Restaurant Inspection Evidence — 7 Official Jurisdictions

This Actor retrieves official restaurant and food-facility inspection records from seven government feeds and preserves each jurisdiction's meaning. It does not translate unlike scores into a fake national ranking.

Verified source coverage

Live bounded canaries ran on 2026-08-08 against every source:

Jurisdiction	Official dataset	Portal	Newest row observed	Freshness
New York City, NY	43nn-pn8j	Socrata	2026-08-06	current
Chicago, IL	4ijn-s7e5	Socrata	2026-08-05	current
Austin, TX	ecmv-9xxi	Socrata	2026-05-22	aging
Cincinnati, OH	rg6p-b3h3	Socrata	2026-08-06	current
Boulder County, CO	6ytb-f2cq	Socrata	2026-07-21	current
Montgomery County, MD	dkrp-gr48	Socrata	2026-08-06	current
King County, WA	r878-4sxa	Socrata	2026-08-06	current

current, aging, and stale describe the newest row returned by the bounded canary. They do not guess why a publisher has not posted newer records. This makes nominal coverage distinguishable from currently updating coverage.

Evidence contract

Every record includes:

• stable record_key and content-based record_fingerprint;
• published business and inspection identifiers where available;
• facility type, risk, geocode, critical flag, violation code, and violation detail where published;
• explicit score_direction and source_row_grain;
• official source URL, dataset ID, portal, attribution, fetch time, and source status; and
• the original source row in raw, with configured phone fields removed.

The Actor also writes RUN-RECEIPT to its default key-value store. The receipt contains requested jurisdictions, effective limits and filters, per-source counts, newest observed dates, freshness, errors, warnings, completeness, and a canonical SHA-256 receipt_hash.

Input

Field	Meaning
cities	Any subset of nyc, chicago, austin, cincinnati, boulder, montgomery, king_county.
businessNameContains	Case-insensitive establishment substring.
resultContains	Jurisdiction-published result/grade substring; scores are never converted into grades.
since / until	Inclusive YYYY-MM-DD inspection range.
maxRecordsPerCity	Newest-first bound from 1 to 5,000 per jurisdiction.
socrataAppToken	Optional caller-owned Socrata app token, kept secret and sent only as X-App-Token.

Interpretation boundaries

• NYC scores are lower-is-better; Austin scores are higher-is-better; other jurisdictions may publish no score or a source-specific score. Compare within a jurisdiction unless a qualified analyst defines a documented transformation.
• Some feeds publish one row per inspection and others one row per violation. source_row_grain makes this explicit.
• A stale feed is still factual historical data, but it is not described as current monitoring.
• A bounded query is not a claim that the Actor enumerated every matching record.

Tests

npm test checks normalization, identity keys, stable fingerprints, date bounds, ArcGIS pagination, source receipts, and receipt hashing. npm run test:live performs a bounded official-source pull. node test_sources_live.mjs canaries all seven sources and prints their observed freshness.

Named-portfolio material comparison

Provide portfolio: [{ reference, jurisdictionId, businessId }] for 1-25 exact establishments; an optional exact-normalized expectedAddress flags identity review. This mode does not fuzzy-match names. It rereads all available published history up to the observation date, capped by maxRowsPerSite (default 1,000, maximum 5,000), with one extra row to detect truncation. Date/name/result filters are rejected in portfolio mode so a recent-date watermark cannot hide corrections to older records.

The first complete query establishes a baseline. Subsequent calls require the private previousSnapshot and previousSnapshotReceiptHash. Results identify APPEARED, CHANGED, and NOT_RETURNED_IN_COMPLETE_QUERY inspections, preserving the agency's row grain and scores. The latter is not proof of deletion or safety. Exact duplicate rows collapse; violation-grain records are compared as a set within the inspection. Stable event IDs make retry delivery deduplicable. Partial/outage/identity-failure observations cannot advance the last accepted per-site baseline or prove disappearance.

The default dataset contains normalized official-source records, using the existing per-record event (including separate violation-grain records where the agency uses that grain). A comparison is not billed or labeled as one inspection. After exact dataset readback, PORTFOLIO-SNAPSHOT, PORTFOLIO-COMPARISON and PORTFOLIO-DELIVERY-RECEIPT are published as sidecars of that emitted scope. Partial, unavailable or identity-conflicted sites expose no new source rows in the sidecars; their caller-provided baseline is retained. Insufficient allowance for the full accepted record batch stops before any append or useful sidecar. A 4 MB batch bound requires splitting larger named portfolios. Zero results do not invent a billable inspection record; the existing startup terms still apply.

Dataset append is attempted once. An uncertain append is only read back, never blindly retried; a retained hash-only intent permits same-run sidecar recovery from the exact emitted rows without another source query or append. Persistent missing, partial or conflicting dataset evidence leaves sidecars withheld. Separate runs remain separate source queries and billable deliveries. Caller storage, authenticated review, compare-and-swap, delivery and acknowledgement remain destination responsibilities: a hash alone does not authenticate prior state. Source tests: node test_portfolio.mjs. Publication, paid-market validation and destination delivery are separate release gates.