You will pay for answers.
Never for the record.

One lot, one EPC, one question — the full event chain in seconds, and at every hop not just a company doing a process but the attested observer: which person, which agent, which device, at the moment of the scan. Today's record shows a case arrived at a DC; it never shows who received it. This answer shows both.

Real underneath, today. The per-EPC trace is a real, tested read: GET /epcs/{epc}/events and the trace_epc MCP tool run locally over captured events, and the tested corpus carries the attested-observer envelope the trace renders — the spine's native event model, whose EPCIS 2.0 projection always validates against the pinned official schema. The worked, illustrative trace on See your first trace is drawn from that tested event model.

In the P0 ledger. The trace answer view — the product surface a food-safety director would open — is a named entry in the open P0 ledger (P0-A1). What you can exercise today: the worked trace, the interview, and the seat list.

A custody chain you can hand to a regulator, an auditor, or the other side of a chargeback dispute — every event content-hashed per CBV 2.0 §8.9, append-only with corrections as declared events, carrying the attested observer — verifiable whether or not the counterparty joined anything.

Real underneath, today. The evidentiary spine is written and verified: the CBV 2.0 §8.9 event hash gated against OpenEPCIS reference vectors — and live at epcis.dev/hash today — the append-only law (no service identity holds UPDATE or DELETE), corrections as ErrorDeclaration events rather than edits, and the two-grain envelope — who, the attested observer, never collapsed into capturedBy, the warrantor account.

In the P0 ledger. The evidence pack itself — a rendered, dated custody dossier a reader can recompute offline — is a named entry in the open P0 ledger (P0-A2). It reuses the trust shape of the open conformance suite's evidence bundles: transcript-complete, rejudgeable without trusting us.

The standing view of every handoff where the record went quiet — received with no performer, shipped with no custody closure, a franchise or co-manufacturer boundary crossed with nothing attested on the far side — triaged before the auditor or the claim finds it first.

Real underneath, today. The underlying predicate is answerable on the tested query surface today: the corpus includes, deliberately, an event with activity and no who — the contrast fixture this whole brand is built on.

In the P0 ledger. The view, the triage queue and the notification path are named entries in the open P0 ledger (P0-A3); notification gates on the verified send path, an [OWNER] entry there.

Share exactly these goods, these event kinds, this window, at this attribution grain — with a customer, a shipper, or a regulator — as a grant that compiles to a spine-native scope, is enforced identically on every door, and revokes without rewriting history. Answer the traceability clause with a grant, not a paragraph.

Real underneath, today. The Scope engine underneath is implemented and tested: holder, grantor, subjects, business steps, window and attribution grain, with current state as a fold over an append-only log of compiles and revocations — and both brands' query surfaces evaluate the same scopes against the same catalog, so there is no door whose reads escape them. Party and org grain are derived at read time from grant chains, never stamped — which is what makes the record reorg-proof and revocation-safe.

In the P0 ledger. The SharingGrant customer object, the workspace surface, and the UI for minting or accepting a grant are named entries in the open P0 ledger (P0-A4).

When the call comes, the trace-back that took days across the co-manufacturer or franchise boundary becomes a query: covered-food KDEs and CTEs, custody closed at every hop, exportable in the shape the auditor asks for — so the 2028 enforcement floor is a de-risking deadline you beat early, not a gun to your head.

Real underneath, today. The trace and query primitives this view sits on are the same tested reads as the trace answer above. The FSMA record itself is part of the offer: the direction of travel is softening, and we will keep saying so, because a plan built on 2028-as-a-deadline is falsified by one search in the room.

In the P0 ledger. The KDE/CTE mapping and the export view are named entries in the open P0 ledger (P0-A5); they land on the trace answer view.

Exactly what Sunrise 2027 requires of you — GTIN owner, converter, or retailer; which symbology and which URI form is genuinely your decision; what the lane must extract versus what nothing obliges you to encode — and the one structural fact you can verify without us: EPCIS 2.0 §7.2.2 defines five dimensions and no performer — the Who it carries is a company, a GLN. Ten minutes, the specs are public, don't take our word for it.

Real underneath, today. This is the only answer deliverable now, because it is written. The get-started interview ends every business path with the read for your situation — the standing corrections included: a QR carrying a GS1 Digital Link URI is not a GS1 DataMatrix; element strings are not a URI; lot and expiry are optional AIs; Sunrise's baseline is GTIN extraction, and it puts nothing on anyone's pack.

In the P0 ledger. The one open entry behind this page is the seat-ready send path behind the address you may choose to leave — an [OWNER] entry in the open P0 ledger.

A human seat provisions an agent seat with a written mandate — scope named, ceiling named — so the agent that works your exception queue or answers your customer's verifier acts under authority you granted and can be shown to have acted under it. provisionAgentSeat is a ceremony with a human audience, not a route; identity resolves through id.org.ai — Agent. Human. Thing.

Real underneath, today. The scope holder/grantor model and its enforcement — the substrate a seat compiles into — are implemented and tested, including attribution-grain reads.

In the P0 ledger. The ceremony, the workspace and the seat objects are named entries in the open P0 ledger (P0-A7); the ceremony's exact shape awaits ratification, and its mechanics stay unstated here on purpose.

This origin publishes its machine face: /icp.json (the business-principal contract: classification ladder, authority and presence with the fail-closed rule verbatim, the no-ask zone, route derivation) and /agent-classes.json (the single agent-class enumeration both brands subset by id). The interview itself is machine-readable at /flow.json — the same definition the human flow walks, so an agent reads exactly what a human is promised. There is no bookDemo verb, and there will not be one.

The interview is the door: ten minutes of questions that branch on your answers, and the read for your situation at the end — whether or not you leave an address.

We answer in writing. We take at most five conversations a month, only when you ask for one, and only after you already have the written read.