AppSketch Works' asw-controller service (net.geedge.asw, 271 commits) implements a full automated signature-extraction pipeline: it tracks app source/releases via git (BranchController, MergeRequestController, ApplicationReleaseEntity), provisions remote/virtual Android 'Environment' instances with noVNC and terminal WebSocket access so a human operator can drive the app, captures the resulting traffic to pcap (PcapController, PcapParserThread), runs Playbook-scripted analysis integrated with Zeek and WebShark (ZeekClient, WebSharkClient), and produces versioned per-app DPI signatures (SignatureExtract.java, SignatureUtil.java -> ApplicationSignatureEntity).

Live TSG session logs from an internal test/QA gateway (device_id 9800165603191146 / 21426003, data_center label XXG-TSG-BJ) show real sessions from named commercial VPN apps — AlohaBrowserLite, BeePassVPN, BravePrivateVPN (WireGuard), Proton VPN, Turbo VPN, CyberGhost, BetternetVPN, SuperUnlimitedVPN, TrustzoneVPN and VPNHero — each matched to a dedicated per-app security rule (e.g. Deny_Brave, Deny_BeePassvpn, deny_Super Unlimited VPN) and given security_action=Deny. One row's app_transition field records a layered classification chain 'Psiphon Provider' -> ... -> 'BravePrivateVPN' for a single session, indicating the engine attempts nested/tunnel-in-tunnel protocol identification, not just single-label app ID.

A recurring weekly '[Xinjiang Unicom/Xinjiang Mobile] Traffic Analysis Report' (新疆联通/移动流量分析报告), produced by a 'Carrier Front-End Analysis Team' (运营商前端分析团队), spans Feb-Jul 2023 in this batch. It reports each carrier's total/access bandwidth (Xinjiang Unicom: 1.88 Tbps total, 880 Gbps access; Xinjiang Mobile: 4.4 Tbps total, 1 Tbps access) and per-app server-IP/location/traffic breakdowns for 31 named foreign platforms including Telegram, WhatsApp, Twitter, Facebook, Discord, Snapchat, Gmail and YouTube, alongside domestic-app sections — direct evidence of an ongoing, carrier-integrated domestic monitoring program for China's Xinjiang region.

A Sentinel HASP software-license XML file names "CEIEC" as the licensed organization (type "Evaluation"), with the license's embedded HASP feature blob (v2c field) containing readable product-SKU strings "TSG-Web-Sketch-DB- Subscription", "TSG-App-Sketch-DB-Subscription", "TSG-App-Sketch-Engine", "TSG-App-Sketch", "TSG-WANNAT", "TSG-Proxy", and "TSG-CM" — direct primary- source evidence of a CEIEC-licensed TSG deployment naming the specific licensed product modules. This does not by itself identify which end customer/country CEIEC was reselling to for this particular license.

TSG's app-traffic classification relies on an updatable "App Sketch DB" component (uploaded as a versioned file to each deployment). A version bump at the Xinjiang Unicom province-exit + IDC site increased identified application-traffic share from 23% to 68% of total traffic within days, with ByteDance-attributed traffic alone rising from ~100TB/day to ~500TB/day identified, illustrating both the scale of traffic under classification and that classification itself is a frequently-updated, centrally-distributed database rather than a static build-time artifact.

Confirms the full licensed TSG component roster deployed at Ethiopia (E21): Firewall, Digital Observer, Email Retention, Statistics Policy, Proxy, Session Record, GTP Security, AppSketch, AppSketch Engine, AppSketch DB, WebSketch, WebSketch DB. Several license terms were extended to expire 2091-12-31, indicating a multi-decade commercial commitment.

Side-by-side internal performance comparison across Xinjiang (China Mobile carrier deployment, hostname cmcc-xj-server1-sapp-244), Fujian (domestic), and Ethiopia (E21) explicitly references the same 'app_sketch_maat' diagnostic log format at all three sites, confirming the identical AppSketch app-fingerprinting stack is used for domestic Xinjiang surveillance and for the exported Ethiopia deployment.