204 — AgentENV: primary training-infrastructure claim and network defaults Recorded 2026-09-06 UTC. Read-only source inspection; no project code executed. RESULT AgentENV's own repository describes it as the environment platform powering Kimi K3 agentic reinforcement-learning training. This upgrades the earlier, secondary AgentEnv mention in report 174 to a primary publisher claim. The published design supports many isolated Firecracker environments, outbound internet access and externally proxied application services. It supplies a plausible infrastructure mechanism for internet-reaching training agents, not proof that a particular public post came from Kimi, or that any agent escaped. PINNED EVIDENCE Repository: https://github.com/kvcache-ai/AgentENV Inspected tree: 891d64e77fd0ca7305df6a7b817f487cec7e91cf GitHub recursive tree contains 893 paths and reports no truncation. Five downloaded source/document files match their Git blob SHA-1 values in that tree. This verifies capture consistency, not deployment history. 1. README identifies Kimi K3 training as a use of the platform. No training-run logs, model weights, production configuration or fleet/operator records were recovered in this check. 2. Sandboxes documentation explicitly defaults allow_internet_access / allowInternetAccess to true. Users can configure allowOut and denyOut, while node-level denied networks take precedence. Source BaseSandboxNetworkPolicy defaults to the variant documented as allowing outbound traffic except static namespace egress rejects. 3. Application ingress is a separate setting: network.allowPublicTraffic defaults to true, also visible in SandboxNetworkPolicy::default(). Setting it false requires a sandbox traffic token. This does not mean the control API or environment-management service is unauthenticated, or that a running service exists in each sandbox. 4. The design places each VM in an isolated network namespace, with routing and an egress proxy. Its internal/private address pools are not public swarm endpoints. Generic IP ranges and ports are poor search fingerprints. SEARCHABLE CLUES, WITH LIMITS The proxy docs name x-agentenv-sandbox-id and x-agentenv-target-port, with E2B compatibility aliases. Source also names AGENTENV-EGRESS, AGENTENV-USER-EGRESS and AGENTENV-EGRESS-PROXY iptables chains. Exact combinations in voluntarily published debug logs or execution traces would be more useful than a generic agent or sandbox label. These markers are copyable open-source implementation details, not lab identity. Routing headers are stripped before application forwarding, so absence in ordinary destination logs is unsurprising. A valuable next artifact would be a public dated run log containing one of these distinctive markers AND a concrete public-site URL, followed by an independently readable matching post. Even that establishes a software-linked event before it establishes model/operator attribution. Do not probe guessed sandbox hosts or private services. WHAT THIS DOES NOT ESTABLISH No join to XZ/Xinzhai, the original wiki/paste cluster, a Chinese egress IP, an unattended inter-agent exchange, or pre-disclosure swarm activity. Published current defaults cannot be assumed to be production defaults or historical defaults. A claim about Kimi K3 infrastructure cannot be extrapolated to every Kimi version. INFRASTRUCTURE IMPLICATION These GitHub sources are reachable from the existing server. More GPUs or another large cloud machine would not resolve the missing historical run evidence. A mainland broadband browser remains useful for regional Chinese search and public pages that block this server; it cannot repair missing hosts or grant account access. SOURCES (all pinned to inspected tree) https://raw.githubusercontent.com/kvcache-ai/AgentENV/891d64e77fd0ca7305df6a7b817f487cec7e91cf/README.md https://raw.githubusercontent.com/kvcache-ai/AgentENV/891d64e77fd0ca7305df6a7b817f487cec7e91cf/docs/src/internals/networking.md https://raw.githubusercontent.com/kvcache-ai/AgentENV/891d64e77fd0ca7305df6a7b817f487cec7e91cf/docs/src/concepts/proxy.md https://raw.githubusercontent.com/kvcache-ai/AgentENV/891d64e77fd0ca7305df6a7b817f487cec7e91cf/docs/src/concepts/sandboxes.md https://raw.githubusercontent.com/kvcache-ai/AgentENV/891d64e77fd0ca7305df6a7b817f487cec7e91cf/src/sandbox/network/policy.rs LOCAL EVIDENCE investigation/china/204-private/: tree.json, five source files, sources.json (Git blob verification), hashes.json (SHA-256 capture hashes). Prior context: 174-kimi-code-swarm-fingerprint-check.txt. Classification: primary infrastructure claim; published network capability; no confirmed escaped swarm. FOLLOW-UP SEARCH SCOPE Four web queries searched the exact x-agentenv-sandbox-id header and AGENTENV-EGRESS chain (excluding the upstream GitHub/docs domains), plus AgentENV with trajectory and with 日志. Returned material included a source mirror, unrelated AgentGym/AgentEnv classes and ModelScope Twinkle deployment documentation. No independent public execution record linking these markers to a swarm post was recovered in those results. This is a bounded search negative, not proof that no such logs exist. Twinkle primary documentation to inspect next: https://modelscope.github.io/twinkle-web/zh/docs/usage-guide/agentic-rl-deployment-and-training/ Its search excerpt describes a local deployment without authentication, whereas the inspected AgentENV proxy docs discuss traffic-token controls and a separate control-plane API. Version and configuration differences must be checked before treating either as a blanket security claim. No deployment was contacted.