The launch journal.

When events carry computed identity, aggregation history and org-grain parties, tracing an EPC across commissioning, packing, DC receipt and store receipt is one trace_epc call returning a verifiable chain — a transcript over the committed corpus fixtures, hashes verbatim.

The FSMA 204 compliance date slipped roughly 30 months, the extension was never finalized as a rule, and FDA is soliciting further flexibilities — the checkable date record no compliance vendor publishes, and the engineering case that survives it.

The FSMA Traceability Lot Code needs exactly one home per record — LGTIN at lot grain, stamped in ILMD at commissioning, referenced by every downstream event, and printed as AI (10) on the case label. A three-event lot lifecycle, validated against the pinned GS1 schema.

Every FSMA 204 Critical Tracking Event maps onto a specific EPCIS event shape, and every Key Data Element has a conformant field — the CTE-to-event table, the KDE placements, and a receiving-CTE fixture validating against the pinned GS1 schema.

X12 publishes no conformance suite, so ground truth is manufactured honestly — independent open-source parsers run as subprocesses, byte-exact round-trips with two recorded canonical-equal exceptions, envelope fuzzing, and disagreements adjudicated by journaled human ruling.

UNECE publishes the UN/EDIFACT directories openly, so the DESADV→EPCIS mapping goes dictionary-deep with sha256-pinned artifacts — CPS/PAC/GIN to the SSCC tree, RFF to bizTransactionList, NAD GLNs to source and destination — the treatment X12 licensing forecloses.

X12's spec content is copyright-licensed, so our EDI documentation policy is structural — original prose about semantics and joins, deep links to Stedi's reference for segment detail, and full dictionary depth reserved for the openly published EDIFACT/UNECE side. The constraint, published as policy.

Reconciling what the ASN said against what the scanners recorded is a deterministic set diff once both sides are conformant EPCIS — over, short, wrong-lot and unexpected fall out as typed discrepancy records a program can route, and the receiving advice becomes a projection of the diff.

The X12 856's shipment-order-pack-item hierarchy is structurally isomorphic to the EPCIS aggregation model. One deterministic mapping turns any ASN into a validated event skeleton — SSCC parents, GTIN-grain children, desadv and po references — shown on a worked fixture pair.

CBV 2.0 §7.3 defines po, desadv, inv and recadv as first-class bizTransaction types, and §8.5 puts bizTransactionList on every EPCIS event type. Joining EDI context onto events is core spec machinery, not an extension hack — with a pinned-schema fixture to prove it.

MCP and A2A leave tool selection and approval to the client, so whether a call fires inside already-granted authority comes down to honest tool annotations. epcis.dev marks its provably pure verbs — validate, hash, translate, the read tools — readOnlyHint true, and leaves capture unmarked, so a verifier agent reaches first value with zero approval prompts and stops exactly where a write begins.

An event needs two performer fields — who, the attested observer (human, agent, or embodied agent), and capturedBy, the warrantor account stamped by the gateway — because an agent may observe under an account it does not own. One fixture shows the split; one dispute shows why collapsing it destroys the evidence.

A bid needs conformance sentences that survive a technical evaluator, and every honest sentence has a runnable artifact behind it — pinned-schema validation, reference-vector-gated hashing, per-job fidelity reports, an advisory conformance suite that says so on every run. The permitted sentences, each with its proof command, and the forbidden ones with why each fails checking.

A procurement-class agent needs two things stated as matchable fact — what conformance the surface demonstrates (pinned spec version, sha256 provenance, reference-vector gating) and what its ceiling buys. Both are published machine-readable on this origin, and when the ask exceeds the ceiling the agent escalates with evidence instead of negotiating.

The same observation arrives as urn:epc:id:sgtin from a legacy system and as a GS1 Digital Link URI from a 2D-era system. The CBV 2.0 §8.9 hash's normalization rules make both compute the same event identity — shown with two real fixtures hashing equal, step by step.

The epcis.dev translator turns EPCIS 1.1/1.2 XML into 2.0 JSON-LD deterministically, and every job emits a round-trip fidelity report — roundTripClean plus an enumerated loss ledger. A job that is not clean and schema-valid fails visibly and is never delivered. Two real corpus jobs shown, including the one with a flagged path.

TransformationEvent's input/output lists are the standard's answer to processing genealogy — raw-material lots in, finished-good lots out, linked by transformationID across sessions. A validated two-in, three-out fixture, and the forward and backward trace queries answered from events alone.

