# Track 04 — Canon (Knowledge Canon)

## Source Manifest

| source_id | url | bucket | last_checked | author/host | one-line note |
|-----------|-----|--------|--------------|-------------|---------------|
| T04-S001 | https://docs.github.com/en/site-policy/github-terms/github-terms-of-service | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) — GitHub ToS full text |
| T04-S002 | https://docs.github.com/en/site-policy/acceptable-use-policies/github-acceptable-use-policies | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) — AUP master page |
| T04-S003 | https://docs.github.com/en/site-policy/acceptable-use-policies/github-appeal-and-reinstatement | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) — appeal + reinstatement policy |
| T04-S004 | https://docs.github.com/en/site-policy/other-site-policies/github-and-trade-controls | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) — trade controls & sanctions |
| T04-S005 | https://docs.github.com/en/site-policy/github-terms/github-community-guidelines | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) — community guidelines |
| T04-S006 | https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) — privacy statement |
| T04-S007 | https://docs.github.com/en/site-policy/other-site-policies/github-government-takedown-policy | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) — government takedowns |
| T04-S008 | https://docs.github.com/en/site-policy/content-removal-policies/dmca-takedown-policy | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) — DMCA takedown policy |
| T04-S009 | https://docs.github.com/en/site-policy/content-removal-policies/guide-to-submitting-a-dmca-counter-notice | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) — DMCA counter-notice guide |
| T04-S010 | https://transparencycenter.github.com/ | surrogate_primary | 2026-05-23 | GitHub / transparencycenter.github.com | vendor docs (GitHub 一手) — transparency center with moderation data |
| T04-S011 | https://transparencycenter.github.com/appeals/ | surrogate_primary | 2026-05-23 | GitHub / transparencycenter.github.com | vendor docs (GitHub 一手) — appeals & reinstatements data |
| T04-S012 | https://github.blog/news-insights/policy-news-and-insights/advancing-developer-freedom-github-is-fully-available-in-iran/ | surrogate_primary | 2026-05-23 | GitHub / github.blog | vendor docs (GitHub 一手) — Iran OFAC license announcement 2021-01-05 |
| T04-S013 | https://github.blog/2019-09-12-global-software-collaboration-in-the-face-of-sanctions/ | surrogate_primary | 2026-05-23 | GitHub / github.blog | vendor docs (GitHub 一手) — Nat Friedman 2019 sanctions response |
| T04-S014 | https://ofac.treasury.gov/sanctions-programs-and-country-information | verified_primary | 2026-05-23 | U.S. Treasury OFAC / ofac.treasury.gov | OFAC sanctions programs by country |
| T04-S015 | https://ofac.treasury.gov/specially-designated-nationals-list-sdn-list/program-tag-definitions-for-ofac-sanctions-lists | verified_primary | 2026-05-23 | U.S. Treasury OFAC / ofac.treasury.gov | SDN list program tag definitions |
| T04-S016 | https://sanctionssearch.ofac.treas.gov/ | verified_primary | 2026-05-23 | U.S. Treasury OFAC / ofac.treasury.gov | SDN list search tool |
| T04-S017 | https://ofac.treasury.gov/faqs/1184 | verified_primary | 2026-05-23 | U.S. Treasury OFAC / ofac.treasury.gov | FAQ on IT/software services determination re Russia |
| T04-S018 | https://www.law.cornell.edu/uscode/text/17/512 | verified_primary | 2026-05-23 | Cornell LII / law.cornell.edu | 17 U.S.C. section 512 — DMCA safe harbor statute text |
| T04-S019 | https://www.copyright.gov/512/ | verified_primary | 2026-05-23 | U.S. Copyright Office / copyright.gov | Section 512 resources on safe harbors |
| T04-S020 | https://www.bis.gov/regulations/ear | verified_primary | 2026-05-23 | Bureau of Industry & Security / bis.gov | Export Administration Regulations (EAR) overview |
| T04-S021 | https://www.bis.gov/regulations/ear/part-734/section-734.17/export-encryption-source-code-object-code-software | verified_primary | 2026-05-23 | Bureau of Industry & Security / bis.gov | EAR encryption export rules for source code |
| T04-S022 | https://arxiv.org/abs/2404.05489 | verified_primary | 2026-05-23 | Fan et al. / arxiv.org | "Impact of Sanctions on GitHub Developers" — 156K profiles, 41M activities |
| T04-S023 | https://lessig.org/product/code/ | surrogate_primary | 2026-05-23 | Lawrence Lessig / lessig.org | vendor docs (作者一手) — Code: And Other Laws of Cyberspace (1999/2006) |
| T04-S024 | https://en.wikipedia.org/wiki/Code_and_Other_Laws_of_Cyberspace | reference | 2026-05-23 | Wikipedia | Reference — Lessig Code summary |
| T04-S025 | https://press.stripe.com/working-in-public | surrogate_primary | 2026-05-23 | Stripe Press / press.stripe.com | vendor docs — Nadia Eghbal Working in Public (2020) publisher page |
| T04-S026 | https://nadiaeghbal.com | surrogate_primary | 2026-05-23 | Nadia Eghbal / nadiaeghbal.com | vendor docs (作者一手) — author site |
| T04-S027 | https://yalebooks.yale.edu/book/9780300261431/custodians-of-the-internet/ | surrogate_primary | 2026-05-23 | Yale University Press / yalebooks.yale.edu | vendor docs — Gillespie Custodians of the Internet (2018) |
| T04-S028 | https://harvardlawreview.org/print/vol-131/the-new-governors-the-people-rules-and-processes-governing-online-speech/ | surrogate_primary | 2026-05-23 | Kate Klonick / Harvard Law Review | vendor docs (协会) — "The New Governors" 131 Harv. L. Rev. 1598 (2018) |
| T04-S029 | https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3186205 | surrogate_primary | 2026-05-23 | Jack Balkin / SSRN | vendor docs (作者一手) — "Free Speech is a Triangle" Columbia L. Rev. (2018) |
| T04-S030 | https://columbialawreview.org/content/free-speech-is-a-triangle/ | surrogate_primary | 2026-05-23 | Columbia Law Review | vendor docs (协会) — Balkin triangle essay publication |
| T04-S031 | https://cyber.harvard.edu/wealth_of_networks/3._Peer_Production_and_Sharing | verified_primary | 2026-05-23 | Yochai Benkler / Harvard Berkman Center | Wealth of Networks ch. 3 — commons-based peer production |
| T04-S032 | https://law.stanford.edu/publications/design-principles-for-intermediary-liability-laws/ | verified_primary | 2026-05-23 | Daphne Keller / Stanford Law School | Design Principles for Intermediary Liability Laws |
| T04-S033 | https://cyberlaw.stanford.edu/about/people/daphne-keller/ | verified_primary | 2026-05-23 | Stanford CIS / cyberlaw.stanford.edu | Daphne Keller profile + publications list |
| T04-S034 | https://digital-strategy.ec.europa.eu/en/policies/digital-services-act | surrogate_primary | 2026-05-23 | European Commission / ec.europa.eu | vendor docs (监管) — EU Digital Services Act overview |
| T04-S035 | https://en.wikipedia.org/wiki/Section_230 | reference | 2026-05-23 | Wikipedia | Reference — CDA section 230 overview |
| T04-S036 | https://www.eff.org/issues/bloggers/legal/liability/230 | surrogate_primary | 2026-05-23 | EFF / eff.org | vendor docs (协会) — Section 230 explainer |
| T04-S037 | https://firstmonday.org/ojs/index.php/fm/article/download/578/499?inline=1 | surrogate_primary | 2026-05-23 | Eric Raymond / First Monday (UIC) | vendor docs (协会) — Cathedral & the Bazaar original essay (peer-reviewed journal) |
| T04-S038 | https://www.oreilly.com/library/view/the-cathedral/0596001088/ | surrogate_primary | 2026-05-23 | O'Reilly Media / oreilly.com | vendor docs — Cathedral & the Bazaar book page |
| T04-S039 | https://open.umn.edu/opentextbooks/textbooks/producing-open-source-software-how-to-run-a-successful-free-software-project | verified_primary | 2026-05-23 | Karl Fogel / University of Minnesota | Producing Open Source Software 2nd ed. (open textbook) |
| T04-S040 | https://kaiyuanshe.github.io/2024-China-Open-Source-Report/ | surrogate_primary | 2026-05-23 | Kaiyuanshe (开源社) / kaiyuanshe.github.io | vendor docs (协会) — 2024 China Open Source Annual Report |
| T04-S041 | https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/recovering-your-account-if-you-lose-your-2fa-credentials | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) — 2FA recovery procedures |
| T04-S042 | https://support.github.com/contact/reinstatement | surrogate_primary | 2026-05-23 | GitHub / support.github.com | vendor docs (GitHub 一手) — reinstatement form URL |
| T04-S043 | https://github.blog/news-insights/policy-news-and-insights/2022-transparency-report/ | surrogate_primary | 2026-05-23 | GitHub / github.blog | vendor docs (GitHub 一手) — 2022 transparency report |
| T04-S044 | https://en.wikipedia.org/wiki/Censorship_of_GitHub | reference | 2026-05-23 | Wikipedia | Reference — GitHub censorship history incl. China |
| T04-S045 | https://www.loc.gov/item/global-legal-monitor/2021-07-06/germany-network-enforcement-act-amended-to-better-fight-online-hate-speech/ | verified_primary | 2026-05-23 | Library of Congress / loc.gov | Germany NetzDG amendment analysis |
| T04-S046 | https://en.wikipedia.org/wiki/Network_Enforcement_Act | reference | 2026-05-23 | Wikipedia | Reference — NetzDG overview |
| T04-S047 | https://docs.github.com/en/site-policy/acceptable-use-policies/github-active-malware-or-exploits | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) — active malware policy |
| T04-S048 | https://docs.github.com/en/site-policy/acceptable-use-policies/github-disrupting-the-experience-of-other-users | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) — disruption policy |
| T04-S049 | https://docs.github.com/en/site-policy/acceptable-use-policies/github-impersonation | surrogate_primary | 2026-05-23 | GitHub / docs.github.com | vendor docs (GitHub 一手) — impersonation policy |
| T04-S050 | https://github.blog/news-insights/policy-news-and-insights/github-supports-internet-freedom-and-global-availability-in-iran/ | surrogate_primary | 2026-05-23 | GitHub / github.blog | vendor docs (GitHub 一手) — continued Iran availability 2024 |
| T04-S051 | https://www.congress.gov/crs-product/IF11478 | verified_primary | 2026-05-23 | Congressional Research Service / congress.gov | DMCA Safe Harbor legal overview |
| T04-S052 | https://en.wikipedia.org/wiki/Cybersecurity_Law_of_the_People's_Republic_of_China | reference | 2026-05-23 | Wikipedia | Reference — China Cybersecurity Law summary |
| T04-S053 | https://pilot2254.github.io/blog/how-github-suspended-me/ | surrogate_primary | 2026-05-23 | Michal Flaska / pilot2254.github.io | vendor docs — 40-day suspension case study 2024 |
| T04-S054 | https://blog.lyc8503.net/en/post/github-account-suspended/ | surrogate_primary | 2026-05-23 | lyc8503 / blog.lyc8503.net | vendor docs — Chinese developer suspension case study |
| T04-S055 | https://github.com/orgs/community/discussions/177139 | surrogate_primary | 2026-05-23 | GitHub Community / github.com | vendor docs (GitHub 一手) — student reinstatement success story |

