Application of EPCIS for Digital Services Companies

Underneath this topic sits one mechanism: an EPCIS 2.0 capture gateway. epcis.dev is one — every posted event is validated against GS1's own schema, stamped with the capturing account (capturedBy, the warrantor, kept distinct from who, the attested observer), hashed by CBV 2.0, and appended, never edited. Hold the topic above against that ground and it stays concrete.

Whatever the setting, the mechanics underneath this topic are the same four moves: an event is captured at a door, validated against GS1's official EPCIS 2.0 schema, identified by the CBV 2.0 §8.9 hash of its own content, and appended to a store nothing can rewrite. The variations between industries and use cases are vocabulary — the CBV's business steps and dispositions — not architecture.

Custody is structural, not promised. No service identity holds an UPDATE or DELETE grant; the write path has exactly one writer and it can only append. You can add an event; you cannot un-write one, which is what makes a later trace evidentiary rather than merely stored.

Two attributions travel with every event, and the door owns a different half of each. capturedBy is the warrantor — the account whose key opened the door — stamped by the gateway together with recordTime and the attestation grade, with caller-supplied values in those stamped fields stripped. who is the attested observer, asserted by the caller and graded by the door: it reaches only the grade claimed until identity attestation lands. One is stamped, the other is graded; they never merge.

Provenance: an aged epcis.dev page, kept at its original URL and refreshed into the current design on 8 September 2026.