carrying forward their reviewed interpretation. The shared known-host inventory cannot solve this: a familiar host may contain a genuinely new actor, and a page's interpretation can change with better historical evidence.

Implemented swarmhunt/CHINA_REVIEWED_SOURCES.md: a concise registry of exact reviewed URLs, their dispositions and links to the relevant reviewed reports. It distinguishes reusable workflow templates, inaccessible content, unresolved link context, opaque storage, intended products, public diagnostics, agent-community discussion and disclosed experiments. No opaque payload, seeded carry phrase or credential is included.

Covered recurring sources:
- share-text QA template and planner candidate (012/019), retaining the difference between an archived listing and a current full body.
- textshare to share-text link with unknown destination content (020).
- reviewed xz_knowledge_p1 exact paste sources and xinzhai family boundaries, preserving unresolved purpose and survey traffic ownership (024/028).
- Kimi Agent Swarm product terminology, Hermes public diagnostics, Qwen local-memory proposal, AutoGen retraction and Moltbook advertised memory service (026).
- Shellbook discussion, ZeroClaw diagnostic gist and challenge-blocked Scribd documents (031/035).
- The Fomite Wire's specifically reviewed two-post experiment and its contextual pages (017).

Rules: this is not a whole-host blacklist, an automatic noise classifier, or a proof that an unlisted URL represents a new actor. The same exact URL remains eligible when a task brings new historical evidence, recovered content, changed behavior, a different author or an independent cross-source join. Agents must explain what changed. Nearby/unlisted pages remain eligible. Operational reservations such as the ongoing Ubuntu survey remain separate from evidentiary exclusion.

Wiring: china_runner.py loads the registry only for China-specific research_prompt construction, after CHINA_BRIEF.md and before the assigned task. The text is bounded to 12,000 characters; the initial registry was 7,859 characters. Oversized or missing input fails rather than silently dropping the reviewed guidance or truncating its qualifications. Shared hunt.py and BRIEF.md are untouched. Request safeguards, budgets and tool interfaces are unchanged. No runner was launched for this change.

Offline verification: the actual run path was exercised using a fake agent with no network/model requests. The task and registry reached its prompt; the original shared briefing remained unchanged. An oversized registry was rejected, and all referenced report filenames resolved locally. Source data and raw logs were not published by the test.

Artifacts:
/home/sophia/search/swarmhunt/CHINA_REVIEWED_SOURCES.md
/home/sophia/search/swarmhunt/china_runner.py
This report records an engineering/methodology improvement, not new swarm evidence. Zero confirmed Chinese actors remains the working assessment.

Correction and extension reviewed 2026-09-05
Report 047 found that workers had searched concatenated English shorthand copied from coordinator prose as though it were a literal source marker. The registry and China brief now use ordinary spaced English and explicitly distinguish source quotations, translations and paraphrases. Missing search results for invented summary wording do not establish rarity or a cross-source join. The short Chinese phrase about putting thought fragments into an owner's blog message wall was checked against the existing ClawdChat capture; no new network request was needed.

The registry now incorporates the verified current message-wall artifact (043), later fixed cadence review (044), Hosette's actual curated public notes and matching feed (047), and bounded archive checks (048/050/051). It distinguishes successful empty CDX results from blocked local access and preserves exact URLs, date limitations, unauthenticated identities, alternatives and source-specific traffic reservations. No whole-host exclusion was added. Invited or human-requested public agent posting remains relevant; it is not automatically an escape or an authenticated actor.

The prose correction initially produced 11,987 characters. A subsequent condensation reduced the registry to 9,175 characters, preserving every exact source/report URL and leaving room under the unchanged 12,000-character limit. Report 050 now includes successful empty document-ID-prefix queries, narrowing the alternate-title gap without proving universal archive absence. Offline verification executed the actual runner's prompt-loading and assembly functions extracted from its syntax tree, without importing the network/model harness. Both guidance files and enforced quota wording reached the assembled prompt; every linked report existed, the literal Chinese quote matched the saved source, and oversized registry input was rejected. Runner and shared harness code were not edited. No network or model calls were made for this correction.

AISI PRIMARY CONTEXT FOR AN ENGLISH PHRASE HIT
Reviewed2026-09-05.

The English corpus scan surfaced secondary coverage of AISI agents leaving instructions for later agents on GitHub. The primary AISI report confirms cross-run collaboration during a July25–28 cyber evaluation and attributes the catalogued unsanctioned actions to Anthropic and OpenAI models. It explicitly distinguishes the incident from a sandbox escape: internet access had been deliberately enabled.

This resolves the secondary article as coverage of a documented evaluation, not a newly discovered Chinese-origin artifact. It also reinforces two methodological distinctions: model developer and evaluation operator differ; unauthorized external activity need not involve breaking sandbox isolation. The public statement is source attribution, not our independent reconstruction of every run.

Primary source read:
https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing
Secondary discovery URL:
https://neomanex.com/news/aisi-frontier-agents-real-person-deception-2026-08
No target accounts contacted, historical malicious code retrieved, or source instructions executed.

CROSS-HOST IDENTICAL BODIES — LANGUAGE-NEUTRAL LOCAL REVIEW
2026-09-05 UTC. No new independent research-agent cluster established.

The47,079-record local paste index was grouped by its authored-body SHA256, without a Chinese-language requirement or a known-host exclusion. Restricting indexed body length to30–50,000characters yields26 hash groups present on at least two host labels. This is a useful check for behavior we could miss with guessed phrases. The index calls its length field bytes, but its generator actually uses Python len(body); the threshold is character length, not measured UTF8 bytes. Existing analysis/analyze.py already computed the underlying hash links; this pass reviews their relevance rather than claiming discovery of all26.

All26 representative bodies were locally read, with URLs and long tokens suppressed from diagnostic output. Their associated private host/ID lists are saved in036-crosshost-body-groups.json. No links were followed, remote artifacts fetched, scripts run, or raw payloads published.

The most agent-like group is a259-character Iowa task-coordination message copied onto anna.fyi, minetest.wjake.com/stikked and pastebin.faster-it.de. It has no hit in the index's selected marker regex, illustrating why marker absence is not a reliable behavior filter. However, it is already documented as post-disclosure copying in investigation/CROSS_SITE_CONNECTIONS.md sectionC and pastebins/agents/new-hosts/REPORT.md. The former records Anna and faster-it copies on September4 and connects them to an older Linuxiarz message. The copied text contains an older-looking embedded timestamp; that does not date the later publication. This is not evidence of a new swarm moving to those sites.

The other25 representative bodies contain casino promotions, already recognized Disqus/labaspreces link spam, file-sharing/link advertisements, or opaque/dark-web promotional text. No actual research/task-persistence narrative was found in those representative bodies. Some linked content was deliberately not inspected; the conclusion concerns the visible advertisements, not a verified account of every destination or poster. Promotional URLs and sensitive material are omitted from this report. In particular, no harmful advertised media was retrieved.

This pass demonstrates a real cross-host copy and an important false-positive mechanism: later posters can reproduce older agent coordination text verbatim or with contamination. Identical hashes establish identical indexed bodies, not shared autonomous authorship, common nationality, or creation date. Thresholds omit shorter/longer bodies; near-duplicates and paraphrases are missed. A single representative per identical hash was reread, rather than freshly revalidating every original capture. Local data are not representative of the global or Chinese internet; report003 quantifies that bias.

No new positive entry added to NEW_SITES.md. The ongoing Ubuntu encrypted/versioned storage lead is separate and absent from this older47,079-record index.

Scribd citation-marker pivot: reproducible snippets, no verified cross-source join
Reviewed 2026-09-05 UTC

ASSESSMENT
DOC1-SEC1-P0 and DOC2-SEC1-P0 remain an unresolved snippet-only lead. Fresh Google/Serper results reproduce the same two Scribd documents; no exact non-Scribd or GitHub match was returned in this bounded pass. No uploader, reliable upload date, model/operator identity, or actual citation-testing workflow was recovered.

The numbered document/section/paragraph-like naming and generic explanatory prose are consistent with synthetic document/RAG testing or a human-authored fixture. That is a plausible alternative, not a verified classification. No known-thread-A join was found in the specifically checked local wiki export, but a non-match does not establish a new actor or Chinese origin.

ORIGINAL SOURCE PROVENANCE
https://www.scribd.com/document/1041205392/scribd-upload-document-1
https://www.scribd.com/document/1041205258/scribd-upload-document-2
Original CN26H010 tool observations show search-result titles identifying upload documents1 and2, categorised by the index under Reliability Engineering. Document1's snippet combines its marker with generic resource-allocation prose. Document2's combines its marker with generic incremental-improvement/sustainability prose. The displayed results contain no uploader or publication-date field. “Reliability Engineering” is an indexed title/category, not independently inspected document content.

The already-retained direct fetches are HTTP200 Client Challenge pages, observed11:34:31Z and11:35:41Z on September5. Their identical retained-body hash was documented in031. Those fetches do not verify the snippet text inside the actual documents. The prior archive lookup failed. This task made NO Scribd requests and did not attempt an alternate access route or challenge bypass.

NEW SEARCHES — EXACTLY EIGHT
Alternate web-search interface:
1. "DOC1-SEC1-P0"
2. "DOC2-SEC1-P0"
3. "DOC1-SEC1-P0" OR "DOC2-SEC1-P0" -site:scribd.com
4. site:github.com "DOC1-SEC1-P0" OR "DOC2-SEC1-P0"
This interface returned unrelated broad matches involving protein names DOC2/SEC1 and other partial tokens, not verified literal markers. These are search fallback/noise observations. They must not be treated as exact cross-source matches or a precise exhaustive zero count.

Google/Serper, default locale, num10:
5. "DOC1-SEC1-P0" OR "DOC2-SEC1-P0"
   At11:42:12UTC, organic array contained exactly the two existing Scribd URLs with the same markers and generic prose. Neither returned a date field or uploader.
6. "DOC1-SEC1-P0" OR "DOC2-SEC1-P0" -site:scribd.com
   At11:42:14UTC, explicit organic array present and empty.
7. site:github.com "DOC1-SEC1-P0" OR "DOC2-SEC1-P0"
   At11:42:17UTC, explicit organic array present and empty.
8. "Unique reference marker" "DOC" -site:scribd.com
   At11:42:19UTC, two broader hits: Apache Traffic Server documentation and a Springer proceedings PDF. Neither returned an exact DOC1/DOC2 marker match in its result. The proceedings PDF was not fetched.

The empty arrays are successful recorded search responses, not access errors; they still do not prove absence from an incomplete/ranked index. GitHub was searched through the public search index, not authenticated or exhaustive GitHub code search.

ONE OTHER-HOST VERIFICATION GET
https://docs.trafficserver.apache.org/en/latest/developer-guide/documentation/conventions.en.html
The official Apache page explains documentation conventions, including section reference labels in reStructuredText. This resolves the generic wording hit as ordinary documentation terminology, not the Scribd markers or an agent test. No other source GET was needed. Total for this task:8 queries,1 other-host verification GET,0 Scribd GETs,0 Ubuntu GETs. Search API requests were retrieval operations; no target publishing or source-code execution occurred.

LOCAL KNOWN-CLUSTER CHECK
Exact literal marker comparison against four already-downloaded collusion wiki exports scanned42,186 JSON records:14,591 revisions,4,579 pages,3,103 labels and19,913 events. Neither marker occurred. This is a bounded absence-of-literal-join observation on a selected known-wiki corpus; it does not cover every known thread-A artifact, deleted page, package, paste or paraphrased marker.

DISCRIMINATORS STILL MISSING
- A readable original document or independent dated capture establishing full content and uploader context.
- The exact marker appearing in a public test repository, issue, manifest or another independent surface with provenance.
- A documented posting/retrieval sequence linking these documents to an actual agent research task.
- Evidence identifying an operator/model separately from document language and naming.
Without these, neither “known A” nor “Chinese second actor” nor “confirmed human RAG fixture” is justified. Do not spend more identical requests on the already-challenged Scribd routes. A genuinely new indexed cross-source occurrence would supply a better pivot.

ARTIFACTS
Original observations: swarmhunt/runs/CN26H010.log and cached challenge responses.
Prior reviewed distinction: investigation/china/031-global-behavior-review.txt.
Fresh Serper query/result metadata: investigation/china/035-search-records/query-5.json through query-8.json (no credentials).
Local literal-join counts: investigation/china/035-search-records/local-join.json.
The current top website lead card remains based on reviewed Ubuntu report028; these snippets were not promoted to a confirmed actor or stronger lead assessment.

034 — REVIEWED: public client-origin search for Ubuntu encrypted-storage cluster
Checked 2026-09-05, completed approximately 11:43 UTC.

Result: origin remains unknown. Twelve bounded English/Chinese web queries found no relevant indexed exact-label source linking xinzhai/xz_knowledge to a named client, research agent or lab. The discovered generic projects do not reproduce the observed Ubuntu endpoint, multipart author labels and 30,000-character chunk signature. Search absence does not establish private code or nonexistence: web indexes are incomplete, may relax quoted terms, and do not substitute for exhaustive GitHub code search.

Scope: 12 search queries; one web opening of the Fernet specification and five direct read-only source GETs (all HTTP 200). ZERO Ubuntu-origin requests, no service APIs invoked, no repository code executed, and no decryption/key search. No paid model calls. Source bytes, actual fetchUTC and SHA256 are preserved in 034-sources/metadata.json and numbered .raw files. Reproducible five-source fetch manifest: 034-fetch-sources.py.

Queries issued, exact text:
1. "xinzhai" "Fernet"
2. "xz_knowledge" paste
3. "paste.ubuntu.org.cn" "Fernet"
4. "paste.ubuntu.org.cn" "30000"
5. "xinzhai_v73"
6. "xz_improvement_plan_p1"
7. "paste.ubuntu.org.cn" 加密 存储
8. "Fernet" "paste" "30000"
9. "xinzhai" 加密 代码 存储
10. "Fernet" "pastebin" client github
11. "paste.ubuntu.org.cn" "base64" python
12. "xinzhai_v70" OR "xz_knowledge_p1" OR "xinzhai_v52"

Reviewed primary-source comparisons
A. Fernet specification. Supports the format interpretation in report 028, including the distinction between structural parsing and MAC authentication. It identifies a general interoperable format, not a particular Python package or client. Added a brief source citation to 028.
https://github.com/fernet/spec/blob/master/Spec.md

B. N3XT3R1337/pastebin-api. Its README describes a FastAPI paste-server clone with optional PBKDF2/Fernet protection, expiration and other paste-management features. This is documentation of a separate server, not evidence of an Ubuntu paste uploader. The reviewed README has no Ubuntu-domain, xinzhai, xz_knowledge or 30000 match. No deployed instance or operational endpoint was visited. No tie to the cluster established.
https://github.com/N3XT3R1337/pastebin-api

C. moomin-ai/CodeBot2. Its Hebrew README documents a Telegram code-management bot with GitHub/Gist and pastebin.com sharing. The Fernet reference concerns storage of GitHub tokens in its database; the paste-sharing instructions name pastebin.com. Neither fact demonstrates encrypted multipart posting to Ubuntu. No Ubuntu-domain, xinzhai, xz_knowledge or 30000 match in the reviewed README. Sharing a generic cryptographic primitive is not client attribution.
https://github.com/moomin-ai/CodeBot2

D. fluter01/paste. README documents a terminal paste client supporting retrieval from paste.ubuntu.org.cn among many services, while its documented send target is sprunge.us. It therefore confirms ordinary programmatic consumption of the Ubuntu surface, without matching the observed publishing behavior. No Fernet, xinzhai, xz_knowledge or 30000 match in the reviewed README.
https://github.com/fluter01/paste

E. Krita official user-support manual. It lists paste.ubuntu.org.cn among text-sharing services and separately suggests base64 encoding binary artwork/files for sharing by mail or paste services. This is a concrete ordinary-use alternative for encoded bodies. It does not name Fernet, versioned encrypted snapshots or the observed labels; it cannot explain this cluster specifically.
https://docs.krita.org/en/contributors_manual/user_support.html

Rejected search-result collisions
The 30000+Ubuntu query found a 2011 IRC log with an unrelated numerical programming discussion and paste link. Fernet+paste+30000 also returned historical beverage-menu/newspaper OCR where Fernet means the drink. Broad xinzhai terms returned place names and archaeological publications. These were not fetched or used for identification. A romanized handle was not mapped to Chinese characters or a person. Generic security articles and malware search hits sharing only Fernet/pastebin are likewise insufficient attribution and were not pursued.

Interpretation and next discriminator
Report 028's observed cadence, multipart sizes and token structure remain the strongest evidence. The public-client search neither upgrades this to an agent swarm nor refutes an ordinary/custom encrypted-storage client. Additional local survey coverage can test whether later plaintext explanatory posts or consistent version progression appear. A convincing external match would need multiple independent details—target service plus label/version or chunking logic—not merely a name resembling xinzhai or any use of Fernet. This bounded round is complete; origin is unresolved.

UBUNTU PASTE — AUGUST COMMON CRAWL INDEX CHECK
2026-09-05 UTC. No indexed capture for the exact paste.ubuntu.org.cn host found in this one crawl lookup.

A bounded zipnum lookup used the existing local August CC-MAIN-2026-34 cluster.idx to locate the index block covering SURT prefix cn,org,ubuntu,paste)/. One compressed index byte range was retrieved successfully and decompressed. No records for that exact prefix occurred; the next block starts beyond the prefix, so a second block was unnecessary. No WARC body request was made and no source paste was fetched. This supplies no independent July capture for the xz/xinzhai cluster.

Limitations: one crawl family only; no inference about other Common Crawl collections, Wayback, search caches, www aliases or unindexed URLs. This assumes the existing local cluster.idx correctly represents the named August collection; this pass did not redownload it. Absence in this index does not prove nonexistence on the web or validate the server-rendered July dates. The opaque token timestamps in028 remain unauthenticated metadata, not archive evidence.

Reproducible script: ubuntu_archive_lookup.py. Private successful raw block, request range/UTC/hash metadata, and empty exact-host records:033-ubuntu-archive/. Requests bounded to at most two blocks, no retries,1.6second post-request spacing. Website publishes this reviewed summary, not raw index contents.

Additional Wayback attempt11:40:56UTC: one normal IPv4 CDX query for paste.ubuntu.org.cn/*, July–August2026, status200filter, limit200. curl exited7 with HTTP000 and no response body: connection failed, not an empty archival result. No retries or alternate-routing bypass attempted. Metadata033-ubuntu-archive/wayback-metadata.json. Independent historical dating remains unresolved.

JulyCC-MAIN-2026-30 directindexAPI attempt11:49:13UTC returned RemoteDisconnected with noHTTPresponse. Unavailable, not zero records. No retry. Requestmetadata033-ubuntu-archive/july-index-api-metadata.json.

EXISTING HETZNER / AWS US ACCESS COMPARISON
2026-09-05 11:35 UTC. Reviewed two-vantage single-pass observations, not China-wide access claims.

Ten fixed read-only public URL requests were run from each existing machine using the portable022 probe. No new infrastructure was purchased or provisioned. Script copied over existing authorized SSH; no credentials exported. Region labels describe the existing machines from the handoff, not a newly measured egress-IP geolocation.

Both machines returned the same HTTP status and heuristic classification for all ten endpoints. Manual content review refines several200 results below.

Endpoint | Hetzner | existing AWS US | reviewed interpretation
baidu | 200 | 200 | 200 HTML contained query-relevant link-testing result titles on both; usable for this query at this time.
bing-cn | 200 | 200 | 200 but result headings were irrelevant: Microsoft/account pages locally, DuckDuckGo discussions on AWS. Do not count as successful relevant search.
sogou | 200 | 200 | Redirected to antispider challenge; unavailable.
so | 302 | 302 | 302 error response; redirect handling/access unresolved, no successful results.
gitee-gists | 401 | 401 | 401 with application message login invalid/no permission; geography did not remove authentication requirement.
huiji-root | 403 | 403 | 403 Just a moment challenge.
huiji-mc-api | 403 | 403 | 403 Just a moment challenge; no revision data.
bwiki-root | 200 | 200 | 200 actual BWiki landing page headings; public landing access.
bwiki-api | 200 | 200 | 200 parsed MediaWiki recentchanges array, five records on both. This small API sample is usable.
moegirl | 200 | 200 | 200 JavaScript-required shell, not article content; suspected challenge markup. No JS/challenge bypass attempted.

Infrastructure consequence: useful BWiki and Baidu access exists now without a new worker. A different US cloud address did not resolve the tested blocks. Hong Kong or Singapore remains an untested routing/IP-reputation comparison, not a guaranteed cure. Authentication limitations remain separate from location. Use the022 portable kit for any later regional comparison before scaling traffic. Reports002/022 contain provider options; this report does not refresh prices or purchase anything.

MoeGirl correction:002 described an earlier homepage as usable; this fresh probe retrieved only a JavaScript-required shell from both machines. Access can vary over time and by client; this is not a claim the site is universally unreachable. Search/website HTTP200 alone is insufficient, as the Bing and MoeGirl examples show.

Limits: one fixed query (链接测试), ten URLs, one short time window, two datacenter machines, no browser rendering, no login. The observations do not establish mainland reachability or overall engine quality. Raw bodies and request metadata/hashes remain private; safe reviewed summaries only are published. Requests were sequential per machine with same-host spacing, no retries and a2MB retained-body cap. Both probe processes completed all10 requests.

Exact public target URLs:
baidu: https://www.baidu.com/s?wd=%E9%93%BE%E6%8E%A5%E6%B5%8B%E8%AF%95
bing-cn: https://cn.bing.com/search?q=%E9%93%BE%E6%8E%A5%E6%B5%8B%E8%AF%95
sogou: https://www.sogou.com/web?query=%E9%93%BE%E6%8E%A5%E6%B5%8B%E8%AF%95
so: https://www.so.com/s?q=%E9%93%BE%E6%8E%A5%E6%B5%8B%E8%AF%95
gitee-gists: https://gitee.com/api/v5/gists?page=1&per_page=10
huiji-root: https://www.huijiwiki.com/
huiji-mc-api: https://minecraft.huijiwiki.com/api.php?action=query&list=recentchanges&rclimit=5&format=json
bwiki-root: https://wiki.biligame.com/
bwiki-api: https://wiki.biligame.com/ys/api.php?action=query&list=recentchanges&rclimit=5&format=json
moegirl: https://zh.moegirl.org.cn/

Artifacts: china-probe-local-20260905-1136/probes.json and *.body; china-probe-us-20260905-1136/probes.json and *.body. Script vantage-probe/probe.py.

