# Conformance & pins

The conformance family ships as callable rows of the npm package: run the
advisory suite, hand the evidence bundle to a counterparty, let them
rejudge it offline, and diff the pinned normative artifacts the whole
exercise is judged against. Every row here is `npx epcis.dev` away — no
key, no account.

**A run from this tool is advisory. It is unsigned, carries no attestation
weight, and can never back a ConformanceAttestation.** That sentence is
printed by the tool itself at the top of every run.

## conformance run

| contract | value |
|---|---|
| Verb | `conformance run --self\|--target d.json [--out o]` |
| Price class | free |
| `--self` | the 18-check suite against the built-in hermetic reference implementation (deterministic, loopback) — proves the suite, not any external system |
| `--target` | an advisory run against the EPCIS 2.0 endpoint the descriptor names; the only network the CLI ever touches |
| `--out o` | writes the full evidence bundle — a hash tree over complete HTTP transcripts (auth headers redacted at record time) |
| `--json` | `{ mode: "advisory", notice, record }` |
| Exit codes | `0` ok · `1` fail · `2` usage · `3` not-found · `4` internal |
| Library twin | `runSuite`, `ALL_CHECKS`, `buildEvidenceBundle`, `createReferenceTarget`, `REFERENCE_TARGET_DESCRIPTOR` |

Target descriptor: `{ "name", "vendor", "version", "captureURL"?,
"queryURL"?, "auth"?, "declared"? }` — at least one URL required.
Undeclared capabilities yield reasoned not-applicable rows, never silent
skips.

## conformance rejudge

| contract | value |
|---|---|
| Verb | `conformance rejudge <run.json> [--signing-key b64]` |
| Price class | free |
| Input | a `--out` run file or evidence bundle |
| What it does | offline verify + replay: checks the hash tree, replays every check from the recorded transcripts, reports `identical` or `FAILED` — a tampered bundle fails the tree |
| `--json` | `{ signature, replayed, identical, missingChecks, flips, ok }` |
| Exit codes | `0` ok · `1` fail (rejudge mismatch) · `2` usage · `3` not-found · `4` internal |
| Library twin | `rejudgeEvidenceBundle`, `verifyEvidenceBundle` |

## pins

| contract | value |
|---|---|
| Verb | `pins` |
| Price class | free |
| Output | one `pin` line per vendored official GS1 artifact: name, sha256, source URL |
| `--json` | the `vendor/gs1/PINS.json` record verbatim |
| Exit codes | `0` ok · `4` internal |
| Library twin | `PINS`, `getPin`, `ARTEFACT_NAMES` |

Every verdict in the suite — and every `/validate` answer — is judged
against these pinned bytes, not against a URL that can drift. The pins
page at [/conformance/](/conformance/) renders the same table from the
same source.

## Proof — the suite, executed

Against the published npm package, `epcis.dev@0.1.0`:

```
$ npx epcis.dev conformance run --self --out run.json
advisory	ADVISORY — this run was produced locally and is unsigned.
	It carries no attestation weight and can never back a
	ConformanceAttestation. Attestation requires an Ed25519-signed
	run executed by a signing conformance service; this tool never
	signs.
run	advisory-bc1c86ed-2d6f-415e-bae0-f642ed96f990	suite=0.4.0
	target=epcis.dev reference implementation
pass	TCR-43.1
pass	TCR-43.2
pass	TCR-43.3
pass	TCR-43.4
pass	TCR-53.1
pass	TCR-53.2
pass	TCR-53.3
pass	TCR-53.4
pass	TCR-53.5
pass	TCR-53.6
pass	TCR-53.7
pass	TCR-53.8
pass	TCR-53.9
pass	TCR-53.10
pass	TCR-53.11
pass	TCR-54
pass	M121
pass	M122
state	passed	passed=18	failed=0	total=18
wrote	run.json
$ echo $?
0
```

(The `advisory` and `run` lines are single TSV lines on the wire; wrapped
here for the page.) The written `run.json` is the evidence bundle the
[rejudge walkthrough](/docs/conformance/run-rejudge/) replays offline.

---

**Proof, not adjectives.** This build could not verify the gateway's test suite green, so no sentence on this page claims a passing run — the last verified run is recorded in the repository's own CI, not here. Live on this origin, no key: POST /translate, /validate, /hash. No conformance attestation has ever been issued. The dated ledger is /what-ships-today/.