# visibility.cloud — Everything you ship is anonymous.

> The barcode on the unit says what kind of thing it is. Nothing you own says which one. So one bad run costs you every run it could have been. A case that goes missing between two docks becomes a number in a report with no address on it. A disputed delivery is two records that both name a company, and a company has no hands. And a convincing copy of your product carries the same digits as the original, because the digits were never about the original. visibility.cloud is the record at the grain you ask questions at — grain being the size of the thing a record is about: a company is one, a batch is finer, and a single case, this one and not the one behind it, is the finest there is. One item, one handoff, and an attested observer on every event — a person, an agent, or a robot — kept distinct from the account that stands behind the capture, stamped at the door and impossible to un-write. It holds up whether or not the other side of the handoff joined anything.

## There is no single version of this problem

One defect, four bills. Each read stands on its own evidence and names its evidence class; the typed index is /variants.json.

- **Recall** (/for/recall/) — One run went bad and you withdrew everything it could have been in. Food CPG and QSR — whoever owns the recall desk. Evidence class: `public-record`. FSMA 204 and its dated enforcement record are public and citable. No adoption, customer or recovery figure is claimed.
- **Authenticity** (/for/authenticity/) — A convincing copy carries the same digits as the original. Jewelry, watches and luxury — brand protection, and whoever answers the client. Evidence class: `structural-only`. No counterfeit rate, market size or resale figure is cited here, because none is held that can be shown. Every claim on this read is a checkable property of a record.
- **Shrink** (/for/shrink/) — Every unit was scanned, and the investigation still ends at “seen here, then not.” Apparel and general merchandise — loss prevention, and the fulfillment side that owns the dock it happens on. Evidence class: `structural-only`. No shrink rate, loss figure or recovery number is cited here, because none is held that can be shown. Every claim on this read is a checkable property of a record.
- **The discarded scan** (/for/the-discarded-scan/) — The lane reads the serial, the lot and the expiry, and keeps none of them. Retailers and brands on the Sunrise 2027 timeline. Evidence class: `public-record`. GS1's Sunrise 2027 program is public and dated, and is cited here as GS1's own program. No adoption or scan-volume figure is claimed.

## Nothing in your building is broken.

The barcode scans first time. The register rings it. The warehouse books the receipt and the count reconciles at the end of the period. The drill is on the calendar, the read points are where they should be, the artwork went through every stage it was meant to. Nobody skipped anything, and nobody was sold a bad product. **Every one of those four bills is what doing it correctly produces** — given a record that was only ever asked one question.

## It names a class. That is all.

It is worth being precise about what the limit actually is, because the imprecise version is easy to dismiss and the precise version is not. The barcode is not *unreadable*. It is read constantly — more often than any other act in your business. It is not *inaccurate*; it is one of the most reliable pieces of engineering in commercial history. It is not *proprietary*, or hidden, or withheld by anybody. **It answers *what kind of thing is this* with total precision and total reliability, and it has no capacity whatsoever to answer *which one*.**

## One problem, not two

**The barcode that could not say which one, and the record that cannot say who, are the same defect at two different grains.** A record that names a kind of thing, performed by a kind of party. Categories all the way down, in a world where the questions being asked are about individuals.

## The two offers that span every surface in the family

- **Fork the scan.** The retail lane will read the whole symbol and keep a twelfth of it. The other eleven twelfths are yours for the asking, and asking costs nobody a behavior change. The lane-side split is not built yet. What is live today is the read underneath it: the interview at get started ends every business path with the Sunrise decision read for your situation — which symbology and which URI form is genuinely your decision as GTIN owner, and what the lane must extract versus what nothing obliges you to encode.
- **One place to point your agents.** An agent buying from you has to show whose money it is spending and under what limit. An agent working inside your plant has to show whose authority it holds and which task it was asked to perform. Those are the same question, asked from opposite sides of the same door. Neither the sandbox nor the seat mandate it runs under is built yet. What is live today is the machine face this surface already publishes: /llms.txt, /icp.json, /agent-classes.json, /flow.json and /variants.json, plus the markdown twin of this page on this same route.

## If you have started nodding, check this before you believe the rest

Go check us. It takes ten minutes and doesn’t involve us.
EPCIS 2.0 §7.2.2 defines five event dimensions: what, when, where, why, how. No performer is among them. The party fields are organization-grain — EPCIS §7.3.6.4, CBV §7.4.3, CBV §8.7.1 (PGLN). The conformant path to a performer today is a namespaced user-extension field (EPCIS §6.3 / §9.1 / §10.1.3). So the standard can say a company did a process — its Who is the company, a GLN. It cannot say which person or which device observed the event at 06:12: no field names the performer. The specs are public. Don’t take our word for it.

## The spine's laws

1. **Conforms to EPCIS 2.0 and CBV 2.0.** Implemented against GS1's official OpenAPI description, pinned by digest.
2. **Validated on every capture.** Each event is machine-checked against the official GS1 EPCIS 2.0 JSON schema before it is accepted. A capture that does not validate is refused, in RFC 7807 problem+json, carrying the standard's own exception types — not a vendor error string.
3. **Stamped by the gateway, not by the sender.** recordTime, who captured it, and the grade of that attestation are applied at the door. Whatever you sent in those fields is stripped. The scriber is not the part being scribed.
4. **Identified by the standard's own hash.** The standardized EPCIS event hash from CBV 2.0 §8.9, with GS1 Digital Link normalization, so the same event captured twice is the same event, and a changed event is a different one.
5. **Append-only, by construction.** No service identity anywhere in the system holds an UPDATE or a DELETE grant. You can add an event. You cannot erase one.
6. **Minimally scoped on read.** You see your own scope. What is outside it is absent, not grayed out and not redacted — there is no shape left behind to argue about.
7. **Ten years of vendor XML, translated.** EPCIS 1.1, 1.2 and 2.0 XML in, EPCIS 2.0 JSON-LD out, with a round-trip fidelity report per job so the translation is reviewable rather than trusted.
8. **A door for agents as well as people.** The same interface, the same key, over MCP — so a partner's logistics agent can capture and query without a human copying values between two systems.