---

## 总览 (Tiered Canon)

### Tier 1 — 必读 (Must-Read Canon)

These are non-negotiable foundational texts. Anyone operating in the GitHub account reinstatement domain must internalize these.

**A. GitHub Official Policy System (6 documents)**
1. **GitHub Terms of Service** — the master contract governing all account relationships [T04-S001]
2. **GitHub Acceptable Use Policies** — the behavioral rulebook; violations here trigger most suspensions [T04-S002]
3. **GitHub Appeal and Reinstatement** — the only official pathway back; defines the 6-month window, appeal vs. reinstatement distinction, form URL, and review process [T04-S003]
4. **GitHub and Trade Controls** — the sanctions compliance page; lists sanctioned regions, explains location determination (IP + payment, not nationality), and appeal process for false flags [T04-S004]
5. **GitHub Transparency Center** — quantitative data on moderation actions, appeals granted/denied, DMCA volumes [T04-S010] [T04-S011]
6. **GitHub 2FA Recovery** — critical for the "locked out, not banned" diagnostic branch [T04-S041]

**B. OFAC/Sanctions Legal Framework (3 sources)**
7. **OFAC Sanctions Programs and Country Information** — the authoritative list of which countries face what restrictions [T04-S014]
8. **OFAC SDN List and Search Tool** — the actual blocklist that GitHub screens against [T04-S015] [T04-S016]
9. **31 CFR Part 500-599 / EAR** — the regulatory code underlying all trade control actions [T04-S020] [T04-S021]

**C. Platform Governance Foundational Texts (3 works)**
10. **Lawrence Lessig, "Code: And Other Laws of Cyberspace" (1999/2006)** — "code is law" thesis; explains why GitHub's architecture IS its governance [T04-S023]
11. **Kate Klonick, "The New Governors" (2018)** — the definitive academic framework for understanding platforms as quasi-governmental content moderators [T04-S028]
12. **Tarleton Gillespie, "Custodians of the Internet" (2018)** — content moderation as central (not peripheral) to platform existence [T04-S027]

### Tier 2 — 强烈推荐 (Strongly Recommended)

These provide essential depth in specific sub-domains.