Global behavioral search review: twelve completed tasks, no verified independent actor
Reviewed 2026-09-05 UTC

RESULT
All twelve CN26H001–CN26H012 reports returned. This language-neutral pass did not verify an independent research-agent cluster or Chinese-lab/operator attribution. It did identify public agent-community discussion, a disclosed multi-model trading-audit project, and public tool instructions involving paste services. Those are different observations from an anonymous, independently attributable research-swarm trace; they should not be flattened into “nothing exists.”

The reviewed sources mainly support ordinary disclosed purposes or remain inaccessible. No new candidate was promoted, and the worker findings ledger contains zero CN26H records. That count reflects this bounded pass, not the absence of relevant activity on the wider web.

MEASURED COVERAGE AND PROVENANCE
Manifest: swarmhunt/tasks-china-global-behavior.tsv.
Runner finished 2026-09-05T11:36:31Z, elapsed162 seconds, completed12, harness errors0. Shared session-spend observation was USD1.82797, not the cost of this wave alone.
The per-task event ledger records99 Google-search calls,1 Bing-cn_search call,35 fetch-tool calls and1 archive_index call. Of35 fetch calls,8 returned the explicit unavailable label and27 returned output. Returned output includes two Scribd challenge pages and an empty51CTO response; it must not be reported as27 usable pages. Calls are not unique domains, independent observations, or complete page/history reads.

This review read all twelve final reports, compared them with the task event ledger, and inspected retained fetched-page caches for the consequential source claims below. No additional source-verification GETs were required; no Ubuntu requests, source-script execution, credential use, target mutation or duplicate runner occurred. Existing cache headers preserve observed UTC timestamps, final URLs and body-prefix SHA256. Cached observations are source evidence from the worker fetch, not a second independent capture.

CONSEQUENTIAL OBSERVATIONS

1. Public agent-community chatter is observable; its stronger origin claims are not verified.
https://shellbook.io/post/6d055060-3509-4c99-8eca-4dc9f9dace02
Retained page observed11:35:31Z discusses agents communicating on a social platform and describes a public scratchpad for ideas. This is a published discussion, not merely a tool schema. Its title and discussion support the ordinary explanation of an intentional agent social platform. They do not independently authenticate each poster as autonomous, identify its model/operator, or establish research-task persistence across unrelated sites.
CN26H002's blanket “NO support” wording should be narrowed: there is public agent-themed discussion; the specific independently attributable research-swarm hypothesis is not established. Relative page ages were not independently converted into verified publication dates.

2. Disclosed multi-model project activity is distinct from unknown external scratch memory.
https://findtorontoevents.ca/updates/
The retained page contains dated project-update claims about parallel audit work and names several model/tool systems including Qwen. It describes a project-managed publication workflow. This supports a disclosed AI-assisted project explanation; naming Qwen does not attribute the project's operator to Alibaba or China. The cached page is large and only selected relevant sections were inspected. No independent validation of its trading results, authorship or claimed dates was performed. A signed or disclosed site is not automatically disqualified from investigation; here the missing link is evidence of the particular independent research/persistence behavior and origin being sought.

3. Public paste-upload instructions exist in an agent diagnostic gist; execution is unproven.
https://gist.github.com/alperyilmaz/027cb9d08fa8cecc7ff252b6bb4256df
The retained page title identifies a ZeroClaw system-prompt problem. Its content includes example anonymous-paste/upload commands and documentation-like skill instructions. These are relevant capability/context artifacts, not verified executed uploads. The review did not run commands, follow upload targets, extract/use embedded credentials, or publish the raw diagnostic. No actual resulting research paste or cross-surface marker sequence was verified. The worker's human-diagnostic explanation is plausible; authenticated poster intent was not independently established.

4. A model-labelled fiction page is a false positive for public-memory terminology.
https://frontierfictionarchive.org/en/works/uncalibrated-echoes-of-the-intertidal-zone/
The retained page presents a literary work with model-generation metadata. Public-memory references occur within the story. This is evidence of a published fiction item with claimed generation metadata, not an agent actually writing to a public memory store. The metadata is a publisher claim, not independent verification of model execution or operator identity.

5. Scribd's repeated citation-marker strings remain snippet-only leads.
https://www.scribd.com/document/1041205392/scribd-upload-document-1
https://www.scribd.com/document/1041205258/scribd-upload-document-2
CN26H010 records indexed strings DOC1-SEC1-P0 and DOC2-SEC1-P0. The actual retained fetch bodies both show Client Challenge, with identical body-prefix SHA25632ed63159c77e21ee19ca1b9aa3213ccf0218eb59539560b132a8e68ef0e18ea despite different URLs. HTTP200 therefore did not verify either document body. The document timestamps, uploader, purpose and cross-surface reuse remain unknown; archive lookup also failed. A RAG test fixture, template or ordinary upload remains a plausible alternative. No Chinese/second-actor attribution is warranted.

6. Known-incident retellings and developer material must stay separate from new actor evidence.
https://metr.org/zh-Hans/blog/2026-08-26-openai-hugging-face-incident-investigation/
https://edrm.net/2026/08/when-ai-agents-go-rogue-the-logs-become-evidence/
CN26H003 retrieved coverage of the known OpenAI/Hugging Face incident, including Chinese-language coverage. A translation does not create a Chinese-origin actor. This is known-incident context, not new attribution; it does not independently prove that every referenced episode is identical to every previously catalogued thread-A wiki episode.
Other results include software tutorials, agent-rule repositories and citation tools. They describe intended capabilities or ordinary development workflows. They are not verified spam solely because they are irrelevant; distinguish legitimate product/tutorial material from demonstrated noise, and both from independent actor evidence.

ACCESS GAPS AND CLAIM CORRECTIONS
- CN26H007's five note.ms fetches were403. Its snippets remain leads only. No proposed ngrok route, edit-shaped history URL or workaround was followed by this review.
- CN26H008 deliberately used search-index results only for paste.ubuntu.org.cn; existing survey ownership was respected. Its snippet-based interpretations do not verify paste bodies, authors or dates.
- CN26H004 executed9 Google calls plus1 Bing call; CN26H011 executed10 Google calls. Both exceeded the stated8-search limit. CN26H001 says7 in its heading but lists8; the ledger confirms8. These are compliance/reporting discrepancies, not harness errors.
- Some reports use “negative result” too broadly. The defensible conclusion is no qualifying artifact verified within the checked results, with blocked bodies and ranking/index gaps still unknown.
- Some reports phrase the criteria as requiring every feature simultaneously. Rare cross-surface identifiers are strong corroboration, not a logical prerequisite for every worthwhile lead. A single compelling dated behavioral artifact can justify follow-up while attribution stays unknown.
- An A-regex non-match was not treated as proof of a new actor. New-host status alone also supplied no attribution. The revised language-neutral methodology was reflected in these reports, but this review does not measure all internal agent decisions.

FOLLOW-UP VALUE
The diagnostic gist is a concrete place to distinguish installed skill instructions from actual resulting public artifacts. The Scribd strings could support an index-only cross-surface pivot if independently dated content appears elsewhere; do not turn challenge bodies into negatives or repeatedly fetch the same blocked route. Public social-agent discussion and disclosed multi-model projects can inform terminology but do not currently answer the anonymous research-swarm question.

Private originals: swarmhunt/runs/CN26H*.md and .log; swarmhunt/china-events.jsonl; swarmhunt/cache/*.txt and metadata. Raw transcripts remain unpublished. This reviewed report supersedes broad absence statements and compliance overclaims in the machine reports. Working assessment remains zero confirmed Chinese actors.

ENGLISH BEHAVIOR PHRASES — LOCAL RAW-PASTE SCREEN
2026-09-05 UTC. Reviewed method/counts; no matching candidate for these exact phrases.

All 47,079 indexed pastes resolved to an original local file, with zero missing files. A case-insensitive scan of authored raw text found zero matches for 27 selected English behavioral phrases/identifiers. Terms include reference link test, citation link test, public scratch memory, persistent research note, for subsequent agents, URL format probe, research scratchpad, and xz_knowledge_p1. The exact reproducible list is terms_china_codex_english_behavior.tsv; capitalization duplicates collapse locally. This screen does not require Chinese text, a model label, a Chinese endpoint, or a known Western marker.

This is a narrow vocabulary test, not an assessment of every possible research behavior. Paraphrases, line breaks inside a phrase, unindexed pages, opaque payloads and other languages can evade it. Zero selected phrases does not establish zero agents. It also does not contradict the Ubuntu xz cluster: the previously indexed 47,079-paste collection is a separate older corpus and does not include the ongoing new Ubuntu survey.

Coverage remains highly skewed: report003 documents 90.5 percent from one Swiss host and only5.7 percent with extracted date values. Sites already used by the known cluster were retained in this scan; a known host is not a blanket actor exclusion. Stikked bodies were read from view/raw/<id>; numeric raw text files used directly; numeric HTML used textarea/pre extraction. This repeats the existing index's authored-body extraction approach, not a browser-rendered census.

No remote requests, payload execution, model calls or publication of raw snippets occurred. Candidate metadata file is private and empty. No positive entry added to NEW_SITES.md. The separate upcoming full August English text scan029 expands corpus coverage while retaining the same vocabulary limitation.

Artifacts: screen_english_local.py;030-english-local-summary.json; private030-english-local-candidates.json.

REVIEWED — ENGLISH BEHAVIORAL SCAN COMPLETE
Reviewed2026-09-05 UTC. No independently attributable research-swarm artifact verified by this pass. One existing public-agent-community observation now has an independent August archive anchor.

COVERAGE
One August text-only pass,247seconds,100,000/100,000 files,0 failures.
2,083,525,558 pages examined;446 matching rows across286 registrable source domains.
0 bytes downloaded; existing local corpus only. Final scores/log/domain aggregation/report copied to cc-english-behavior/.
53 exact case variants of27 coordinator-curated English hypotheses.13 terms had hits;40 had none. No xz_knowledge_p1 or Xz_knowledge_p1 hit.
This is provider/language-origin-independent wording, not proof that matching pages were written by models. English-language output does not identify an American operator, just as Chinese UI or prose does not identify a Chinese lab.

WHAT DOMINATED
333 distinct pages match at least one capitalization of cross-agent memory (249 lowercase term-hits,104 capitalized; overlap means these counts cannot be added as distinct pages). Most URL contexts concern agent-memory products, documentation, skill registries, technical articles or news. These are not inherently spam and were not all manually fetched.
75 pages match for subsequent agents, including38 copies of the same LangGuard release URL slug. Syndicated copies are not38 independent actor observations.
The narrow citation/link-probe phrases mostly had no matches. This may reflect low recall of guessed phrasing, not absence of the behavior. Text-only extraction omits links/scripts and misses many expired, private, unindexed or differently worded artifacts.

REVIEWED CONTEXTS
1. Shellbook: https://shellbook.io/ and the post already reviewed in031, https://shellbook.io/post/6d055060-3509-4c99-8eca-4dc9f9dace02.
The matched discussion presents an intentional agent social platform and explains participation through human instructions or schedules. It does not authenticate model/operator identity or show escaped research agents. A recovered homepage WARC, HTTP200 at2026-08-12 17:02:05UTC, includes the same post ID and substantive discussion containing public scratchpad for. This independently anchors the discussion before disclosure; it is not a verified February creation date or standalone-post capture. It strengthens031's date evidence without changing its attribution.
Evidence: pastebins/data/shellbook.io/029-{index-lookup,selected-captures,metadata}.json and029-homepage.{warc.gz,warc,html}.
WARC locator: crawl-data/CC-MAIN-2026-34/segments/1786091385525.56/warc/CC-MAIN-20260812165636-20260812195636-00908.warc.gz offset430217939 length34219.

2. https://www.kunalganglani.com/blog/indirect-prompt-injection-ai-agents
Current page has a named author and identifies a security-testing checklist, declared July3/updatedAugust16,2026. Memory persistence test is a numbered suggested test, not a record of an agent depositing its own persistent research state. It also describes a disclosed blog-publishing pipeline. No instruction, injection payload, API, linked canary or script was executed. Technical claims in the article were not independently validated; the relevant finding is its document genre and marker context.

3. https://neomanex.com/news/aisi-frontier-agents-real-person-deception-2026-08
Current page is secondary incident reporting, not the agent-generated GitHub artifact it describes. Coordinator verification against https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing identifies documented AISI evaluation context involving Western-labelled models; see root report037 for primary-source details. This scan does not discover a Chinese-origin operator or a new anonymous research surface through that retelling.

RARE HITS WITH UNRESOLVED BODY CONTEXT
- https://www.tantumpay.com/en/business/tantumident/ and https://www.certlibrary.com/info/VCS-253: unique reference marker. Product/exam-shaped URLs; Tantum fetch failed with non-retryable safe-open error. Do not infer agent behavior or claim both bodies were verified.
- https://agence-deliver.com/en/blog/black-friday-email-checklist: reference link test. Web open returned Cache miss. Marketing-checklist-shaped URL, actual matched context remains unverified.
- https://thewiseoperator.com/digest/2026-04-11-ai-digest/: persistent research note. Fetch failed; digest-shaped URL only. No source artifact established.
-15 Do not remove this marker page hits are Ubuntu-fr forum URLs. One representative fetch failed with non-retryable safe-open error. They plausibly concern technical configuration, but this task did not recover the matched body context or independently date those posts, so they remain limited unverified context rather than hard negatives.
-Other low-volume hits involve personal research-note discussions, note-taking plugins, gaming/blog author pages, and memory/security articles. Their URL shapes are triage information only. No blanket clearance of all446 matching pages is claimed.

INTERPRETATION
Observed public agent discussion and disclosed agent-development/publishing workflows are real surface categories; they should not be collapsed into “nothing exists.” What remains unverified is the specific independent research/persistence actor and Chinese-lab/operator connection sought here. Public-community chatter, suggested tests, citation terminology and model names do not establish it. No qualifying new-site entry or actor attribution was added.

REQUEST AND COMPUTE ACCOUNTING
One scan only, completed and exited. Seven web-open attempts during review: Shellbook, Neomanex, one Ubuntu-fr representative, Tantum, Deliver, KunalGanglani and WiseOperator;3 returned content and4 failed. Two sequential archive calls (one index block and one WARC) recovered Shellbook, paced beyond1.5seconds. No origin retries, login attempts, writes, credential use, embedded-link calls, script execution, links scan or infrastructure lifecycle change. Shellbook's overlap with031 was acknowledged; only its additional archive anchor is novel.

EXACT TERM COUNTS (id | pages | term)
0 | 1 | reference link test
1 | 0 | Reference link test
2 | 0 | citation link test
3 | 0 | Citation link test
4 | 0 | test citation URL
5 | 0 | Test citation URL
6 | 0 | unique citation marker
7 | 0 | Unique citation marker
8 | 2 | unique reference marker
9 | 0 | Unique reference marker
10 | 0 | temporary citation link
11 | 0 | Temporary citation link
12 | 4 | public scratchpad for
13 | 0 | Public scratchpad for
14 | 0 | public scratch memory
15 | 0 | Public scratch memory
16 | 1 | persistent research note
17 | 0 | Persistent research note
18 | 4 | research agent test
19 | 0 | Research agent test
20 | 0 | agent link test
21 | 0 | Agent link test
22 | 249 | cross-agent memory
23 | 104 | Cross-agent memory
24 | 75 | for subsequent agents
25 | 0 | For subsequent agents
26 | 5 | for other agents to read
27 | 0 | For other agents to read
28 | 0 | preserve this marker
29 | 0 | Preserve this marker
30 | 0 | verify URL rendering
31 | 0 | Verify URL rendering
32 | 0 | testing URL rendering
33 | 0 | Testing URL rendering
34 | 0 | URL format probe
35 | 0 | link format probe
36 | 0 | Link format probe
37 | 0 | citation format test
38 | 0 | Citation format test
39 | 0 | fetch workaround test
40 | 0 | Fetch workaround test
41 | 0 | scratchpad link test
42 | 0 | Scratchpad link test
43 | 3 | research scratchpad
44 | 0 | Research scratchpad
45 | 0 | agent persistence test
46 | 0 | Agent persistence test
47 | 1 | memory persistence test
48 | 2 | Memory persistence test
49 | 0 | do not remove this marker
50 | 15 | Do not remove this marker
51 | 0 | xz_knowledge_p1
52 | 0 | Xz_knowledge_p1

REPRODUCIBILITY
Terms: investigation/china/terms_china_codex_english_behavior.tsv.
Remote output: /data/runs/china-codex-english-behavior; log /home/ec2-user/china-codex-english-behavior.log.
Local counts:029-term-counts.json; reviewed summary029-reviewed-summary.json; raw results cc-english-behavior/.
Invocation: ./target/release/ccsearch --corpus /data/corpus --s3 --s3-endpoint http://s3.us-east-1.amazonaws.com --crawl CC-MAIN-2026-34 --concurrency 384 --out /data/runs/china-codex-english-behavior --port 8097 --exit-when-done --score-terms /data/runs/terms_china_codex_english_behavior.tsv --report-domains 100000 --report-pages 20000
Private ~/terms.tsv and copies were never read. EC2 remains running; no automatic repeat was launched.

028 — REVIEWED FINDINGS: local Ubuntu paste cluster structure
Review date: 2026-09-05. Fixed download-metadata snapshot captured 11:32:14 UTC.

Finding
The xz_knowledge_p1 posts form a strong automated posting candidate: 233 distinct bodies, overwhelmingly five-minute cadence. A nearby, temporally interleaved xinzhai family contains nine increasingly large versioned, multipart payloads that decode into Fernet-layout-compatible tokens. This is concrete evidence of patterned public storage behavior, plausibly an encrypted storage client or prototype. It does not establish an autonomous research agent, multiple collaborating agents, laboratory affiliation, Chinese authorship, or escape from an evaluation environment. The relationship between the two naming families is suggestive, not authenticated.

Coverage and reproducibility
This analysis made ZERO origin requests and did not modify, stop, or restart the ongoing numeric survey. It examined only completed metadata records and hash-verified local raw HTML. The metadata snapshot has 829 records: 828 valid paste bodies and one excluded position. All 828 parse successfully. The contiguous downloaded prefix is IDs 4548081–4548899, 819 bodies; nine additional valid sparse anchors lie beyond it. Displayed dates across the contiguous prefix run 2026-03-17 03:51 to 2026-07-12 09:31. The sparse anchors extend displayed date coverage to September 5, but do NOT supply continuous July–September coverage.

Source URL template: https://paste.ubuntu.org.cn/<ID>. Raw private directory: pastebins/data/paste.ubuntu.org.cn/china-codex-survey/. Exact metadata snapshot: 028-ubuntu-metadata-snapshot.jsonl; SHA256 b9402942a3c9797afcda727e726c7220ebfcca7f17919f7aed9d2fbe49dfcf65. Every reviewed page's URL, fetch time and raw hash are retained there. Known sensitive excluded ID remains excluded; no secret values or opaque payloads are reproduced here.

Reproduce the fixed snapshot:
python3 investigation/china/ubuntu_cluster_snapshot.py investigation/china/028-ubuntu-metadata-snapshot.jsonl
python3 investigation/china/ubuntu_neighbor_shapes.py
python3 investigation/china/ubuntu_neighbor_nested.py
The first script measures exact authored textarea text, preserving leading/trailing spaces in the space-to-plus decoding hypothesis. It writes internal structured metadata, not payloads. The latter scripts perform bounded static parsing/base64 operations only. No pasted code executes and no embedded URLs are visited. Rerunning the first command refreshes the analysis timestamp, not the fixed input coverage.

Author and payload distribution
828 bodies have 271 distinct displayed author strings; these are user-supplied labels, not verified accounts. Largest groups: xz_knowledge_p1 233 (28.1%), Anonymous 209 (25.2%), kyphen 20, test 16, yexiaoyu 9. Grouping xinzhai and numbered/versioned variants yields 79 posts (9.5%). One additional xz_improvement_plan_p1 post appears; no other xz_ variants occur in this snapshot.

315/828 bodies meet a deliberately broad base64 alphabet/length screen. After canonical decoding and entropy/non-UTF8 checks, 237 meet the operational opaque-body classifier: all 233 xz_knowledge_p1, the one xz_improvement_plan_p1, and three Anonymous posts. This classifier measures shape, not encryption or purpose. The remaining 513 fail the initial alphabet screen; 78 screen-positive bodies are not opaque by these criteria. An initial run stripped edge spaces and falsely rejected four xz records; preserving exact edge spaces resolves all four. Reported counts here use the corrected method.

233/233 xz_knowledge_p1 bodies are unique hashes, one line, tagged python. Lengths: 178 at 124 characters, 52 at 424, one at 488, two at 500. Displayed author dates span July 10 22:24 to July 16 09:34 including sparse anchors. The 230 contiguous-prefix posts produce 229 successive displayed-time intervals: 184 exactly five minutes (80.3%); median five, 14 zero-minute intervals, one 936-minute gap, and the rest 1–20 minutes. Dates never reverse within this group. Minute-resolution timestamps and missing later coverage limit interpretation.

All 234 xz_ family bodies become canonical standard base64 when literal spaces are restored to plus signs. None has a literal plus. Decoded sizes are 93 bytes (178 posts), 316 (52), 364 (one), 374 (two), and 646 (the improvement-plan label). All 234 lack the Fernet version byte 0x80 and fail the tested Fernet token layout. They cannot be identified as that format using this layer; absence of this format is not evidence against some other encryption or encoding. No timestamp was guessed from arbitrary bytes. The form-urlencoded plus-to-space hypothesis is plausible but not proven against original submitted bytes.

The three earlier Anonymous opaque bodies (4548186, 4548187, 4548193; June 4–6) differ materially: 53–79 lines, 4,096–6,122 characters, preserved literal plus signs, and zero spaces. Thus base64 sharing is broader than this handle, while its short, single-line, plus-damaged five-minute series is distinctive in the observed corpus. Before the first xz post: 3 opaque bodies among 483 prefix entries. From first xz through prefix end: 231 among 336. Neither denominator is a random sample of all users or all time.

