Detected automatically by ai_agent_arrival · 2026-07-31 13:13:44 UTC

Requests declaring meta-externalagent were recorded on this site

A client declaring meta-externalagent made 1 request across 1 distinct path, first seen 2026-07-31.

What was observed

First request 2026-07-31 13:13:30 UTC, most recent 2026-07-31 13:13:30 UTC.

What it means

Arrival is the entire event. This records that a client presenting this identity reached the site and what it took; it does not establish why it came, whether the content was retained, or whether it will return.

No registered trial of ours was running when any of this arrived. That is not proof it came unprompted: it means only that if something of ours caused it, the cause was not written down, which is a gap in our record-keeping rather than evidence either way.

This identity cannot be checked against anything

no machine-readable range list found (checked 2026-07-26)

So the declaration stands unexamined — not contradicted, and not corroborated either. This is a gap in what the vendor publishes rather than anything observed about the client, and it is stated here because the difference between "checked and consistent" and "not checkable" is invisible in a table of counts.

Limits

• The declared user agent is unverified. Any client can send any string, so this describes a claim rather than a confirmed identity.
• Published address lists change. This was checked against the lists as captured on 2026-07-26; a vendor that adds a range afterwards makes an older answer stale rather than wrong, which is why the capture date is stated with the result.
• Fetching is not ingestion. Whether any of this content persists in a model is measured separately, by the coined markers listed on the lab page.
• An arrival cannot be shown to be unprompted. Nothing in a request says why it was made, so “nobody asked for this” rests entirely on our own trial log being complete.
• One domain, observed continuously. Nothing here generalises to how this client behaves elsewhere.

Evidence chain

This finding was not written from memory. Each figure below came from a query against the immutable request record, and each query is shown so it can be run again — by us, on this page, or by anyone reconstructing the same instrument.

What was measured

Each figure is stated first as what it means, which does not depend on how this system happens to store anything today. The query underneath it is implementation — it would be written differently on different storage, and it is shown so the figure can be checked, not because it is part of the claim.

SELECT COUNT(*) FROM RequestReality WHERE siteId = ? AND cfRay IS NOT NULL AND userAgent LIKE ? AND 
  cfConnectingIp IS NOT NULL
  AND cfConnectingIp NOT LIKE '192.0.2.%'
  AND cfConnectingIp NOT LIKE '198.51.100.%'
  AND cfConnectingIp NOT LIKE '203.0.113.%'
  AND cfConnectingIp NOT LIKE '10.%'
  AND cfConnectingIp NOT LIKE '192.168.%'
  AND cfConnectingIp NOT LIKE '127.%'
  AND cfConnectingIp NOT LIKE '::1'
  AND cfConnectingIp NOT LIKE 'fc%'
  AND cfConnectingIp NOT LIKE 'fd%' AND RequestReality.cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%' AND 
  NOT EXISTS (
    SELECT 1 FROM RequestReality c
    WHERE c.siteId = RequestReality.siteId
      AND c.cfConnectingIp = RequestReality.cfConnectingIp
      AND (c.userAgent LIKE 'curl%' OR c.userAgent LIKE 'Wget%'
           OR c.userAgent LIKE 'Python-urllib%' OR c.userAgent LIKE '%python-requests%'
           OR c.userAgent LIKE 'Go-http-client%' OR c.userAgent LIKE 'node-fetch%')
  )

SELECT COUNT(DISTINCT path) FROM RequestReality WHERE siteId = ? AND cfRay IS NOT NULL AND userAgent LIKE ? AND 
  cfConnectingIp IS NOT NULL
  AND cfConnectingIp NOT LIKE '192.0.2.%'
  AND cfConnectingIp NOT LIKE '198.51.100.%'
  AND cfConnectingIp NOT LIKE '203.0.113.%'
  AND cfConnectingIp NOT LIKE '10.%'
  AND cfConnectingIp NOT LIKE '192.168.%'
  AND cfConnectingIp NOT LIKE '127.%'
  AND cfConnectingIp NOT LIKE '::1'
  AND cfConnectingIp NOT LIKE 'fc%'
  AND cfConnectingIp NOT LIKE 'fd%' AND RequestReality.cfConnectingIp NOT LIKE '2a00:1d34:4896:b600:%' AND 
  NOT EXISTS (
    SELECT 1 FROM RequestReality c
    WHERE c.siteId = RequestReality.siteId
      AND c.cfConnectingIp = RequestReality.cfConnectingIp
      AND (c.userAgent LIKE 'curl%' OR c.userAgent LIKE 'Wget%'
           OR c.userAgent LIKE 'Python-urllib%' OR c.userAgent LIKE '%python-requests%'
           OR c.userAgent LIKE 'Go-http-client%' OR c.userAgent LIKE 'node-fetch%')
  )

2 figures have moved since publication. That is expected where a window is still open: the record grew, so the count grew. It means the sentence has aged, not that it was wrong. The published value is what the record showed at the moment it was published, and both are kept.

Governed by

• I. Reality is not interpretation — Reality ≠ Interpretation
• IV. Replay guesses nothing — Every figure must be reproducible from the record
• VI. The record is honest about its size — Sample size is stated; absence is reported as absence

These are the standards this finding was held to, not a claim that it is beyond question. The constitution states them in full.

Other findings

• One address requested 61 distinct paths within 15 seconds
• One address requested 24 distinct paths within 23 seconds
• One address requested 38 distinct paths within 7 seconds
• One address requested 28 distinct paths within 33 seconds
• One address requested 28 distinct paths within 29 seconds

All findings · Live record · Methodology