**D. Legal Frameworks**
13. **17 U.S.C. section 512 (DMCA safe harbor)** — the legal architecture that shapes GitHub's takedown/counter-notice system [T04-S018] [T04-S019]
14. **CDA Section 230** — the immunity shield that lets GitHub moderate content at its discretion [T04-S035] [T04-S036]
15. **EU Digital Services Act (DSA)** — the new compliance regime giving EU users out-of-court dispute settlement rights [T04-S034]
16. **Germany NetzDG** — the first platform content moderation law; template for 13+ countries [T04-S045]

**E. Platform Governance Theory**
17. **Jack Balkin, "Free Speech is a Triangle" (2018)** — state-platform-speaker triadic model replacing the old dyadic free-speech framework [T04-S029] [T04-S030]
18. **Daphne Keller, "Design Principles for Intermediary Liability Laws"** — practical framework for evaluating platform liability regimes [T04-S032]
19. **Yochai Benkler, "The Wealth of Networks" (2006)** — commons-based peer production theory; explains why open-source code hosting is a public good [T04-S031]

**F. Open Source Governance**
20. **Nadia Eghbal, "Working in Public" (2020)** — the modern reality of open-source maintenance; platform dependency risks [T04-S025] [T04-S026]
21. **Eric Raymond, "The Cathedral and the Bazaar" (1999)** — foundational open-source development philosophy [T04-S037] [T04-S038]
22. **Karl Fogel, "Producing Open Source Software" (2005/2017)** — practical governance handbook for open-source projects [T04-S039]

**G. Empirical Research**
23. **Fan et al., "The Impact of Sanctions on GitHub Developers and Activities" (2024)** — the only large-scale empirical study; 156K profiles, 41M activities, 8 countries [T04-S022]

### Tier 3 — 按需 (Reference as Needed)

**H. GitHub Operational Documents**
24. GitHub Community Guidelines [T04-S005]
25. GitHub Privacy Statement [T04-S006]
26. GitHub Government Takedown Policy [T04-S007]
27. GitHub DMCA Takedown Policy + Counter-Notice Guide [T04-S008] [T04-S009]
28. GitHub Active Malware Policy [T04-S047]
29. GitHub Disruption Policy [T04-S048]
30. GitHub Impersonation Policy [T04-S049]
31. GitHub Blog: Nat Friedman 2019 sanctions response [T04-S013]
32. GitHub Blog: Iran OFAC license announcement [T04-S012]

**I. China-Specific**
33. Kaiyuanshe 2024 China Open Source Annual Report [T04-S040]
34. China Cybersecurity Law / Data Security Law / PIPL [T04-S052]
35. Censorship of GitHub (Wikipedia overview) [T04-S044]

**J. Case Studies**
36. Pilot2254 40-day suspension case [T04-S053]
37. lyc8503 Chinese developer suspension case [T04-S054]
38. Student reinstatement success story [T04-S055]

---

## 详细卡片

### Card 1: GitHub Terms of Service (ToS)
- **类型**: Platform contract / legal document
- **作者/发行**: GitHub, Inc. (Microsoft subsidiary)
- **最新版**: continuously updated; current as of 2024
- **必读理由**: The ToS is the master agreement that creates and governs the account relationship. Every suspension ultimately traces back to a ToS violation or a legal obligation (sanctions, DMCA) that the ToS incorporates by reference. Understanding ToS structure (account terms, acceptable use incorporation, termination provisions, governing law) is prerequisite to any appeal. evidence: [T04-S001]
- **核心收获**: (a) GitHub may suspend or terminate access for ToS violations "at its sole discretion." (b) California law governs; venue is San Francisco. (c) ToS explicitly incorporates AUP, Privacy Statement, and Community Guidelines by reference. (d) Users are responsible for compliance with all applicable laws including export controls.
- **局限**: ToS is intentionally broad and vague on enforcement discretion — it tells you what CAN happen but not what WILL happen in specific cases.
- **智识谱系**: Upstream: U.S. contract law + platform TOS tradition. Downstream: feeds into AUP, Appeal & Reinstatement, Trade Controls.

### Card 2: GitHub Acceptable Use Policies (AUP)
- **类型**: Platform behavioral rulebook
- **作者/发行**: GitHub, Inc.
- **必读理由**: The AUP is the primary "charging document" — most suspensions cite an AUP violation. It defines specific prohibited categories: spam, abuse, active malware, impersonation, disruption, harassment, misinformation, and more. Each sub-policy has its own page with detailed guidance. evidence: [T04-S002] [T04-S047] [T04-S048] [T04-S049]
- **核心收获**: (a) Prohibitions organized by category with individual sub-policies. (b) Dual-use content (security research) gets explicit carve-out under active malware policy. (c) Spam includes automated bulk activity, unsolicited promotions, and cryptocurrency mining. (d) Impersonation covers both identity and organizational misrepresentation.
- **局限**: Does not quantify thresholds (how many automated actions = "excessive"?) — enforcement is case-by-case.
- **智识谱系**: Parent of Appeal & Reinstatement policy. Operationalizes ToS section on conduct.

### Card 3: GitHub Appeal and Reinstatement
- **类型**: Administrative procedure document
- **作者/发行**: GitHub, Inc.
- **必读理由**: This is THE operational manual for getting an account back. It defines the two pathways (appeal vs. reinstatement), the 6-month window, the form URL, and the review process. No practitioner can operate without memorizing this document. evidence: [T04-S003] [T04-S042]
- **核心收获**: (a) Appeal = "violation didn't happen" + provide evidence. Reinstatement = "violation happened, I'll fix it." (b) 6-month window from decision is hard cutoff; beyond that GitHub may decline. (c) Form URL: https://support.github.com/contact/reinstatement. (d) If initial reviewer upholds on appeal, a different staff member independently re-reviews. (e) EU users can access out-of-court DSA dispute settlement. (f) Trust & Safety typically responds within 1-3 business days.
- **局限**: Does not disclose approval rates, internal criteria weighting, or escalation paths beyond "different staff member."
- **智识谱系**: Child of AUP. Operationalized by Transparency Center data.