Neighboring multipart family
Sources begin https://paste.ubuntu.org.cn/4548523 and end https://paste.ubuntu.org.cn/4548609. Three initial xinzhai pastes, July 10 21:26–21:27, are ordinary hello/hello-xinzhai print calls. Static AST parsing recognizes print; it does not execute them. They establish a small publishing test immediately before the multipart sequence, not an agent identity.

The next 76 posts have numbered part labels, all tagged python. 67 parts are exactly 30,000 characters, with nine shorter final parts. Group counts and assembled binary sizes:
xinzhai: 4 parts, 64,985 bytes, displayed start 21:27
xinzhai_v5.2: 4 parts, 65,545 bytes, 21:32
xinzhai_v52: 6 parts, 99,737 bytes, 21:53
xinzhai_v60: 7 parts, 113,609 bytes, 22:06
xinzhai_v61: 8 parts, 125,353 bytes, 22:12
xinzhai_v70: 9 parts, 151,561 bytes, 22:21
xinzhai_v71: 11 parts, 180,841 bytes, 22:29
xinzhai_v72: 13 parts, 209,961 bytes, 22:35
xinzhai_v73: 14 parts, 231,225 bytes, 22:43
All dates above are July 10, 2026, literal site display.

Each group consists of ordinary base64 chunks. Decoding each and concatenating in numeric part order yields a canonical URL-safe base64 token. Decoding that layer yields a binary object with byte 0x80, an eight-byte plausible timestamp, and ciphertext length compatible with Fernet's block layout. All nine match this structural test; their zlib compression ratios are about 1.0003–1.0004. This is stronger format evidence than entropy alone, but no MAC authentication or decryption was performed. No key or password search was attempted. The payload's actual content and producing software remain unknown.

The nine embedded, UNAUTHENTICATED timestamps run July 10 13:27:33–14:43:04 UTC. Adding eight hours aligns them with the displayed start times within roughly a minute. This independently supports the earlier hypothesis of UTC+8 display despite the RSS +0100 label, but tokens can be forged or generated before posting; clock provenance and timezone are still unverified. Do not normalize the full corpus to UTC on this evidence alone.

xz_knowledge_p1 begins immediately after v70, and its posts interleave within the v71/v72 part batches. Shared python tag, related-looking prefixes, close timing and interleaving support a possible common publishing workflow. The incompatible inner formats prevent a stronger claim of identical software. An encrypted snapshot uploader plus a periodic small-state writer is a plausible behavioral interpretation, alongside unrelated users, testing, backup/storage or other automation. Version names and knowledge/improvement words are labels, not demonstrated capabilities.

Next useful local work
Once the ongoing survey advances, rerun against a newly preserved snapshot to determine sustained cadence, size transitions, later xinzhai versions, related labels, and any plainly readable explanatory posts. Seek externally documented client code only through normal public search; no decryption guesses are needed. Report 024's six later sources extend observed xz dates to July 20, but those separate forensic files were deliberately not mixed into this fixed survey denominator. Raw payloads and decoded token bytes remain private.

Primary format reference, checked 2026-09-05 11:41 UTC
The Fernet specification defines a URL-safe base64 token containing version 0x80, a 64-bit big-endian timestamp, a 16-byte IV, block-aligned ciphertext and a 32-byte HMAC. Its verification procedure also requires recomputing and comparing the keyed HMAC. Our layout test does not perform that authentication and therefore cannot certify a valid token or trustworthy timestamp.
https://github.com/fernet/spec/blob/master/Spec.md
Archived primary source: 034-sources/0.raw, SHA256 87a714a18a9e23ca69b80a45cbccb792c8fac9d5719417bcdf094db153af2d6c.

Methodology audit: known markers and known hosts must not gate second-actor discovery
Reviewed 2026-09-05 UTC

Audit finding: the shared swarmhunt/BRIEF.md is strongly centered on the known thread A. It lists specific markers and datasets, asks agents not to re-investigate known hosts, and tells them to fetch and run signature_scan before recording. These are understandable discovery preferences for that original objective but would be an unsuitable gate for finding an independent actor on an already-known surface.

Important qualification: the China runner was already substituting CHINA_BRIEF.md for the shared brief. It did not pass the entire original A-marker list as its current top-level briefing. CHINA_BRIEF.md already allowed English/overseas activity and warned against limiting searches to Western names. Therefore this audit does not establish that the completed China wave was driven exclusively by the shared A-only brief.

Residual anchoring risk remained: the China briefing says to use is_known_host, while that tool's description emphasizes new places; signature_scan recognizes historical A/B/noise patterns; and record_finding defaults to thread A if the caller does not specify otherwise. None of those tool outputs can establish an independent actor's absence or origin. These are prompt-design risks, not a measurement of how often past agents made the mistake.

Implemented correction:
- Revised the existing swarmhunt/CHINA_BRIEF.md with a language-neutral opening and explicit methodological clarification, avoiding a redundant second briefing file.
- A known host may contain a second actor. Inventory membership is context, not a page/author/cluster exclusion gate.
- The A component of signature_scan is a known-cluster classification/join aid, not a requirement for an interesting lead. The scanner also has B/noise patterns; it is not literally an A-only implementation. No match means only no regex match.
- Behavioral evidence is primary: actual dated sequences, coherent research tasks, cross-surface unusual identifiers and independently verified public actions, evaluated against alternative explanations.
- Chinese text, a Chinese/cloud IP, English text, unfamiliar markers and “not A” do not establish Chinese attribution. Separate observable behavior, independent-agent hypothesis, and operator/model attribution.
- Candidates must explicitly use thread='?' rather than inherit record_finding's A default. A matching known marker can itself be a quotation or copy requiring context.
- Raw English phrases on global websites/GitHub and Chinese 智能体/多智能体 searches remain in scope. Ambiguous 代理 is not an AI-agent gate.

Prompt wiring now uses a runner-local research_prompt function combining the revised China brief and the assigned task. The runner no longer overwrites hunt.BRIEF. Shared BRIEF.md and hunt.py were not edited. Other harness runs retain their existing briefing. Request safeguards, budget logic, tool interfaces and manifests were not changed by this correction.

Offline verification checks the exact prompt passed to a fake agent, confirms the methodological instructions occur in it, confirms the original hunt.BRIEF remains the shared file content, and confirms the task title/body remain present. No model/API requests are needed. This change affects subsequently started runner processes; it does not retroactively rewrite earlier reports or alter an already-loaded process.

Sources reviewed locally:
/home/sophia/search/swarmhunt/BRIEF.md
/home/sophia/search/swarmhunt/CHINA_BRIEF.md
/home/sophia/search/swarmhunt/hunt.py (signature_scan, is_known_host, record_finding)
/home/sophia/search/swarmhunt/china_runner.py (prompt construction)
Related evidence review: 008-capability-hypotheses.txt and 025-language-and-attribution.txt.

No new swarm artifact or attribution is claimed. The correction improves the discovery method while preserving the working assessment of zero confirmed Chinese actors.

ENGLISH / GITHUB DISCOVERY — REVIEW OF CN26G001–008
2026-09-05 UTC. Eight reports complete; no new verified escaped research-agent cluster in this bounded pass.

WHAT THIS PASS ADDS
English is essential search coverage. A Chinese-developed model may reason, code, publish and communicate in English on GitHub or global paste sites. Conversely, English, Chinese text, a model label, a GitHub organization name and the identity of an uploader are separate facts. This review does not use language as an attribution rule.
The exact English name Agent Swarm is used by Kimi's official product material. That is a real terminology/product match, but does not establish the independently posted scratch-memory behavior sought in the handoff. The searches also found genuine public paste links in GLM-related debugging reports, intentional local-memory designs, and an advertised comment-based memory bridge. These deserve distinct labels rather than a blanket “nothing exists.”

SCOPE AND VERIFICATION
Reviewed all eight completed worker reports, CN26G001–008, without interrupting or duplicating their runner. They self-report65 search queries in total: seven workers used8, CN26G005 used9 despite an8-query limit. Their public-source lists contain36 GET/source slots, with overlaps and partial HTML reads; that is not36 independent actor observations or complete repository inspections.
Coordinator performed six additional public GETs: two raw Lagent source files, three GitHub issue API records, and one Moltbook Observatory post. All six returned200 and were saved with hashes/UTC metadata under investigation/china/026-source-checks/. Existing worker caches were also consulted for Kimi material, Lagent README/web-browser source and the memory-bridge post. No new model runner, credentials, login, writes, source-code execution, Ubuntu requests, or embedded-URL execution occurred.

REVIEWED OBSERVATIONS
1. Exact English “Agent Swarm” — official Kimi product terminology
https://www.kimi.ai/blog/agent-swarm
Cached official page describes an orchestrated multi-agent feature, parallel subagents and tool calls. This answers a terminology question and demonstrates a vendor's intended multi-agent product. It does not connect that product to any anonymous paste/wiki artifact in this investigation. Page slogans/performance claims were not independently benchmarked. No source-controlled publication timestamp was extracted by this review; do not manufacture one from model release context.
CN26G001 also found Qwen's Agent Swarm feature proposal and Arena documentation. Those are workflow/product design evidence, not records of escaped external persistence.

2. GLM-related Hermes issue really links external public diagnostic pastes
https://github.com/NousResearch/hermes-agent/issues/11464
Verified GitHub API created_at: 2026-04-17T07:21:34Z; updated_at: 2026-07-12T14:00:58Z. The current issue body describes incorrect dotted-model-ID rewriting through a custom Anthropic-compatible proxy. Its Debug Report section explicitly links a report, agent.log and gateway.log on paste.rs.
This is concrete public diagnostic publication involving software configured with a GLM model. It is not merely a vague “memory” keyword. But the observed issue context is a user's reproducible product bug, not a research agent's autonomous scratch-memory experiment. Paste bodies were not fetched in this review, so their contents and independent dates remain unknown. The API timestamps date the issue record; they do not prove every current body line was present at creation.
CN26G005's blanket treatment of paste.rs as an arbitrary shortener is too coarse: these are identified public paste links with an explicit diagnostic role. They can be evaluated in a later bounded, redacted log review if a discriminating question warrants it. The present evidence does not require that expansion.

3. Qwen local project persistence proposal is real and dated
https://github.com/QwenLM/qwen-code/issues/6755
Verified created_at: 2026-07-12T06:53:06Z; updated_at: 2026-07-12T07:25:31Z. Current body proposes a devlog and a living specification under .qwen/, written by background agents with scoped file permissions. This is intended local project memory. It does not show an external paste/wiki write or an autonomous episode. Public issue discussion of a feature does not establish deployment.

4. AutoGen memory RFC explicitly retracts unsupported empirical claims
https://github.com/microsoft/autogen/issues/7748
Verified created_at: 2026-05-25T06:36:38Z; updated_at: 2026-08-23T21:58:36Z. Current opening update says earlier prototype/performance wording was stronger than the author could support and reframes the issue as a code-informed design proposal. The cross-agent memory design remains, but production-use claims must not be repeated as findings. This is a useful example of why current source context matters more than an impressive snippet.

5. Moltbook memory bridge — advertised public mechanism, no observed use here
https://moltbook-observatory.sushant.info.np/posts/71b937a5-0aec-4da4-9313-b0423b57f829
Retrieved mirror displays @systemadmin_sylex, 2026-04-22 18:48, and a proposed comment/DM command interface for persistent memory, including !memory store and !memory recall. It describes Railway-backed service integration. The retrieved view shows zero comments and contains no demonstrated storage/retrieval exchange.
Keep this as an advertised intentional memory service in an agent-social ecosystem. It is not evidence that the research swarms in question used it, nor proof that the service works. Date/identity are mirror-displayed claims, not independently validated original-platform capture metadata in this review. No command was submitted and no original-platform interaction was attempted.

IMPORTANT CORRECTION TO CN26G008: CODE INTERPRETER DOES NOT IMPLY NETWORK ISOLATION
The worker called InternLM/Lagent “VERIFIED READ-ONLY + LOCAL EXECUTION ONLY” and inferred no remote-write capability from a directory listing plus search/browser wrappers. That conclusion is unsupported and is withdrawn by this review.
Actual source retrieved:
https://raw.githubusercontent.com/InternLM/lagent/main/lagent/actions/python_interpreter.py
GenericRuntime.exec_code passes supplied Python to exec with a globals dictionary; imports are explicitly part of the tool's example. Timeout handling limits waiting, not network access. This file contains no demonstrated outbound-network restriction.
https://raw.githubusercontent.com/InternLM/lagent/main/lagent/actions/ipython_interpreter.py
Source starts a Jupyter kernel and sends code to kernel execution. A working directory, process/kernel boundary and execution timeout are not by themselves a network-denial policy. No code was run to test reachability, and any deployment may impose independent container/firewall controls not visible in these files.
Correct conclusion: general Python/kernel execution could make remote requests if the hosting environment permits them. Absence of a dedicated paste/wiki-write tool does not establish absence of remote-write capability. Likewise, GET-only browser code is not proof of no remote side effects because some target sites mutate on GET. This capability correction does NOT prove that Lagent or any Chinese lab actually performed the investigated writes.
Files were read from mutable main branches and hashed at capture; no historical commit SHA/date was established. They cannot retrospectively prove the configuration of a particular March–August deployment.

REMAINING WORKER FINDINGS AND LIMITS
CN26G002: in-repository handoff templates, proposed shared memory and ordinary memory-isolation bugs; no verified external episode. Several commit dates were not obtained.
CN26G003: DeepSeek-labelled research pipelines, harness/plugin documentation and a handbook discussion; no observed paste/wiki scratch-memory join. A README/landing-page review is not an issue-history or source-code census.
CN26G004: official DeepResearch material plus local-memory proposals; its404 documentation URL is unavailable, not a negative result for the feature. Model-serving paste links remained unreviewed.
CN26G005: Kimi/GLM searches mostly returned compatibility and diagnostic reports. One query-budget overrun is recorded above. Linked diagnostic logs remain a content-coverage gap.
CN26G006: MiniMax memory features, release notes and attributed evaluation discussions. Model names and a self-described AI author are not authenticated publisher/provider identity.
CN26G007: broad rare phrases mostly resolve to overloaded product/community terminology. Eight searches cannot exclude otherwise worded research traces.
CN26G008: source-capability limitation corrected above. Other lab/tool claims were snippet-only and remain unverified.

GitHub HTML loading-error banners do not necessarily hide the issue body, but they can hide comments and dynamic sections. The three public REST issue records succeeded without authentication and provide a useful fallback for basic body/timestamp verification. Comments, edits, repository history, gists and forks were not exhaustively reviewed. Search absence is an index observation, not proof the activity does not exist.

RESEARCH CONSEQUENCE
Continue language-neutral discovery and use source-level behavioral joins: a dated external artifact, actual research/test content, repeated marker/body/link reuse, and evidence about who or what performed the posting. Distinguish four separate categories: designed capability, human-posted diagnostics, intentional agent-community services, and independently observed autonomous external writes. Only the last category directly answers the escape-pattern question; the others can supply leads and infrastructure context.
No candidate in this pass establishes a second escaped research swarm or Chinese-lab attribution. No swarm-positive entry added to NEW_SITES.md.

ARTIFACTS
Worker reports: swarmhunt/runs/CN26G001.md through CN26G008.md (unverified originals).
Reviewed additional raw sources and metadata: investigation/china/026-source-checks/metadata.json and *.raw.
Verification script: investigation/china/verify_english_github.py.
This file is the reviewed interpretation and supersedes the overly restrictive Lagent capability claim in CN26G008.

Language scope correction: raw English phrases and actor attribution
Reviewed 2026-09-05 UTC

The investigation target is agents associated with Chinese labs or operators, independent of the language in which they reason, search, code or publish. Raw English phrases on global websites and GitHub are explicitly in scope. Chinese-language traces are one search channel, not the definition of the target.

The user clarified that the discussion concerned the raw English phrase and supplied comments challenging a Chinese-only search assumption and the literal translation of “agent” as 代理. This correction affects both search coverage and terminology. For AI-agent concepts, 智能体 and 多智能体 are useful Chinese terms; 代理 is ambiguous and often means proxy. Preserve proxy terms when investigating network tooling, but do not mistake every proxy result for an AI-agent result.

Report 008 already documented why language or website geography cannot be a gate: Tongyi's published research environment uses Google and Jina, while DeepSeek's technical report explicitly describes multilingual search-task construction. Kimi and GLM also distinguish simulated tool environments from real coding/search environments. Those are capability and task-distribution observations, not attribution of a public artifact.
Source review:
http://178.105.23.35:8090/china/reports/008-capability-hypotheses.txt
Tongyi environment description:
https://arxiv.org/html/2510.24701v1#A4
DeepSeek agent-task description:
https://arxiv.org/html/2512.02556v1#S3.SS2.SSS3

The supplied discussion also asserted that DeepSeek performs coding reasoning mostly in English. This investigation has not measured or independently established that frequency claim. It is unnecessary for the scope correction: plausible English activity is enough to require English searches. Do not elevate the comment into a verified empirical result.

Practical search implications:
- Keep original English strings intact for exact-match searches; do not replace them with a Chinese translation. When an exact string is provided, search that string before using translated expansions.
- Include global public websites and GitHub. Inspect dated issues, discussions, code/tool definitions, model reports and linked artifacts when relevant. An official agent repository demonstrates capabilities or implementation details; it does not establish an escaped swarm.
- Search structural behavior as well as labels: repeated reference-link experiments, scratch-memory-like sequences, distinctive identifiers reused across surfaces, and coherent dates. A generic English “agent” or “test” string remains weak evidence.
- Separate language, model identity, operator identity, execution location and hosting provider. None determines all the others.
- Preserve the existing evidence standard: dated source verification, cross-surface coherence, alternative explanations, and independent attribution. Commercial tools, tutorials, ordinary coding tests, spam and post-disclosure imitation remain alternative explanations.

Operational snapshot: all 112 initially scheduled research tasks have returned outputs (72 initial and 40 follow-up). The latest follow-up runner reports completion at 2026-09-05T11:13:46Z with zero harness errors. Eight additional raw-English/GitHub tasks were subsequently launched, bringing planned coverage to 120 tasks; they are a separate wave from the completed 112. Returned outputs remain unverified unless separately reviewed; this is not a claim that all relevant surfaces were reachable or that the search is exhaustive.

The website now explicitly describes English/global/GitHub coverage and the Chinese terminology distinction. The continuation handoff records the same scope correction and completed task count. Working assessment remains zero confirmed Chinese actors; no candidate was promoted by changing the search vocabulary.

XZ_KNOWLEDGE_P1 — OPAQUE PASTE CLUSTER, STRUCTURAL FORENSICS
2026-09-05 UTC. PRIORITY UNRESOLVED LEAD; no research-agent or lab attribution established.

MAIN OBSERVATION
Six independently fetched public paste bodies share the displayed author xz_knowledge_p1, language tag python, and a single-line Base64-like format. The bodies are not readable Python. A repeatable encoding anomaly is present: all six contain literal spaces and no plus signs; replacing spaces with '+' makes all six valid Base64. Merely removing whitespace fails for four of six. This is consistent with '+' being converted to spaces during form-urlencoded submission, but the original intended bytes are not proven.
Decoded bytes remain opaque. No plaintext research content, recognizable file header, or successful basic decompression was recovered. Automated/encrypted storage, a client test, arbitrary binary data, or some other posting tool remain alternatives. This is stronger evidence of a repeated posting format than of a research-agent swarm.

OBSERVED SCOPE AND PROVENANCE
The six IDs were already indexed/fetched in the unverified CN26F017 report. Their swarmhunt cache files existed, but held HTML-to-text extractions, not exact HTML or canonical authored text. The ongoing numeric survey had not yet downloaded these six when this review started. Therefore six additional sequential origin GETs were made, with1.6s delay between responses and requests, while the independent survey continued. No other origin URL was fetched by this task. All six returned HTTP200 with actual matching numeric pages, author/date headers and authored textarea data.
Local fetch interval: 2026-09-05 11:17:08–11:17:20 UTC (HTTP Date headers). Authored text is extracted from textarea[name=code2], not from prettified syntax highlighting or model excerpts. No pasted code was executed, no embedded URL called, and no decoded payload content was printed or published.

SIX STRUCTURALLY REVIEWED PASTES
Public source URL for each: https://paste.ubuntu.org.cn/<ID>
ID       Claimed local date   Text chars  Spaces  Padding  Decoded bytes*  Entropy(bits/byte)*  zlib ratio*
4548782  2026-07-12 00:43     124         2       0        93              6.106               1.118
4548856  2026-07-12 06:50     424         3       2        316             7.306               1.035
4550067  2026-07-14 21:42     488         8       2        364             7.433               1.030
4550729  2026-07-16 11:35     500         5       1        374             7.433               1.029
4551521  2026-07-18 16:20     500         5       1        374             7.496               1.029
4552198  2026-07-20 04:18     572         7       1        428             7.517               1.026
*For the explicitly hypothetical spaces-to-plus transformation. Ratios are compressed size/original byte size; values above1 mean compression made the data larger. Small samples have biased entropy estimates and cannot diagnose a cipher.

All six are one line, all six bodies have distinct hashes, and the longest common prefix between any pair is only one character. Alphabet is limited to Base64 characters plus spaces; none has an unexpected punctuation/content character. All six transformed strings decode to non-UTF8 byte sequences. Approximately36–39% of the transformed decoded bytes are printable ASCII/whitespace, consistent with opaque binary rather than text but not proof of encryption.
No recognized leading gzip, ZIP, bzip2, xz, PNG, PDF or OpenSSL Salted__ header. Bounded local zlib/gzip/raw-DEFLATE attempts failed for every decoded variant; no decompressed content was recovered. No password guessing, decryption or execution was attempted. Decoded lengths modulo16 vary, so there is no simple uniform block-padding signature in these six examples. No opaque blob, credential candidate or decoded byte excerpt is reproduced here.
Whitespace-removal alone happens to decode two samples; one of those is non-canonical when re-encoded. Therefore silently stripping whitespace and treating the result as the original payload would be unsound. The plus-restoration hypothesis fits all six lengths and padding more consistently, without establishing what the binary contains.

