# epcis.dev — Post the event. The door does the rest.

> In EPCIS, the Who is a company. Every event has a performer. The door is epcis.dev: an EPCIS 2.0 capture gateway. EPCIS is GS1's standard for supply-chain events — what, when, where, why, how — and its Who is a company: the GLN of the legal entity involved. id.org.ai — Agent. Human. Thing. — extends that Who to the actual performer, the human, agent, or robot that took the action, and the event still validates against GS1's own pinned schema.

**Proof, not adjectives.** The gateway's conformance tests pass against GS1's normative artefacts — verified by this build: 925/925 tests green, 2026-08-01. Live on this origin, no key: POST /translate, /validate, /hash. No conformance attestation has ever been issued. The dated ledger is /what-ships-today/.

`npx epcis.dev` is the one-line local door — translate, validate, hash, capture, MCP — the same engine this origin hosts at POST /translate, /validate and /hash.

## The eight laws

1. **Stamped by the gateway, not the sender.** recordTime, spine:capturedBy and spine:attestationGrade are applied at the door. Whatever you sent in those fields is stripped. The scriber is not the part being scribed.
2. **Two grains, never collapsed.** who is the attested observer — a human, an agent, or an embodied agent — asserted by the caller and graded by the door. capturedBy is the warrantor: the account whose key opened the door, stamped by the gateway. Never the same thing, never merged; one is stamped, the other is graded. Party and org grain are derived at read time from grant chains, never stamped on an event — the record survives your reorg and your revocations.
3. **Conforms to EPCIS 2.0 and CBV 2.0.** Implemented against GS1's official OpenAPI description, pinned by digest and re-checked in CI. The spine speaks What/Who/When/Where/Why/How natively; EPCIS 2.0 is its projection, and the projection always validates.
4. **Validated on every capture.** Each event is machine-checked against the official GS1 EPCIS 2.0 JSON schema before it is accepted. A capture that does not validate is refused as RFC 7807 problem+json, carrying the standard's own exception types — not a vendor error string. The digests are on the pins page.
5. **Identified by the standard's own hash.** The standardized EPCIS event hash from CBV 2.0 §8.9, with GS1 Digital Link normalisation, checked against the pinned reference vectors — so the same event captured twice is the same event, and a changed event is a different one.
6. **Append-only, by construction.** No service identity anywhere holds an UPDATE or DELETE grant; the write path has exactly one writer. You can add an event. You cannot un-write one. Corrections are declared events, never edits.
7. **Minimally scoped on read.** You see your own scope. What is outside it is absent, not greyed out and not redacted — there is no shape left behind to argue about.
8. **Ten years of vendor XML, translated.** EPCIS 1.1, 1.2 and 2.0 XML in; EPCIS 2.0 JSON-LD out; a round-trip fidelity report per job, so the translation is reviewable rather than trusted. The translation door is a page of its own.

What the laws add up to: Everyone in this market has built a network that is authoritative because you joined it. The spine makes a record that is verifiable whether or not you joined anything — and it carries, in the record itself, an attested answer to who observed the event, including when the observer was an agent.

## Two grains. One stamped, one graded.

capturedBy is the warrantor — the account whose key opened the door — and the gateway STAMPS it, together with recordTime and the attestation grade: caller-supplied values in those three fields are stripped and replaced. who is the attested observer — a human, an agent, or an embodied agent — asserted by the caller and GRADED by the door, reaching only the grade `claimed` until identity attestation lands. The two never collapse. Party and org grain are derived at read time from grant chains, never stamped on an event.

## The MCP door (one door for people and agents)

| tool | what it does | readOnlyHint | state |
|---|---|---|---|
| capture | POST an EPCIS document through the gateway laws: strip → validate → project-check → stamp → append | no | shipped |
| query | SimpleEventQuery over whatever was captured | yes | shipped |
| get_event | one event, by its CBV §8.9 hash identity | yes | shipped |
| trace_epc | the full event chain for one EPC | yes | shipped |
| translate | EPCIS 1.1 / 1.2 / 2.0 XML → 2.0 JSON-LD, with a per-job fidelity report | yes | shipped |
| resolve | refuses honestly: returns a typed tool error, never a fabricated resolution — identity resolution lives at id.org.ai (Agent. Human. Thing.) | — | honest refusal |
| subscribe | refuses honestly: a typed tool error, never a silent downgrade to a one-shot pull | — | honest refusal |

The door is POST /mcp on this origin, and npx epcis.dev mcp runs the same server on your bench.

## $0 per event — intent, not terms

Our intent is that recording an event never costs money and is never shown as a meter. Until published terms bind it, that is a commitment we make, not a contract you hold. Revenue attaches to answers on the executive side (visibility.cloud).

## Shipped / open (condensed)

Shipped:
- Hosted on this origin: POST /translate, POST /validate and POST /hash — the stateless engine doors, no key required
- Validation against the official GS1 EPCIS 2.0 JSON schema, on every capture
- Gateway stamping, with caller-supplied values stripped
- An MCP door: capture / query / get_event / trace_epc / translate as tools

Open in the launch ledger:
- The hosted capture/query/MCP spine at api.epcis.dev — cloud provisioning and deploy (P0-14)
- Issued capture keys — provisioned from the key list, in order, when the spine's door opens (P0-14/P0-18)
- The public repository host — the clone URL ships on this site the day the publication ruling lands (P0-24)
- The business-transaction layer’s EDIFACT track — parse of EDIFACT answers a typed SYNTAX_UNSUPPORTED refusal while this row is open (biztx ledger, EDIFACT P6)

The ledger in full, dated: /what-ships-today/

## Doors

- /translate/ — EPCIS 1.1/1.2/2.0 XML to 2.0 JSON-LD with a per-job fidelity report
- /conformance/ — the pinned GS1 digests and the advisory suite (no attestation has ever been issued)
- /mcp/ — the agent door
- /run-it-yourself/ — the five-minute local capture transcript
- /what-ships-today/ — the dated ledger
- /get-a-key/ — the capture-key waitlist (machine twin of the interview: /flow.json)
- /llms.txt · /icp.json · /agent-classes.json · /.well-known/agents.json — the machine face

We answer in writing. We take at most five conversations a month, only when you ask for one, and only after you already have the written read.