### Card 4: GitHub and Trade Controls
- **类型**: Compliance policy document
- **作者/发行**: GitHub, Inc.
- **必读理由**: Critical for the sanctions diagnostic branch. This document lists exactly which countries/regions are restricted, what services remain available in each, how GitHub determines location (IP + payment history, NOT nationality/ethnicity), and the appeal process for false flags. evidence: [T04-S004]
- **核心收获**: (a) Sanctioned regions: Crimea, Donetsk/Luhansk, Cuba, Iran, North Korea, Russia, Belarus (varying levels). (b) Iran and Cuba: full services available (OFAC license). (c) North Korea: no services. (d) Crimea/Donetsk/Luhansk: free public repos only. (e) China is NOT listed as sanctioned — it is NOT a restricted region. (f) False-flag appeal: contact support.github.com/request with verification info. (g) GitHub Enterprise Server and Copilot have separate ECCN 5D992.c export controls.
- **局限**: Does not explain the specific ML/rules that trigger automated sanctions flags. Does not address VPN-based false positives explicitly.
- **智识谱系**: Implements OFAC regulations + BIS EAR. Connected to Transparency Center data.

### Card 5: Lawrence Lessig — "Code: And Other Laws of Cyberspace" (1999, rev. 2006)
- **类型**: Academic monograph (law + technology theory)
- **作者**: Lawrence Lessig (Harvard Law School)
- **出版**: Basic Books, 1999; Code v2, 2006
- **必读理由**: The foundational thesis that "code is law" — platform architecture regulates behavior as powerfully as legal code. For GitHub unban practitioners, this is the meta-framework: GitHub's technical decisions (flagging algorithms, IP geolocation, 2FA requirements) ARE governance decisions, not merely technical implementation. evidence: [T04-S023] [T04-S024]
- **核心收获**: (a) Four regulators: law, norms, market, architecture. (b) In cyberspace, architecture (code) is the most potent regulator. (c) The choice of code architecture is itself a political choice — not neutral. (d) Copyright in digital space is regulated by code more than by courts. (e) Platform design choices displace traditional legal balances (e.g., fair use).
- **局限**: Written pre-social-media era; does not address platforms as intermediaries (Gillespie and Klonick fill this gap). The 2006 revision is still pre-iPhone.
- **智识谱系**: Upstream: legal realism, Foucault. Downstream: Gillespie, Klonick, Balkin, Zuboff. The "code is law" thesis underpins ALL platform governance scholarship.

### Card 6: Kate Klonick — "The New Governors" (2018)
- **类型**: Law review article
- **发表**: Harvard Law Review, Vol. 131, No. 6, pp. 1598-1670 (April 2018)
- **必读理由**: The first systematic academic analysis of how major platforms actually moderate content, based on original interviews and internal documents from Facebook, Twitter, and YouTube. Introduces the "new governors" framework — platforms as quasi-governmental entities making speech governance decisions. Directly applicable to understanding GitHub Trust & Safety as an unelected governance body. evidence: [T04-S028]
- **核心收获**: (a) Platforms are "new governors" sitting between state and speakers in a triadic model. (b) They are self-regulating, economically and normatively motivated to reflect democratic culture. (c) Content moderation is not a bug but a feature of platform existence. (d) Platforms have little direct accountability to users. (e) Their rules, enforcement, and appeal processes are forms of private administrative law.
- **局限**: Based on Facebook/Twitter/YouTube — does not study developer platforms like GitHub. The governance dynamics differ when content is code rather than speech.
- **智识谱系**: Extends Lessig's "code is law." Parallel to Gillespie. Downstream: Balkin triangle, DSA legislative design.

### Card 7: Tarleton Gillespie — "Custodians of the Internet" (2018)
- **类型**: Academic monograph
- **作者**: Tarleton Gillespie (Microsoft Research / Cornell University)
- **出版**: Yale University Press, 2018
- **必读理由**: Argues that content moderation is central to platform existence, not a peripheral function. Explains the hidden human and algorithmic decisions that shape what users see and don't see. Essential for understanding why GitHub's Trust & Safety team operates the way it does — they are custodians, not mere administrators. evidence: [T04-S027]
- **核心收获**: (a) Content moderation is constitutive of platforms, not imposed upon them. (b) Moderation involves both human reviewers and algorithmic systems. (c) Platforms face impossible demands: moderate too little (harm) vs. too much (censorship). (d) Transparency is structurally limited because full disclosure would enable gaming. (e) Recommends diverse platform designers, user agency, and increased transparency.
- **局限**: Focuses on social media content moderation. Code hosting (GitHub) has different moderation challenges — copyright, security vulnerabilities, sanctions compliance — that social media theory doesn't fully cover.
- **智识谱系**: Parallel to Klonick. Extends Lessig. Downstream: DSA transparency requirements.

### Card 8: Jack Balkin — "Free Speech is a Triangle" (2018)
- **类型**: Law review essay
- **发表**: Columbia Law Review, Vol. 118, No. 7, pp. 2011-2055 (November 2018)
- **必读理由**: Replaces the 20th-century dyadic model (state vs. speaker) with a triangular model: state, platform infrastructure, speakers. Essential for understanding why GitHub suspensions involve THREE actors (U.S. government sanctions law, GitHub as platform, developer as user) and why remedies must address the right corner of the triangle. evidence: [T04-S029] [T04-S030]
- **核心收获**: (a) Free speech is now pluralist, not dualist. (b) States can use platforms for "collateral censorship" — regulating speech indirectly through platform obligations. (c) Platform ToS enforcement creates private administrative law. (d) Users must exhaust platform "administrative remedies" before seeking judicial relief. (e) OFAC sanctions are a textbook case of state-mandated collateral censorship via platform.
- **局限**: Theoretical framework; does not provide operational guidance for individual cases.
- **智识谱系**: Extends Lessig + Klonick. Applied by DSA legislative design (out-of-court dispute settlement as remedy).