Agent sessions evaporate; configuration survives. epcis.dev ships a machine-parseable persist-me block — an MCP entry, an AGENTS.md path, a memory line — naming the exact artifacts that make the tool exist again after a cold start. The retention metric is the cold-start test, not engagement.

epcis.dev ships AGENTS.md inside the npm tarball — a closed verb set, --json on every verb, payload-only stdout, typed stderr errors, five stable exit codes, token-cheap TSV text mode. An agent integrates by reading the contract, not by probing the tool. Three commands prove it holds.

An agent-first property publishes its own machine surfaces — a ledger-first llms.txt, a derivation-contract icp.json built from the same frozen enumeration the runtime selects on, agent-classes.json, and .well-known/agents.json — so an arriving agent matches, verifies, and integrates from published fact instead of scraping prose meant for humans. All four are live on this origin.

Stedi built the best public X12 reference and a $142M healthcare clearinghouse on the same discipline. The reference is live, free, and credited here. No developer-EDI vendor ships an EPCIS product — the document-to-event join is open ground, and CBV 2.0 already standardized its vocabulary.

Agent-built standards code invites Goodhart's law — the implementation hill-climbs whatever the tests measure. epcis.dev pins every conformance-harness spec by sha256 and the verifier refuses to run against text that doesn't hash to its pin. Change one character and the digest says so.

Recording an event costs nothing and the free verbs are everything pure or bounded — translate, validate, hash, capture at $0/event (intent, until published terms bind it) — because the gate belongs past first value, on durable statefulness, authority, and licensed data. The verb-by-verb gate map, with the reason each gate exists.

CBV 2.0 §7.4 defines exactly three source/destination types — owning_party, possessing_party, location — the org-grain Who EPCIS already has. A custody-transfer fixture models ownership changing while possession doesn't, perfectly. The question the fixture cannot answer is the point: the performer grain has no field.

The SimpleEventQuery parameters that matter — EPC match, time windows, bizStep, location, error declarations — with executed queries and exact result sets over the golden corpus, plus the matching gotchas that surprise integrators and the pagination contract, stated as fact.

An EPCISDocument can carry party, location, and product master data in its epcisHeader alongside the events that reference them — one self-describing, schema-valid artifact a receiving system loads with zero out-of-band setup. The fixture, the schema definitions that allow it, and when a GDSN feed still wins.

EPCIS 2.0's sensor model puts telemetry inside the event — sensorElements with metadata and reports, standard units, alarm conditions — so a temperature excursion and the custody event that observed it are one validated artifact, not two systems glued in a spreadsheet.

A parsed 2D scan plus scanning context mechanically constructs a valid EPCIS ObjectEvent — AI map to SGTIN or LGTIN, validation against the pinned schema before anything leaves the function, and the attested observer carried as a conformant namespaced extension. Real transcripts throughout.

bizStep and disposition are the join keys that make events queryable across parties — and the pinned official schema enumerates the CBV values, so a home-grown status string is not just unqueryable, it is schema-invalid. Ten real WMS status strings mapped to their CBV pairs, and the validator rejecting the free-text version.

Deputization is a typed ceremony with a human audience — provisionAgentSeat confers a bounded mandate (scope, ceiling, expiry) on an agent seat, and every later capture traces to that ceremony instead of to a shared API key. Party and org grain stay derived at read time, so revocation never rewrites an event.

"We validate against the official schema" is empty unless the schema artefact is pinned by digest and changes only by journaled ruling. PINS.json records sha256, source URL and retrieval date for all five GS1 EPCIS 2.0.1 artefacts; verify:pins re-checks them in CI — a one-byte tamper demonstration shown failing, verbatim.

One vehicle move exercises the whole family in sequence — barcode scan to identity, custody events with an attested driver who and a carrier capturedBy, and escrow release triggered by the delivery-confirmed event's hash. The layering is a mechanism, not an analogy.

Every answer the business surface sells — traces, custody evidence, exceptions — is a view computed over the same catalog the open developer surface queries. "Does the dashboard match the record" stops being an audit question and becomes a definition: recompute the view and it is the record. The architecture that makes that structural, not promised.

Runtime schema compilation is a supply-chain surface and a cold-start tax. epcis.dev precompiles the pinned GS1 schemas into standalone eval-free validator code, freshness-gated against the pins — measured on the golden corpus at about 12 microseconds per document, versus 73 ms just to compile the schema at runtime.

When an absent agent hits a human-gated scope with no pre-registered notification channel, the only honest behavior is failing closed with a typed, resumable refusal. The rule is published verbatim in /icp.json, gate-clearing is presence-typed, and the MCP door already ships its refusals as typed tool errors — never silent successes.