ADDITIONAL LOCAL SURVEY EVIDENCE (HEADERS ONLY, NOT SIX MORE BODY ANALYSES)
While this review was running, the existing numeric survey supplied eight further distinct pages whose actual author header is xz_knowledge_p1 [python]:
4548564 — 2026-07-10 22:24
4548565 — 2026-07-10 22:25
4548575 — 2026-07-10 22:30
4548578 — 2026-07-10 22:30
4548579 — 2026-07-10 22:35
4549705 — 2026-07-13 23:48
4550704 — 2026-07-16 09:29
4550705 — 2026-07-16 09:34
This makes14 distinct known author-attributed IDs in the union at this checkpoint and moves the earliest observed claim from July12 to July10. The July10 group contains five postings within11 minutes, including pairs at the same displayed minute or one minute apart. That suggests a batch/tool process worth measuring, but a small selected subset cannot establish a fixed cadence or full posting count. These eight were discovered from already-present local HTML only; no extra network request was made for them here. Their contents were not added to the six-body structural table.

CROSS-SOURCE SEARCH
Five web queries were used: exact xz_knowledge_p1; xz_knowledge excluding this host; exact author plus host/July; author plus pastebin; xz_knowledge plus github. The tool returned no results. This is limited indexing/search coverage, not evidence the handle exists nowhere else. No cross-host join, attributable lab identity, creator IP or authenticated ownership was found. The pinyin-like handle and the Chinese interface do not establish nationality or model provider.

DATING LIMITATIONS
All July dates are server-rendered claims observed September5. No independently obtained July capture was verified. The separate Ubuntu timestamp audit found RSS timezone inconsistency, so dates are preserved literally and not normalized to UTC. Displayed author strings are user-supplied labels; they can be copied/spoofed and are not authenticated identity evidence. Same handle plus same encoding shape is a candidate cluster, not proof one person or one program authored every paste.

ASSESSMENT AND NEXT DISCRIMINATORS
Confidence: high that the six saved artifacts share a distinctive opaque encoding format; moderate that some scripted posting process is involved when combined with short-interval header batches; unknown content/purpose; no evidence sufficient for a research-agent or second-lab conclusion.
The ongoing authorized survey can measure all matching author headers, exact posting cadence, p1/p2-style label variants, body-length distributions and repeated payload hashes without decoding private content. Compare a sample of neighbouring author labels and encoding shapes to determine whether this is a broader storage client or spam/testing run. A date-anchored public source identifying the client/software would be more discriminating than another guessed model name. Seek independently dated archives of a few already-public IDs. Stop short of publishing or interpreting opaque payloads as research memory without recoverable, relevant context.
No change made to NEW_SITES.md as a swarm-positive finding. Numeric survey continues separately; this report did not stop or restart it.

ARTIFACTS
Exact raw HTML: pastebins/data/paste.ubuntu.org.cn/china-codex-xz/<ID>.html (private directory).
Per-paste response and authored-body SHA256, HTTP/fetch dates, lengths, author/date header and structural metrics:
pastebins/data/paste.ubuntu.org.cn/china-codex-xz/metadata.json
Copy of structural metadata: investigation/china/024-xz-structural-metadata.json
Additional header checkpoint: investigation/china/024-xz-survey-author-observations.json
Reproducible bounded fetch/decode script: investigation/china/xz_structural_review.py
The source model report and finding record remain unverified: swarmhunt/runs/CN26F017.md and its low-confidence thread=? finding. This review supersedes its assumption that whitespace should simply be removed before decoding.

REVIEWED — SURFACE LINKS SCAN COMPLETE
Reviewed 2026-09-05 UTC. No new rare-candidate source or verified second actor found.

COMPLETE COVERAGE
One August text-plus-links pass finished in1,604seconds (26min44sec).
100,000/100,000 WET-manifest files processed;0 failures.
2,083,525,558 text pages examined with corresponding existing links extracts.
3,940 matching page rows across102 registrable source domains.
0 bytes downloaded; all100,000 text files and100,000 links files were present at preflight. No malformed final result rows.
Remote PID171673 exited after completion. No repeat job, new corpus, target write or infrastructure change. EC2 remains running.

PRIMARY CANDIDATE RESULTS
1785436446544 (unreadable bridge destination):1 text hit,0 link hits. The sole text source is the already archived https://textshare.online/d4622e/. Its destination URL is plain text, not an observed clickable href in the links extract. No new source or body recovery resulted. Report020's destination HTTP503/no-capture limitation remains UNKNOWN, not a negative actor finding.
1784928797078 (candidateA QA_REPORTING):0 text hits,2 link hits. They are the already known https://share-text.org/public-notes?page=19 and https://share-text.org/ru/public-notes?page=19, linking respectively to /view/1784928797078 and /ru/view/1784928797078. Relative hrefs were resolved against the source URL and actual host/path validated. These are two localized listings on the same surface, not two independent actor events. Report016's August10 archived listing anchor and report019's current reusable QA-template review remain the appropriate disposition.
1786814922347 (candidateB planner configuration):0 text or link hits. No new date or body evidence.
textshare.online/d4622e/ (exact source-page reference):0 text or link hits from other page content/links. Its own page's presence does not imply someone linked to it: ccsearch terms are matched against body/links, not the source URL field.

Thus only2 validated candidate-target href examples from2 source pages exist in final results; both are previously reviewed same-surface listings. There are0 new external candidate-target href sources. The separate known cross-surface plain-text reference is real but its purpose and destination content remain unknown.

REVIEW SCOPE
Manually inspected all3 rare-term matching rows and their JSON link evidence. Reused already recovered archived bodies/metadata from016 and020; no redundant target/archive fetch was necessary. This review used0 of the permitted6 new retrievals. No generic directory/spam bodies were re-triaged. Broad service references and own-site navigation do not establish research-agent behavior.

HOST-BOUNDARY VALIDATION
Link-term counts include href strings and anchor text. The parser resolves relative hrefs, then validates parsed target hostname exactly; merely embedding the desired URL in another host's query or anchor is not a direct target link. This removed76 non-target-host netcut evidence examples and66 note.ms examples from direct-link counts. Examples are capped by ccsearch at3 per term per source page, so validated example/source-page totals are lower bounds where output evidence is capped. They are not a complete inventory of all hrefs in each original page.
Case-sensitive exact terms, Common Crawl sampling, expired/unindexed/private pages and missing full target content still limit recall. The result cannot establish that no Chinese, English-speaking Chinese-model or other research swarm exists.

FINAL COUNTS
Columns: term | text-page hits | link-page hits | distinct source pages with a validated direct target href (from saved evidence).
1785436446544 | 1 | 0 | 0
1784928797078 | 0 | 2 | 2
1786814922347 | 0 | 0 | 0
textshare.online/d4622e/ | 0 | 0 | 0
//share-text.org/ | 8 | 630 | 629
//textshare.online/ | 2 | 267 | 267
//textdb.online/ | 0 | 0 | 0
//api.textdb.online/ | 0 | 0 | 0
//webnote.cc/ | 7 | 11 | 11
//netcut.cn/ | 95 | 1866 | 1790
//getnote.top/ | 3 | 7 | 7
//paste.ubuntu.org.cn/ | 9 | 6 | 6
//note.ms/ | 79 | 163 | 96
//www.netnr.eu.org/ | 1 | 1048 | 1048

REPRODUCIBILITY
Terms: investigation/china/terms_china_codex_surface_links.tsv (14 terms).
Remote output: /data/runs/china-codex-surface-links.
Local raw scores/log/domain aggregation/generated report: investigation/china/cc-surface-links/.
Safe term counts:023-link-summary.json. Rare source/href pairs:023-candidate-links-internal.json.
Parser: summarize_surface_links.py. Bounded completed monitor: monitor_surface_links.py. Original launch method/progress details preserved in023-initial-methods.json.
Command: ./target/release/ccsearch --corpus /data/corpus --links /data/links --s3 --s3-endpoint http://s3.us-east-1.amazonaws.com --crawl CC-MAIN-2026-34 --concurrency 384 --out /data/runs/china-codex-surface-links --port 8097 --exit-when-done --score-terms /data/runs/terms_china_codex_surface_links.tsv --report-domains 100000 --report-pages 20000

Progress reports were automatically refreshed approximately every60seconds and labelled AUTOMATIC. This final assessment is analyst reviewed. Final DONE matches equal final score rows; earlier gaps came from per-file output buffering and non-atomic progress snapshots.

Portable China reachability comparison kit prepared
Reviewed 2026-09-05 UTC

A concrete comparison artifact is ready; no worker was provisioned, no purchase was made, and no live reachability probes were repeated to prepare or test it.

Download code and instructions:
http://178.105.23.35:8090/china/downloads/vantage-probe.zip
Local source:
/home/sophia/search/investigation/china/vantage-probe/probe.py
/home/sophia/search/investigation/china/vantage-probe/README.txt

The standard-library Python script accepts --label and --out and has ten fixed targets matching report 002: Baidu, Bing-CN, Sogou, so.com, Gitee gists, Huiji homepage/API, BWiki homepage/Genshin API, and MoeGirl homepage. It does not accept arbitrary target URLs. All requests are GET, sequential, with at least 1.5 seconds between same-host starts. Redirect destinations are checked for public addresses and potentially mutating routes. There is no authentication, JavaScript, CAPTCHA handling or cookie jar.

Each operation uses a 20-second socket timeout and retains at most 2MB of response data. Redirects and progressing reads can extend wall-clock duration; this is not an absolute whole-program deadline. Raw bodies and JSON records stay in the user-selected output directory. The output directory must be new, so earlier observations are preserved.

Records distinguish HTTP errors, suspected challenges, JSON with a recentchanges array, generic JSON, and HTTP200 content of unknown semantic usefulness. Status, final URL, UTC timestamps and retained-body SHA256 are recorded. These classifications are measurement aids; a challenge detector can miss a challenge, and valid JSON can still contain an application error. A successful transport response does not prove relevant search results.

The README includes exact scp/ssh command templates for an existing HK worker, commands to return the output, and a matching local comparison invocation. Host/user/SSH-key placeholders contain no credentials. The ZIP contains only probe.py and README.txt, no result bodies, logs, credentials, or local test files.

Verification used fake HTTP responses only: fixed target count, timeout/GET arguments, actual JSON recognition, HTTPError403 preservation, HTTP200 challenge distinction, 2MB body cap, private-address/mutation rejection, and per-host pacing. ZIP contents were checked explicitly.

Interpretation: the location label is supplied by the operator and is not independently verified geolocation. A Hong Kong or Singapore worker supplies a routing/IP-reputation comparison, not guaranteed access. Authentication remains a separate limitation. Repeat low-rate measurements at different times before moving research workloads.

Baseline observations and provider-source context:
http://178.105.23.35:8090/china/reports/002-infrastructure.txt
https://intl.cloud.tencent.com/document/product/1103/47794?lang=en
https://www.alibabacloud.com/help/en/simple-application-server/user-guide/create-a-server
https://www.alibabacloud.com/help/en/simple-application-server/product-overview/instance-families/
These provider links are carried from report 002 as context, not new price verification. No observation in this kit is evidence of a Chinese agent swarm.

FIRST 72-TASK WAVE — COORDINATOR ASSESSMENT
2026-09-05 11:05 UTC. Forty targeted follow-up tasks are now running.

All72 original tasks produced model reports, with no final report headed by a fatal harness ERROR. This is output completion, not proof that every query succeeded or every target was covered. Some reports reached their step limit, some tool calls had recoverable formatting errors, and many sites or archive routes were unavailable. The first21 reports came from the initial runner; the remaining51 from the resumed runner with network and task-attribution fixes.

There is still no verified Chinese/second-actor research swarm. At this checkpoint, shared finding logs contain31 new entries:28 labeled benign/noise N and3 uncertain ?. No model recorded a new A attribution in this wave. Counts may omit first-process events whose task context was lost; the underlying log timestamp and per-task reports are retained. These numbers describe model dispositions, not independently verified discoveries.

The three uncertain records do not currently support an actor finding:
1. zblog.nciaer.com/?id=2: coordinator verified a routine promotional guestbook comment, with no research/test/coordination pattern. Relevance rejected in007.
2. scanner.etherpad.org/instances/dh%2E6s3%2Ecn/: software-scanner metadata suggesting an Etherpad instance. The origin was inaccessible; no actual pad artifact was inspected. Keep the surface as access-unknown. An instance/version/date is not a medium-confidence swarm candidate.
3. thefomite.com/wire: coordinator verified a deliberately agent-inviting experiment. The two observed posts are a containment test and a site-seeded transmission phrase. Relevance as a spontaneous Chinese research swarm rejected in017.

Separate coordinator archive work, not counted as a bot positive, strengthened and then resolved the share-text QA prompt: its listing existed by August10, and its current full body is an unfilled human-directed QA template. Historical full-body continuity remains unproved. See019.

What changed usefully: more actual public Chinese-language software instances and indexed historical paste IDs were found; BWiki API access proved usable in bounded checks; Chinese lab reports support multilingual/international searches; timestamp and corpus-selection claims were corrected; and a longer read-only Ubuntu paste survey is collecting a previously unsurveyed historical interval. None of those coverage improvements identifies an actor by itself.

Current continuation:40 fixed follow-up tasks,24 worker slots, shared20USD incremental OpenRouter budget guard across all processes. The measured API usage was about1.24USD at11:04UTC; consult the live budget JSON for the latest figure. Separate Serper/AWS costs are not included. The survey and website update independently; their automatic reports are explicitly separated from reviewed findings.

Reviewed reports and downloads: http://178.105.23.35:8090/china/
Machine reports/transcripts: swarmhunt/runs/CN26*.md and .log, private pending review/redaction.

TEXTSHARE → SHARE-TEXT BRIDGE — DESTINATION UNKNOWN / ACCESS FAILURE
Reviewed2026-09-05 UTC. No verified swarm connection or lab attribution.

Established source:
https://textshare.online/d4622e/ was recovered from Common Crawl with HTTP200 at2026-08-12 19:00:13UTC. Its anonymous, July31-labelled plain-text note contains a single link to https://share-text.org/view/1785436446544. This is a verified pre-disclosure cross-surface reference. Its author and purpose are unknown; ordinary human link sharing remains a sufficient explanation.
The source date label is not independent creation proof. The August12 archived capture independently establishes the link's presence by that date.

Bounded destination check:
ONE direct public GET to https://share-text.org/view/1785436446544 at2026-09-05 11:04:54UTC returned HTTP503, Content-Type text/plain and a17-byte error body: error code:1102. Response headers identify Cloudflare. No cause is inferred from the error code alone. No redirect, retry, authentication attempt, browser execution or embedded URL/API call followed.
Because the response is an actual short error rather than a Next.js editor shell, there are no React/JSON text chunks to parse and no current note content was recovered.

Archive fallback:
One successful byte-range GET reused the already-established August zipnum block locator, cdx-00248.gz range206106697-206379616. Filtering only the exact discovered destination ID1785436446544 within share-text.org URL keys yielded zero records in any indexed locale in that complete host-key block. Therefore no candidate WARC member was available to retrieve. This is a no-capture result for the checked crawl, not proof that the destination is absent or benign.
The coordinator previously reported no matching entry in the720 locally enumerated September5 listing rows. That does not improve historical/body coverage beyond the limits of that listing sample.

Disposition:
CROSS-SURFACE LINK CONFIRMED; DESTINATION BODY UNKNOWN.
The source contributes no known swarm marker, data-source link or research-memory state beyond the destination URL. Without destination content or provenance, this cannot be closed as a positive agent bridge, nor conclusively classified as ordinary human sharing. Keep as a low-confidence unresolved link-context lead. A later successful public read could resolve it; repeated requests during the current503 condition are unwarranted.

Evidence:
Source capture and source metadata: investigation/china/surface-pivot-reviews/textshare.warc.gz,.warc,-metadata.json (report016).
Destination response: pastebins/data/share-text.org/china-codex-textshare-bridge-current-internal.html.
Destination status/time/bytes/SHA256: china-codex-textshare-bridge-current.json.
Headers: china-codex-textshare-bridge-headers.txt.
Exact archive lookup result: china-codex-textshare-bridge-cdx.json.
No personal/credential excerpts or callback links were inspected or published; no target writes occurred.

Request total for this follow-up:1 original public GET and1 archive-index GET. Combined with report016's six archive calls, only seven archive calls were used; no new full scan or infrastructure was needed.

SHARE-TEXT QA PROMPT — FULL CURRENT TEXT RECOVERED
Reviewed 2026-09-05 UTC. Candidate A from009/012/016 remains unconfirmed as actor evidence.

URL: https://share-text.org/zh/view/1784928797078
Canonical metadata URL: https://share-text.org/view/1784928797078

After more than ten minutes without requests following the earlier listing error, one direct public GET returned HTTP200. The apparent Loading editor page was not an empty note. Its HTML contains JSON-encoded Next.js text chunks. Parsing those strings as data, without executing JavaScript, recovered a 10,650-byte HTML text record and an 8,702-character plain-text representation. This differs from the listing's 8,611-character count because the rendered/extracted representations have different formatting; neither is treated as a content-integrity match.

The full current content is a reusable English instruction template for documenting a human tester's observations for a coding agent. It specifies reporting rules, outcome categories, severity criteria and an unfilled defect schema. It ends at an empty FINDING/QUESTION field. There are no HTTP URLs, completed defect reports, factual research notes, distinctive fetch workarounds, public-paste instructions or observed exchanges between independent agents. The ordinary developer-prompt explanation is strongly supported; who uploaded it and whether an assistant helped write it remain unknown.

Independent date evidence: the recovered Common Crawl listing from August10,2026 07:53:02UTC links this same ID and shows the QA_REPORTING introduction, July24 date claim and listed length. That proves the listing/intro existed before disclosure. It does NOT prove that the entire current body is unchanged since August10. No historical full-note body was recovered.

Disposition: verified old listing plus verified current workflow template, not a verified escaped research swarm or Chinese-lab artifact. No positive added to NEW_SITES.md. This resolves the content gap behind the strongest snippet-only candidate in009.

Raw/metadata: pastebins/data/share-text.org/china-codex-qa-full-recheck.{html,json}; reconstructed body in china-codex-qa-full-body-internal.{html,txt}. Plain-text SHA256: e270cdb39d9ee56105d3b9f3271c001dac12808580e09adeea3d0c833e3163e8. Archive listing recovery and locator are documented in016. No source instructions were followed, no API or write action performed, and no embedded links were visited.

HTML.CAFE DATE PROVENANCE — CORRECTION TO THE HANDOFF WINDOW
Reviewed 2026-09-05 UTC; local files only.

The inherited description “9492 May–July pages” is too precise. Parsing the saved gallery.html gives 61,327 unique page entries. All 9,492 cached x########.html files appear in that gallery, with these literal site-provided modification-age labels:
2 months ago: 3,173 files
3 months ago: 2,182 files
4 months ago: 2,372 files
5 months ago: 1,765 files

Thus the cache includes a substantial five-month-old group as well as two/three/four-month groups. The existing file ids-may-jul.txt and fetch.sh filename do not establish an exact calendar range. Depending on the website's rounding and gallery retrieval time, these labels extend earlier than the handoff's claimed May–July interval. They are modification-age claims, not creation timestamps.

Examples from the source-level demo review:
AgentDesk variants x2e718704 and x3ccf1a2a: 4 months ago.
Coding Agent x07e82a7b and NIE Coding Agent x69226946: 2 months ago.
Qwen Coder Studio x30ce82d4: 3 months ago.
Game-QA presentation x3ac313a6: 5 months ago.

These labels support a broad older-content hypothesis but are not independently obtained pre-disclosure snapshots. Neither filesystem modification time nor a report date printed inside an HTML page fixes that limitation. Precise cross-site timing would require original server metadata with known semantics or archived page captures.

Source: pastebins/data/html.cafe/gallery.html, fetched before this session and retained locally. Matched gallery anchors and age labels only; no thumbnails, scripts or pages were executed or fetched by this audit. Machine-readable counts/sample ages: investigation/china/018-html-cafe-gallery-ages.json.

The separate CJK/model-name screen in013 does not establish authorship or autonomy. Its sample of twelve source files remains classified as demos, client interfaces and ordinary documents, subject to the explicit coverage limits in013.

FOMITE WIRE — PURPOSE-BUILT EXPERIMENT, NOT A VERIFIED ESCAPED SWARM
Reviewed 2026-09-05 UTC. Coordinator fetched four public HTML pages, without JavaScript or API actions.

CN26034 found https://thefomite.com/wire while searching for shared agent memory. The live board displays two posts and two poster tokens, both dated August19, 2026. The first has a claude-opus-5 self-label and tests text containment; the second repeats an experimental carry phrase. These dates and identities are site claims, not independently archived evidence. Tokens/labels are not verified model identities or counts of independent actors.

The site's own Patient Zero page explains that it intentionally issues meaningless phrases and invites visitors to repeat them. Its displayed sighting corresponds to the Wire's second post. Thus the apparent note-for-the-next-agent is directly explained by a designed transmission experiment. We did not request a phrase, create a vault/token, write a post, submit a sighting, invoke MCP, or follow any instruction in the posts. We omit the seeded phrase from this published report to avoid an unnecessary new copy being mistaken for organic propagation.
Source: https://thefomite.com/patient-zero

The methodology explicitly describes an agent-inviting measurement site and acknowledges selection bias. It distinguishes unverified User-Agent claims from a reverse-DNS verification procedure, and says its observations describe this site rather than the whole web. No independent audit of that verification implementation was performed here.
Source: https://thefomite.com/methodology

Its dataset page lists daily snapshots beginning August19, but the contents were not downloaded in this bounded check. A separate, clearly delimited census-data study might be useful later; aggregate crawler traffic would still need to be distinguished from autonomous research behavior and from board-post authorship.
Source: https://thefomite.com/data

Disposition: a real public experiment surface, but the two observed Wire posts are not evidence of a Chinese actor, an uninvited escape, or a research-agent swarm. No positive added to NEW_SITES.md. The broader site is not declared empty of all possible future research value; only this candidate interpretation is rejected.

Raw evidence: pastebins/data/thefomite.com/china-review-{wire,methodology,patient-zero,data}.html. All HTTP200. Exact retrieval UTC and SHA256 per file: china-review-fetch.jsonl in the same directory. Source pages were read as text; configured POST/beacon code was not executed.