### Card 9: OFAC Sanctions Programs + SDN List
- **类型**: U.S. federal regulatory framework
- **发行**: U.S. Department of the Treasury, Office of Foreign Assets Control
- **必读理由**: The hard legal boundary that GitHub cannot override. OFAC sanctions are federal law (31 CFR Parts 500-599), not platform policy — GitHub faces criminal penalties for non-compliance. Understanding what OFAC actually requires (vs. what GitHub over-complies on) is essential for the sanctions diagnostic branch. evidence: [T04-S014] [T04-S015] [T04-S016] [T04-S017]
- **核心收获**: (a) SDN List = individuals/entities whose assets must be blocked; U.S. persons cannot deal with them. (b) Country-based sanctions (comprehensive vs. targeted) vary by program. (c) OFAC issues specific licenses for exemptions (e.g., GitHub's Iran license). (d) China mainland is NOT under comprehensive OFAC sanctions — it appears on NO OFAC country program list as a sanctioned jurisdiction. (e) Russia IT services determination (June 2024) prohibits specific software services but not open-source collaboration.
- **局限**: OFAC guidance is legalistic and dense. FAQ format is helpful but incomplete. The gap between legal requirements and platform over-compliance is not addressed by OFAC itself.
- **智识谱系**: Upstream: International Emergency Economic Powers Act (IEEPA), Executive Orders. Downstream: GitHub Trade Controls page implements these.

### Card 10: Fan et al. — "The Impact of Sanctions on GitHub Developers" (2024)
- **类型**: Empirical academic paper (arXiv preprint)
- **作者**: Youmei Fan, Ani Hovhannisyan, Hideaki Hata, Christoph Treude, Raula Gaikovina Kula
- **DOI**: 10.48550/arXiv.2404.05489
- **必读理由**: The only large-scale empirical study of how sanctions actually affected GitHub developer behavior. Provides quantitative evidence (156K profiles, 41M activity points, 2008-2022) across 8 countries. Essential for evidence-based argumentation in appeals and for understanding the real-world impact of platform compliance measures. evidence: [T04-S022]
- **核心收获**: (a) Many sanctioned developers navigated around restrictions. (b) When sanctions were lifted, developers returned to GitHub rather than abandoning it — indicating platform lock-in. (c) GitHub plays a critical role in sustaining global open-source contributions. (d) The study covers Iran, Crimea, Cuba, Syria, Russia, plus control countries (Greece, Kenya, Hong Kong).
- **局限**: arXiv preprint (not yet peer-reviewed at time of analysis). Focuses on aggregate behavior patterns, not individual reinstatement outcomes. Does not cover China.
- **智识谱系**: Empirically validates Eghbal's platform dependency thesis and GitHub's own advocacy arguments re: developer freedom.

### Card 11: 17 U.S.C. Section 512 (DMCA Safe Harbor)
- **类型**: U.S. federal statute
- **必读理由**: The legal framework that governs GitHub's DMCA takedown/counter-notice system. Relevant to the "DMCA takedown" diagnostic branch — where account restrictions stem from copyright claims rather than behavioral violations. Understanding the counter-notice mechanism and 10-14 day restoration timeline is essential. evidence: [T04-S018] [T04-S019] [T04-S051]
- **核心收获**: (a) Safe harbor shields GitHub from copyright liability IF it follows notice-and-takedown procedures. (b) Counter-notice mechanism: user can challenge takedown under penalty of perjury. (c) 10-14 business day waiting period before content restoration. (d) GitHub publishes all notices at github.com/github/dmca. (e) Repeat infringer policy: GitHub must terminate accounts of repeat infringers to maintain safe harbor.
- **局限**: Only covers copyright-based removals. Does not apply to sanctions, AUP violations, or spam-based suspensions.
- **智识谱系**: DMCA is part of broader intermediary liability framework (CDA section 230 for non-copyright; DSA for EU).

### Card 12: CDA Section 230
- **类型**: U.S. federal statute (47 U.S.C. section 230)
- **必读理由**: The legal shield that gives GitHub discretion to moderate content and suspend accounts without incurring publisher liability. Section 230(c)(2) — the "Good Samaritan" provision — specifically protects platforms that remove content they deem objectionable. This is why GitHub CAN suspend accounts aggressively without legal consequence. evidence: [T04-S035] [T04-S036]
- **核心收获**: (a) "No provider or user of an interactive computer service shall be treated as the publisher" — core immunity. (b) Good Samaritan provision protects good-faith content moderation decisions. (c) GitHub's immunity means users have very limited legal recourse against moderation decisions. (d) Does not apply outside the U.S. — EU DSA creates a different regime.
- **局限**: Section 230 is under ongoing legislative threat. Its scope may narrow in the future. Also, it does not shield GitHub from federal law obligations (OFAC, DMCA).
- **智识谱系**: Parallel to DMCA section 512. Together they form the U.S. intermediary liability framework. Contrasts with EU DSA approach.

### Card 13: EU Digital Services Act (DSA)
- **类型**: EU regulation (Regulation 2022/2065)
- **生效**: February 17, 2024 (full application)
- **必读理由**: The DSA creates new rights for EU-based GitHub users: (a) right to be informed of moderation reasons, (b) right to appeal through platform internal mechanism, (c) right to access out-of-court dispute settlement body, (d) transparency reporting obligations. GitHub's Appeal & Reinstatement page explicitly mentions DSA rights for EU users. evidence: [T04-S034] [T04-S003]
- **核心收获**: (a) Platforms must explain removal/suspension reasons to affected users. (b) Users can appeal internally AND through external out-of-court dispute settlement. (c) Fines up to 6% global annual revenue for non-compliance. (d) In the first two years, approximately 50 million content moderation decisions were reversed through appeals. (e) Transparency database with 9 billion+ moderation decisions reported.
- **局限**: Only benefits users physically located in the EU. Does not override OFAC sanctions compliance (federal U.S. law). GitHub's status as a VLOP (Very Large Online Platform) under DSA is not definitively established.
- **智识谱系**: Downstream of NetzDG. Implements Klonick/Gillespie transparency recommendations at regulatory level. Contrasts with CDA section 230 approach.

### Card 14: Nadia Eghbal — "Working in Public" (2020)
- **类型**: Non-fiction book
- **出版**: Stripe Press, 2020
- **必读理由**: Explains the modern reality of open-source maintenance and platform dependency. Essential context for understanding why GitHub account suspension is devastating — it doesn't just block one user, it can orphan entire dependency chains, break CI/CD pipelines, and strand maintainers. evidence: [T04-S025] [T04-S026]
- **核心收获**: (a) Open-source production has shifted from collaborative bazaar to solo-maintainer reality. (b) GitHub has become infrastructure — suspension is equivalent to cutting off a public utility. (c) Attention (not code) is the scarce resource. (d) Platform dependency is real and under-discussed.
- **局限**: Does not specifically address account suspension scenarios. More descriptive than prescriptive.
- **智识谱系**: Updates Raymond's bazaar model. Parallel to Benkler's commons theory. Downstream of Ford Foundation "Roads and Bridges" report (also by Eghbal).

