Xinzhai / XZ investigation — consolidated understanding and handoff

Written September 6, 2026 UTC. Consolidates the investigation through report 142. This document supersedes optimistic interpretations in earlier notes where they conflict. Research status: blocked on missing provenance, not solved. This handoff records both the findings and the limits; it is not a claim of exhaustive internet coverage.

1. My current understanding

The strongest interpretation is one related automated publishing workflow: large version-labelled encrypted objects, alongside recurring small records called knowledge and improvement plans. The connection between xinzhai and xz is supported by their tightly interleaved posting history, not merely by the abbreviation.

The large objects convincingly match the Fernet format after two Base64 decoding steps. Their authentication has not been verified. The small records use a different visible format. They are opaque and consistent with encryption, but their cipher is not identified. Nothing has been decrypted.

There is strong evidence of automated publishing. There is no established evidence of an agent swarm, autonomous reasoning, a Chinese lab, or even a particular human operator. A Chinese paste host and a pinyin-looking name do not establish nationality. The original spelling is xinzhai, not xinhai; 心斋/心齋 are search hypotheses, not recovered Chinese project names.

My leading operational picture is a development/deployment session followed by unattended scheduled publishing. The large objects might be program releases or state snapshots; the small records might be checkpoints, summaries, manifests, messages or repeated encryption of nearly unchanged state. We cannot choose among these contents from the ciphertexts. One program can produce all the streams. The evidence does not require multiple agents.

Two corrections that matter: 30,000 characters is the observed client-side split convention, not an established site limit. Other surveyed posts exceed it. Fernet uses AES-128-CBC plus HMAC-SHA256; its combined 32-byte key does not mean AES-256.

2. Best evidence: counts, chronology and linkage

The fixed survey covers IDs 4548081–4552953: 4,873 positions, 4,872 validated pages, one deliberately excluded page. The selected Xinzhai/XZ cluster has 3,574 posts:

FamilyCountObserved content
xinzhai tests3Readable print tests
Large xinzhai parts76Nine reassembled version-labelled objects
xz_knowledge_p13,484Distinct small opaque bodies
xz_improvement_plan_p111Distinct opaque bodies

All dates below are site-displayed dates. Minute precision limits timing deductions. The apparent UTC+8 relation to the large objects' embedded timestamps is consistent, but those timestamps are not authenticated or an independent archive date.

Why the shared-workflow inference is strong: all 87 consecutive IDs 4548523–4548609 belong to this cluster; small records interrupt large multipart releases; three plan posts immediately precede three size transitions. Another size cohort continues across the latter two transitions. These are stronger signals than name resemblance.

Limits: only three of eleven plans have that immediate transition relationship. Initial roughly six-hour plan timing becomes irregular. Perfect alternation in an early 430-post segment eventually breaks. This is not proof of causation, two separate processes, a continuously running six-hour loop or a swarm.

Best reports: 055, 056, 067–074. Report 074 is the older detailed working overview; its appended search history is useful, but use this handoff and reports 117 onward for the final crypto interpretation.

3. Large objects: what the bytes establish

Observed decoding chain:

ordered paste parts
  → concatenate
  → standard Base64 decode
  → URL-safe Base64 text
  → URL-safe Base64 decode
  → Fernet-shaped binary object

The nine groups are xinzhai, v5.2, v52, v60, v61, v70, v71, v72, v73, with respectively 4, 4, 6, 7, 8, 9, 11, 13, 14 parts. Parts are split at 30,000 outer characters except the final part. A mathematically equivalent 22,500-character inner split is possible; the exact order of encoding and chunking in the writer was not recovered.

Every reconstructed binary object has the expected 0x80 version, 8-byte timestamp, 16-byte IV, block-aligned ciphertext and 32-byte authentication field. All nine IV fields differ. Across 77,644 ciphertext blocks, no 16-byte block repeats. None of the 36 object pairs shares the first ciphertext byte. This excludes literal reused ciphertext prefixes in this sample, not common plaintext or common keys.

Conditional plaintext sizes, if standard Fernet, after allowing 1–16 bytes of padding:

GroupBytes supplied to encryption
Initial64,912–64,927
v5.265,472–65,487
v5299,664–99,679
v60113,536–113,551
v61125,280–125,295
v70151,488–151,503
v71180,768–180,783
v72209,888–209,903
v73231,152–231,167

These could be compressed or serialized bytes. They are not recovered text lengths. Increasing size is consistent with growing releases or state, but does not establish self-modifying code.

Primary format: https://github.com/fernet/spec/blob/master/Spec.md

Best evidence: reports 068, 117, 118 and 118-crypto-layout-audit.py.

4. Small records: strongest deductions and unresolved issues

Knowledge bodies have exactly ten decoded lengths:

Raw text charactersDecoded bytesPosts
12493178
304226143
36427171
424316358
428319300
472352146
488364239
5003741,153
532397605
572428291

All eleven plan bodies are 864 text characters: the first five decode to 646 bytes, the remaining six to 647. Do not infer equal binary length merely from equal Base64 length.

Decoding replaces spaces with +, then validates Base64. This yields canonical encodings; raw originals must retain their spaces. Of the knowledge records, 3,453 contain spaces, including 55 with edge spaces; 31 already satisfy the expected Base64 form. The visible editor uses multipart/form-data, which does not itself explain plus-to-space damage. A malformed custom form request or additional server decoding remains plausible. No submission experiment established the responsible layer.

