Government Data API & MCP Evidence Gateway

Origin verification

Production can attach an Ed25519 provenance signature to every gateway packet. The signing key remains a server-side secret supplied as CDF_RECEIPT_SIGNING_KEY_PEM_B64; outputs identify only the stable key ID, public-key fingerprint, signed-payload hash, and signature. If the key is not configured, packets say UNSIGNED rather than implying cryptographic origin. This makes copied or altered packets detectable without publishing the private implementation or signing key.

CivicDataForge routes official-source government data tasks for U.S. STR permits, India companies by CIN, restricted-party screening, EPA ECHO facilities, Earth observation fused with U.S./India civic telemetry, and rights-first China-facing intake into one receipt-bound packet. Use it through Apify API or MCP.

This is the single access plane over the CivicDataForge public-data refinery: domain Actors ingest, clean, reconcile, and preserve provenance; the Gateway routes those products through one packet model. Adding a domain expands the refinery without forcing buyers or agents to learn another custody model.

Tasks

Task	Minimum input	Downstream route	Boundary
us_property_decision	Address, exact supported city/county label, state	str-permit-registry address evidence	Exact label routing is not parcel-boundary resolution or legal permission
india_company_evidence	21-character CIN	india-company-registry	Company evidence is not KYC or procurement eligibility
india_supplier_pack	CIN, purpose, optional rights-labeled GST/Udyam/IBBI evidence	india-company-registry plus minimized caller evidence	Missing registries remain missing; caller evidence is not silently promoted to official verification
restricted_party_screening	Name; optional identifier supplies context	cross-border-restricted-party-evidence	Identifier-only resolution is not supported; no result is legal clearance
epa_facility_evidence	FRS ID or facility name (name accepted as alias); address adds context	epa-echo-facility-compliance	Address alone is not a supported lookup; no environmental safety or liability verdict
earth_observation_evidence	AOI ID, bounding box, optional time/source filters	earth-observation-evidence	Catalog evidence is not ground truth or a legal determination
area_multimodal_evidence	Country (US or IN), bounding box, U.S. state when applicable	Earth observation + official civic telemetry in parallel	Every source clock and missing layer remains explicit; partial success is never reported as complete
china_counterparty_intake	Chinese legal name, USCC, purpose, rights-labeled evidence	Optional U.S. ITA CSL screening	No China-native registry, UBO, or KYB claim

Output contract

Every packet carries:

• minimized subject identifiers;
• downstream Actor and evidence digest;
• source-rights ledger with artifact hashes but no supplied raw content;
• EVIDENCE_FOUND, NO_PUBLISHED_MATCH, REVIEW_REQUIRED, SOURCE_UNAVAILABLE, or SCOPE_INCOMPLETE;
• complete-scope flag;
• evidence-state and final packet receipts;
• baseline/change/incomplete-scope monitoring state;
• optional caller-policy transaction state that never issues legal permission;
• optional cross-border exchange decision bound to sealed source-rights passports and the evidence-state receipt;
• readable Markdown dossier in EVIDENCE-DOSSIER.md.
• a sealed downstream.field_presence receipt that distinguishes field absence, null, empty string, empty array, and empty object without copying source values.

The field-presence receipt stores each observed top-level key set and its signature. A publisher dropping a field is therefore diffable from a publisher sending the same field empty.

Source-rights input

Each evidence item must include label, sourceAuthority, accessMode, and one of content, contentBase64, payload, or a precomputed sha256. Licensed sources must explicitly state whether processing, customer delivery, and cross-border delivery are allowed. The gateway output contains hashes instead of the supplied raw content. Apify stores run INPUT and run artifacts under the account's storage lifecycle: this is not a promise that supplied bytes are never stored by the platform. Prefer sending a precomputed hash and non-sensitive metadata. retentionDays describes the requested policy in the receipt; it does not override platform storage or create an automatic deletion schedule. Advanced rights/document inputs are validated by the direct Actor and are not accepted by the basic hosted commerce preflight.

For destination-specific delivery, supply sourceRightsPassports with an exchangeRequest containing exchangeId, destinationCountry, recipientClass, and requestedOperations. Passport hashes, shapes, classifications, expiries, destination limits, recipient classes, and operation states are validated before the downstream task starts. The final exchange receipt binds the gateway evidence-state hash. Any unresolved, expired, prohibited, or tampered right downgrades the packet to REVIEW_REQUIRED, marks the bounded scope incomplete, and prevents a ready transaction state.

Charging

Successful packets use the custom evidence-packet pay-per-event name. SOURCE_UNAVAILABLE packets are pushed without that event name, so a failed source cannot masquerade as paid evidence. The public price remains a separate Apify publication state and must be verified on the Actor listing after configuration.

GATEWAY-PACKET in the run key-value store is the canonical deliverable. In PPE mode the gateway checks available event budget, accepts one custom packet charge, then saves that fixed-key packet before creating optional dataset/Markdown mirrors. SDK pushData with an event name writes before charging and is not used for this paid boundary. A rejected event budget does not receive useful dataset or KVS output. A source-failure receipt excludes successful partial-source records.

Same-run recovery binds the input hash, verifies the existing packet and confirmed PPE charge (except a free source-failure diagnostic), and restores named records without another source run or charge. Dataset append is attempted once only: an uncertain timeout is not proof it failed, and no delay or empty immediate read establishes that it will never commit. Hosted synchronous delivery uses Apify's run-sync?outputRecordKey=GATEWAY-PACKET; A2A reads that same canonical record. The dataset remains a convenient optional mirror, not the sole recovery path. This is not an atomic transaction across Apify billing and storage: a persistent canonical-storage outage after charging remains a recoverable paid-delivery incident, not a claim of delivered evidence. Reading an existing paid record does not require a new paid run.

The packet's request_fingerprint binds its exact gateway input. Its full receipt includes observation metadata; evidence_state_receipt_hash uses the material-state projection, separating known collection clocks from substantive record fields. Unknown fields remain conservative material input. Schema/normalizer changes can require a new baseline. A checksum proves content integrity; issuer authentication is a separate signing-key verification.

Downstream datasets are paged with a 10,000-record / 6 MB collection ceiling. Reaching a ceiling, an inconsistent total or a premature end produces an explicit SCOPE_INCOMPLETE marker and collection receipt, never a silent complete result. These bounds are not a guarantee of upstream source completeness.

Responsible use

This gateway assembles and routes evidence. It does not approve, deny, clear, certify, or determine legality, KYC completion, procurement eligibility, credit, insurance, employment, housing, safety, sanctions compliance, or booking/listing authorization.