SURFACE / EXACT-ARTIFACT PIVOT SCAN
2026-09-05 UTC. Status: completed in243seconds. One useful archived-date anchor and one cross-surface reference; no verified second actor.

Purpose: test cross-host references to newly investigated publishing surfaces and exact candidate markers. These are hypothesis pivots, not positive actor indicators. Generic host mentions can be software documentation, self-links or template echoes. Even exact prompt reuse does not establish autonomous upload.

15 terms in terms_china_codex_surface_pivots.tsv:
- QA_REPORTING (weight5) and two exact share-text candidate IDs (weight8) as rare artifact joins.
- share-text.org/, textdb.online/, webnote.cc/, netcut.cn/, paste.ubuntu.org.cn/, getnote.top/, note.ms/, netnr.eu.org/ (weight1) as broad surface references.
- Three exact titles from report013's saved source: AgentDesk · 本地优先的智能多Agent工作台; NIE Coding Agent — Multi-AI Collaborative Coder; Qwen Coder Studio — Local WebGPU AI (weight4). Each title's literal presence was rechecked in the corresponding local HTML. Potential design/template joins, not attribution.
- nie-ai.vercel.app (weight2), a literal backend reference in html.cafe/x69226946 source. Not contacted or executed.

Remote existing EC2 44.222.74.56, preflight idle with load0 and unused port8097 at10:54 UTC.
Output /data/runs/china-codex-surface-pivots.
Log ~/china-codex-surface-pivots.log.
Invocation: ./target/release/ccsearch --corpus /data/corpus --s3 --s3-endpoint http://s3.us-east-1.amazonaws.com --crawl CC-MAIN-2026-34 --concurrency 384 --out /data/runs/china-codex-surface-pivots --port 8097 --exit-when-done --score-terms /data/runs/terms_china_codex_surface_pivots.tsv --report-domains 100000 --report-pages 20000

Text-only existing corpus. No links corpus scan, new infrastructure, target writes or forbidden private terms. As in prior scans, source fallback can stream missing corpus files; final downloaded-byte count will establish whether this happened. All groups will be counted separately. Archived context recovery, if warranted, is capped at eight paced index/WARC requests.

Limits: text extraction omits most href URLs and code/script text, so a host-reference negative is particularly weak without a WAT links scan. Common Crawl coverage and exact spelling/case also limit recall. Short note.ms is explicitly requested as a host pivot despite its potential accidental/ambiguous matches. Page score is a retrieval priority, never a probability of agent activity.

COMPLETE SCAN RESULTS
100,000/100,000 WET files;2,083,525,558 pages;0 failures;0 downloaded bytes.
138 matching pages on51 registrable domains. Groups:2 rare-marker pages,135 surface-reference pages,1 derived-backend substring page. No exact candidate-ID or demo-title text hits.
Files: cc-surface-pivots/{scores.tsv,domains.tsv,report.html,china-codex-surface-pivots.log};016-term-counts.json.
Scores and counts are retrieval indicators, not attribution. free.co.tz alone contributes65 pages, consistent with repeated host-reference/template noise; those65 were not separately verified. No broad links-corpus scan is justified solely by these counts.

1. QA_REPORTING — SAME SURFACE, INDEPENDENT PRE-DISCLOSURE LISTING
Two hits are https://share-text.org/public-notes?page=19 and https://share-text.org/ru/public-notes?page=19. They are localized listings, not two independent agent episodes.
Recovered the English listing through the existing local zipnum cluster index and one WARC byte-range request. CDX timestamp20260810075302 (August10 at07:53:02 UTC), HTTP200. The Russian listing also has a CDX record at20260810072637 but its WARC was not fetched.
The English archived row links /view/1784928797078 and contains <mode>QA_REPORTING</mode>, displayed date Jul24,2026 and8611characters. This independently establishes candidate A's listing and visible prompt introduction by August10, before disclosure. It does not independently prove July24 creation or who uploaded it. The archived React payload repeats the truncated snippet; no historical full note body was recovered.
This is new evidence strength, not a swarm-positive. A guessed Chinese prior did not find it; the exact newly observed marker did. Exact-ID text terms scored zero despite the archived link existing, illustrating the WET-text versus href visibility limitation.
Coordinator follow-up recovered the current full body via a read-only origin fetch and safely parsed React data: a reusable QA-reporting prompt with blank finding/question fields, no URLs and no completed issue/research state. See report019 (current full-body review) and china-codex-qa-full-body-internal.{html,txt} under pastebins/data/share-text.org/. That current body is not an independently archived August full body and cannot prove historical text unchanged.
Evidence: pastebins/data/share-text.org/surface-pivot-archive/metadata.json, cdx-selected.json, safe-candidate-A-anchor.json. INTERNAL-listing.warc.gz/.warc/.html contain the archived full listing and must not be published unredacted because unrelated rows may contain sensitive material.
WARC: crawl-data/CC-MAIN-2026-34/segments/1786091385322.54/warc/CC-MAIN-20260810065506-20260810095506-00354.warc.gz offset424530177 length31392.
Decompressed WARC SHA256:3e0b506ce20a060cc38b9851b38603a016d7bf96a124c64d9f2ff23413a677a7.

2. TEXTSHARE.ONLINE — VERIFIED CROSS-SURFACE REFERENCE, ACTOR UNKNOWN
https://textshare.online/d4622e/ matched share-text.org/. Its archived HTTP200 body (August12 at19:00:13 UTC) is a Text Share Online plain-text paste labelled Anonymous and July31,2026. The authored content is a link to https://share-text.org/view/1785436446544. It displays plain-text syntax and no expiry. This is a concrete public-paste-to-public-paste reference, not merely a directory mentioning a service.
The destination note was not visited. No source-task links, research scratch state, autonomous posting provenance or actor identity have been established. Human link sharing remains an ordinary explanation. Treat as a low-confidence surface-connection lead, not an escaped research-agent event.
WARC: crawl-data/CC-MAIN-2026-34/segments/1786091385525.56/warc/CC-MAIN-20260812165636-20260812195636-00504.warc.gz offset465410547 length20877.
Raw evidence and capture metadata: investigation/china/surface-pivot-reviews/textshare.warc.gz,.warc,-metadata.json. Raw includes site scripts; no scripts or linked destinations were executed.

3. NIE BACKEND — FALSE POSITIVE FROM SUBSTRING MATCHING
https://muzbox.tistory.com/483691?category=1217861 matched nie-ai.vercel.app. Archived HTTP200 August11 at20:29:38 UTC reveals the actual destination is https://shop-genie-ai.vercel.app/, a ShopGenie AI shopping-product-page application described by a Korean blog. The suffix overlaps the detector; this is not a reference to the NIE Coding Agent backend. It is therefore not even a verified template/client join. Future backend searches should use a scheme-qualified or hostname-boundary detector.
Raw evidence: surface-pivot-reviews/nie-blog.warc.gz,.warc,-metadata.json; selected-captures.json supplies locator.

4. OTHER USEFUL SURFACE URLS (URL-TRIAGED, NOT POSITIVE ARTIFACTS)
https://webnote.cc/llms.txt and https://webnote.cc/p/e8b0d71721e85527 — actual indexed service documentation/published-page routes; content review belongs to live-agent work. Self-hosted references do not demonstrate agent activity.
https://gist.github.com/zhugezifang; https://cn.v2ex.com/t/957841; https://meta.appinn.net/t/topic/79424; https://pknote.top/77.html — potential service discussions/reference lists. Not all were fetched, so do not call them cleared.
https://netnr.com/1606/edit and /448/edit — indexed edit-shaped URLs; no live requests or form actions made. Existing netnr.eu.org proxy/tutorial reference remains non-agent evidence.

ARCHIVE REQUEST ACCOUNTING
Six paced requests total: one share-text CDX block+one listing WARC; one textshare CDX block+one WARC; one Korean-blog CDX block+one WARC. Every request succeeded. Sequential pulls within loops slept1.6seconds; other requests were separated by tool/read/analysis work. No requests to original targets, no writes, no callback/credential-note visits, no new infrastructure and no full links scan. The compute job exited after completion; EC2 remains running.

EXACT TERM COUNTS (id,weight,page count,term)
0	5	2	QA_REPORTING
1	8	0	1784928797078
2	8	0	1786814922347
3	1	8	share-text.org/
4	1	0	textdb.online/
5	1	7	webnote.cc/
6	1	96	netcut.cn/
7	1	9	paste.ubuntu.org.cn/
8	1	3	getnote.top/
9	1	79	note.ms/
10	1	3	netnr.eu.org/
11	4	0	AgentDesk · 本地优先的智能多Agent工作台
12	4	0	NIE Coding Agent — Multi-AI Collaborative Coder
13	4	0	Qwen Coder Studio — Local WebGPU AI
14	2	1	nie-ai.vercel.app

FOLLOW-UP020: The textshare destination received one live read, returningHTTP503/error1102; a targeted August index check found no capture. The cross-surface source link remains verified, destination content unknown. See020-textshare-bridge-review.txt.

WHAT THE BILLION-PAGE SCAN COVERS
Reviewed 2026-09-05 UTC.

Common Crawl's official language table reports Chinese (zho) as 4.3829% in CC-MAIN-2026-34, 4.4292% in July (2026-30), and 4.5771% in June (2026-25). The language detector is CLD2; the table uses the primary language and language detection is applied to HTML pages. These are crawl-composition figures, not estimates of what fraction of the Chinese internet is captured.
Source: https://commoncrawl.github.io/cc-crawl-statistics/plots/languages

The local scanner counted 2,083,525,558 text records. Do not multiply that count by the published language percentage and describe the result as a measured Chinese-page total: the scanner's text-record denominator and the official language table's denominator have not been reconciled.

Common Crawl warns that its domain rankings reflect crawling constraints, including robots exclusions and avoidance of excessive server load. Therefore highly ranked real-world domains may be underrepresented. Our own archive work illustrates a narrower practical gap: neither of two dated share-text candidate IDs was present in the inspected August index block, despite successful live listing retrieval.
Source: https://commoncrawl.github.io/cc-crawl-statistics/plots/domains.html

Inference: a full pass through this large corpus is a valuable rare-string detector on an accessible crawl, but it is not an exhaustive search of Chinese platforms. Missing pages, expiring unlinked notes, login walls, dynamic content, uncertain publication dates and lexical mismatch all limit sensitivity. Chinese-language index coverage and Chinese-lab activity are also different questions: reviewed lab reports describe English/multilingual research over international sources.

The current no-confirmed-actor assessment describes the evidence collected so far. It does not justify assigning a probability of nonexistence from the billion-page denominator.

HTML.CAFE — CHINESE/CJK AND AGENT-THEMED SOURCE REVIEW
2026-09-05 UTC. Local files only; no network requests, browser rendering, script execution, or configured API calls.

MEASURED SCREEN
Parent-run html_cafe_language_audit.py reports 9492 matching x########.html files, 3786 with at least one visible-text CJK ideograph, and 271 matching its language/model/test/memory keyword regex. These are file counts, not people, agents or independent episodes. The keyword count is not restricted to CJK files; an English/Japanese page naming Qwen can match.
The script removes script/style/noscript tags with BeautifulSoup, then uses U+4E00–U+9FFF as the CJK signal. One ideograph is enough; Japanese text qualifies. This is not Chinese-language identification. Parsing malformed HTML can expose bundled script strings as visible text: JoySpace is a concrete example. The counts establish an overlooked mixed-language subcorpus, not 3786 Chinese users or 271 swarm candidates.

BOUNDED REVIEW:12 SOURCE FILES
The following classifications use actual saved HTML, script functions, embedded data, metadata and selected code context. Every file was parsed as text. Referenced external scripts were not fetched. Any described client capability remains source-level, not runtime-verified.

1. https://html.cafe/x2e718704
Title: AgentDesk · 本地优先的智能多Agent工作台
Category: marketing/architecture landing-page demo. Talks about task trees, local/cloud models and an upcoming download. Its397-character inline JavaScript only smooth-scrolls anchor links. The file itself is not a running orchestration backend or a completed multi-agent trace.

2. https://html.cafe/x3ccf1a2a
Title: AgentDesk · 本地优先的智能多Agent工作台
Category: expanded variant of the same landing-page concept. Adds benchmark tables, commercial roadmap and future enterprise plans. Inline JavaScript is again 397 characters of anchor scrolling. Benchmark numbers and claimed product features are page claims, not verified measurements. Two similar pages show a design/content relationship, not evidence of autonomous coordination.

3. https://html.cafe/x07e82a7b
Title: Coding Agent
Category: Japanese-language browser coding client. UI asks the user for model-service credentials and GitHub repository connection details. Code contains repository reads, model chat and a GitHub write operation guarded by an approval UI. None was invoked. A credential-input interface plus API code is ordinary application source, not evidence that a model autonomously posted this page or used it as research scratch memory.

4. https://html.cafe/x69226946
Title: NIE Coding Agent — Multi-AI Collaborative Coder
Category: Japanese-language multi-model coding interface/client. Source defines runAgent, deep-think/review/search/image tools, a chat-completions backend, local browser sessions and an interactive activity timeline. The initial visible state has zero logs and awaits user input. This is meaningful implemented client logic, not merely static branding, but contains no observed completed research episode or artifact-publication history. No backend availability or actual collaboration verified.

5. https://html.cafe/x001fcd09
Title: AI 财富管家 · 实验页
Category: elaborate financial-app prototype. Inline script contains preset action steps, delayed transitions and result displays; functions include runAgentSteps and runAgentExec. No fetch calls in the saved file. The so-called agent execution is represented by timed UI behavior rather than evidence of executed financial operations. Personal and financial-looking values are omitted; whether every displayed value is fictional is not independently known.

6. Personal AI-chat archive (public-report URL omitted)
Title withheld here because it identifies a personal conversation archive.
Category: static personal AI-chat archive with Kimi labels, no inline script. Contains sensitive personal discussion, deliberately not summarized or quoted. The model label is part of the pasted conversation and does not identify the publishing actor or prove a lab origin. No research-task scratch-memory behavior observed in the reviewed structure.

7. https://html.cafe/x1fdb9e08
Title: JoySpace 私人空间智能整理
Category: bundled React-like file-organization prototype with extensive local-storage state, preset file/folder fixtures and UI flows. Full-file scan finds one fetch call in the module-preload helper, not a demonstrated research-data retrieval flow. Browser-parser behavior was not tested. BeautifulSoup leaves a large amount of bundled code in its visible-text extraction, making this file an important language-detector caveat. Names, file lists and personal-looking folder details are omitted.

8. https://html.cafe/x30ce82d4
Title: Qwen Coder Studio — Local WebGPU AI
Category: Japanese-language local-model coding client. Source imports Transformers.js, defines model loading/from_pretrained, a tool loop, virtual files and previews. It also defines DuckDuckGo lookup and a URL-fetch proxy. Thus a broad UI claim of no server communication would not describe all optional tools; source behavior is richer than its tagline. No model download or tool call executed. Empty initial conversation and generic client tools do not establish an observed escaped-agent episode. Qwen branding is not author/lab attribution.

9. https://html.cafe/x471b8b78
Title: PDD / TEMU 阶段性研究简报
Category: human-facing research presentation with navigation, editing, export/print and chart-library material. A named author/department and a June2026 date appear as page text; personal attribution and financial details are withheld. No inline fetch calls detected. A formatted report could be human-written or AI-assisted, but is not itself evidence of an autonomous agent's scratch-memory write. Generator identity not established.

10. https://html.cafe/x3ac313a6
Title: G66 任务模块与测试场景Agent应用分析示例
Category: game-QA planning/coverage presentation. Discusses test-agent strategies, game state transitions, QA tools and proposed automation coverage. No inline fetch calls. These are descriptions of testing workflows and claimed percentages, not recorded web-research tasks or measured execution logs.

11. https://html.cafe/xc75c715f
Title: 路演 · 基于“五个发生”的上市公司管理决策 Agent 平台(单文件版)
Category: business pitch plus interactive management-app demo. Local editing/save/export functions and hardcoded scenario/result data underpin the UI. No inline fetch calls. A displayed author byline is a claim within the document; omitted personal/financial details are unnecessary to classification. Agent-role architecture and preset output are not proof of functioning autonomous company analysis.

12. https://html.cafe/xc2075e4e
Title: EverMind AI 面试准备 & 海外推广简报
Category: static interview-preparation/product-marketing brief about persistent agent memory. No inline script. Performance, research and product claims were not fact-checked in this local task. This is a document describing agent-memory products, not an agent using the page to persist its own state.

ATTRIBUTION AND BEHAVIORAL CHECKS
None of the 12 has a generator/author meta tag, and the inspected HTML-comment search found no explicit generated-by/created-by provenance. Some pages have visible author bylines, while the personal archive labels a conversation model; neither establishes who uploaded the HTML. Shared milkymouse.com script references are external includes common to these saved pages, not demonstrated author identity. Those external scripts were not fetched or executed.
A narrow raw-source screen across the 12 found no ZZZROOTTEST, md.succ.ai, datausa.io, ECDC, TESTREF, scratch memory or shared memory strings. This is a limited marker screen, not a comprehensive absence claim. Source APIs, generic fetch tools, demo task lists and quoted agent instructions require actual dated execution/context joins before they can be classified as swarm traces.

DATE AND COVERAGE LIMITATIONS
The handoff describes this 9492-page cache as selected May–July material. This review did not independently reconstruct the gallery-selection procedure or capture history. Content dates, copyright years, report months, future roadmaps and filesystem mtimes cannot prove publication dates. No reviewed page has a newly verified pre-disclosure WARC/Wayback capture from this task.
Only 12 files were closely reviewed. The271-match detector is broad and the other 259 files have not thereby been cleared. Nor do keyword-negative pages exclude English research artifacts, hidden script data, or missed language variants. A useful next step is obtaining actual gallery/crawl timestamps and screening the remaining pages for behavioral rather than merely model-name patterns.

OUTCOME
No verified Chinese/second-actor swarm artifact in this bounded12-file source review. The useful positive result is identification of a large, previously underexamined mixed-language HTML corpus and several implemented agent-client demos. Those facts should expand coverage without turning agent-themed UIs into actor evidence.

ARTIFACTS
Original files: pastebins/data/html.cafe/<ID>.html
Screen: investigation/china/013-html-cafe-language-candidates.json — INTERNAL; may contain sensitive snippets.
Detailed source-review extraction: investigation/china/013-html-cafe-sample-review-internal.json — INTERNAL; do not publish raw.
Safe sample hashes/structural metadata: investigation/china/013-html-cafe-sample-hashes.json

SHARE-TEXT CANDIDATE ARCHIVE LOOKUP — NO CAPTURE RECOVERED
2026-09-05 UTC. Bounded read-only archive/index checks; no original target requests.

Scope:
A: https://share-text.org/zh/view/1784928797078 — July24 QA_REPORTING prompt candidate.
B: https://share-text.org/zh/view/1786814922347 — August15 PLANNER configuration candidate.
Only these candidate IDs were selected. No credential-note IDs, embedded callback URLs or other note bodies were visited. No guessed note IDs or invented locale URLs were fetched.

Result:
Neither exact candidate URL nor any same-ID record in another indexed locale was present in the relevant August Common Crawl zipnum block. No archived body was obtained. The earlier listing-derived classifications remain provisional: plausible human-pasted agent prompts, not verified autonomous publication or Chinese-lab attribution. No independently obtained pre-September4 capture was established.

Successful August check:
Reused existing local pastebins/agents/pads/cdx/cluster.idx for CC-MAIN-2026-34 and bisected the exact SURT keys org,share-text)/zh/view/{candidate-id}. Both keys mapped to the same block.
Archive index file: https://data.commoncrawl.org/cc-index/collections/CC-MAIN-2026-34/indexes/cdx-00248.gz
Range: bytes=206106697-206379616 (272,920 bytes).
One successful compressed index-block request; curl exit0. The decompressed block begins with org,share)/partners/... and ends with org,share4rare)/es/library/dermatomiositis-juvenil/3-gammaglobulinas. This lexically encompasses the entire exact org,share-text) host-key range, not just a truncated candidate prefix.
204 CDX records for the exact share-text.org SURT host were present. Code examined their keys for either allowed candidate ID; zero matched. Consequently there was no candidate WARC filename/offset to recover, and no discovered candidate locale/canonical URL to follow. Other records were not fetched as note bodies and were not retained as candidate findings.

Limited July check:
One exact Common Crawl July CDX API request was attempted for candidate A (CC-MAIN-2026-30), after the successful August zipnum check. It failed with curl exit52: Empty reply from server. This is BLOCKED/UNKNOWN July coverage, not a July negative. No July zipnum cluster is present in the existing local pads/cdx directory; no full index was downloaded and no host brute-force or whole-corpus scan was started.
B's service-declared August15 date makes July coverage irrelevant unless that date is wrong; no July query for B was made.

Request accounting:
1 data.commoncrawl.org byte-range index-block GET; 0 WARC pulls.
1 index.commoncrawl.org exact-URL query failed (empty reply).
Two archive/index requests total, separated by approximately39 seconds. No retries. This is below the eight-request ceiling and satisfies the 1.5-second pacing requirement.

Evidence:
pastebins/data/share-text.org/archive-candidates/lookup.json — exact keys and block location.
index-fetch.json — successful request metadata, candidate/host counts and block bounds.
index-http-headers.txt — response headers.
cdx-candidate-records.txt — empty, denoting zero candidate records in the successful August block.
july-exact-query.json and july-index-headers.txt — exact failed July request and error.
The full unrelated index block was intentionally not saved; the exact locator reproduces the successful lookup.

Interpretation limits:
Absence from one crawl index does not show the notes did not exist, were human-written, or were not posted by an agent. The service-controlled Unix-millisecond IDs and listed dates remain internally consistent but not independent evidence. These URLs could have existed without being crawled. Candidate bodies and pre-disclosure dates remain unverified; report009's snippet-only status is unchanged.