### Card 15: Yochai Benkler — "The Wealth of Networks" (2006)
- **类型**: Academic monograph
- **作者**: Yochai Benkler (Harvard Law School)
- **出版**: Yale University Press, 2006
- **必读理由**: Provides the theoretical foundation for why open-source code hosting is a form of public good. Commons-based peer production theory explains why GitHub suspensions are not just private contract disputes but interventions in public infrastructure. evidence: [T04-S031]
- **核心收获**: (a) Commons-based peer production is a distinct economic model — not market, not firm, not government. (b) Weak property rights + intrinsic motivation + dispersed knowledge = open source. (c) The digital commons is a public good that requires institutional support. (d) Platform intermediaries control access to the commons.
- **局限**: Written pre-GitHub (2006). The "happy commons" thesis has been challenged by Eghbal's work on maintainer burnout and platform capture.
- **智识谱系**: Upstream: Ostrom (commons governance). Parallel: Lessig (regulatory modalities). Downstream: Eghbal, Raymond.

### Card 16: Daphne Keller — Intermediary Liability Research
- **类型**: Academic papers + policy analysis
- **作者**: Daphne Keller (Stanford CIS, former Google Associate General Counsel)
- **必读理由**: The leading practical framework for evaluating intermediary liability regimes. Her "Design Principles for Intermediary Liability Laws" directly informs understanding of how different legal frameworks (CDA 230 vs. DSA vs. NetzDG) shape platform moderation incentives — and thus GitHub's behavior. evidence: [T04-S032] [T04-S033]
- **核心收获**: (a) Liability regimes create incentives — strict liability leads to over-removal, immunity leads to under-removal. (b) Notice-and-takedown systems have known failure modes (abuse by claimants, chilling effects). (c) Counter-notice mechanisms are under-used because of legal risk. (d) Design matters: small changes in liability rules produce large changes in platform behavior.
- **局限**: Focuses on content moderation broadly, not specifically on code hosting or account-level actions.
- **智识谱系**: Bridges legal theory (Lessig, Balkin) and practical policy (DSA design). Applied by GitHub's own DMCA process design.

### Card 17: Eric Raymond — "The Cathedral and the Bazaar" (1999)
- **类型**: Essay/book (software engineering philosophy)
- **作者**: Eric S. Raymond
- **出版**: O'Reilly, 1999 (originally presented 1997)
- **必读理由**: The foundational text of open-source philosophy. Establishes why code collaboration is inherently valuable — the "given enough eyeballs, all bugs are shallow" thesis (Linus's law). Provides the ideological context for why GitHub account restrictions are seen as threatening to the open-source movement. evidence: [T04-S037] [T04-S038]
- **核心收获**: (a) Cathedral model (closed, hierarchical) vs. bazaar model (open, distributed). (b) Open-source development requires open platforms for collaboration. (c) The bazaar model produces better software through mass parallel debugging.
- **局限**: Deeply ideological and optimistic. Does not anticipate platform capture, maintainer burnout, or sanctions compliance constraints.
- **智识谱系**: Upstream: FSF, Stallman. Downstream: Eghbal (critique/update), Fogel (practical handbook), OSI.

### Card 18: Karl Fogel — "Producing Open Source Software" (2005/2017)
- **类型**: Practical handbook
- **作者**: Karl Fogel
- **出版**: O'Reilly 2005; 2nd ed. 2017 (open access)
- **必读理由**: The practical governance manual for open-source projects. Relevant because account suspension disrupts governance structures (maintainer access, org ownership, contributor permissions) in ways that this book helps you understand and plan for. evidence: [T04-S039]
- **核心收获**: (a) Project governance structures (BDFL, meritocracy, consensus). (b) How to handle contributor conflict, licensing, and community management. (c) The human side of open source is harder than the technical side. (d) Backup governance structures (multiple maintainers, org-level access) as resilience.
- **局限**: Does not address platform-level risks (GitHub suspension, sanctions). Assumes stable platform access.
- **智识谱系**: Operationalizes Raymond's philosophy. Parallel to Eghbal. Downstream: GitHub community management docs.

### Card 19: GitHub Blog — Sanctions Response Posts
- **类型**: Corporate communications
- **必读理由**: Two key blog posts document GitHub's sanctions compliance philosophy and OFAC advocacy strategy. Essential for understanding GitHub's institutional position — they frame themselves as advocates for developer freedom, not just compliance enforcers. evidence: [T04-S012] [T04-S013] [T04-S050]
- **核心收获**: (a) Nat Friedman (CEO) 2019 post: GitHub acknowledges over-compliance risk and commits to advocating for developer access. (b) 2021 Iran announcement: GitHub obtained OFAC license after "lengthy and intensive" 2-year advocacy process. (c) GitHub demonstrated to OFAC that developer use "advances human progress" and US foreign policy. (d) License covers all services (public + private, free + paid) for Iranian developers. (e) GitHub continues to advocate for Crimea/Syria access.
- **局限**: Corporate communications are inherently self-serving. No independent verification of advocacy efforts. Timeline from restriction to resolution was approximately 18 months for Iran.
- **智识谱系**: Implements Balkin triangle dynamics. Demonstrates Lessig's "code is law" in reverse — legal code changed to unlock architectural restrictions.

### Card 20: Kaiyuanshe 2024 China Open Source Annual Report
- **类型**: Industry report
- **发行**: Kaiyuanshe (开源社), nonprofit organization
- **必读理由**: The most comprehensive annual survey of China's open-source ecosystem. Provides data on Chinese developer participation on GitHub, domestic alternatives (Gitee, AtomGit), and the regulatory environment that shapes Chinese developers' platform choices. evidence: [T04-S040]
- **核心收获**: (a) China has approximately 7.23% of global GitHub developers (third after US and India). (b) Chinese developer activity levels are disproportionately high relative to population share. (c) Domestic alternatives (Gitee) face their own censorship issues (2022 mandatory review incident). (d) Open Source AI is reshaping the ecosystem. (e) Report published in zh-CN, EN, and JP.
- **局限**: Self-reported data. Does not directly address GitHub account suspension experiences of Chinese developers.
- **智识谱系**: Parallel to Linux Foundation surveys. Downstream of Eghbal's platform dependency analysis.

