DEV Publication Evidence — Missing/Null/False Safe

DEV's public article endpoint can return a valid published article while omitting the published field that appears in authenticated article representations. A deserializer that treats a missing key like false can silently classify a live article as a draft.

This Actor is a compatibility and evidence API. Give it a DEV article URL or ID. It returns an explicit published value, the evidence-backed published_state, the raw publisher field state, a stable endpoint-shape fingerprint, the observed key set, the official response hash, and a sealed receipt.

Public use

{
  "articleUrl": "https://dev.to/civicdataforge/what-broke-when-we-turned-government-open-data-into-agent-callable-evidence-1m81"
}

Public articles need no DEV API key. DEV documents the public article endpoints as returning published articles, and its own request specs return 404 for unpublished articles. A public-endpoint HTTP 200 is recorded as published: true only after checking a structured article, exact requested ID or URL, canonical DEV URL and author/organization identity. The raw response may omit the field. An unrelated or malformed HTTP 200 is a source-integrity error, not publication proof.

Owner-only draft resolution without giving us a key

When a public request returns 404, that result alone cannot distinguish a draft, deletion, changed URL, or unknown article. CivicDataForge's hosted Worker and Apify Actor deliberately never accept DEV API keys.

Owners can instead use the dependency-free unified local client. It prompts for the key without terminal echo and sends it directly from the owner's machine to the exact HTTPS host dev.to. CivicDataForge and Apify never receive the key or the private result.

node .\local\civicdataforge-devto-direct.mjs --path /api/articles/123456

The hosted services reject credential fields, authorization headers, credential-like query parameters, and unknown JSON properties. See ./SECURITY.md for the exact boundary.

Use the normal DEV API plus CivicDataForge receipts

The unified local direct client preserves DEV's official /api/* operations while adding strict origin enforcement, redirect rejection, request/response hashes, and a provenance receipt. Its default terminal output is a short summary that never dumps an article body, user profile, or organization object. Add --raw only when the complete unchanged DEV response and full receipt envelope are actually needed. For official single-article GET routes, it also runs the publication compatibility check automatically. A public 200 becomes explicit PUBLISHED; an authenticated 404 can be resolved to DRAFT when the article exists in the owner's records. It is not a hosted proxy: the optional key travels from the local process directly to https://dev.to and nowhere else.

# Public article check: no key is requested.
node .\local\civicdataforge-devto-direct.mjs --path /api/articles/4471683 --public

# Authenticated owner request: omit --public.
node .\local\civicdataforge-devto-direct.mjs --path /api/articles/me/all

# The client now displays a hidden prompt. Paste the DEV API key and press Enter.
# Nothing appears while the key is pasted. The key is sent directly to dev.to.

# Full upstream response only when deliberately requested.
node .\local\civicdataforge-devto-direct.mjs --path /api/articles/123456 --raw

Replace 4471683 or 123456 with the desired DEV article ID. Never place a DEV API key in --json, the command line, or the downloaded file. The --json argument is only the request body for DEV endpoints that accept JSON.

The client supports the documented GET, HEAD, POST, PUT, PATCH, and DELETE method surface. DEV still controls authorization, rate limits, response schemas, and which methods each endpoint implements. CivicDataForge does not bypass or expand the permissions of the user's key.

Output semantics

• Hosted published: true or null when the public state is genuinely unknown.
• Hosted published_state: PUBLISHED or UNKNOWN; the unified local client can also return DRAFT with published: false in publication_evidence.
• publisher_field_state: MISSING, PRESENT_NULL, PRESENT_TRUE, PRESENT_FALSE, or PRESENT_VALUE.
• publisher_payload_shape: observed keys, missing expected keys, explicit null keys, explicit false keys, shape fingerprint, response hash, and receipt hash.
• integrity_state: makes representation drift visible even when the HTTP request succeeds.
• manual_review_required: includes a valid public representation whose raw published: false contradicts the public endpoint contract. The contradiction is not silently auto-approved.
• observation_fingerprint: stable article/state/shape identity excluding retrieval time and response hash; repeated observations remain separately receipt-bound.

Requests and source responses are bounded (16 KiB hosted JSON body, 8 MiB upstream response). Duplicate identity query parameters, nonstandard ports, malformed IDs, redirects and credential-bearing input are rejected. Upstream 429/5xx and invalid representations are retryable source failures at the hosted boundary, not evidence of a draft or deletion. A caller can retry a read with backoff; the Worker does not amplify failures with automatic retries.

This Actor does not accept credentials, modify DEV, bypass authentication, expose drafts, or claim DEV supplied a field that it omitted. The optional unified local direct client can perform the normal DEV operations the owner explicitly invokes and adds the publication-state correction on official single-article GET routes; those actions execute directly against DEV under the owner's existing permissions.

Direct CivicDataForge API

The same contract is available without an Apify account:

GET https://civicdataforge-devto-evidence.neoaethel.workers.dev/v1/devto/publication-evidence?url=<encoded-dev-url>

Use POST /v1/devto/publication-evidence with keyless JSON containing an article URL or ID. The local Worker and Actor source import the same normalization and receipt implementation. Deployed parity still requires a build and live readback of each surface; source sharing alone does not prove deployed parity. Private owner checks are intentionally local-only.

Agent access

• Actor: civicdataforge/devto-publication-evidence
• MCP: https://mcp.apify.com/?tools=civicdataforge/devto-publication-evidence
• Support: civicdataforgehq@gmail.com

Official contract references:

• Forem API v1
• Forem API request specifications