The role of EPCIS 2.0 and the CBV in food safety

EPCIS 2.0 is the GS1 standard for supply-chain event data, and epcis.dev is a capture gateway for it: post an event and the door validates it against GS1's own schema, stamps the capturing account — capturedBy, the warrantor, kept distinct from who, the attested observer — hashes it by CBV 2.0, and appends. That is the ground the topic above stands on.

Traceability holds only when the record would hold up out of context: validated at capture against GS1's official schema, identified by the standard's own hash, appended and never edited, with the capturing account stamped by the gateway rather than asserted by the sender. That is what turns a trace from a report someone compiled into evidence someone else can check.

Custody is structural, not promised. No service identity holds an UPDATE or DELETE grant; the write path has exactly one writer and it can only append. You can add an event; you cannot un-write one, which is what makes a later trace evidentiary rather than merely stored.

Identity is the standard's own. The gateway computes the standardized EPCIS event hash from CBV 2.0 §8.9, with GS1 Digital Link normalization, checked against pinned reference vectors, so the same event captured twice is the same event and a changed event is a different one.

Provenance: an aged epcis.dev page, kept at its original URL and refreshed into the current design on 15 August 2026.

Proof, not adjectives. The gateway's conformance tests pass against GS1's normative artifacts, and the calculators answer on this origin — POST /translate, /validate, /hash, no key. The dated ledger is What ships today.