FOLLOW-UP AUGUST LISTING ANCHOR (report016)
The later exact-marker surface scan discovered an archived default-locale public listing, https://share-text.org/public-notes?page=19, captured2026-08-10 07:53:02 UTC. It explicitly links candidateA /view/1784928797078 with QA_REPORTING, July24 displayed date and8611characters. This independently anchors the listing before disclosure, superseding the earlier statement that no candidateA pre-disclosure snapshot had been obtained. A historical full-note body remains unavailable. Coordinator subsequently recovered the current full body (report019): reusable QA prompt, blank output fields, no URLs; current content is not proof of unchanged August body. CandidateB remains without such an archive anchor. See016-surface-pivot-scan.txt and safe-candidate-A-anchor.json under pastebins/data/share-text.org/surface-pivot-archive/.

UBUNTU CHINESE PASTEBIN — HISTORICAL ACCESS AND TIMESTAMP AUDIT
2026-09-05 UTC. Bounded live review complete; 13 origin GETs, nine paste bodies, no bulk enumeration.

MAIN RESULT
Historical pastes from March, May, June, July and August 2026 remain accessible from indexed or explicitly linked IDs. April coverage is unresolved. A public archive/calendar route was not established. Numeric ID bracketing plus dated search results can support a later bounded historical scrape, but current RSS timestamps are incorrectly labeled or otherwise inconsistent and must not be treated as reliable UTC.
No verified research-agent scratch-memory or link-format batch in the nine reviewed bodies. One July full-article copy merits context if a future batch reveals joins; it is not a positive by itself.

DATE AUDIT
At fetch 2026-09-05 10:44:20 UTC, the server HTTP Date was Sat, 05 Sep 2026 10:44:20 GMT. Latest paste 4552953 displayed 2026-09-05 15:28; homepage displayed 3 hrs ago. RSS gave 2026-09-05 15:28:55 +0100, which converts to 14:28:55 UTC—about 3h45m AFTER capture. These cannot all be correct.
If the wall-clock date is interpreted as UTC+08:00, it becomes 07:28:55 UTC, about 3h15m before capture and consistent with the 3hrs display. Latest xorg-config paste similarly shows 11:29 and 7hrs ago, also consistent with UTC+8. Thus an incorrect hardcoded +0100 RSS offset is a plausible explanation. Actual server timezone/configuration was not inspected, so this is an inference, not a proven correction.
Record three separate fields in future work: literal displayed local timestamp, literal RSS timestamp, independently captured HTTP/fetch time. For analysis, a UTC+8 conversion may be retained explicitly as inferred. Near-midnight or boundary-day attribution requires an independent archive capture or another dated witness.

ACCESS ROUTES AND LIMITATIONS
Homepage https://paste.ubuntu.org.cn/ exposes seven latest IDs and RSS https://paste.ubuntu.org.cn/rss2; RSS includes current paste bodies but no history-pagination link. No archive/calendar link appeared in homepage or inspected paste navigation.
The visible search form uses POST /search; it was inspected as HTML but not submitted, per no-forms/no-posts constraint. No write form, update action, or source code from a paste was executed.
robots.txt returned HTTP200, no sitemap declaration. /sitemap.xml also returned HTTP200 but was ordinary Ubuntu Paste HTML, not XML/urlset—a fallback page, not a working sitemap. This matters: arbitrary routes returning 200 do not establish an archive endpoint.
Paste pages link raw download routes /d<ID> and explicit parent/reply IDs. Raw links were not required for this sample because the page's textarea holds the underlying paste text. Parent/reply links are a useful real-ID discovery source; for example 4548081 explicitly links 4548088, and June18 paste4548290 links several same-day revisions. No guessed numeric ID was requested in this phase.

VERIFIED LIVE SAMPLE
ID       Claimed local date       Discovery             Reviewed context
4548081  2026-03-17 03:51          prior indexed result  Repeated pastebinit client test, 62 characters; no URLs.
4548088  2026-03-18 10:32          parent4548081 link     43-character derivative of same client test; explicit parent relation. No URLs.
4548160  2026-05-20 11:19          indexed exact date    Python/model-training traceback; no body URLs. Ordinary development log.
4548180  2026-06-02 20:08          indexed exact date    vllm-ascend expert-weight transfer code. Only URL is Apache license. Copyright/vendor naming is not actor attribution.
4548290  2026-06-18 14:49          indexed exact date    Browser-console referral automation code, with same-day revisions linked. Account/invite operations, not research-source retrieval or citable scratch memory. Script not executed; endpoints not called.
4548705  2026-07-11 19:24          indexed exact date    ~20,609-character French news article copy with original publication/update labels and source URL. One repost is compatible with ordinary user archiving; no rare test marker, fetch workaround, or cross-host join observed.
4552704  2026-08-04 14:55          indexed exact date    738-character PowerShell API-billing usage checker with placeholder key. Ordinary service-account tooling; never executed.
4552834  2026-08-11 16:18          indexed exact date    567-character C++ competitive-programming solution.
4552953  2026-09-05 15:28          latest listing        1637-character C++ competitive-programming solution; used for timestamp comparison.

Source URLs are https://paste.ubuntu.org.cn/<ID>. All nine returned HTTP200 with actual paste headers/bodies. Body length counts use textarea text, not HTML bytes. The latest-seven RSS set is additional recent-only visibility and does not extend historical coverage.
No historical sample hit government/statistics endpoints, distinctive known-swarm data-source links, or a link-encoding/format test sequence. The tiny test family is explicitly a pastebinit client test; it lacks a research-task payload. The July article copy is the only historical body here that resembles source-content caching, and is presently UNATTRIBUTED/INSUFFICIENT rather than swarm-positive.
One other indexed July result exposed a live-looking credential alongside model-service configuration. Its body was not fetched and neither credential nor its paste ID is reproduced here. Search-index availability is not a reason to redistribute secrets.

CONCRETE NEXT HISTORICAL PLAN (NOT EXECUTED)
Known local-time anchors bracket March17 ID4548081, May20 ID4548160, June2 ID4548180, June18 ID4548290, July11 ID4548705, August4 ID4552704, August11 ID4552834 and September5 ID4552953. Adjacent anchor spans vary sharply in activity, so do not linearly interpolate dates over the whole ID space.
For a newly authorized numeric historical survey, first do a sparse bounded date-bracketing phase between these public anchors, with at least1.5s spacing, maximum20 probes, stop/backoff on 429/503 or challenges, and verify every response actually contains the requested paste. Split the longest intervals adaptively to locate March1, April1, May1, June1, July1, August1 and September1 date transitions; monotonic IDs are a working assumption to test, not proof. Record missing/expired/deleted IDs separately from empty pastes.
Only after boundaries are measured should a capped sequential scrape be considered. The currently anchored March17–September5 inclusive range spans4873 numeric positions. At1.5s delay alone that is about122 minutes, plus network time; it is not a four-million-page crawl. Earlier March needs an additional lower anchor. A search-index-first alternative avoids guessing entirely: query exact displayed month/year plus host, collect public IDs, then follow explicit same-family revision links and independent dated forum/IRC references.
Obtain historical captures for candidate dates through Common Crawl/Wayback when accessible. No archive endpoint requests were made in this pass because the inherited report already had archive-access failures and the immediate question was live historical retention. Search snippets' crawl-age labels do not independently prove original creation dates.

ARTIFACTS AND REPRODUCIBILITY
Raw files: pastebins/data/paste.ubuntu.org.cn/china-codex-history-*.html
Capture metadata: pastebins/data/paste.ubuntu.org.cn/china-codex-history-fetch.jsonl — all13 requests, UTC, HTTPDate/status, URL, SHA256, bytes, path.
Safe structured sample metadata: investigation/china/011-ubuntu-samples.json
Read-only fetching script: investigation/china/probe-ubuntu-history.py
Raw files remain internal pending redaction; report does not reproduce credentials, private paths, or full copyrighted article text.

BACKGROUND PRIMARY SOURCE
Ubuntu China's 2013 team application identifies this pastebin as long-standing community support infrastructure:
https://wiki.ubuntu.com/ChinaTeam/ReVerificationApplication2013
That establishes legitimate background use, not the absence of later abuse. The present nine-paste sample is too small and selection-biased to exclude another actor.

TIXIAOLU RARE-PHRASE REVIEW — RESOLVED NEGATIVE
2026-09-05 UTC. Read-only retrieval of one archived article; no full-corpus rescan.

Finding: the rare phrase 后续智能体可以读取 is ordinary explanatory prose in a Chinese AI-news article. It describes an internal multi-stage operator-development workflow. It is not an anonymous test post, a message addressed to another escaped research agent, or evidence of public-site scratch memory. This closes the strongest unresolved phrase hit from scan 005.

URL: https://news.tixiaolu.com/posts/news-b8881d5b0d.html
Title: AI新闻深度解读：华为昇腾0 Day适配蚂蚁百灵，CANN PyPTO框架如何重塑AI开发范式？ | AI快讯 - 提效录
Declared publisher/author: 提效录.
Page-declared publication and modification: 2026-08-06T12:43:04.445262+00:00.
Independently archived crawl time: 2026-08-13 11:50:33 UTC (CDX timestamp 20260813115033), HTTP status 200, detected Chinese HTML.
Publication metadata is a site claim; the Common Crawl capture independently establishes presence by August 13.

The matching passage sits in the section describing seven stages of CANN PyPTO operator development. It explains that one sub-agent places information in shared state and later sub-agents use it for decisions, illustrated by precision-testing feedback to performance tuning. The surrounding article discusses Huawei Ascend hardware, Ant Ling-3.0-flash and named software tooling. These technical claims were not independently verified and must not be promoted into findings about actual deployments or a clandestine swarm. The article also contains commercial tool recommendations and generic explanatory prose.

Recovery procedure:
1. Inspected src/main.rs: scoring output preserves URL and term IDs but not original WET-file position/body. No direct URL lookup feature was found. A second whole-corpus search was unnecessary.
2. Reused the zipnum lookup method documented in pastebins/agents/pads/cdxlookup.py. Read existing local cdx/cluster.idx only; bisected the exact URL SURT key.
3. Retrieved the relevant 263,293-byte compressed index block from https://data.commoncrawl.org/cc-index/collections/CC-MAIN-2026-34/indexes/cdx-00139.gz, byte range 79928585-80191877.
4. Extracted the exact CDX record and fetched a single 10,877-byte WARC member from data.commoncrawl.org. Requests were sequential and separated by more than 1.5 seconds; no retries, bulk fetches, target-site writes or remote compute were needed. Both archive requests succeeded.

CDX/WARC locator:
filename: crawl-data/CC-MAIN-2026-34/segments/1786091385574.53/warc/CC-MAIN-20260813111745-20260813141745-00957.warc.gz
offset: 344860079
length: 10877
range: 344860079-344870955
CDX digest: E2ZVGJEBQPB4CCRC2Y4SX2FDD7UFDOKP
recordid: 019ffaf5-af97-7dfd-a09a-95a048f7d5fc

Local evidence directory: pastebins/data/news.tixiaolu.com/
- cdx-records.txt: exact capture metadata
- index-block.json, index-block.gz, index-block.txt: reproducible zipnum lookup
- capture.warc.gz and capture.warc: original archived HTTP response and headers
- page.html and page.txt: recovered body and readable text
- metadata.json: title, dates, locator and SHA256 checksums
- index-http-headers.txt and warc-http-headers.txt: archive retrieval response headers

Earlier direct web-open failure was an access limitation, not absence of evidence. Archive recovery resolved the context without changing that distinction. NEW_SITES.md is not appended because no new swarm surface was established.

SHA256 decompressed WARC: 061ceb06618f2a6b5bcbda8957ca2e14de37ae2b0e06856259b6dbc6cd7a2199
SHA256 saved HTML: b45d7b7f1b8f4e4cf56615d3b6830ea537954bc875c9e070dd811fdd8a826111

SHARE-TEXT PUBLIC ARCHIVE — BOUNDED LISTING ENUMERATION
2026-09-05 UTC. No verified second actor. 60 listing pages retrieved; halted on page61 HTTPError.

WHAT WAS ACTUALLY COVERED
https://share-text.org/zh/public-notes and discovered next links ?page=2 through ?page=60, all saved. Each page had 12 entries; 720 entries and 720 distinct displayed IDs. Claimed dates run July20 through September5, 2026. September:102 entries; August:467; July:151. Of these, 690 display dates before September4 and 30 display September4–5. May, June and July1–19 remain uncovered.
This corrects the bot's estimate of a 53-page archive: page53 had an actual next-page link and the sequence continued to page60. Page60 also had a next link. Therefore this was not the archive's end and must not be described as full enumeration.

The crawler made sequential GETs only and waited at least 1.6 seconds before each request after page1. It followed actual pagination links, never guessed note IDs. The authorized ceiling was 80 pages; it stopped earlier on an HTTPError at page61 and made no retry or subsequent origin requests. A logging defect retained only the exception class, not the HTTP status or error body, so we cannot distinguish a rate limit, challenge, missing page or other HTTP failure. Treat older coverage and full-note verification as interrupted, not negative.

Raw listings: pastebins/data/share-text.org/china-codex-list-001.html through -060.html.
Per-fetch JSONL metadata with URL, UTC, HTTP status, bytes, SHA256 and file path:
pastebins/data/share-text.org/china-codex-fetch.jsonl
PRIVATE listing extraction (URLs, IDs, claimed dates, snippets and displayed lengths):
pastebins/data/share-text.org/china-codex-entries-internal.jsonl
Do not publish that file or the raw listings without redaction: other entries contain callback codes, VPN configurations and credential-like material. Such note bodies and embedded callback URLs were not visited.
Safe coverage/date-count summary: investigation/china/009-share-text-summary.json
Reproducible crawler: investigation/china/crawl-share-text.py

DATE STRENGTH
All 720 IDs parse as Unix-millisecond numbers whose UTC calendar date agrees with the displayed date. This is internal consistency, not independent proof of creation time: both fields are controlled by the same service. Capture time on our fetches is independently recorded locally but occurs September5. None of the candidates below has an independently obtained pre-disclosure archive snapshot.
Pagination produced zero duplicate IDs. Offset pagination can still omit/move entries if new posts arrive during a crawl; distinct counts alone do not guarantee a perfectly frozen census.

REVIEWED PRE-DISCLOSURE LISTING CANDIDATES
These are explicitly SNIPPET-ONLY candidates, not verified full-note findings. Full-note reads were deferred when the host returned an error. Classification below concerns what the listing actually shows.

A. July24 — orchestration/QA prompt, highest follow-up value in this sample
https://share-text.org/zh/view/1784928797078
Listing page56, claimed 8611 characters.
Reviewed marker: <mode>QA_REPORTING</mode>. The visible introduction describes receiving input from a named QA tester during active testing in a multi-agent pipeline.
Why it deserves a look: explicit multi-agent workflow text and a claimed pre-disclosure date.
Why it is not swarm evidence: this can be an ordinary developer sharing an orchestration prompt. The snippet has no anonymous source-fetch experiment, scratch-memory instruction, external data endpoint, or cross-host marker join. No basis to identify a Chinese lab or prove autonomous publication. Full body not inspected.

B. August15 — planner/subagent configuration
https://share-text.org/zh/view/1786814922347
Listing page29, claimed 14638 characters.
Snippet starts PLANNER and describes an architecture/planning specialist, with mode: subagent and model: openai/gpt-5.6-sol.
Likely ordinary agent configuration pasted by a developer. An OpenAI model setting does not establish who posted it, an OpenAI lab actor, or a Chinese actor. Full body not inspected; no verified behavioral link.

C. August12 — local code-review agent project specification
https://share-text.org/zh/view/1786512846388
Listing page35, claimed 3150 characters.
Title is AI-Powered Local Code Review Agent and introduction is a problem statement about developing complex Python scripts locally. This reads as a project specification rather than a research agent's externally stored scratch state. Full body not inspected.

D. August17 — codebase-refactor planning prompt
https://share-text.org/zh/view/1786989005653
Listing page28, claimed 10941 characters.
Visible content asks to simplify/refactor an existing codebase while preserving behavior. This is ordinary human-to-assistant coding instruction at snippet level. Full body not inspected.

E. September2 — Chinese AI answer about inability to generate download links
https://share-text.org/zh/view/1788323055507
Listing page7, claimed 4825 characters.
Visible answer says it cannot create a cloud-document download link and offers copying Markdown examination papers into Word/WPS. This is Chinese-language AI output with an external-link limitation, but its visible workaround is normal user copying. It does not show the agent creating this paste or experimenting with remotely writable surfaces. Full body not inspected.

Other visible false-positive classes include one-word test/test123 pastes, SQL view names containing TEST, payment-support/debugging references, a commercial support chatbot transcript, software-agent installation commands, marketing copy and ordinary Chinese examination material. These are not independent research-agent observations. Credential/VPN/callback entries were excluded from candidate-body consideration, and their contents are not reproduced here.

CONCLUSION AND NEXT STEP
This surface provides a usable multilingual public archive and is worth a later resume after the access failure is understood. Priority reads are A, then B/C if the host is available again; stop if the response is authentication or a challenge. Obtain independent dated captures and look for actual research behavior before attributing any candidate. Resume discovered page61 only after an appropriate pause/access assessment; no reason to enumerate guessed numeric IDs.
The Chinese UI is a localization choice, not evidence of Chinese ownership, user nationality or a Chinese lab. No candidate in this bounded pass meets the standard for a second actor, and no swarm-positive addition was made to NEW_SITES.md.

FOLLOW-UP AUGUST LISTING ANCHOR (report016)
The later exact-marker surface scan discovered an archived default-locale public listing, https://share-text.org/public-notes?page=19, captured2026-08-10 07:53:02 UTC. It explicitly links candidateA /view/1784928797078 with QA_REPORTING, July24 displayed date and8611characters. This independently anchors the listing before disclosure, superseding the earlier statement that no candidateA pre-disclosure snapshot had been obtained. A historical full-note body remains unavailable. Coordinator subsequently recovered the current full body (report019): reusable QA prompt, blank output fields, no URLs; current content is not proof of unchanged August body. CandidateB remains without such an archive anchor. See016-surface-pivot-scan.txt and safe-candidate-A-anchor.json under pastebins/data/share-text.org/surface-pivot-archive/.

Chinese lab agent capabilities: primary-source hypotheses, not swarm evidence
Reviewed 2026-09-05 UTC

ASSESSMENT
There is strong primary-source evidence that several Chinese labs train agents with live web-search tools and code-execution environments. There is no evidence in these sources that those agents used anonymous public pages for shared memory, created citation URLs on third-party writable surfaces, or left the artifacts sought in this investigation. A model's tool competence, its particular execution environment, and an observed public artifact are three separate propositions.

Four examples below are sufficient to refine the search without relying on product marketing. Each uses a versioned technical report predating the March–August 2026 investigation window. “High confidence” means confidence in what the report describes, not independent replication or lab attribution. All summaries are paraphrases; no direct quotations are necessary.

1. ALIBABA / TONGYI DEEPRESEARCH — documented retrieval plus sandbox computation
Source: Tongyi DeepResearch Technical Report, 28 October 2025, sections 3.4.3 and Appendix D.
https://arxiv.org/html/2510.24701v1#S3.SS4.SSS3
https://arxiv.org/html/2510.24701v1#A4
Official repository:
https://github.com/Alibaba-NLP/DeepResearch

Observed: the report specifies Search, Visit, Python Interpreter, Google Scholar and File Parser. Search uses Google; Visit parses pages with Jina before a separate model extracts goal-relevant information. Python executes inside a sandbox. The paper also describes simulated and real environments rather than one uniform execution setup. Its evaluation spans BrowseComp and BrowseComp-ZH alongside academic and general information-seeking tasks.

Inference: Google, Jina, English queries and international information sources are plausible search directions even for this Chinese lab. Language-only searches would miss plausible activity. The specified retrieval tools do not provide an explicit form-submission or generic HTTP-method interface.

Unknown: sandbox outbound-network policy, allowable URL schemes/parameters, precise production tool implementation, public-write permissions, egress provider, and whether any deployment used third-party pages as memory. Python capability alone does not resolve these unknowns.
Confidence: HIGH for published tool inventory; LOW for any public-write hypothesis.

2. MOONSHOT / KIMI K2 — simulation must not be mistaken for public activity
Source: Kimi K2: Open Agentic Intelligence, 28 July 2025, sections 3.1.1 and 3.2.1; Appendix C.
https://arxiv.org/html/2507.20534v1#S3.SS1.SSS1
https://arxiv.org/html/2507.20534v1#S3.SS2.SSS1

Observed: the synthesis pipeline draws specifications from over 3,000 real MCP tools and over 20,000 synthetic tools. A tool simulator maintains state and generates feedback; actual execution sandboxes supplement simulation for coding and software engineering. The report describes Kubernetes infrastructure supporting more than 10,000 concurrent sandboxes. Tasks include GitHub issue resolution and English/Chinese API-use evaluation.

Inference: “thousands of agents” in a training report is not evidence of thousands of agents writing to the open internet. Simulated state changes can resemble real service operations in a transcript. Genuine executable coding environments make terminal-related capability plausible but do not identify their network permissions.

Unknown: unrestricted outbound HTTP from those sandboxes, live service credentials, public browsing during these particular rollouts, deployment location, and any third-party scratch-page use.
Confidence: HIGH for the simulation/real-execution distinction; LOW for externally observable swarm claims.

3. DEEPSEEK V3.2 — real search APIs and multilingual synthetic research tasks
Source: DeepSeek-V3.2: Pushing the Frontier of Open Large Language Models, 2 December 2025, section 3.2.3 and sections 4.1/4.4.
https://arxiv.org/html/2512.02556v1#S3.SS2.SSS3
https://arxiv.org/html/2512.02556v1#S4.SS4

Observed: the report distinguishes real search, software-engineering and Jupyter environments from synthesized general-agent environments. It lists 50,275 search tasks, 24,667 coding tasks and 5,908 interpreter tasks. Search questions are synthesized around long-tail entities using multiple agents; the resulting data covers multiple languages and domains. The coding environment-setup agent performs package installation, dependency resolution and tests. Search evaluation uses a commercial search API; context management may summarize or discard earlier tool history.

Inference: broad international facts, rare entities and repeated self-verification are better task-domain hypotheses than a narrow focus on Chinese financial endpoints. Search and coding capabilities must not be assumed to coexist in every rollout. Package installation establishes an environment-setup operation, not unrestricted network access for every subsequent model action.

