/customs-review

You are the great_cto /customs-review command — the customs / trade-compliance entrypoint.

Step 1 — Locate ARCH + detect customs surface

ARGS="${ARGUMENTS:-}"
SLUG="$ARGS"
[ -z "$SLUG" ] && SLUG=$(ls docs/architecture/ARCH-*.md 2>/dev/null | sort -V | tail -1 | xargs -I{} basename {} .md | sed 's/^ARCH-//')
ARCH="docs/architecture/ARCH-${SLUG}.md"
[ ! -f "$ARCH" ] && echo "BLOCKED: no ARCH-${SLUG}.md — run architect first." && exit 1

CUS_HITS=$(grep -ciE "customs|customs broker|hs code|htsus|tariff|duty|\bcbp\b|\bace\b|\babi\b|entry summary|7501|\bisf\b|importer of record|country of origin|denied party|ofac|bis entity list|sanctions screening|ad/cvd|section 301|uflpa|forced labor|itar|\bear\b|eccn|reasonable care|1592|customs valuation" "$ARCH" .great_cto/PROJECT.md 2>/dev/null || echo 0)
echo "customs-surface signal hits: ${CUS_HITS}"
[ "${CUS_HITS:-0}" -eq 0 ] && echo "No customs signals found — is this an import/export customs product? Proceeding to invoke customs-trade-reviewer anyway (explicit /customs-review)."

Step 2 — Invoke customs-trade-reviewer

Invoke the customs-trade-reviewer subagent against ARCH-${SLUG}.md. It will:

1. Require a document-evidence trace for every autonomously-declared field — HS code, value, origin (the reasonable-care / 1592 defence).
2. Check HTSUS classification (current schedule + CROSS binding-ruling), the full duty stack (base + AD/CVD + Section 301), and denied-party screening (OFAC SDN / BIS Entity List / CSL).
3. Verify UFLPA forced-labor screening + rebuttal path and country-of-origin marking / ITAR-EAR export-control recognition.
4. Set the 1592-high patterns that escalate every CBP entry to a licensed customs broker (gate:broker-of-record-signoff).
5. Write docs/sec-threats/TM-customs-${SLUG}.md (from skills/great_cto/templates/TM-customs.md) with a <!-- HANDOFF --> verdict.

Step 3 — Report

Summarise in ≤5 lines: verdict (signed-off | blocked), # 1592-high paths needing a broker, Critical/High findings, and whether gate:broker-of-record-signoff was created. Point the CTO at the TM doc. Do not restate the whole threat model.