Data Quality and Governance for a 199-Country Dataset

By Stanley · Founder, Piaopiao Travel · 2026-10-28

Question

Piaopiao Travel answers entry-requirement questions for 199 countries and regions. Visa data can be wrong in both directions: until October 19 the dataset listed Niue as visa-free, while Niue's own site says "All other travellers must apply for a visitor visa prior to travel"; until October 27 it listed Korea's visa-free scheme for Chinese tour groups as expired, although Korea's Consulate General in Qingdao had announced an extension to December 31. The first error gets a traveller turned away at the gate; the second sends them through a visa application they did not need. How can every fact be traced back to an official page and the date someone checked it, and how are changes caught before users are?

Basis

Two governance rules.

• The model never produces visa facts. A language model's knowledge stops at its training cutoff, stress tests caught it announcing "eVISA" and "visa on arrival" without looking anything up, and it cannot cite a page. Visa content reaches users only through a dedicated briefing tool that builds a deterministic card from data. If a reply contains a visa claim on a turn without a briefing, the sentence is replaced with a fixed hand-off line, and the rewrite layer that sets the final voice is barred from adding visa conclusions back.
• One source of truth. Visa data is edited in one canonical file, built, and distributed as three copies that must hash-match. Nobody edits a copy by hand.

Verification per unit. A unit is a whole record or a block within it (tourism entry, a visa option, an application route). A verified unit carries a verification date and a list of sources. Every build checks that date and sources appear together, dates are real and not in the future, URLs are HTTPS, each source has one of six approved classes (government, embassy, visa centre, multilateral body, Chinese consular reference, IATA), every source's check date equals the unit's date, and a scope states what the source actually supports. The source policy is one line: no official original, no metadata.

Snapshot (2026-10-27): read-only counts of the canonical dataset and the weekly review run of that date.

Findings

Weekly review, signal 1: link liveness. A read-only job runs every Tuesday at 03:17 UTC and never edits data. Its first real run reported 22 "dead links" that came down to 7 unique URLs, every one of which opened normally in a manual check: a 100% false-positive rate, because government firewalls block datacenter traffic. The fix was a three-tier classification: 401/403/429 are warnings; 5xx and timeouts are "unconfirmed", retried, and escalated only after two consecutive UTC days; known anti-bot hosts (19, each with evidence) sit on an allowlist. Cutting false positives created a false negative: a France-Visas page that really did return 404 was hidden by its exemption. Every exempted URL now sits in a browser spot-check ledger that a person must review at least every 90 days. The rule is two-sided: unconfirmed is not dead, and exempted is not healthy.

Weekly review, signal 2: policy-page fingerprints. 55 pages (45 unconditional visa-free destinations, 8 popular destinations, 2 correction monitors) are stripped of scripts, navigation, timestamps and nonces, then hashed. A changed fingerprint opens a review task; it never edits data.

Change log from version history. The log is computed from the committed build output, not written by hand. Normalisation drops metadata and puts links into one shape (without it, one link restructure would have shown all 199 destinations as changed, when 17 really were). Every changed field maps to a category, with no catch-all. Bulk commits over 30 destinations must be registered. The generator uses no network, no model and no clock; CI regenerates it from full history and fails on any byte difference.

Triage in practice.

• Backlog cleanup (October 19). After six red weeks: 8 dead links moved to new official addresses, Niue corrected to visa required, official fees added for 3 countries, and all 22 changed fingerprints re-checked and rebuilt. A summary card still showed old wording after the main field was fixed; only a check of the rendered page caught it.
• Routine review (October 27). 12 signals: Korea's group scheme was a real change (fixed, with two official sources added per unit level and a re-check booked for late December); the Cook Islands' "official" link was a private airport site and was replaced with the ministry's; one site behind a bot challenge was allowlisted after a real-browser check; two announced-maintenance outages were held for observation; 7 were cosmetic page drift. Result: 2 data corrections, 1 allowlist update, 2 holds, 7 noise.

Decision

• Show users only what holds up. Each destination page has a "Sources and updates" block with the last change date, up to three change-log entries by category, a process note ("a link that opens does not mean the policy is unchanged"), and a positive link line that appears only when the exact link on screen passed the latest check and expires 21 days after it. In the October 27 check, 168 of 366 links qualified.
• Keep verification badges and dates internal. Coverage is partial (91 of 199), some verifications rest on a source that does not cover stay length or fees, and 14 destinations had source URLs swapped without a fresh check. Badges would make every other page look untrustworthy and would show some dates that are no longer true.
• Never show negative link states. On one check, a "could not confirm" label would have hit 49 official links, including Japan, Korea and the USA, almost all blocked only because the check ran from a datacenter.
• Route every alert through human triage. Fingerprint changes and dead links open review tasks; the job itself never changes data.

Limits

• Coverage is partial. 108 of 199 countries and regions have official links but no unit-level verification date yet.
• Verification is human work. It means reading originals in Korean, Spanish and other languages; AI helps find pages, but every value needs an official URL and an independent second check. Aggregation can fail too: once, mismatched country keys silently dropped confirmed corrections for 17 destinations.
• Anti-bot defences freeze data. Without the original page, the source policy keeps data as it is.
• Fingerprints say "changed", not "how". A page counter alone can trigger an alert, and expiry dates such as Korea's and Brazil's December 31 deadlines need a human calendar.
• Change dates are data-commit dates. They can precede the production release.

Source: read-only counts of the canonical visa dataset and the weekly review run of 2026-10-27, plus the project's design records and data-change history.