You will pay for answers.
Never for the record.

One lot, one EPC, one question — the full event chain in seconds, and at every hop not just a company doing a process but the attested observer: which person, which agent, which device, at the moment of the scan. Today's record shows a case arrived at a DC; it never shows who received it. This answer shows both.

Real underneath, today. The per-EPC trace is a real, tested read: GET /epcs/{epc}/events and the trace MCP tool run locally over captured events, and the tested corpus carries the attested-observer envelope the trace renders — the spine's native event model, whose EPCIS 2.0 projection always validates against the pinned official schema. The worked, illustrative trace on See your first trace is drawn from that tested event model, and One trace, two records is that chain made interactive — seven worked chains, one per segment, with the performer switched on and off against the seven questions an investigator asks.

Not built yet. The trace answer view — the product surface a food-safety director would open. What you can exercise today instead: the worked trace, the interview, and the seat list.

A custody chain you can hand to a regulator, an auditor, or the other side of a chargeback dispute — every event content-hashed per CBV 2.0 §8.9, append-only with corrections as declared events, carrying the attested observer — verifiable whether or not the counterparty joined anything.

Real underneath, today. The evidentiary spine is written and verified: the CBV 2.0 §8.9 event hash gated against OpenEPCIS reference vectors — and live at epcis.dev/hash today — the append-only law (no service identity holds UPDATE or DELETE), corrections as ErrorDeclaration events rather than edits, and the two-grain envelope — who, the attested observer, never collapsed into capturedBy, the warrantor account.

Not built yet. The evidence pack itself: a rendered, dated custody dossier a reader can recompute offline. It will reuse the trust shape of the open conformance suite's evidence bundles: transcript-complete, rejudgeable without trusting us.

The standing view of every handoff where the record went quiet — received with no performer, shipped with no custody closure, a franchise or co-manufacturer boundary crossed with nothing attested on the far side — triaged before the auditor or the claim finds it first.

Real underneath, today. The underlying predicate is answerable on the tested query surface today: the corpus includes, deliberately, an event with activity and no who — the contrast fixture this whole brand is built on.

Not built yet. The view, the triage queue and the notification path. The notification half additionally waits on the verified sending address the seat mail waits on.

Share exactly these goods, these event kinds, this window, at this attribution grain — with a customer, a shipper, or a regulator — as a grant that compiles to a spine-native scope, is enforced identically on every door, and revokes without rewriting history. Answer the traceability clause with a grant, not a paragraph.

Real underneath, today. The Scope engine underneath is implemented and tested: holder, grantor, subjects, business steps, window and attribution grain, with current state as a fold over an append-only log of compiles and revocations — and both brands' query surfaces evaluate the same scopes against the same catalog, so there is no door whose reads escape them. Party and org grain are derived at read time from grant chains, never stamped — which is what makes the record reorg-proof and revocation-safe.

Not built yet. The SharingGrant customer object, the workspace surface, and the UI for minting or accepting a grant. The scope engine they compile into is written and tested.

When the call comes, the trace-back that took days across the co-manufacturer or franchise boundary becomes a query: covered-food KDEs and CTEs, custody closed at every hop, exportable in the shape the auditor asks for — so the 2028 enforcement floor is a de-risking deadline you beat early, not a gun to your head.

Real underneath, today. The trace and query primitives this view sits on are the same tested reads as the trace answer above. The FSMA record itself is part of the offer: the direction of travel is softening, and we will keep saying so, because a plan built on 2028-as-a-deadline is falsified by one search in the room.

Not built yet. The KDE/CTE mapping and the export view. They land on the trace answer view, which is unbuilt above.

Exactly what Sunrise 2027 requires of you — GTIN owner, converter, or retailer; which symbology and which URI form is genuinely your decision; what the lane must extract versus what nothing obliges you to encode — and the one structural fact you can verify without us: EPCIS 2.0 §7.2.2 defines five dimensions and no performer — the Who it carries is a company, a GLN. Ten minutes, the specs are public, don't take our word for it.

Real underneath, today. This is the only answer deliverable now, because it is written. The get-started interview ends every business path with the read for your situation — the standing corrections included: a QR carrying a GS1 Digital Link URI is not a GS1 DataMatrix; element strings are not a URI; lot and expiry are optional AIs; Sunrise's baseline is GTIN extraction, and it puts nothing on anyone's pack.

Not built yet. Only one thing, and it is the mail that tells you a seat is ready at the address you may choose to leave: it waits on a verified sending address and a named human sender. Everything else on this page is written and live.

A human seat provisions an agent seat with a written mandate — scope named, ceiling named — so the agent that works your exception queue or answers your customer's verifier acts under authority you granted and can be shown to have acted under it. provisionAgentSeat is a ceremony with a human audience, not a route; identity resolves through id.org.ai — Agent. Human. Thing.

Real underneath, today. The scope holder/grantor model and its enforcement — the substrate a seat compiles into — are implemented and tested, including attribution-grain reads.

Not built yet. The ceremony, the workspace and the seat objects. The ceremony's exact shape awaits ratification, and its mechanics stay unstated here on purpose.

This origin publishes its machine face: /icp.json (the business-principal contract: classification ladder, authority and presence with the fail-closed rule verbatim, the verbs that are free to call, route derivation) and /agent-classes.json (the single agent-class enumeration both brands subset by id). The interview itself is machine-readable at /flow.json — the same definition the human flow walks, so an agent reads exactly what a human is promised. There is no bookDemo verb, and there will not be one.

The interview is the door: ten minutes of questions that branch on your answers, and the read for your situation at the end — whether or not you leave an address.