078 — GitHub commit-message search for xinzhai/xz
Reviewed September 5, 2026, 20:01 UTC.

Outcome
A previously unused public search route was accessible without authentication. Seven bounded queries returned no demonstrated matching uploader. This is commit-message coverage, not a search of all source-file contents. GitHub documents that commit search searches messages and only the repository default branch: https://docs.github.com/en/search-github/searching-on-github/searching-commits .

Actual query results
"xz_knowledge": total_count=5, incomplete_results=False, HTTP 200
"xz_improvement_plan": total_count=0, incomplete_results=False, HTTP 200
"xinzhai": total_count=18, incomplete_results=False, HTTP 200
"paste.ubuntu.org.cn" "Fernet": total_count=0, incomplete_results=False, HTTP 200
"xz_knowledge_p1": total_count=0, incomplete_results=True, HTTP 200
"xz_improvement_plan_p1": total_count=0, incomplete_results=False, HTTP 200
"xinzhai_v60": total_count=0, incomplete_results=False, HTTP 200

The full xz_knowledge_p1 query returned incomplete_results=true. Its zero returned items must not be reported as a completed negative search. Other queries returned incomplete_results=false, within the API's indexed scope. All result sets fit one requested page of 100. Quoted queries are not necessarily byte-literal identifier matching: xz_knowledge returned hyphenated xz-knowledge-graph messages.

Candidate review
1. All five shorter xz_knowledge hits belong to xiaozhu-eco/xz-modules. Its public README describes 小竹 (Xiaozhu) Rust AI infrastructure, including memory and knowledge-graph crates. This establishes a different expansion of xz in that project; the reviewed material does not show a xinzhai/paste uploader link. Generic memory/agent terminology is insufficient.
Primary: https://github.com/xiaozhu-eco/xz-modules . README API response saved privately.
2. Four xinzhai hits refer to djc-Sherlock/checkin's xinzhai.js. The creation commit's complete 44-line patch implements a new-bond subscription reminder, calling a bond-list data source and notification helper. Its displayed Chinese label is 新债. No paste upload or encoded state mechanism appears in that patch. This is a concrete pinyin namesake, not the sought client.
Primary: https://github.com/djc-Sherlock/checkin/commit/a1c1e5d633367fa0c8c85668aedd136b2e26167a . Code was read, never executed; linked data/notification endpoints were not called.
3. Three PR_tool hits concern parsing hardware control bits and xinzhai registers. Inspection of one matching commit confirms pad-control parsing, rather than a paste storage client.
Primary: https://github.com/098654321/PR_tool/commit/3cfba6a0a59ed005d4d7071dd8c811f036159f61 .
4. Remaining xinzhai messages concern website routes/photos, the previously reviewed xinzhai web app, philosophical or historical content, and a campus electricity app whose message explicitly maps xinzhai to 新斋. Message-level review found no shared naming/chunking/encoding fingerprint. This does not claim exhaustive inspection of those repositories.

Evidence retained
078-private contains seven complete API query responses, query URLs, counts, incomplete flags, UTC capture times and SHA-256 hashes, plus three follow-up source responses. Scripts078-commit-search.py and078-exact-commit-search.py reproduce the queries. No credentials, paid bots, original-service writes or pasted-code execution were used.

Implication
The strong local xinzhai/xz workflow evidence is unchanged. This pass adds a usable public discovery route and resolves misleading near-matches. It does not establish absence of a public implementation, especially because commit messages do not contain all code and the full knowledge-label query was incomplete. A separate public code index would offer materially different coverage if accessible.