EPCIS 2.0 and CBV implementation strategies

EPCIS 2.0 is the GS1 standard for supply-chain event data, and epcis.dev is a capture gateway for it: post an event and the door validates it against GS1's own schema, stamps the capturing account — capturedBy, the warrantor, kept distinct from who, the attested observer — hashes it by CBV 2.0, and appends. That is the ground the topic above stands on.

The implementation order that works: validate first — every event against the official GS1 schema, failures refused in the standard's own exception types — then bring the archive along, EPCIS 1.1/1.2 XML through translation with a per-job fidelity report, then make the store append-only so custody is structural rather than promised. Each step is checkable on its own before the next begins, and this gateway implements all three.

Ten years of vendor XML has a path forward: EPCIS 1.1, 1.2 and 2.0 XML in, EPCIS 2.0 JSON-LD out, with a round-trip fidelity report per job so the translation is something you review rather than something you trust. That translator answers at POST /translate on this origin.

Two attributions travel with every event, and the door owns a different half of each. capturedBy is the warrantor — the account whose key opened the door — stamped by the gateway together with recordTime and the attestation grade, with caller-supplied values in those stamped fields stripped. who is the attested observer, asserted by the caller and graded by the door: it reaches only the grade claimed until identity attestation lands. One is stamped, the other is graded; they never merge.

Provenance: an aged epcis.dev page, kept at its original URL and refreshed into the current design on 8 September 2026.