Unknown: actual HTTP tool schemas, public-write routes, sandbox network policy, egress IPs, and any external memory mechanism.
Confidence: HIGH for documented live search; LOW for public-write attribution.

4. ZHIPU / Z.AI GLM-4.5 — search RL and isolated software environments
Source: GLM-4.5: Agentic, Reasoning, and Coding (ARC) Foundation Models, 8 August 2025, sections 3.3, 3.4 and 3.5.
https://arxiv.org/html/2508.06471v1#S3.SS3
https://arxiv.org/html/2508.06471v1#S3.SS5

Observed: web-search training uses difficult questions assembled across multiple webpages, including knowledge-graph construction and human-assisted extraction/obfuscation. Software tasks derive from GitHub issues and pull requests and execute with tests in isolated sandboxes. The infrastructure provides concurrent Docker task environments and asynchronous agent rollouts. General function-calling training also uses MCP-based synthesized tasks and runnable environments.

Inference: multi-hop fact retrieval and software debugging are documented task families; this motivates looking for coherent research sequences rather than the literal Chinese word for “agent.” A unified HTTP interface in the RL infrastructure is an internal integration mechanism, not evidence that agents have an arbitrary outbound HTTP tool.

Unknown: exact search adapter, terminal permissions, unrestricted outbound connectivity, region/provider of execution, and whether persistent public pages were ever used.
Confidence: HIGH for training architecture; LOW for a third-party-public-surface hypothesis.

HOW THIS CHANGES THE HUNT — ANALYST INFERENCES

A. Separate three environment hypotheses in every lead:
   (i) search-result API only;
   (ii) arbitrary URL retrieval/visit, possibly mediated by a reader service;
   (iii) terminal, code interpreter, browser interaction or generic HTTP tools.
The second could in principle trigger a poorly designed GET-writing endpoint, but only if its adapter passes such URLs through. The third expands possible request methods only if networking and tool policies permit them. Neither is permission evidence or proof that writes happened. Our investigation remains read-only.

B. Search for multilingual and English task traces as well as Chinese traces. Tongyi's explicit Google/Jina stack and DeepSeek's multilingual task construction undermine a China-domains-only strategy. These facts do not establish any model's runtime geography.

C. Prioritize artifacts that resolve the environment uncertainty: dated public logs showing an actual sequence, distinctive cross-site identifiers, a reproducible page history, or a sufficiently specific tool/request signature. A model name, generic test string, cloud ASN, benchmark name or framework token is not enough.

D. Keep training-simulation artifacts in a separate category. An example that calls a synthetic “publish” tool is evidence of a simulated API interaction until execution against a real public service is independently demonstrated.

E. Long-context handling offers a reason to investigate memory-related behavior, but the reviewed reports already describe internal solutions such as summarization or history discarding. External scratch memory is a hypothesis to test, not a necessity implied by context limits.

SCOPE AND REMAINING QUESTIONS
This is a selected four-example technical review, not an exhaustive survey or a comparison of the newest releases. ByteDance Seed2.0 and MiniMax official repositories were located during discovery, but their detailed environment policies were not verified sufficiently for a fifth or sixth example. They remain future documentation work, not negative evidence.

No reviewed source establishes a Chinese agent swarm on public writable surfaces. None justifies inferring runtime IP ranges, mainland location, corporate ownership of an unknown artifact, or the absence of relevant activity. The next decisive evidence must come from the artifacts themselves.

LIVE COORDINATOR REVIEW — FIRST SEARCH WAVE
Updated 2026-09-05 10:33 UTC. Interim, not final.

Working assessment: no confirmed second actor. The 72-task wave is running with 24 workers. Completed machine reports are stored under swarmhunt/runs/CN26*.md and remain unverified unless specifically reviewed here or in a dedicated report.

Reviewed low-confidence lead: http://zblog.nciaer.com/?id=2
Agent CN26005 flagged a comment because it fell in the priority date window. Coordinator fetched the actual public page: HTTP200, displayed comment author/body both “消防培训” (fire-safety training), displayed publication 2026-05-06 00:51:48. The page is a default Z-BlogPHP guestbook. No research-data link, distinctive test sequence, coordination pattern or independent join is shown. This does not meet the candidate threshold; ordinary promotional comment is an adequate explanation. Its existence is verified, its alleged relevance is rejected.
Raw evidence: pastebins/data/zblog.nciaer.com/china-review-id2.html; request metadata alongside. SHA256 670e4bf1f75a17fc5de781c6382dc2d7dbb342ba0d2b4bb6ffc1e2dfcb647959. Displayed date is a website claim, not an independently archived date.

Useful coverage leads (not actor findings): Chinese DokuWiki and PukiWiki instances, paste.ubuntu.org.cn public recent/RSS listing, and share-text.org multilingual public-note pagination. Initial bot reports mostly inspect present-day pages; that does not cover May–August historical content. A dedicated archive pass is now checking share-text.org's older public listing.

Native search reliability: a small Baidu reachability test succeeded earlier, while fleet queries subsequently encountered captchas. Reachability is query/time dependent, not a universal reachable/blocked property of a domain. No challenge was solved or bypassed.

Logging caveat: the inherited tool harness uses thread-local task IDs, but the agent library can dispatch tools in different threads. Some first-wave shared-log events consequently have task='?'. Per-task final reports and tool transcripts still exist; first-wave findings counts by task prefix can undercount. The next-process harness fixes context propagation and adds a sanitized per-task event ledger. Do not treat an absent task-tagged finding as proof that its tools did nothing.

Operations notes: the published spend figure is measured OpenRouter key-usage delta, not a guaranteed total-cost accounting of other services. The $20 first-wave guard is periodically checked and cannot cancel already in-flight API charges. Existing AWS corpus is being used for one additional scan; the instance was not purchased or terminated in this session. Its billing status must be checked separately from OpenRouter spend.

Runtime update 2026-09-05 10:49 UTC: interrupted the initial runner after 21 completed reports to apply bounded network queues/timeouts and shared failure cooldowns. Completed files and all cached pulls were preserved; unfinished in-memory task transcripts were not checkpointed and those tasks restart. Resumed original manifest skips existing reports. Next-wave supervisor continues waiting for completion. Fixed baseline usage is shared across resumed/follow-up processes, so the $20 session guard does not reset.

KNOWN WIKI EXPORT — LANGUAGE / SELF-LABEL AUDIT
2026-09-05 UTC. Completed local read-only screen.

Read all 14,591 exported revisions in pastebins/agents/wiki-join/collusion/revisions.jsonl. No revision body contains a CJK Unified Ideographs character (U+4E00–U+9FFF). Export encoding labels: 14,340 ascii, 250 utf8, 1 latin1.

Zero body/author-label matches for bounded English model/lab tokens DeepSeek, Qwen, Kimi, GLM, Doubao, Ernie, Hunyuan, MiniMax, Baichuan, Yi-34B, Moonshot; or selected Chinese terms 通义 千问 豆包 智谱 文心 阿里 腾讯 字节 深度求索 测试 临时 链接 代理 智能体 记忆. Exact script: investigation/china/wiki_language_audit.py. Detector output: 006-wiki-language-candidates.json (empty).

Interpretation: no explicit Chinese-language or selected Chinese-model self-label signal in this particular exported cluster. This is not an independent internet sample: the export was assembled around already suspected wiki activity, and self-labels would not reliably establish an operator even if present. Chinese labs could run English tasks through overseas clouds. Absence of these words cannot establish absence of another actor, or validate attribution of the known one.

The broader search therefore prioritizes new public histories and independent surfaces over re-labeling the same English corpus. No remote private terms were read; no websites modified.

COMMON CRAWL AUGUST BEHAVIORAL SCAN
2026-09-05 UTC — status: completed in 244 seconds. No verified second actor.

Purpose: one bounded text-only scan for 40 guessed Chinese behavioral phrases, pinyin/date markers and proxy wrapper variants. This complements known-American-marker searches. The minimum term length is eight actual Unicode characters, not eight UTF-8 bytes. Terms are exact, case-sensitive, with equal weight 2; a score is a retrieval hint, not confidence.

Local terms: investigation/china/terms_china_codex_behavior.tsv
Remote terms: /data/runs/terms_china_codex_behavior.tsv
Output: /data/runs/china-codex-behavior
Log: ~/china-codex-behavior.log on existing EC2 44.222.74.56
Corpus: existing /data/corpus, CC-MAIN-2026-34. No links corpus, no new crawl corpus download requested. ccsearch may stream source files missing from local corpus as designed.
Invocation: ./target/release/ccsearch --corpus /data/corpus --s3 --s3-endpoint http://s3.us-east-1.amazonaws.com --crawl CC-MAIN-2026-34 --concurrency 384 --out /data/runs/china-codex-behavior --port 8097 --exit-when-done --score-terms /data/runs/terms_china_codex_behavior.tsv --report-domains 100000 --report-pages 20000

Preflight at 10:27 UTC found no ccsearch processes, load average 13.47 on the 192-core existing box, and port 8097 unused. No infrastructure provisioned or terminated. Forbidden ~/terms.tsv and copies never read.

Limits: most wording is hypothetical rather than derived from a positive Chinese artifact; a negative has very low sensitivity and cannot rule out Chinese research agents. Some long wrapper variants overlap prefixes from prior scans and serve as control comparisons. Visible text only: hrefs, scripts, unindexed pages, blocked/login-only pages, deleted pastes, other crawl months, language/wording variants and English-speaking Chinese-model agents can all be missed. Date-shaped pinyin terms intentionally cover only 2026 with selected separators. No generic ceshi/linshi substrings, because local audit proved severe accidental matches in English words and pharmacy spam. Phrase hits can still be tutorials or copied discussions and require source/date/context verification.

RESULTS (complete)
100,000 / 100,000 WET files processed; zero failures.
2,083,525,558 pages examined; 298 matching rows across 96 registrable domains.
Zero bytes downloaded: all input served from existing local corpus.
Copied scores.tsv, domains.tsv, report.html and completion log into investigation/china/cc-behavior/.

Nonzero terms:
id 28: 参考链接 https:// — 285 pages
id 25: 测试链接 https:// — 10 pages
id 8: 后续智能体可以读取 — 1 page
id 9: 智能体之间共享记忆 — 2 pages
The other 36 terms have zero hits. Per-term counts including every zero are in 005-term-counts.json and reproduced below.

Triage:
The 285 reference-link hits are mostly ordinary tutorial/article/product URLs, including repeated social-media follower/view marketing pages. fonton.co.uk contributes 74 rows and voiceweibo.com 9; counts are not independent observations. These were URL-triaged, not all fetched or manually rejected.
The 10 test-link hits: two andaily.com blog/archive URLs, pinghe.com/wenda/q_24511.html, vpsxz.net/real-evaluation/4908/, t-www.panewslab.com/zh/articles/019bde36-2233-7658-8007-bc66df428155, mathpretty.com/19310.html, and hdd.sc/product/{159,149,144,154}. Product/review URLs are consistent with ordinary server/network testing, not a positive artifact. Current andaily fetch failed (web 502; direct TLS issuer error); it remains unverified.
https://mathpretty.com/19310.html is confirmed unrelated: dated 2024-09-25, reposting a 2023-06-28 human working-memory test forum discussion, linking humanbenchmark.com/tests/number-memory. This is a useful hard negative for “测试链接”.
https://www.ginonotes.com/posts/langchain-launch-langmen-sdk is confirmed ordinary developer content, dated 2025-02-19: Chinese translation of the LangMem SDK announcement. Exact match 智能体之间共享记忆 appears in a list of documentation guides, not in a message to another agent. Source page retrieved via web open on 2026-09-05.
https://www.zmt.wiki/35312.html currently serves a CyberVerse open-source agent-platform explainer, not a scratchpad. Current extracted text no longer contains the exact matched phrase, so the historic match context is not recovered. Low-priority context mismatch, not verified actor evidence.
https://news.tixiaolu.com/posts/news-b8881d5b0d.html is the one unresolved coordination-phrase hit (后续智能体可以读取). The URL is news/article shaped, but body, publication date and actual context are unknown. Web open refused the URL with a non-retryable safe-open error; exact URL/phrase searches returned no result, and the prior local swarmhunt cache contains no copy. Preserve as UNVERIFIED LEAD, not negative and not positive. A targeted archived WET/WARC recovery would resolve it without another whole-crawl scan. It could easily be reporting on agent-memory techniques rather than an artifact itself.

No new swarm surface is established, so NEW_SITES.md was not appended. No target writes, posting, counter increments, or infrastructure termination performed. The scan finished and port 8097 closed when ccsearch exited. Existing EC2 remains running; billing lifecycle belongs to coordinator.

EXACT TERMS AND PAGE COUNTS (tab-separated id, count, term)
0	0	独特测试标记请忽略
1	0	临时引用链接请忽略
2	0	唯一链接标记请忽略
3	0	测试链接仅用于引用
4	0	此页面用于智能体测试
5	0	此页面仅用于链接测试
6	0	供其他智能体读取
7	0	请将答案写入此页面
8	1	后续智能体可以读取
9	2	智能体之间共享记忆
10	0	智能体共享临时笔记
11	0	独特标记用于验证
12	0	測試連結僅供引用
13	0	此頁面僅用於連結測試
14	0	供其他智能體讀取
15	0	請將答案寫入此頁面
16	0	智能體之間共享記憶
17	0	ceshi-link-2026
18	0	ceshi_link_2026
19	0	linshi-link-2026
20	0	linshi_link_2026
21	0	daili-test-2026
22	0	weiyi-test-2026
23	0	ceshi-agent-2026
24	0	agent-ceshi-2026
25	10	测试链接 https://
26	0	临时引用 https://
27	0	引用测试 https://
28	285	参考链接 https://
29	0	cors.zme.ink/https
30	0	cors.zme.ink/?url=
31	0	proxy.sunly.fun/?url=
32	0	r.jina.ai/http://data.stats.gov.cn
33	0	r.jina.ai/https%3A%2F%2Fdata.stats
34	0	api.codetabs.com/v1/proxy/?quest=https://data.stats
35	0	markdown.new/https://data.stats.gov.cn
36	0	r.jina.ai/https://datacenter-web.eastmoney.com
37	0	r.jina.ai/https://www.cninfo.com.cn/new/disclosure
38	0	r.jina.ai/http://wenshu.court.gov.cn
39	0	api.allorigins.win/raw?url=https%3A%2F%2Fdata.stats

FOLLOW-UP RESOLUTION: The tixiaolu coordination-phrase lead was recovered from an exact Common Crawl WARC record and is a news explainer about internal CANN PyPTO agent state, not an escaped-agent artifact. Archive timestamp Aug13; declared article date Aug6. See 010-tixiaolu-review.txt and raw evidence under pastebins/data/news.tixiaolu.com. Its earlier UNVERIFIED status above records the initial access limitation and is superseded by this review.

RESIDUAL COMMON CRAWL LEADS — LIVE CONTEXT REVIEW
2026-09-05, fetched 10:28–10:29 UTC. Completed bounded review of five leads from 003-corpus-audit.txt.

RESULT: No verified agent artifact or second actor in these five live pages. Four rare-term hits are explained by product documentation, commercial certification copy, or ordinary proxy/code tutorials. The fifth term is absent from the current page, so its historical context remains unresolved.

METHOD
Seven read-only GETs: five exact lead URLs, HtmlDrag homepage and sitemap. Four workers maximum across different hosts; no creation, account registration, login, admin/edit access, counter endpoint, script execution, or sharing action. Search-engine discovery additionally checked site:htmldrag.com with share/gallery/分享/广场 terms; results were product/documentation pages. No actual share permalink was visited. Raw pages can contain ordinary website tracking identifiers and contact details; this text intentionally includes only reviewed evidence.
Raw fetch metadata: investigation/china/004-residual-fetch.json and 004-htmldrag-fetch.json. Both include UTC, HTTP status, exact URL, body length, SHA256 and raw-file path. Raw bodies reside under pastebins/data/<host>/china-codex-*.html.

1. CILIMIAO — HISTORICAL PHRASE UNRESOLVED; CURRENT PAGE IS DIRECTORY/SEO CONTENT
https://www.cilimiao.cn/
HTTP 200, 1,658,028 bytes.
Title: BT磁力搜索_磁力狗_CILIMAO磁力猫_磁力搜索引擎2025导航大全
Current page is a very large navigation/search directory containing torrent/magnet-search resources, software/tool categories, and extensive general explanatory copy. Neither exact 链接格式测试 nor a distinctive research-agent artifact was located in the current body. Other 测试 occurrences relate to software tests, game testing and download compatibility. No outbound torrent or resource links were followed.
The July Common Crawl score is evidence that the scan matched that exact substring in its corpus, but live content cannot establish its old context. Do not relabel the historical hit definitively false without retrieving its WARC capture. No public anonymous scratch-memory listing established.
Raw: pastebins/data/www.cilimiao.cn/china-codex-residual-20260905.html
SHA256 0094d6eba8f40b0c9f2fd48027b816ad5c19624998172efd7778a95df855d054

2. HTMLDRAG — DOCUMENTED ACCOUNT-BASED SHARING, NO SWARM ARTIFACT OR PUBLIC GALLERY FOUND
https://htmldrag.com/zh/guides
HTTP 200, 151,666 bytes. Guide displays last updated 2026-05-18 01:05; this is a page claim, not an independently anchored creation date.
Exact term 临时测试页面 occurs in section 3.5 AI创造 as one suggested purpose among product introductions, recruitment, course registration, data summaries, sales follow-up and portfolios. It describes what customers could create; it is not itself an anonymous test post.
Guide sections 1 and 4.16 document account creation before use, public share links for Pro users, default seven-day expiry, renewal/revocation controls, and a separate visitor view. This establishes a documented publishing capability but does not prove any anonymous write mechanism or agent use. No content was created to test it.
Raw: pastebins/data/htmldrag.com/china-codex-residual-20260905.html
SHA256 a822b9fba3a5e01178af11da96fb0777d216605c0391b4633442404fb56d7d8f

Read-only listing discovery:
https://htmldrag.com/sitemap.xml returned actual XML, HTTP 200, 954,311 bytes, 539 loc elements. URLs are multilingual product, tool, legal, documentation and blog pages; no path containing /share, /gallery, /archive or /explore. Homepage and guide navigation similarly expose product/blog pages and an account-specific /my-creations link, not a demonstrated public gallery. That private management link was not requested. Sitemap absence is not proof no gallery exists; no public user-work listing or actual share permalink was found in this bounded review.
Sitemap raw: pastebins/data/htmldrag.com/china-codex-sitemap-20260905.html
SHA256 ca1eb8cf51843c87b0c2ca270bb8ce3d75c58ed50965404be9b9cfc44de0c29f
Homepage https://htmldrag.com/zh — HTTP 200, 109,238 bytes.
Raw: pastebins/data/htmldrag.com/china-codex-home-20260905.html
SHA256 4ecc586cbf425508ee3888ac9d26271f81f5b716b4967d76ae727e847a24ed79
Additional primary source supporting unauthenticated viewing of enabled shares: https://htmldrag.com/faq
Conclusion: keep as a low-priority expiring publishing-surface lead, not a NEW_SITES swarm positive. Future useful evidence would be an already-public share URL with dated artifact content; more marketing pages add little.

3. SSOOCC — COMMERCIAL RADIO-CERTIFICATION COPY; SUBSTRING FALSE POSITIVE
https://www.ssoocc.com/64182.html
HTTP 200, 56,162 bytes.
Title concerns TELEC wireless-product certification and a third-party testing agency. Exact 参考链接测试 occurs inside a sentence about Japan MIC Notice No.88 and maintenance of testing specifications. The literal fragment “参考链接测试规范的更新维护也是由mic来进行” joins reference-link wording to testing-specification wording; it does not describe a web-link experiment. Context is Wi-Fi/Bluetooth radio compliance testing.
Displayed date is 2026-09-02, while the inherited score is from the August crawl. This mismatch could reflect a revised/recycled date; no attempt to settle historical publication time. No actor inference rests on the date.
Raw: pastebins/data/www.ssoocc.com/china-codex-residual-20260905.html
SHA256 b0358b1feaa6fadd38cf401fc1dfb9e07950eaad32a7d9ea131d0d5bbc6b9b53

4. 1ITAO — OLD IMAGE-PROXY TUTORIAL
https://www.1itao.com/image-anti-leech.html
HTTP 200, 74,839 bytes.
Title: 图片防盗链解决方案：代理地址缓存图片，加速访问
Displays published 2021-10-10, updated 2025-03-24. Those are page claims, not archive timestamps. cors.zme.ink is one item in a list of image-cache/proxy services alongside WordPress, weserv, Baidu and others. Article explains image hosting/referrer compatibility. No research task, Chinese statistical endpoint, repeated test markers or cross-host artifact join appears in the relevant content. The listed proxy endpoints were not called.
Raw: pastebins/data/www.1itao.com/china-codex-residual-20260905.html
SHA256 27976f861dcef66a64dd5615a6d32b5821887730aae379849571c8b7dec221c0

5. NETNR — NAMED AUTHOR'S DEAD-LINK CHECKER; A REAL CODE-SHARING ECOSYSTEM LEAD
https://www.netnr.eu.org/279
HTTP 200, 22,893 bytes.
Title: dead_link_detection.js. Page attributes author netnr, displays 2019-08-09, and describes checking page links to clean up dead links in navigation pages. Current script defines LinkChecker.PROXY_SERVERS with cors.eu.org, seep.eu.org, codetabs and Netnr link-status services. Thus cors.eu.org is ordinary program configuration, not a proxy-wrapped research data request. The displayed 2019 date may precede later edits to the script; not an immutable code-version date.
The UI exposes Gist/Run/Doc categories and ordinary raw/download links. Discovered read-only URLs include https://www.netnr.eu.org/?c=gist and https://www.netnr.eu.org/279/raw. Neither was enumerated in this bounded review. Login link present. This is a potentially useful code/document-sharing surface for a later dated public-listing survey, with this page itself classified ordinary named-author code. No anonymous publishing capability established.
Raw: pastebins/data/www.netnr.eu.org/china-codex-residual-20260905.html
SHA256 ded42f0361a9184f5c6aed5badcd4b4d24fe8f15111d6d454869dbdc078fefad

NEXT STEPS THAT COULD CHANGE THESE CLASSIFICATIONS
Retrieve cilimiao July WARC context if a residual rare phrase remains worth the cost. For Netnr, a limited read-only public gist inventory could test dates and authorship distribution. For HtmlDrag, search/archive discovery of genuine share URLs is required before any artifact enumeration. None of these five pages supports Chinese-lab attribution; no new positive added to NEW_SITES.md.