---

## 核心概念清单 (30 个)

1. **账号封禁 (Account Suspension)**: GitHub 对违反 ToS/AUP 的账号采取的最严厉措施之一 — 账号被完全锁定, 无法登录、推送代码或访问私有仓库. evidence: [T04-S001] [T04-S002] [T04-S003]

2. **账号限制/标记 (Account Flagging/Restriction)**: 比封禁轻的措施 — 账号仍可登录但功能受限 (如无法授权第三方应用、私有仓库降为只读). 常见于制裁合规审查或自动反垃圾系统标记. evidence: [T04-S004] [T04-S002]

3. **Ban Evasion (封禁规避)**: 被封账号用户创建新账号继续使用平台的行为 — GitHub 明确禁止, 是导致永久封禁的首要原因. 创建多个新号不仅不能恢复, 还会拖慢原账号恢复进程. evidence: [T04-S002] [T04-S003]

4. **申诉 (Appeal)**: 用户主张 "违规事实不存在" 并提供证据要求推翻处罚决定的程序. 与 reinstatement 的关键区别: appeal 否认违规, reinstatement 承认违规. evidence: [T04-S003]

5. **恢复 (Reinstatement)**: 用户承认违规、承诺纠正并同意遵守条款, 请求恢复账号或内容的程序. evidence: [T04-S003]

6. **6 个月窗口 (6-Month Appeal Window)**: GitHub 允许对审核决定提出申诉的时间上限 — 超过 6 个月 GitHub 可能拒绝受理. 这是一个硬性操作截止线. evidence: [T04-S003]

7. **Terms of Service (服务条款 / ToS)**: GitHub 与用户之间的主合同 — 所有账号关系的法律基础. 违反 ToS 是封禁的法律依据. evidence: [T04-S001]

8. **Acceptable Use Policies (可接受使用政策 / AUP)**: ToS 下属的行为规则体系 — 定义了垃圾邮件、恶意软件、冒充等具体禁止行为. 大多数封禁引用 AUP 作为 "起诉书". evidence: [T04-S002]

9. **Trust & Safety (信任与安全团队)**: GitHub 内部负责内容审核和账号执法的部门 — 通常在 1-3 个工作日内响应申诉. 他们是 Klonick 所说的 "New Governors" 在 GitHub 的具体化身. evidence: [T04-S003] [T04-S028]

10. **OFAC (Office of Foreign Assets Control)**: 美国财政部下属机构, 管理经济制裁项目 — GitHub 因是美国公司必须遵守 OFAC 规定. OFAC 可以发放特别许可证 (如 2021 年伊朗许可). evidence: [T04-S014] [T04-S012]

11. **SDN (Specially Designated Nationals List)**: OFAC 维护的被制裁个人和实体名单 — 列入 SDN 的个人/组织资产被冻结, 美国人禁止与其交易. GitHub 筛查此名单. evidence: [T04-S015] [T04-S016]

12. **制裁 (Sanctions)**: 美国政府对特定国家、地区、个人或实体施加的经济限制 — 分为全面制裁 (comprehensive) 和定向制裁 (targeted). GitHub 合规措施基于此. evidence: [T04-S014] [T04-S004]

13. **合规 (Compliance)**: 平台遵守适用法律法规的义务 — 包括 OFAC 制裁、BIS 出口管制、DMCA 版权法. 过度合规 (over-compliance) 是误伤的主要来源. evidence: [T04-S004] [T04-S020]

14. **出口管制 (Export Controls)**: BIS/EAR 下对软件和技术的出口限制 — GitHub Enterprise Server 和 Copilot 有 ECCN 5D992.c 分类, 不可出口到 E:1 国家组. evidence: [T04-S020] [T04-S021] [T04-S004]

15. **BIS/EAR (Bureau of Industry & Security / Export Administration Regulations)**: 美国商务部出口管制体系 — 与 OFAC 制裁不同: EAR 管控物项出口, OFAC 管控交易和资金. 二者经常被混淆. evidence: [T04-S020] [T04-S021]

16. **DMCA (Digital Millennium Copyright Act)**: 美国数字版权法 — 其 section 512 创建了 "安全港" 机制: GitHub 按程序响应侵权通知即免责, 用户可通过反通知 (counter-notice) 恢复内容. evidence: [T04-S018] [T04-S008] [T04-S009]

17. **CDA Section 230 (通信规范法第 230 条)**: 美国法律中的平台免责盾牌 — "互动计算机服务提供者不被视为第三方内容的发布者". 这就是为什么 GitHub 可以自由决定封禁/不封禁而几乎不承担法律责任. evidence: [T04-S035] [T04-S036]

18. **Safe Harbor (安全港)**: 法律为平台提供的有条件免责保护 — DMCA section 512 安全港要求 GitHub 遵循通知-删除程序; CDA 230 提供更广泛的免责. evidence: [T04-S018] [T04-S051]

19. **Counter-Notice (反通知)**: DMCA 框架下的用户救济机制 — 用户声明内容被误删, 在宣誓下签署, GitHub 10-14 个工作日后恢复内容 (除非版权方起诉). evidence: [T04-S009] [T04-S018]

20. **Intermediary Liability (中介责任)**: 平台对用户生成内容承担法律责任的程度 — 美国 (CDA 230 高免责) vs. EU (DSA 条件免责 + 透明义务) vs. 德国 (NetzDG 强制删除) 代表三种模式. evidence: [T04-S032] [T04-S034] [T04-S045]

21. **Platform Governance (平台治理)**: 将平台视为准政府实体进行分析的学术框架 — Klonick "新治理者"、Lessig "代码即法律"、Balkin "三角模型" 共同构成理论基础. evidence: [T04-S028] [T04-S023] [T04-S029]

22. **Content Moderation (内容审核)**: 平台对用户发布内容进行筛查、限制或删除的行为 — Gillespie 论证这是平台存在的核心功能而非附属功能. evidence: [T04-S027]

23. **误伤 (False Positive)**: 自动系统或人工审核错误地将合规账号标记为违规 — 制裁合规中常因 VPN 出口节点在受制裁地区而触发. 中国大陆开发者使用 VPN 科学上网时 IP 出口可能位于受制裁地区是典型误伤场景. evidence: [T04-S004] [T04-S022]

24. **升级阶梯 (Escalation Ladder)**: GitHub 执法的渐进措施序列 — 从警告 → 内容删除 → 账号限制 → 临时封禁 → 永久封禁. 严重度取决于违规性质和历史记录. evidence: [T04-S002] [T04-S003] [T04-S005]