Key deductions:

Best evidence: 056, 073–074, 085, 118–120, 124, 141. Primary AEAD documentation: https://cryptography.io/en/latest/hazmat/primitives/aead/

5. Explanations worth retaining, ranked by support

A. Shared automated publisher — strongest. Supported by consecutive IDs, interleaving, regular timing and linked size changes. It could be a conventional script, a human-directed prototype or an agent-connected system.

B. Large releases/snapshots plus small scheduled state — leading architectural interpretation. Explains the startup sequence and persistent small output. Contents could be code, saved state, configuration or documents. No reader has been found.

C. Re-encryption of unchanged or slowly changing data. Explains unique ciphertexts at long-lived fixed lengths. Repeated records do not measure how much learning happened. Neither unchanged nor changing plaintext has been proven.

D. One generic uploader with different caller formats. Fernet already returns Base64 text; a raw AEAD function returns bytes. Base64-encoding both at the upload layer could explain the extra layer on large objects. A public Stack Overflow answer juxtaposed these functions in November 2022, but there is no evidence it was copied by this writer. Report 137.

E. Small manifests, pointers or protocol state. A knowledge-labelled record could point elsewhere. Umbra is an actual encrypted chunk-and-manifest implementation, but its format does not match. Reports 139, 141. This remains a hypothesis about XZ, not a decoded pointer.

F. Versioned sealed publication or priority records. A Chinese OFIRM author explicitly described Pastebin as convenient publication with a timestamp for priority claims. Their March 2026 public project and manuscript provide a real precedent. No XZ link, encrypted matching format or working AGI implementation was established. Reports 132, 134.

G. Persona preservation, synthetic workload, write-only backup or messaging. These can explain some behavior. July persona-export tools exist, but inspected implementations did not match. A prior encrypted website messaging proposal also exists. Neither supplies attribution. Reports 126–128, 138.

Do not assign numerical probabilities: we have no calibrated model or representative base rates. The main uncertainty is missing provenance, not choosing a better-sounding analogy.

6. Search coverage and lessons

The investigation included exact labels, pinyin/Chinese variants, hostnames, form fields, encoding/chunk constants, source-file searches, repository metadata, public community posts, upload attachments and independent corpus scans. Treat every negative as bounded by its recorded scope.

Concrete namesakes and analogues were checked rather than accepted from descriptions. Guanxinzhai, a Coze 心斋 skill and WenDao were not linked to XZ. RentBuddy's public demo claimed encryption through a status message but its inspected function only changed UI state. Alfred similarly had a Fernet helper without the claimed memory integration. A README, badge or architecture diagram is not proof of implementation.

Infrastructure lesson: a legitimately available China/Hong Kong browser or network vantage could improve access to specific challenged public sources. It cannot solve absent indexing, unavailable source, authentication requirements or cryptographic ambiguity by itself. No new infrastructure was purchased. The original broad-hunt handoff describes existing infrastructure; confirm current ownership/process/billing state before using it. Do not assume old infrastructure status remains current.

7. Where everything lives

Working root: /home/sophia/search

Archive SHA256:

4a202ecd9dbe3dfcc40c1dac00984573cdffb38102e9d4ba4e04ce09b9a9105c

Frozen checkpoint SHA256:

620d6dcc62fd2f4eefa396c631b43f57e308fcbd31e5c097994eca4aa5005f40

The archive is9,911,019bytes with3,920members. All3,574 selected cluster bodies were reconciled against our hashes. Eight separately saved large tokens match reassembly; the ninth, initial group is recoverable from the selected bodies. The included1,142-post mirror matches our public subset and is not independent corroboration. No writer source was found among the inspected nonpage files. Report117.

Public site:

Server document root: /home/sophia/search/public. The generators are investigation/china/build_xinzhai_overview.py, 118-build-crypto-page.py, 121-build-analogues-page.py, 122-build-community-page.py, 126-build-ideas-page.py, and swarmhunt/china_dashboard.py --once. The dashboard copies reviewed top-level numbered text reports; never move private/raw files there casually. Updating the website does not mean autonomous research jobs are active.

Suggested reading order: 074 → 117 → 118 → 119 → 120 → 067–073 → 121–142, using the report catalog for specific questions. For reproducible data checks start with118's audit script,119's overlap check,124's wrapper check and141's header check. For the original survey boundaries use039,055,056.

8. What would move this forward

A source or reader tied to these exact labels/URLs would be the best next evidence. Then trace serialization, compression, key derivation, nonce/IV placement, associated data, authentication tag, Base64 layer and upload naming before attempting authentication/decryption.

Other useful changes: an operator-authored explanation, a provenance-linked plaintext/ciphertext example, an independently dated copy, or a supplied usable key together with sufficient format information. A plaintext-looking guess alone is not enough: require authentication where supported and check multiple records.

Without such evidence, do not repeat the same corpus scans, measure entropy again, treat another cipher with matching lengths as identification, or keep collecting unrelated AI namesakes. Missing provenance is why the goal is blocked. It is not proof that the answer does not exist elsewhere.

9. Handling rules for a successor

The unresolved questions are still: what produces the small records, what they contain, and whether the system involves agents at all.

Selected evidence reports