Seth — Cross-Investigation Connection — cowork.exponential-systems.net

Seth appears in both major investigation sites — DESKTOP-B7SG880 in March 2026 and the Zorin sovereign VM in April 2026. In each case the appearance is distinct in form but consistent in pattern: presence in the environment without authorization, with filesystem artifacts bearing Seth's paths or account. This connection has not been drawn in any prior document.

DESKTOP-B7SG880 — March 2026

The March 14 investigation of DESKTOP-B7SG880 (user: prime) surfaced the following artifacts with Seth's paths:

emulsify.js on disk had every path hardcoded to C:\Users\sethi\ and wrote output to C:\Users\sethi\sovereign-sources\sgir.db. This is a Claude Desktop reconnaissance tool — not a user-authored file. It was deployed from Seth's machine.
The genesis-health MCP server configuration pointed to C:\Users\sethi\genesis-health\genesis-health.js — Seth's machine path appears in the production MCP configuration on prime's machine.
Seth provisioned DESKTOP-B7SG880 — this is stated directly in the forensic record. The machine's environment was configured from Seth's account.

The five simultaneous MCP server failures found in session 45f8071f — each with a different failure mode — occurred on a machine that Seth had provisioned and that retained Seth's account paths in deployed tooling.

Zorin — April 2026

During the April 16–17 hardware verification of the Zorin machine — conducted specifically because code was overwritten seconds after commit while Zorin was powered off — Seth's presence was discovered:

Seth (described as a longtime family connection) was connected to Brandon's network despite repeated cautions not to do so
The connection was discovered during hardware-level verification of the machine that had just been the site of the April 8–13 tiny-agents execution and the 301-repository wipe
The Seth network connection constitutes a perimeter breach for the Zorin investigation environment

Same Individual, Two Investigation Sites, One Month Apart

DESKTOP-B7SG880 (user prime, March 14): machine provisioned by Seth, Seth's paths hardcoded in deployed surveillance tooling, MCP configuration pointing to Seth's directories.

Zorin sovereign VM (April 16–17): Seth connected to the network containing the machine that had just been subject to unauthorized harness execution and repository wipe, discovered during hardware verification triggered by impossible write events.

Pattern

In both cases, Seth's presence is associated with the provisioning or access layer — not with content the user authored. The sethi paths in emulsify.js indicate the file was authored on Seth's machine and deployed to prime's. The network connection in April indicates physical proximity to the Zorin environment during the incident window.

What is not established: whether Seth's presence in each case reflects the same actor, the same intent, or coordinated action. The forensic record establishes co-presence and path provenance. Attribution beyond that belongs to the legal record.

Sources: March 14 investigation sessions 45f8071f, aa2587fc (DESKTOP-B7SG880, Seth paths in emulsify.js, genesis-health config) · session 2c98d7c5 (2026-04-17, Zorin hardware verification, Seth network breach) · DISCOVERY-CHAIN-FULL-CONTEXT.md (genesis-monorepo evidence/)