# The loss has a number. It has no address.

> A fully instrumented chain tells you where a unit was last read. It cannot tell you who was standing there. — Apparel and general-merchandise retail — loss prevention.

**Verified 5 August 2026.** Three doors of the spine answer over HTTPS today — POST https://epcis.dev/translate, /validate and /hash — against sha256-pinned official GS1 artefacts, and 931/931 spine tests pass. Every open gap is a named entry in the open P0 ledger at /p0-ledger/.

## What it costs you

That is not an instrumentation gap you can close by adding read points. The read record has no field for a performer — and the evidence that could name one, a proof-of-delivery signature, a door camera, a WMS login, sits in a different system with nothing to join on.

So the loss is attributed to a site, a shift or a period, and the case closes as a number in a report. Another read point buys a tighter interval and nothing else. The marginal information left in a fully-scanned chain is not another scan. It is a witness.

And the hardest links are the ones staffed by people who do not work for you: an agency shift on a cross-dock, a carrier’s driver, a returns desk. Custody genuinely changes hands there, and the standard record of a custody change has no place to name who took it.

## What changes

visibility.cloud puts an attested observer on every read — a person, an agent, or an embodied one; a robot or an autonomous reader on the dock is attested exactly the way a person is — and never confuses it with capturedBy, the account that warrants the capture. A gap is then bounded by two attested events with a named observer on each, which turns an unattributable number into a handoff you can take to somebody.

What this is not. It does not stop a theft and it does not predict one. It removes the reason the investigation stops: the last read and the next read both name who was there, so what used to be a period is a pair of hands. No shrink figure appears on this page, because we hold none we can show you.

## One place to point your agents.

Your agents will reason over anything you hand them. What they get handed is fourteen systems, a credential each, and no two of them describing the same object the same way.

visibility.cloud will onboard those sources as one surface: modern SaaS platforms through their own APIs, Apache Iceberg lakes read and written in both directions, the EDI mailbox that has been running since before anyone there was hired, and the print, scan and read events coming off the floor — landing as one event record with an attested observer on it, at the grain a question is actually asked at.

Then the agents get one secure place to explore it, under a seat with a written mandate: scope named, ceiling named, every read evaluated against the same grants every human read is. The point is not a chat window over a warehouse. It is that the answer comes back actionable — a bounded set of cases, a named handoff, a specific gap — instead of an integration project per source.

The sandbox is a named entry in the open P0 ledger (P0-A11), and the seat mandate it runs under is P0-A7. What is live today is the machine face this surface already publishes: /llms.txt, /icp.json, /agent-classes.json, /flow.json and /variants.json, plus the markdown twin of this page on this same route.

## What this read stands on

Evidence class: `structural-only`. No shrink rate, loss figure or recovery number is cited here, because none is held that can be shown. Every claim on this read is a checkable property of a record.

Go check us. It takes ten minutes and doesn’t involve us.
EPCIS 2.0 §7.2.2 defines five event dimensions: what, when, where, why, how. No performer is among them. The party fields are organisation-grain — EPCIS §7.3.6.4, CBV §7.4.3, CBV §8.7.1 (PGLN). The conformant path to a performer today is a namespaced user-extension field (EPCIS §6.3 / §9.1 / §10.1.3). So the standard can say a company did a process — its Who is the company, a GLN. It cannot say which person or which device observed the event at 06:12: no field names the performer. The specs are public. Don’t take our word for it.

## The other three bills

There is no single company message on this surface, by design — one defect, four costs.

- **Recall** (https://visibility.cloud/for/recall/) — One run went bad and you withdrew everything it could have been in. Food CPG and QSR — whoever owns the recall desk.
- **Authenticity** (https://visibility.cloud/for/authenticity/) — A convincing copy carries the same digits as the original. Jewelry, watches and luxury — brand protection, and whoever answers the client.
- **The discarded scan** (https://visibility.cloud/for/the-discarded-scan/) — The lane reads the serial, the lot and the expiry, and keeps none of them. Retailers and brands on the Sunrise 2027 timeline.

The typed index of all four, with each read's evidence class: https://visibility.cloud/variants.json