Restaurant Inspection Evidence — 7 Official Jurisdictions

Start with one small Chicago query

In the Input tab, choose JSON and paste this bounded example. Review the current Pricing tab and your run charge limit before pressing Start; this is not a promise of a free run. No token, portfolio or previous snapshot is needed.

{"cities":["chicago"],"maxRecordsPerCity":10}

After a successful run, open the default dataset and the RUN-RECEIPT in Storage. Check the returned row count, source_status, source_fetched_at, official source link and source row grain. Ten is a cap, not a promised number of matches. An empty complete result differs from a failed or partial source response. Do not infer a restaurant's current safety from an old inspection. Change just the jurisdiction or one supported filter after you understand the first result. Repeated runs are separate queries and may incur separate charges under the current pricing.

This example is an input recipe, not a sample result or a customer testimonial.

This Actor retrieves official restaurant and food-facility inspection records from seven government feeds and preserves each jurisdiction's meaning. It does not translate unlike scores into a fake national ranking.

Verified source coverage

Live bounded canaries ran on 2026-08-08 against every source:

Jurisdiction	Official dataset	Portal	Newest row observed	Freshness
New York City, NY	43nn-pn8j	Socrata	2026-08-06	current
Chicago, IL	4ijn-s7e5	Socrata	2026-08-05	current
Austin, TX	ecmv-9xxi	Socrata	2026-05-22	aging
Cincinnati, OH	rg6p-b3h3	Socrata	2026-08-06	current
Boulder County, CO	6ytb-f2cq	Socrata	2026-07-21	current
Montgomery County, MD	dkrp-gr48	Socrata	2026-08-06	current
King County, WA	r878-4sxa	Socrata	2026-08-06	current

current, aging, and stale describe the newest row returned by the bounded canary. They do not guess why a publisher has not posted newer records. This makes nominal coverage distinguishable from currently updating coverage.

Evidence contract

Candidate receipt v2 and NYC key migration

Query RUN-RECEIPT v2 separates source output (counts, source_counts, and source records_returned) from delivery. records_selected counts rows offered to the delivery path; records_submitted counts rows included in append attempts. records_pushed and records_delivered now mean dataset-readback-confirmed rows, or null when delivery is unverified or mismatched. delivered_counts is the confirmed per-jurisdiction breakdown. Delivery may be complete, partial, mismatched or unverified relative to the exact attempted-row multiset captured before append. Withheld rows cannot prove delivery. Bounded-query completeness requires source completion, every selected row attempted, and complete delivery; source-only completion is source_queries_complete. Thus an allowance-limited run can have complete delivery of attempted rows while overall completeness is false. records_blocked_after_uncertain_append separately counts later selected rows blocked by an ambiguous earlier append; they are not allowance-withheld rows.

Query reconciliation performs two complete unfiltered scans from offset zero, each ending with an explicitly empty page. Each scan reads at most the attempted row count plus one surplus-detection row. Every returned row must match the exact attempted-row multiset, and the scans must have the same row count and canonical sequence hash. Header totals are diagnostic only; metadata counts are not required. Changed scans, missing termination, malformed pages and read failures are not accepted. There is no automatic retry after a failed scan and no append/source retry. At most twice (attempted row count + 1) read calls are permitted, even if every nonempty page returns only one row. A matching subset is confirmed partial delivery; overall completeness still requires all selected rows attempted and all attempted rows observed. This proves two observed complete bounded scans, not an atomic snapshot, future immutability, or visibility of unreturned service data.

At-home query appends use a client with retries disabled. Record allowance is reserved before each attempt and bounded by the initial platform allowance and any explicit run budget at the configured record price. Withheld rows are counted separately. An ambiguous append blocks further appends in that invocation; readback does not replay it. This is not a guarantee about other platform charges or payment settlement, and a new run is a separate potentially chargeable query. Transport failures use fixed diagnostics rather than copying URLs or credentials to receipts.

NYC record keys now include inspection_type alongside establishment, inspection date and violation code. Consumers keyed by record_key or record_fingerprint should treat this as a migration, not infer new inspections from the key change alone. Portfolio inspection IDs already included inspection type; portfolio material comparisons exclude these two changed fields. An offline synthetic old-mapping snapshot was accepted without comparison changes or revision change; this is not certification of every retained snapshot.