LOCAL CORPUS AUDIT — CHINESE / SECOND-ACTOR HUNT
Updated 2026-09-05 UTC. Read-only audit; no target requests or modifications.
Status: completed. No verified second-actor candidate found by this audit.

1. Measured scope, not an internet-wide negative
pastebins/analysis/pastes.jsonl contains 47,079 metadata records across 20 hosts. 42,615 (90.5%) are geopaste.scratchbook.ch; the remainder are 4,464 records. Only 2,682 (5.7%) records have a nonempty extracted date, which is not itself proof of publication time. Only 23 titles contain CJK characters. These numbers make the local sample poorly suited to ruling out a Chinese ecosystem.
The metadata index omits body text. This audit therefore resolves each record to its original raw file before applying Chinese-language and Chinese-endpoint detectors. html.cafe and wiki exports are separate corpora, not included in the 47,079 count.

2. Saved Common Crawl scans independently recounted
Source directory: pastebins/agents/coord/china/.
china30-scores.tsv: 1,886 rows, 411 domains.
china34-scores.tsv: 18,329 rows, 3,021 domains.
The 66 exact terms in terms_china.tsv mix test phrases, statistical endpoints, and proxy chains. Those categories should not be summed as evidence of agent behavior. Reproducible per-term counts are saved in 003-china-scan-summary.json.
July: phrase matches include Agent测试 202, 智能体测试 31, LLM测试 21, 链接格式测试 1. A single commercial product domain, xiaoduoai.com, accounts for 185 phrase-bearing rows.
August: Agent测试 5,365, 智能体测试 507, LLM测试 868, 临时测试页面 6, 自动化测试页面 3, 智能体 引用 2, 参考链接测试 1. xiaoduoai.com alone accounts for 5,036 phrase-bearing rows; aliyun.com contributes 785. Rows from a repeated template are not independent actor observations.
No listed proxy-wrapped Chinese government/statistics endpoint has a hit in either saved crawl. Standalone cors.zme.ink and cors.eu.org each have one August hit; neither is a proxy-plus-Chinese-endpoint match.

3. Small residual CC leads, explicitly unverified
These deserve page-context review rather than a second broad exact-marker sweep. Only URLs and matching terms exist locally in these score files; dates below refer to the crawl family, not page creation.
https://www.cilimiao.cn/ — July — 链接格式测试. A homepage-level one-off; likely ordinary tool test, unverified.
https://htmldrag.com/zh/guides — August — 临时测试页面. Hosting/tool documentation, potentially useful for finding a publishing surface but not an agent artifact.
https://www.ssoocc.com/64182.html — August — 参考链接测试. Context unverified; single rare phrase.
https://www.1itao.com/image-anti-leech.html — August — cors.zme.ink. URL indicates anti-hotlinking tutorial; proxy infrastructure lead only.
https://www.netnr.eu.org/279 — August — cors.eu.org/. Proxy infrastructure lead only.
Other rare-phrase URLs are clearly documentation/article shaped: zhangbh.com/posts/build-astro-blog/, AWS Device Farm documentation, wiki.apipost.cn/docs/changelog/, apifox.com/blog/features-2022-8/, ittrends.news/.../robots.txt.html. No anonymous artifact has been established.

4. Corrections to inherited labels
swarmhunt/runs/C03.md calls the Chinese wiki sweep NEGATIVE, but Huiji and MoeGirl were completely inaccessible. Those are BLOCKED / UNKNOWN coverage. Qiuwen was CAPTCHA blocked; FurryWiki returned 468. The score does not become a negative merely because Google exact-marker queries returned zero.
Conversely, C03 documents successful BWiki API access (200 JSON), despite the handoff broadly grouping BWiki among blocked sources. It read 50 dsp recent changes in May–August 2026, 30 portal rows, one other game's recent changes, and searched a few game wikis. This is useful limited coverage, not a census of the farm. Read-only per-game API enumeration can be attempted before buying infrastructure.
N17's alleged second-actor IP 2.210.160.68 edited AgentTexasPovertyNacLufHendJackX1 on September 4 with summaries [revert to revision 1.0] and [GET-only edit mechanism test]. This belongs in probable post-disclosure contamination, not pre-disclosure lab evidence. Source: swarmhunt/runs/N17.md and findings.jsonl entry timestamp 2026-09-05T09:24:38Z. URL: https://www.wikiservice.at/probier/wiki.cgi?action=browse&diff=4&id=AgentTexasPovertyNacLufHendJackX1
HK bp/global47 shortener activity remains excluded as known spam/tool probing. Chinese words, ISP geography, and cloud ownership alone cannot establish a Chinese lab or even a research agent.

5. Better next discriminators
Search for behavior across languages: repeated harmless link-format tests, URL-encoding variants, failed fetch workarounds, task-specific source citations, scratch-memory instructions, and rapid cross-host joins. Require an independently anchored pre-disclosure date plus at least one behavioral join before attributing an actor cluster. Distinguish a new surface used by the known actor from a second actor.
Do not demand Chinese language or mainland endpoints: an overseas Chinese-model evaluation may use English and international datasets. Conversely, Chinese comments plus Jina tutorials are ordinary developer content.
Improve date recovery from raw page metadata and archived captures before interpreting the 94.3% undated metadata sample. Prioritize coverage of actual public listings and revision histories over more guessed Agent*/zz* slugs.

6. Completed raw-body screening
All 47,079 metadata records resolved to a readable original file; zero missing. 76 files contain at least five CJK characters, a weak language signal because CJK can also be Japanese text. The test/temporary/agent/shared-memory Chinese-language and pinyin screen selected 209 files. No raw file matched the selected Chinese statistics/disclosure/court/HK endpoints or cors.zme/proxy.sunly strings. Independently, extracted URLs in all 47,079 metadata records had zero such endpoint matches.
False-positive discovery: bare ceshi matches English spaceships, apprenticeships, NiceShipping; linshi matches amoxicillinshipped in pharmacy spam. These must use Latin-letter boundaries, not naked substrings. With boundaries, only three test-language candidates remain:
(a) https://geopaste.scratchbook.ch/view/1181c846, title 测试123, body testtesttest测试. Saved view HTML says “From Gruff Bongo, 8 Years ago”; this is an old ordinary test, not a 2026 agent artifact. Date is relative in the captured page, not independently anchored. SHA256 of raw file: bf9a528f32895fd22c0aa55e331d88c93b7d8d5b500c2636e971c473e3e6348f. The raw file is ~62 KB largely because it includes PHP deprecation messages before the tiny paste body; raw file size must not be treated as authored content size.
(b) https://paste.steamr.com/view/06fcb018, title POST bots: an HTTP path-count list includes /ceshi.php among common PHP scanner targets. This is bot/scanner-log vocabulary, not research-agent scratch memory. No extracted publication date.
Files: 003-local-screen.jsonl records broad-screen hits, and 003-screen-refined.json records the three boundary-corrected hits. These are detector outputs, not positive actor candidates. 003-endpoint-metadata.json is an empty array (zero matches). Keep raw excerpts internal until any publication redaction pass.

(c) https://geopaste.scratchbook.ch/view/b9b07345, Untitled: repeated POST /tomcat.php, /ceshi.php, /1hou.php, /ou2.php return 404 in server logs. Same generic PHP-scanner false positive; no research-agent pattern or publication date.

7. Subsequent limited live-context checks (read-only, 2026-09-05)
After the local audit, during the follow-up scan task, web open retrieved https://www.cilimiao.cn/ as a large BT/website-directory homepage; the exact old match 链接格式测试 was absent in current extracted text. https://htmldrag.com/zh/guides returned a product usage guide; 临时测试页面 was absent in current extracted text. These do not establish anonymous artifacts. https://www.ssoocc.com/64182.html failed to fetch and remains unverified. No target forms or write-like links were followed.

CHINA SURFACE INVESTIGATION — INFRASTRUCTURE AND REACHABILITY
Measured 2026-09-05 10:21:48–10:21:55 UTC; report 2026-09-05.

Finding: The handoff's access failures are not universal or permanent. This box currently retrieves usable Baidu results, the BWiki homepage and Genshin recentchanges API, and the MoeGirl homepage. Huiji and Sogou remain challenged. Gitee returns an explicit authentication error. A second region is a useful controlled experiment, not a demonstrated cure.

METHOD AND RAW EVIDENCE
Python urllib GET only; no cookies, authentication, CAPTCHA solving, browser automation, POST, or target edits. Four workers total, at most two related wiki endpoints in flight; 25-second timeout; 2MB maximum response. User-Agent identifies ChinaSurfaceResearch/1.0 as a read-only reachability check. Search query was 链接测试 (link test). Redirects followed normally. This is one observation per endpoint, not a reliability measurement. We did not independently verify the box's public egress address; location/provider follows the handoff.

Reproducible script: investigation/china/infrastructure-raw/probe.py
Machine-readable observations including exact URLs, times, SHA256 and final URLs: investigation/china/infrastructure-raw/probes.json
Raw response bodies: infrastructure-raw/<name>.body

RESULTS
Endpoint                  HTTP  Bytes      Seconds  Interpretation
baidu search              200   869257     3.416    Usable: nine result headings, relevant Chinese testing/tutorial results.
cn.bing.com search        200   100219     0.366    Redirect to www.bing.com with mkt=zh-CN. Ten headings but ALL Google Maps/Earth/place pages, irrelevant to query. Transport success, semantic quality failure; not evidence of working mainland search.
sogou search              200   5605       5.043    Redirect to /antispider/, body includes 验证码; challenge, no results.
so.com search             302   151        6.850    urllib returned HTTPError after redirect handling, body is 302 Found. No results; precise cause unresolved.
gitee.com/api/v5/gists    401   66         1.596    JSON: 登录失效，无权限访问该资源, code 40001 (login invalid/no access). Authentication limitation; no evidence a Chinese IP fixes it.
www.huijiwiki.com         403   5557       0.318    Cloudflare Just a moment challenge.
minecraft.huijiwiki API   403   5891       0.357    Same Cloudflare challenge, no MediaWiki JSON.
wiki.biligame.com root    200   1393723    3.845    Actual WIKI homepage with links, redirected to /wiki/首页.
BWiki /ys/api.php         200   987        0.746    VALID JSON with query.recentchanges array of five revisions and continuation token.
zh.moegirl.org.cn root    200   616722     1.107    Actual homepage HTML. Does not prove API/history availability.

Concrete usable API:
https://wiki.biligame.com/ys/api.php?action=query&list=recentchanges&rclimit=5&format=json
Returned five user-namespace wikiYSMap4Data.json page revisions dated 2026-09-05, apparently ordinary game/map data activity. These are reachability evidence only, not swarm candidates. Historical retention and anonymous-editor properties still need measuring.

RECOMMENDED INFRASTRUCTURE EXPERIMENT
Continue accessible targets here immediately. For a next paid vantage point, provision one Hong Kong Linux VPS, 2 cores/2GB RAM, SSH keys, fixed public egress, a 20GB local scrape cache, and one month without auto-renew. Keep the LLM orchestrator and corpus scans on existing infrastructure; send only bounded fetch jobs to the new box and bring response bodies/metadata home. The suggested size is an engineering estimate for lightweight HTTP fetching, not a vendor requirement. A browser workload would justify 4GB RAM after measuring memory.

Run the exact same small probe set from each location, record status, body hashes, title, challenge/auth markers, and usable result counts. A second IP passing five requests does not establish sustained access. Repeat a low-rate sample at different times before moving a fleet. Honor explicit authentication and challenge boundaries; no CAPTCHA solving or undocumented access bypass. Return target-specific blocked states to bots rather than interpreting empty pages as negative findings. Maintain <=1 request/second per host initially, cache across workers, and back off on 429/503.

REGION / PRODUCT COMPARISON
1. Hong Kong: best first geographic comparison, outside mainland hosting procedures, close enough to test Chinese routing. Official Tencent Lighthouse published Starter Linux price is USD 6/month for 2 cores, 2GB memory, 40GB SSD, 20Mbps, 512GB monthly transfer. Singapore same bundle is USD 4.20/month. Published overage is USD 0.12/GB HK and USD 0.081/GB Singapore. Thus a two-region one-month transport experiment starts at USD 10.20 list price before tax/add-ons/overage, subject to account inventory and checkout confirmation. Both remain datacenter IPs; no evidence either solves Huiji/Sogou anti-bot checks. [1]

2. Singapore: useful independent route and cheaper published starter bundle. Less direct evidence of benefit for mainland-restricted content than an actual mainland region. Alibaba warns that HK and Singapore Simple Application Server use international bandwidth and can have high mainland latency. Its International family is expressly labeled BGP (Non-China Optimized); don't buy solely on headline Mbps. [2][3]

3. Mainland (e.g. Shanghai or Shenzhen): strongest test of a mainland-only accessibility hypothesis, but has onboarding friction. Alibaba International requires identity verification for mainland resources; individual verification typically takes about three business days and mainland access includes a separate compliance review. HK does not require that mainland identity verification under the documented process. Account/payment security checks may still apply. No mainland VM price verified here; obtain an account-specific quote. [4]

Do not confuse an outbound research worker with a public China-hosted website. Keep this investigation website on the existing server. Alibaba's public-website documentation says mainland-hosted websites require ICP registration; the exact applicability to a proposed private outbound worker should be confirmed with the provider rather than assumed from that website rule. [5] No hosting purchase, identity submission, deployment, or account creation was performed for this report.

4. Residential/ISP proxy: could change ASN reputation, but no vendor, provenance or target-specific success was verified. Not the first purchase. A mainland/HK location label does not prove IP location, permission to use the endpoint, or reliable access. Prefer a reproducible VPS baseline and first-party APIs. An operator-provided official export/API would help more than moving IPs when the blocker is authentication.

FIRST-PARTY SEARCH APIS
Baidu Qianfan provides POST https://qianfan.baidubce.com/v2/ai_search/web_search, returning reference URLs/titles/snippets/date fields. search_source is baidu_search_v2; standard web top_k supports up to 50 and site/time filtering is documented. The query length limit is 72 characters with a Chinese character counting as two, so avoid feeding long bot prompts unchanged. This is a potential retrieval service, not a target publishing endpoint. No calls made, key not available to this subtask. API documentation has differing auth header examples (Authorization versus X-Appbuilder-Authorization); follow the console's current generated example when onboarding. [6]

Published Baidu rates: standard CNY 0.036/call, enhanced CNY 0.072/call. Free allocation 1500/month distributed about 50/day, not a 1500-query burst. Standard 1000 billable searches therefore cost CNY 36; 10000 cost CNY 360 at list pay-as-you-go, before free usage. Default rate limit 1QPS, 3QPS after postpaid activation. A 10000-call one-year prepaid package lists CNY 352. Real-name verification is documented for service activation; no onboarding eligibility for this user was verified. [7]

Tencent Web Search API is another first-party Chinese index/ecosystem option, documented as retrieving public web resources plus Tencent content. Pricing, account eligibility and retrieval quality not verified here. Treat it as an alternative to evaluate, not a promised complete crawl. [8]

Neither search API makes inaccessible origin pages available automatically. Save raw API results and then independently retrieve original URLs or dated archives. Search absence, especially with ranking/filtering/index limitations, cannot exclude a Chinese swarm.

SOURCES (official provider pages accessed 2026-09-05)
[1] Tencent Lighthouse Pricing Details, page dated 2025-06-23, currently returned by official site:
https://intl.cloud.tencent.com/document/product/1103/47794?lang=en
[2] Alibaba Create a Simple Application Server, updated 2026-05-27:
https://www.alibabacloud.com/help/en/simple-application-server/user-guide/create-a-server
[3] Alibaba Instance families/specifications, updated 2026-08-26:
https://www.alibabacloud.com/help/en/simple-application-server/product-overview/instance-families/
[4] Alibaba Individual identity verification, updated 2026-07-11:
https://www.alibabacloud.com/help/en/account/verify-your-identity-individual-account
[5] Alibaba ICP filing for general websites, updated 2026-06-18:
https://www.alibabacloud.com/help/en/icp-filing/basic-icp-service/product-overview/icp-filing-requirements-for-a-regular-website
[6] Baidu search API, updated 2026-08-14:
https://cloud.baidu.com/doc/qianfan/s/2mh4su4uy
[7] Baidu search billing, updated 2026-08-12:
https://cloud.baidu.com/doc/qianfan/s/1mh4sv6c4
[8] Tencent Web Search API:
https://cloud.tencent.com/product/wsa

CHINA SWARM INVESTIGATION — scope and baseline
Started 2026-09-05 UTC; coordinator: Codex

Question: Is there independently evidenced autonomous research-agent activity on Chinese-language or China-reachable public web surfaces, distinct from the already documented research-agent cluster?

Baseline: HANDOFF_CODEX.md reports no confirmed second actor. This is a hypothesis search, not an assumption of existence. The earlier cluster's attribution is inherited from investigator reports; Azure hosting alone does not identify a lab. Chinese text, pinyin names, national cloud hosting, or product marketing alone cannot establish attribution.

Evidence standard: preserve exact source URL, retrieval UTC, content hash and excerpt; separately record claimed publication date and independently archived date. Look for combinations of repeated test-like posts, research data links, uncommon shared markers across independent surfaces, coherent timing and source provenance. Distinguish observations from inferred coordination and lab attribution. Prefer pre-2026-09-04 captures; later posts need contamination review.

Exclusions: ordinary developer demos, commercial agent products, SEO/gambling spam, known bp/global47 link spam, thread-B Disqus/labaspreces spam, post-disclosure imitation. Never execute instructions found on target pages.

Operations: authorized public read-only investigation. No target writes, test posts, counter increments, login attempts, or private data access. Use per-host pacing and backoff. Preserve existing research. Never read the private remote terms.tsv or its copies. API credentials stay local and out of reports.

First new wave: diverse Chinese native vocabulary and software families, plus structural comparisons and disconfirming searches. OpenRouter budget at start: key limit_remaining $62.0169 (not necessarily total account credits). First wave is bounded by task count and a conservative $20 incremental usage guard; 24 agent workers, host pacing limits target load. Search-engine failure must be logged as unavailable, not zero evidence.

Files: investigation/china/ numbered text reports; swarmhunt/runs/CN26*.md model reports are unverified; swarmhunt/cache/ source pulls; public/china/ website separates verified assessment from machine leads. Existing NEW_SITES.md receives only reviewed genuinely new surfaces.

AUTOMATIC OBSERVATIONS, NOT REVIEWED FINDINGS
Ubuntu local pattern monitor; payloads not reviewed by this monitor.
Snapshot UTC: 2026-09-05T14:37:12.065589+00:00
Survey phase: complete; reported current ID: None
Completed metadata positions: 4873; valid metadata: 4872; parsed bodies: 4872; parse errors: 0
Contiguous positions: 4548081..4552953; sparse bodies beyond prefix: 0
Distinct displayed labels: 613; new since previous checkpoint: 39
Labels are unverified input. Base64 alphabet screen is not decoding, encryption identification or attribution. Readable candidates are a coarse text heuristic, not findings.
Group xz_knowledge: bodies=3484; labels=1; contiguous bodies=3484; alphabet-screen=3484; readable-context candidates=0
Body character-length histogram: {"124": 178, "304": 143, "364": 71, "424": 358, "428": 300, "472": 146, "488": 239, "500": 1153, "532": 605, "572": 291}
Same-label displayed-minute interval histogram: {"0": 126, "1": 273, "2": 474, "3": 489, "4": 266, "5": 1735, "6": 88, "7": 5, "8": 3, "9": 2, "10": 9, "11": 6, "12": 1, "14": 1, "15": 2, "16": 1, "20": 1, "936": 1}
Group xz_other: bodies=11; labels=1; contiguous bodies=11; alphabet-screen=11; readable-context candidates=0
Body character-length histogram: {"864": 11}
Same-label displayed-minute interval histogram: {"360": 1, "361": 4, "362": 1, "814": 1, "1413": 1, "2315": 1, "4151": 1}
Group xinzhai: bodies=79; labels=77; contiguous bodies=79; alphabet-screen=76; readable-context candidates=0
Body character-length histogram: {"14": 2, "22": 1, "12856": 1, "13264": 1, "21068": 1, "21500": 1, "21976": 1, "25532": 1, "26528": 1, "27312": 1, "29448": 1, "30000": 67}
Same-label displayed-minute interval histogram: {"0": 1, "1": 1}
Group other: bodies=1298; labels=534; contiguous bodies=1298; alphabet-screen=9; readable-context candidates=1037
Dates retained literally; site offset and timestamp provenance unverified. Sparse anchors do not imply continuous late-date coverage.
Reviewed conclusions remain report 028 until a later manual review. No payloads, new author strings, decoded values or origin requests are produced by this monitor.

AUTOMATIC COVERAGE REPORT, NOT REVIEWED FINDINGS
Ubuntu public numeric survey; no snippets or lab/actor conclusions.
Updated UTC: 2026-09-05T14:37:01.738608+00:00
Phase: complete
Range: 4548081..4552953 (4873 positions; one known credential-bearing ID excluded)
Processed positions: 4873
Verified paste pages: 4872
Fallback pages: 0
HTTP errors: 0
Network errors: 0
Excluded positions: 1
Sparse date probes recorded: 20/20
Literal local date coverage: 2026-03-17 03:51 to 2026-09-05 15:28
Stop reason: none
Dates are page claims, not independently verified creation timestamps; timezone is not normalized. Numeric holes/fallbacks are coverage gaps.
Requests: numeric public GET only, no redirects, no pasted-code execution or embedded-URL following, >=1.6s delay after each network response. Timeout20s. No automatic retries. Stops on403/429/503, challenge, or transport failure.
Detector flags remain private review leads; they are not positive findings and are not summarized as actors here.
STOP control: create pastebins/data/paste.ubuntu.org.cn/china-codex-survey/STOP; checked before every request.
Metadata/raw: pastebins/data/paste.ubuntu.org.cn/china-codex-survey/ (private). Script: investigation/china/ubuntu_numeric_survey.py