Evidence Review Workflow

Turn CivicDataForge evidence receipts and change events into a deterministic customer-owned review queue.

The Actor provides the operational layer that a raw lookup does not:

• stable case IDs bound to the product, subject, and evidence receipt;
• explicit open, escalated, insufficient-evidence, confirmed-evidence, and dismissed-candidate dispositions;
• immutable reviewer-event history with a receipt on every event, case, and queue;
• terminal-state protection so one run cannot silently rewrite a completed review;
• deterministic output independent of input ordering;
• priority defaults that elevate source failure, incomplete scope, disappeared records, and restricted-party candidates;
• up to 500 cases and 1,000 actions per run.

What it deliberately does not do

This Actor does not call an upstream government source, identify a person, decide legality, declare environmental safety, clear a transaction, or make credit, insurance, employment, housing, licensing, or other eligibility decisions. It does not send messages to arbitrary URLs. Use Apify schedules and customer-configured webhooks to route verified queue outputs into the customer's own Slack, email, ticketing, database, or case system.

Reviewer aliases and notes are customer-supplied operational metadata. Do not submit secrets or unnecessary personal data.

Example

{
  "observedAt": "2026-08-23T03:00:00Z",
  "cases": [
    {
      "reference": "supplier-001",
      "productId": "cross-border-restricted-party-evidence",
      "subjectKey": "supplier:001",
      "decision": "POTENTIAL_MATCH_REVIEW_REQUIRED",
      "evidenceReceiptHash": "sha256:76066c356142664975f19d6f9340ec9800d4bacad126d0f5c82ca966dc2f2b69",
      "reasonCodes": ["PRIMARY_NAME_MATCH", "COUNTRY_CONSISTENT"]
    }
  ],
  "actions": [
    {
      "reference": "supplier-001",
      "disposition": "escalated",
      "reviewerAlias": "trade-review-1",
      "at": "2026-08-23T03:00:00Z",
      "note": "Agency-list confirmation required."
    }
  ]
}

The resulting queue is a review-process receipt. It is not proof that the underlying subject is cleared, prohibited, safe, compliant, or identical to a published record.

Portable reconciliation, not a hosted case database

Without priorQueue, each call explicitly produces STATELESS_NEW_QUEUE. Retain the prior output privately and supply priorQueue plus its independently trusted expectedPriorQueueReceiptHash to reconcile. Unchanged materialEvidenceHash (or evidenceReceiptHash when omitted) preserves the prior disposition. Changed material evidence reopens review with history; omitted prior cases are retained. workflow_id is stable by product/subject; case_id identifies an evidence edition.

Retained actions require an actionId and expectedCaseReceiptHash after evidence reconciliation. Exact retries are idempotent; stale writes and conflicting id reuse are rejected. current_observations binds the latest received evidence separately from a retained disposition. These are portable compare-and-swap inputs, not a server-enforced concurrency guarantee: a trusted destination must persist atomically.

The library supports a synchronous context.authorizeAction callback; it must return exactly true. requireAuthorizedActions fails without that trusted adapter. The standalone Actor has no authenticated reviewer directory and labels aliases as CALLER_ASSERTED_NOT_AUTHENTICATED. Caller-provided aliases or recomputable hashes are not authentication. No patient data, legal clearance or automated eligibility decision is supported. Tests: node test_retention.mjs and node test_unit.mjs.