159 — MiroFlow format-marker check against local raw paste captures
Reviewed 2026-09-06 UTC. No matching literal marker recovered.

Question
Does the existing paste capture corpus contain distinctive MiroFlow tool/server names or its tool-call wrapper, offering a route from a public implementation to otherwise unattributed paste activity?

Scope and method
Only /home/sophia/search/pastebins/data was traversed. No investigation directory, archive contents, external caches or network sources were searched. A path containing4552394 was excluded before any content read; matching directories were pruned, symlinks skipped. Archive/common binary suffixes and files above10,000,000bytes were skipped. Remaining files with a NUL in the first8192bytes were classified binary and excluded from text matching. This is a pragmatic text filter, not a perfect MIME classifier.

Case-insensitive literal byte patterns
agent-worker/execute_subtask
tool-searching/scrape_website
download_file_from_sandbox_to_local
<use_mcp_tool>
MiroFlow

Results
123,510 files enumerated.
123,459 text-eligible files scanned, totaling10,159,988,333bytes.
4 skipped by archive/binary suffix,41 by size,6 by binary-content filter.
0 symlinks,0 read errors.
0 matching files and0 occurrences of each pattern.
Total bytes read including binary-filter checks:10,160,093,895.
No matching4552394 filename was encountered among enumerated files; the pre-read exclusion remained active. No excluded paste was fetched or read.

Limits
This is a negative for exact literal spellings in this fixed local sample. It does not cover JSON escaping of slashes, HTML-escaped wrappers, alternate tool-name serialization, undocumented renames, encrypted or compressed content, uncollected posts or excluded large files. It does not rule out MiroFlow users publishing through these services. The generic use_mcp_tool wrapper alone would not have uniquely attributed a hit; distinctive compound names would still need contextual review.

Next-action implication
No new writer/project link can be followed from this scan. Retain these strings as candidate format clues if a new unencrypted trace appears, rather than describing the no-hit result as attribution evidence.

Preservation
159-private/scan.py records the exact bounded scan and exclusions; summary.json contains counters/timestamps; matches.json is an empty result list. evidence-hashes.json hashes these three local artifacts. No source code from captures was executed; no network request, posting or website edit occurred.