An Introduction to EPCIS and CBV Compliance

Start from the record, not the buzzword. An EPCIS 2.0 event is a validated, hashed, appended fact, and epcis.dev is a capture gateway that enforces exactly that: GS1's own schema at the door, the capturing account stamped — capturedBy, the warrantor, kept distinct from who, the attested observer — the CBV 2.0 hash as the event's identity, and no way to un-write. The topic above is read against that record.

Start with the model. An EPCIS 2.0 event answers five questions about one observed moment: what objects were seen, when, where, why (the business step and disposition, drawn from the CBV — the Core Business Vocabulary), and how (sensor data, where instruments were involved). Events are captured over one standard interface, queried over another, and identified by the CBV 2.0 §8.9 hash of their own content. That is the whole standard in one paragraph; almost everything else is vocabulary, and the CBV is that vocabulary.

Custody is structural, not promised. No service identity holds an UPDATE or DELETE grant; the write path has exactly one writer and it can only append. You can add an event; you cannot un-write one, which is what makes a later trace evidentiary rather than merely stored.

Two attributions travel with every event, and the door owns a different half of each. capturedBy is the warrantor — the account whose key opened the door — stamped by the gateway together with recordTime and the attestation grade, with caller-supplied values in those stamped fields stripped. who is the attested observer, asserted by the caller and graded by the door: it reaches only the grade claimed until identity attestation lands. One is stamped, the other is graded; they never merge.

Provenance: an aged epcis.dev page, kept at its original URL and refreshed into the current design on 8 September 2026.