EPCIS and the Importance of Secure Data Interchange Across the Supply Chain

EPCIS 2.0 is the GS1 standard for supply-chain event data, and epcis.dev is a capture gateway for it: post an event and the door validates it against GS1's own schema, stamps who captured it, hashes it by CBV 2.0, and appends. That is the ground the topic above stands on.

Identity is the standard's own. The gateway computes the standardized EPCIS event hash from CBV 2.0 §8.9, with GS1 Digital Link normalisation, checked against pinned reference vectors, so the same event captured twice is the same event and a changed event is a different one.

Custody is structural, not promised. No service identity holds an UPDATE or DELETE grant; the write path has exactly one writer and it can only append. You can add an event; you cannot un-write one, which is what makes a later trace evidentiary rather than merely stored.

Build state, 29 July 2026. The capture gateway is written and its conformance tests pass against GS1's normative artefacts. Nothing is hosted yet: there is no public endpoint, no key to hold, and no account to open. Today the interface answers on your own machine under wrangler dev; the full ledger is at What ships today.