Confirms operational deployment of TSG's 'Shaping' (bandwidth-throttling) feature at the M22 project's YGN-MYTEL site (Yangon, Mytel — Myanmar), with per-client-IP rate limits implemented via a distributed token-bucket system ('SwarmKV'); a bug investigation shows throttling policies can cause full client disconnection under cluster-sync load, not just degraded speed.

Session records log MITM-proxy decision fields per session -- proxy_action, proxy_pinning_status, proxy_intercept_status, proxy_cert_verify, proxy_intercept_error, and proxy_passthrough_reason -- alongside security_rule_list/security_action and shaping_rule_list. This confirms, at the OLAP schema level, that TLS-interception outcomes (intercepted vs. passed through, including why -- e.g. detected certificate pinning) are retained per session, corroborating the certstore product's Trusted/Untrusted/Dynamic-Bypass model. Two adjacent columns, sc_rsp_raw/sc_rsp_decrypted, sit next to these but their exact semantics were not confirmed from schema alone.

TSG's QA automation framework (dongxiaoyan/gap_tsg_api) documents the policy engine's app-blocking action taxonomy (default/Drop/RateLimit/Tamper, with "rst" later renamed "reset") and records that, as of a 2022 test-suite update, the circumvention tools Psiphon ("赛风") and Freegate ("自由门") were only supported under a RateLimit (throttle) deny action rather than a hard Drop, while dozens of other apps (WeChat, Telegram, WhatsApp, Tor, WireGuard, TachyonVPN, Instagram, Facebook, etc.) had named test coverage across Allow/Deny/Monitor actions.

Raw TSG session_record export logs dated Nov 2024, tagged device_group 'YGN-MYTEL' (Yangon, Mytel), directly corroborate the leak's M22=Myanmar/Mytel/Yangon site-codename mapping with live production data: individual SSL sessions are classified by app as 'Hotspot Shield VPN' (destination get.adobe.com, likely a fronting/CDN endpoint) and allowed under a named whitelist rule 'whitelist_102024', geolocated client-side as Myanmar.Yangon.Yangon.

Under the internal "M22" project (deployment site "YGN-MYTEL" confirms this is Myanmar, at the Mytel carrier), Geedge runs a continuous, individually-tracked signature-extraction pipeline against named commercial VPN apps (Super Unlimited VPN, NotVPN, Avira Phantom, Bitdefender VPN, Thunder VPN, Panda VPN, Mouse VPN, HaloVPN, GoFly VPN, Kiwi/Kuto/Greennet/Gulf Super/Hatunnel+ VPN, and a customer-provided list of 141 more): active probing of app refresh/connect behavior (including automated UI-driving scripts) extracts server IP/FQDN lists, separately for free vs. paid tiers and Android vs. iOS, which are then loaded as blocklist objects and validated against a false-positive ("CT"/穿透) test pass in a separate demo environment before deployment.

Geedge runs an ongoing, systematically-numbered VPN/app fingerprinting program for the M22 (Myanmar) deployment — a tracked "M22-VPN List" with 188+ sequentially numbered entries, and a separate non-VPN app catalog past entry 550 — with weekly-cadence re-testing (e.g. Quark VPN patches issued repeatedly through late 2024 as the target app's own infrastructure changed).

An 'Equipment label and cable label design' spec's data-center appendix lists far more Myanmar carrier taps than previously documented: Yangon sites for NDC, Mytel, MPT, ATOM, Ooredoo, Frontiir, Campana, GTG, GTMH, StreamNet, China Unicom, MTN and MBT; Mandalay sites for Mytel/MPT/ATOM/Ooredoo/GTG/China Unicom; plus Tachilek, Ketong, Myawaddy and Muse border sites; and a Naypyidaw entry 'NPT-NCCC' alongside 'NPT-MPT', plausibly a tap tied to Myanmar's National Cyber [Security] Coordination Center in the capital. The equipment-type table also confirms 'TSG-X' as the formal hardware model code.