Every record includes:

• stable record_key and content-based record_fingerprint;
• published business and inspection identifiers where available;
• facility type, risk, geocode, critical flag, violation code, and violation detail where published;
• explicit score_direction and source_row_grain;
• official source URL, dataset ID, portal, attribution, fetch time, and source status; and
• the original source row in raw, with configured phone fields removed.

The Actor also writes RUN-RECEIPT to its default key-value store. The receipt contains requested jurisdictions, effective limits and filters, per-source counts, newest observed dates, freshness, errors, warnings, completeness, and a canonical SHA-256 receipt_hash.

Input

Field	Meaning
cities	Any subset of nyc, chicago, austin, cincinnati, boulder, montgomery, king_county.
businessNameContains	Case-insensitive establishment substring.
resultContains	Jurisdiction-published result/grade substring; scores are never converted into grades.
since / until	Inclusive YYYY-MM-DD inspection range.
maxRecordsPerCity	Newest-first bound from 1 to 5,000 per jurisdiction.
socrataAppToken	Optional caller-owned Socrata app token, kept secret and sent only as X-App-Token.

Interpretation boundaries

• NYC scores are lower-is-better; Austin scores are higher-is-better; other jurisdictions may publish no score or a source-specific score. Compare within a jurisdiction unless a qualified analyst defines a documented transformation.
• Some feeds publish one row per inspection and others one row per violation. source_row_grain makes this explicit.
• A stale feed is still factual historical data, but it is not described as current monitoring.
• A bounded query is not a claim that the Actor enumerated every matching record.

Tests

npm test checks normalization, identity keys, stable fingerprints, date bounds, ArcGIS pagination, source receipts, and receipt hashing. npm run test:live performs a bounded official-source pull. node test_sources_live.mjs canaries all seven sources and prints their observed freshness.

Named-portfolio material comparison

Provide portfolio: [{ reference, jurisdictionId, businessId }] for 1-25 exact establishments; an optional exact-normalized expectedAddress flags identity review. This mode does not fuzzy-match names. It rereads all available published history up to the observation date, capped by maxRowsPerSite (default 1,000, maximum 5,000), with one extra row to detect truncation. Date/name/result filters are rejected in portfolio mode so a recent-date watermark cannot hide corrections to older records.

The first complete query establishes a baseline. Subsequent calls require the private previousSnapshot and previousSnapshotReceiptHash. Results identify APPEARED, CHANGED, and NOT_RETURNED_IN_COMPLETE_QUERY inspections, preserving the agency's row grain and scores. The latter is not proof of deletion or safety. Exact duplicate rows collapse; violation-grain records are compared as a set within the inspection. Stable event IDs make retry delivery deduplicable. Partial/outage/identity-failure observations cannot advance the last accepted per-site baseline or prove disappearance.

The default dataset contains normalized official-source records, using the existing per-record event (including separate violation-grain records where the agency uses that grain). A comparison is not billed or labeled as one inspection. After exact dataset readback, PORTFOLIO-SNAPSHOT, PORTFOLIO-COMPARISON and PORTFOLIO-DELIVERY-RECEIPT are published as sidecars of that emitted scope. Partial, unavailable or identity-conflicted sites expose no new source rows in the sidecars; their caller-provided baseline is retained. Insufficient allowance for the full accepted record batch stops before any append or useful sidecar. A 4 MB batch bound requires splitting larger named portfolios. Zero results do not invent a billable inspection record; the existing startup terms still apply.

Dataset append is attempted once. An uncertain append is only read back, never blindly retried; a retained hash-only intent permits same-run sidecar recovery from the exact emitted rows without another source query or append. Persistent missing, partial or conflicting dataset evidence leaves sidecars withheld. Separate runs remain separate source queries and billable deliveries. Caller storage, authenticated review, compare-and-swap, delivery and acknowledgement remain destination responsibilities: a hash alone does not authenticate prior state. Source tests: node test_portfolio.mjs. Publication, paid-market validation and destination delivery are separate release gates.