The pallet/case/each hierarchy is not a snapshot to maintain — it is AggregationEvents keyed by SSCC parent with explicit ADD and DELETE actions. Model containment as events and the current tree becomes a derived view that cannot drift from history. A three-event worked sequence, validating against the pinned schema.

The EPCIS 2.0 migration is four concrete deltas — JSON-LD syntax, REST capture/query, sensor extensions, Digital Link identifiers — and the sane order is translate-and-validate the archive first, dual-write second, cut reads last. Every translation job emits a round-trip fidelity report, so loss is declared in the output, never discovered in an audit.

Instance/lot master data belongs in ILMD on the commissioning event — lot, production date, expiry, stamped once at object creation and immutable after. A side-table lookup dies at the company boundary; ILMD keeps the trace answer self-contained. A validating fixture with CBV §9.2 attribute names.

The CBV 2.0 §8.9 event hash makes an EPCIS event's identity a pure function of its content — canonical ordering, identifier normalization, one sha-256 ni-URI. One worked event shown end to end, matching OpenEPCIS's published reference vector byte for byte, with the vectors themselves vendored and pinned.

ObjectEvent, AggregationEvent, TransactionEvent, TransformationEvent — almost every mis-modeled EPCIS event comes from asking "what happened to the thing" instead of "what claim will a reader need to verify." Four questions decide it in sixty seconds, with a minimal validating fixture for each answer.

EPCIS 2.0 §7.2.2 defines five event dimensions — what, when, where, why, how — and no performer field is among them. Party fields are organisation-grain (§7.3.6.4, CBV §7.4.3, §8.7.1 PGLN). The absence of a Who is structural, and it is checkable against the public specs in ten minutes, without us.

Every failure surface here is typed — RFC 7807 problem+json bodies carrying the official epcisException:* vocabulary on the wire, {"error":{"code"}} on CLI stderr, stable exit codes 0/1/2/3/4. The error surface is an API contract a machine caller can branch on without regexing prose. The bodies and the decision tree, verbatim.

In an append-only event record, a mistake is corrected by declaring it — errorDeclaration marks the bad event, links the corrective one, and preserves both. A worked correction with real capture output, and the hash fact that makes in-place edits structurally impossible.

The EPCIS 2.0 query interface's subscription mechanism turns any query into a standing webhook — schedule or trigger, signed delivery, replayable from the durable record — with consumer-side dedupe closed by the CBV 2.0 §8.9 event hash.

A 2D symbol carrying GS1 element strings resolves to nothing in a browser — only the Digital Link form is web-resolvable, the encoding choice belongs to the GTIN owner, and a capture pipeline must parse both to the same canonical AI map or it forks its data model at the scanner.

A golden corpus with two tiers (valid/invalid) cannot check a conformant-extension claim. The epcis.dev corpus has three — valid-standard, valid-envelope, invalid — and every envelope fixture must still validate against the pinned official EPCIS 2.0.1 schema. That is what turns "extends the standard" from a slogan into an acceptance gate.

An ISV facing a customer's EPCIS 2.0 conformance question ships the answer fastest by importing the open-source engine — pinned validators, translation, hashing — as a dependency inside its own product. MIT-licensed, sha256-pinned artifacts vendored in the tarball, and a version policy where spec updates arrive as a dependency bump.

A deployment engineer under commissioning pressure needs a path from reader output to a validated EPCIS event that works on site, offline-tolerant, with a result to show the client the same day. That path is a local pipeline — construct, validate, hash, capture — with idempotent replay when the link returns, and no cloud dependency in the loop.

CBV 2.0 §7.3 defines desadv — "also called an 'Advanced Shipment Notice'" — as a first-class business-transaction type, and §8.5 puts bizTransactionList on every EPCIS event type. Four spec-sanctioned join points land ASN and PO context on events with zero extensions.

Because event identity is the CBV §8.9 content hash, capture is naturally idempotent — an offline buffer flushing twice, a retrying agent, a replayed batch all land as one stored event and benign acknowledgements. A real transcript shows the same document captured twice with one stored result, and why eventID and recordTime cannot break the dedupe.

The EPCIS 2.0 capture interface is a contract with exact semantics — synchronous validate-or-reject for single events, capture jobs with per-event error reporting for documents, RFC 7807 problem bodies, and a no-partial-acceptance law. The walkthrough with real request and response bodies.

The MCP tools — capture, query, get_event, trace_epc, translate — re-dispatch through the same worker fetch handler with the same key as the HTTP API. MCP here is a door into the one path, not a second implementation to keep honest: parity and authz are structural, cited by file.