🚢 GuanWuTong — Cross-Border Compliance Gateway for Shipping Manifests

中文版见 README.md

Upload a shipping manifest, get an auditable cross-border transfer assessment — the legal nature of every field, the recommended lawful transfer pathway, and an explicit list of the facts still missing before a conclusion can be reached.

It deliberately will not tell you "yes, you may send this." Whether data may lawfully leave China depends on the exporter's status, cumulative annual transfer volumes, whether regulators have designated the data as important, and which statutory procedures have already been completed. None of that is visible in a manifest. A tool that confidently answers "safe to transfer" manufactures legal risk rather than removing it.

---

The problem

Shipping lines, freight forwarders and cross-border e-commerce operators send manifests to overseas carriers, destination-port agents and warehouses every day. Those manifests routinely carry data regulated under Chinese law:

• Consignor / consignee ID numbers, phone numbers, addresses
• Seafarer passport numbers and names
• Dangerous goods (IMDG) details, high-value cargo information

Operations staff just want the paperwork out the door. They will not check each field against the Data Security Law, the Personal Information Protection Law (PIPL) and the Provisions on Promoting and Regulating Cross-Border Data Flows. Today the alternatives are manual clause-by-clause review (slow, error-prone) or nothing at all.

GuanWuTong sits at the last mile before data leaves the country and produces a reviewable, replayable compliance assessment.

---

Agent and skills

Delivered as an Agent + Skills package. The agent contract lives in AGENTS.md; skills live under .agents/skills/:

manifest-ingest              Parsing: multi-sheet · title-row detection · encodings · cell coordinates
        │
        ▼
pii-detection                Field name → value regex → checksum validation
        │
        ├──▶ sensitive-pi-classification   General vs. sensitive personal information (PIPL Art. 28)
        ├──▶ important-data-screening      Important-data leads + designation status (CBDF Art. 2)
        └──▶ export-control-screening      Dangerous goods / dual-use items (IMDG · Export Control Law)
        │
        ▼
deidentification             Four-state masking: masked / not-applicable / blocked / failed
        │
        ▼
transfer-pathway-decision    Data nature × scenario facts → one of eight pathways
        │
        ▼
compliance-report            Auditable report: versions · citations · outstanding facts

ai-semantic-review is an optional side-channel skill, disabled by default. With it off, the entire pipeline runs locally and sends nothing anywhere.

---

The two-axis model

The previous version collapsed three questions into one chain: field name → core/important/general → block/mask/allow. That chain contained two legal errors: it equated PIPL "sensitive personal information" with Data Security Law "important data", and it treated masking as satisfying transfer requirements.

Axis 1 — Data nature (what this data is, legally)

Tier	Legal meaning
General business data	Neither personal information nor important data
General personal information	PIPL Art. 38 · notification duties apply
Sensitive personal information	PIPL Art. 28 · separate consent + impact assessment
Important data (pending verification)	Lead detected but not designated by regulators; per CBDF Art. 2 not treated as important data
Important data (designated)	Notified or published as such · security assessment required
Core data (designated)	DSL Art. 21 · stricter regime

The last two tiers can only be asserted by the user in the scenario questionnaire. The system never infers them. Important-data status is an administrative designation, not a property an algorithm can compute.

Axis 2 — Transfer pathway (which procedure applies)

Exempt (international trade / transport) · Exempt (outside FTZ negative list) · Exempt (statutory PI exemptions) · Complete notification, separate consent and PIA · Standard contract or PI protection certification · Security assessment · Manual compliance review · Explicit prohibition

The pathway is derived from a ten-question scenario questionnaire covering CIIO status, important-data designation, cumulative annual transfer volumes for personal and sensitive personal information, statutory exemptions, FTZ registration and negative-list comparison, separate consent, PIA, and overseas-recipient disclosure.

If any material fact is missing, the conclusion degrades to "insufficient information — manual compliance review required."

---

Quick start

pip install -r requirements.txt
cp .env.example .env          # optional: DEEPSEEK_API_KEY for semantic review
python generate_sample.py
streamlit run app.py

Open http://localhost:8501, fill in the scenario questionnaire first, then upload sample_data/sample_manifest.xlsx.

Without an API key the system runs in pure local rule mode and transmits nothing to any external service.

---

Verification

python verify.py                 # eight assertions incl. red-line checks
python tests/run_eval.py         # golden test set: precision / recall / F1
pytest tests/test_regression.py  # regression cases for historical bugs

verify.py runs from dependency checks through to a binary search of the generated PDF for raw sensitive values, exiting non-zero on any failure. Evidence is written to docs/verification-evidence.json so reviewers can re-run it and compare against the committed version. Method: docs/verification.md.

Measured metrics and every false positive / negative: docs/evaluation-report.md. Section 8 of that report is titled "What these numbers do not show" — targets and measurements are stated separately, and the limits of the test set are spelled out.

---

Why shipping, and why now

On 8 February 2025, the Shanghai Cyberspace Administration, Municipal Data Bureau and Development & Reform Commission, together with the Shanghai Pilot Free Trade Zone and Lin-gang Special Area authorities, jointly issued the Data Export Negative List (2024 edition) for the Shanghai FTZ and Lin-gang Special Area. It covers three sectors: reinsurance, international shipping, and retail/catering/accommodation — 6 scenarios, 84 data items.

Consequences:

• Operators registered in and conducting transfers within the FTZ / Lin-gang area may transfer data outside the negative list without filing a security assessment, executing standard contractual clauses, or obtaining certification;
• The regime does not apply to critical information infrastructure operators;
• Users of this simplified route must file a record within 15 working days with their local Cross-Border Data Service Centre.

Exemption from filing is not exemption from recording, and neither removes the need to judge. GuanWuTong splits these conditions into separate questions, surfaces the recording obligation when the simplified route applies, and falls back honestly to the standard pathway when it does not.

The full negative list and its 84 data items must be obtained from the local Cross-Border Data Service Centre. This system provides an applicability assessment and a recording reminder — it does not replace comparison against the official text. Provenance and verification requirements are annotated in legal_sources.py.

---

Scope statement

This tool produces compliance risk leads and outstanding facts. It does not constitute legal advice, nor a final determination of whether data may be transferred. Masking is de-identification, not anonymisation within the meaning of PIPL Art. 73; masked data generally remains personal information. Actual transfers should be assessed by the organisation's compliance officer against the specific business context, with professional advice where appropriate.

Do not upload real production manifests to the demo environment.