PushMe recruitment follow-up: ordinary monitoring network, operator linkage
Reviewed 2026-09-06 UTC

Finding
The container namespace mentioned in the public conversation links to a real
public connectivity-monitoring project. Its current shell implementation
performs periodic network checks and publishes structured status events. This
supports the stated task purpose; it does not prove what binary Mayx installed,
that it ran successfully, or that a payment occurred.

Operator linkage
The GitHub profile yodakohl explicitly links pushme.site and self-locates in
Austria. Its public repositories include pushme-netnode and the associated
internet-health-map consumer. This corroborates a namespace/domain link, not
verified legal identity or control of every historical PushMeBot message.
A Chinese participant joining this network does not make its operator a Chinese
lab or establish Chinese-origin swarm infrastructure.
https://github.com/yodakohl
https://api.github.com/users/yodakohl

Implemented purpose
The inspected netnode.sh is 60310 bytes, Git blob SHA1
93cb345a1fc1da35a1109826f51f0ec4980444a5, verified against the contents API.
It defaults to a 60000-millisecond interval and contains nine profiles covering
DNS resolvers, ordinary websites and AI-provider status sources. It reports
connectivity/provider events and liveness to PushMe through separate startup,
heartbeat and publish paths. The file was read as text, never executed.
https://github.com/yodakohl/pushme-netnode/blob/main/netnode.sh

The README describes a small shell/curl/DNS/ping runtime, local state files,
and container deployment. The latest public source is not cryptographic proof
of the contents of the mutable latest-tag container referenced historically.
https://github.com/yodakohl/pushme-netnode

The companion health-map README describes a subscriber consuming connectivity
events and rendering location status. It describes pooled donations and says
distribution is early-stage/manual. These are project claims, not a verified
payout ledger or evidence that the advertised economics worked.
https://github.com/yodakohl/pushme-internet-health-map

Current website differs
An ordinary GET of https://pushme.site currently returned a VManus/Voynich
manuscript reading-room homepage, with a September 5, 2026 source date and a
link to yodakohl/VManus. Thus the present homepage does not corroborate the
historical marketplace presentation. This could reflect site repurposing or
routing; no cause was established, and the monitoring service's current
availability was not tested.

Evidence boundary
Together with report 164's public conversation, this makes a concrete case
of an agent-associated account recruiting another participant into an ordinary
measurement network. It does not prove autonomous decision-making, unauthorized
installation, an escaped swarm, malware, or the reported payment. This pass
deliberately made no startup/heartbeat/registration/coverage/payout requests.

Exactly six ordinary public resources were captured: homepage, GitHub profile
API, public repository list, two repository READMEs and netnode.sh contents API.
Private captures, blob checks and SHA256 inventory are in 166-private.
No Docker, installation, source execution, accounts, submissions or site edits.