25. **2FA Recovery (双因素认证恢复)**: 丢失 2FA 凭证后恢复账号访问的程序 — GitHub 明确表示安全原因无法帮助恢复, 用户必须依赖 recovery codes、SSH keys、PAT 或 passkeys. 丢失所有恢复方式 = 永久丧失账号访问权. evidence: [T04-S041]

26. **Recovery Codes (恢复码)**: GitHub 在启用 2FA 时生成的一次性备用码 — 默认文件名 github-recovery-codes.txt, 是丢失 2FA 设备后最常用的恢复方式. evidence: [T04-S041]

27. **Sanctioned Region (受制裁地区)**: OFAC 指定的受美国经济制裁的国家/地区 — 当前包括: 朝鲜 (完全禁止), 克里米亚/顿巴斯 (仅免费公开服务), 伊朗/古巴 (已获 OFAC 许可, 全面服务). 注意: 中国大陆不是受制裁地区. evidence: [T04-S004] [T04-S014]

28. **VPN Geolocation (VPN 地理定位)**: GitHub 通过 IP 地址判断用户位置 — VPN 出口节点位于受制裁地区可触发自动限制. 这是中国大陆开发者被误标的主要技术原因 (使用 VPN 翻墙时出口 IP 可能位于伊朗/俄罗斯等节点). evidence: [T04-S004]

29. **Data Export (数据导出)**: 账号被限制或封禁后导出个人数据的能力 — 被制裁标记的账号可能无法下载私有仓库内容, 这是最严重的实际损害之一. evidence: [T04-S004]

30. **Code is Law (代码即法律)**: Lessig 的核心论题 — 平台的技术架构本身就是一种治理机制, 与法律、规范、市场并列为四种规制力量. 在 GitHub 语境下: 封号算法、IP 检测逻辑、2FA 要求都是 "法律" 的一种形式. evidence: [T04-S023]

---

## Phase 2 提炼提示

### 跨 Canon 反复出现的关键词

1. **"Over-compliance" (过度合规)** — GitHub 和 OFAC/BIS 文本之间的落差: OFAC 实际要求 vs. GitHub 实际执行之间存在系统性差异. GitHub 在 2019 年制裁合规中被批评为 over-comply (Al Jazeera 报道). Fan et al. 2024 的数据暗示很多开发者被不必要地影响. 这是 Phase 2 的核心分析维度: 区分 "法律要求" vs. "平台选择".

2. **"Collateral censorship" (间接审查)** — Balkin triangle 的核心概念. 政府通过平台义务间接限制用户 (OFAC → GitHub → developer). 在制裁语境中, 这不是 GitHub 选择封你, 而是 GitHub 被迫封你. 理解这个区别决定了申诉策略: 如果是平台选择, 找平台; 如果是法律义务, 要么证明误标, 要么等待法律变化 (如伊朗 OFAC 许可).

3. **"Platform as infrastructure" (平台即基础设施)** — Benkler 公共品 + Eghbal 基础设施论 + Raymond 开源哲学共同指向: GitHub 不是普通商业服务, 而是数字公共基础设施. 这个论点是 GitHub 自己向 OFAC 倡导伊朗许可时的核心论据.

4. **"Code is law / architecture is governance"** — Lessig 论题在 GitHub 语境的具体化: 封号算法、IP 地理检测、2FA 强制要求都是治理行为. Phase 2 应探讨: 这些技术决策的民主合法性和用户参与度.

### 显著分歧

1. **CDA 230 vs. DSA 模式**: 美国模式给平台几乎完全的审核自由裁量权 (结果: 用户几乎无法律救济); EU DSA 模式要求透明度 + 外部争议解决 (结果: 用户有更多程序性权利). GitHub 作为全球平台, 正处于两种模式的张力中. EU 用户已获得 DSA 权利, 但美国/中国用户没有.

2. **开发者平台 vs. 社交平台的治理差异**: Klonick、Gillespie、Balkin 的理论框架主要基于 Facebook/Twitter/YouTube. 但代码托管平台的治理有本质差异: (a) 内容是功能性代码不是表达性言论; (b) 封号影响是供应链级别的不是个人级别的; (c) 安全研究代码的合法性边界特别模糊 (GitHub active malware policy 的 dual-use carve-out). Phase 2 需要建构适用于开发者平台的治理理论.

3. **中国大陆地位的认知混乱**: OFAC 文件清楚显示中国大陆不是受制裁地区. 但社区讨论 (GitHub community discussions) 中大量中国开发者报告被制裁标记. 原因是技术性的 (VPN 出口 IP 在受制裁地区) 而非法律性的. 这个"误解"本身就是一个研究课题: 技术合规系统如何系统性地误伤某些用户群体.

### 冷僻信号

1. **GitHub 反透明信**: GitHub Transparency Center 的数据粒度有限 — 不公开按国家/违规类型细分的申诉成功率. 一个搜索结果提到 "85 appeals were successful out of 30,000+ suspended accounts" — 如果属实, 这意味着申诉成功率约为 0.28%, 极低. 这个数据需要在 Phase 2 中交叉验证.

2. **SMS 验证的中国排除**: GitHub 2FA 的 SMS 验证不支持 +86 (中国大陆) 和 +852 (香港) 号码. 这不是制裁, 但创造了中国开发者独有的 2FA 恢复困境 — 他们只能依赖 authenticator app 或 recovery codes, 无 SMS 后备.

3. **Gitee 2022 审查事件**: 中国政府在 2022 年 5 月对 Gitee 实施强制代码审查 — 所有公开仓库被锁定, 需人工审核后才能重新公开. 这是 GitHub 替代方案的脆弱性信号: 中国开发者迁离 GitHub 并不能保证更好的自由.

4. **开新号是最大禁忌**: 在 community discussions 和案例研究中, "ban evasion" (封禁后开新号) 反复出现为最严重的恢复障碍. 多个案例表明创建新号不仅没有帮助, 反而被检测到后导致原账号恢复请求被拒. 这应该成为 skill 的第一条硬规则.

5. **NetzDG 的全球传播效应**: 德国 NetzDG (2018) 被至少 13 个国家模仿 (包括俄罗斯、印度、马来西亚), 其中部分国家使用这些法律要求 GitHub 等平台删除内容. 这是 government takedown 分支的法律背景.

6. **OFAC 许可证的先例效应**: GitHub 成功为伊朗获得 OFAC 许可证的事实, 为其他受制裁地区 (叙利亚、克里米亚) 的倡导提供了先例. 2025 年 5 月美国对叙利亚发放 General License 25, GitHub 随即宣布扩展叙利亚服务. 制裁政策是动态的, 不是永久的.
