EPCIS 2.0 and the CBV integration with IoT based systems

Start from the record, not the buzzword. An EPCIS 2.0 event is a validated, hashed, appended fact, and epcis.dev is a capture gateway that enforces exactly that: GS1's own schema at the door, the capturing account stamped — capturedBy, the warrantor, kept distinct from who, the attested observer — the CBV 2.0 hash as the event's identity, and no way to un-write. The topic above is read against that record.

The implementation order that works: validate first — every event against the official GS1 schema, failures refused in the standard's own exception types — then bring the archive along, EPCIS 1.1/1.2 XML through translation with a per-job fidelity report, then make the store append-only so custody is structural rather than promised. Each step is checkable on its own before the next begins, and this gateway implements all three.

Identity is the standard's own. The gateway computes the standardized EPCIS event hash from CBV 2.0 §8.9, with GS1 Digital Link normalization, checked against pinned reference vectors, so the same event captured twice is the same event and a changed event is a different one.

Custody is structural, not promised. No service identity holds an UPDATE or DELETE grant; the write path has exactly one writer and it can only append. You can add an event; you cannot un-write one, which is what makes a later trace evidentiary rather than merely stored.

Provenance: an aged epcis.dev page, kept at its original URL and refreshed into the current design on 8 September 2026.