079 — Separate public code index: Sourcegraph works, coverage is limited
Reviewed September 5, 2026, 20:04 UTC.

Outcome
Sourcegraph's public streaming API returned an actual CPython source-code match in a positive control. Eight read-only queries completed as streams. No matching xinzhai/xz uploader was found in returned content. This adds source-file coverage distinct from078's commit messages, but several limitations prevent a broad absence claim.

Per-query results
control: HTTP 200; matches=1; skipped=['shard-match-limit']; terminal done=True
xz: HTTP 200; matches=0; skipped=['repository-fork', 'excluded-archive']; terminal done=True
xinzhai: HTTP 200; matches=0; skipped=['repository-fork', 'excluded-archive']; terminal done=True
labels_all: HTTP 200; matches=90; skipped=['shard-match-limit']; terminal done=True
host_org: HTTP 200; matches=13; skipped=[]; terminal done=True
host_com: HTTP 200; matches=1; skipped=[]; terminal done=True
distinctive_all: HTTP 200; matches=0; skipped=['shard-match-limit']; terminal done=True
coverage_repo: HTTP 200; matches=0; skipped=[]; terminal done=True

Interpretation of results
The first two literal-label queries used default repository scope, which excluded forks and archived repositories. They returned no matches. Broader follow-up queries explicitly included both.
The combined broad xinzhai/xz expression returned90 matches from22 repositories, with a shard-match-limit warning. Returned snippets concern place names, geographic datasets, historical references, finance names, radio station locations and unrelated variables. No returned snippet contains a demonstrated cluster connection. The result is not exhaustive.
The distinctive combined expression xz_knowledge|xz_improvement|xinzhai_v returned zero matches but still emitted a shard-match-limit warning after roughly20seconds. Preserve that warning even though the zero count seems inconsistent with its wording: this is not a clean exhaustive negative.
The exact known GitHub repository44678020qq-ctrl/xinzhai returned zero in a separate Sourcegraph repository lookup. Earlier GitHub API inspection found that repository. This is a concrete cross-index coverage mismatch, not proof the repository was deleted or private.

Hostname search review
The org.cn hostname query returned13 matches from8 repositories with no skipped warning. They are ordinary references: pastebinit package configuration listings, HTTPS Everywhere rules, a Python tutorial, an old IDAPython article link, I-Nex changelogs, a Flask tutorial image, LinuxToy articles and a desktop service-menu comment. No xinzhai-style uploader is visible in these returned excerpts. The com.cn hostname query returned one HTTPS Everywhere rule match. These counts describe the searched index, not all public implementations.
Example primary repository paths identified by index: https://github.com/i-nex/I-Nex/blob/master/Changelog.md and https://github.com/EFForg/https-everywhere/tree/master/src/chrome/content/rules . Index responses retain exact commits and paths; unrelated referenced paste IDs were not fetched.

Searchcode suitability
The current searchcode.com homepage describes repository-scoped code inspection and search requiring a supplied public repository URL. Its earlier global index is described in the past tense. It therefore does not establish a currently usable global unknown-repository discovery route. No MCP installation or account change was needed or performed.
Primary: https://searchcode.com/ . Local homepage response saved with SHA-256 in079-private/docs-metadata.json.

Method and provenance
Sourcegraph's official streaming documentation describes the read-only endpoint and anonymous public-query example: https://sourcegraph.com/docs/api/stream-api . Documentation was readable through the web tool; a separate local documentation fetch returned403, while API queries succeeded. Do not label the whole host blocked based on the documentation fetch.
079-sourcegraph-check.py,079-expanded-code-search.py and079-distinctive-code-search.py save raw SSE bodies and parsed events, exact queries, timestamps, statuses and SHA-256 hashes in079-private. Queries used count limits and20-second server timeouts,35-second client timeouts, with two-second pacing. No authentication, writes or code execution on target repositories occurred.

Next action
Use Sourcegraph for new distinctive code or host fingerprints, while preserving missing-repository and skipped-result caveats. Do not keep rerunning this same combined-label expression or equate a working API with comprehensive GitHub coverage. The local shared-workflow evidence remains stronger than external attribution evidence.