What the laws add up to: Everyone in this market has built a network that is authoritative because you joined it. This platform makes a record that is verifiable whether or not you joined anything — and it carries, in the record itself, an attested answer to who observed the event, including when the observer was an agent.

## Where atoms generate bits, someone is being paid.

Energy and silicon become tokens, and that trade is metered, invoiced, and growing every quarter. A print, a scan and a read are the same trade at the other end of the economy — a physical act, and a record that could come out of it — and your building performs thousands of them a day. **Where they do not, something is being lost, and there is no line for it anywhere.**

## Both ledgers are rented. Only one has a meter.

**You rent reasoning by the token, and every token is billed to a request, a key and an owner. You rent production by the case, and the case is billed to nobody.** The plant that makes your product is a generating station too — raw material in, finished units out, all day. It counts what comes off the line. It cannot tell one unit from another, because nothing about a case distinguishes it from the case behind it, so what the line reports is a total and never a unit. Owning the plant instead of renting it changes what you can do about that, and nothing about the meter. **A unit that was only ever counted in a total cannot be priced apart, insured apart, financed apart, recalled narrowly, or preferred by a machine.**

## Capture is free. It stays free.

Recording an event will never cost you money — policy, stated ahead of published terms: the gate never lands on capture; terms post here the day they are set. Revenue attaches to answers — traces, custody evidence, exception review, partner grants, seats, retention. Prices post as numbers, on a page, without a call, when they are set.

## The answers

- **The trace: where is it, and who touched it.** One lot, one EPC, one question — the full event chain in seconds, and at every hop not just a company doing a process but the attested observer: which person, which agent, which device, at the moment of the scan. Today's record shows a case arrived at a DC; it never shows who received it. This answer shows both.
- **Chain-of-custody evidence: the record that holds up in the room.** A custody chain you can hand to a regulator, an auditor, or the other side of a chargeback dispute — every event content-hashed per CBV 2.0 §8.9, append-only with corrections as declared events, carrying the attested observer — verifiable whether or not the counterparty joined anything.
- **Exception views: the handoffs that went silent.** The standing view of every handoff where the record went quiet — received with no performer, shipped with no custody closure, a franchise or co-manufacturer boundary crossed with nothing attested on the far side — triaged before the auditor or the claim finds it first.
- **SharingGrants: scoped sharing that compiles, and revokes, cleanly.** Share exactly these goods, these event kinds, this window, at this attribution grain — with a customer, a shipper, or a regulator — as a grant that compiles to a spine-native scope, is enforced identically on every door, and revokes without rewriting history. Answer the traceability clause with a grant, not a paragraph.
- **Recall & audit readiness: FSMA 204 without the war room.** When the call comes, the trace-back that took days across the co-manufacturer or franchise boundary becomes a query: covered-food KDEs and CTEs, custody closed at every hop, exportable in the shape the auditor asks for — so the 2028 enforcement floor is a de-risking deadline you beat early, not a gun to your head.
- **The Sunrise 2027 decision read: the executive gift.** Exactly what Sunrise 2027 requires of you — GTIN owner, converter, or retailer; which symbology and which URI form is genuinely your decision; what the lane must extract versus what nothing obliges you to encode — and the one structural fact you can verify without us: EPCIS 2.0 §7.2.2 defines five dimensions and no performer — the Who it carries is a company, a GLN. Ten minutes, the specs are public, don't take our word for it.
- **Seats & deputization: the mandate your agent works under.** A human seat provisions an agent seat with a written mandate — scope named, ceiling named — so the agent that works your exception queue or answers your customer's verifier acts under authority you granted and can be shown to have acted under it. provisionAgentSeat is a ceremony with a human audience, not a route; identity resolves through id.org.ai — Agent. Human. Thing.

## The family (built in the open)

Three developer-facing sites under this surface; every answer here is a view over the record they write and read. Their mastheads carry "· by visibility.cloud".
- epcis.dev — the event engine: an EPCIS 2.0 capture gateway; translate, validate and hash answer on that origin today
- transactions.dev — the paperwork layer: purchase orders, ASNs and invoices compiled onto the same event record in the standard's own vocabulary
- barcoding.dev — the barcode layer: every barcode read, verified and generated, with the source and license named on every answer
- worklists.dev — the work layer: a task will be the causal parent of the events that satisfy it, and closing one will mean presenting an attested capture rather than ticking a box
- id.org.ai — the identity layer: Agent. Human. Thing. Who an observer is resolves there; this surface only names it.

## Doors

- /get-started — the branching interview (machine twin: /flow.json)
- /first-trace — a worked illustrative trace + the segment waitlist
- /trace — the same chain, interactive: seven worked custody chains, one per segment, with
  a switch that adds or removes the performer
- /answers — the offer surface
- /for/recall/ — the recall read (markdown twin on the same route)
- /for/authenticity/ — the authenticity read (markdown twin on the same route)
- /for/shrink/ — the shrink read (markdown twin on the same route)
- /for/the-discarded-scan/ — the the discarded scan read (markdown twin on the same route)
- /llms.txt · /icp.json · /agent-classes.json · /variants.json — the machine face