From stripes to grids: the founding document of visibility.cloud.
For fifty years, the mark the checkout lane reads has been a stripe. The UPC on the pack was never meant for people: a lane token built for a fixed scanner. Point a phone at it and all it can give up is the same class-level number the lane gets — nothing to open. It says exactly one thing: a product of this kind exists. Not this lot. Not this expiry. Not who touched it. One number, naming a class, said to one machine, for half a century.
Your logistics stripes say more; saying more has not helped. The GS1-128 on the case has carried lot and expiry for decades; the SSCC on the pallet names that pallet and no other. But nothing joins them at the record: lane to case takes a mapping table, pallet to contents a shipping notice, and none of the three carries a witness. Three stripes, three silos, no join, no Who. Consider the store associate who signs for a direct-store delivery. The signature exists — on a clipboard, in an EDI transaction naming two companies — but no event a trace can query names the person. So the trace runs three days and four phone calls through everything except the one witness who was there.
That era is ending on a date that is not ours.
The two clocks — neither of them ours
GS1's Sunrise 2027 program expects retail point-of-sale to scan and process 2D barcodes by the end of December 2027. The date is real, it is GS1's, and its baseline is narrow: GTIN extraction at the lane. Sunrise puts nothing on anyone's pack; the brand does, if it chooses — lot and expiry included.
The second clock is softer. FSMA 204's January 2026 compliance date was proposed to move to July 2028, but that extension was never finalized as a rule. The 2028 date rests on an appropriations act directing FDA not to enforce, with further flexibilities under solicitation as of May 2026; the proposed extension and that solicitation are both in the Federal Register, while the non-enforcement direction is statute, not a notice. Treat 2028 as a floor that de-risks the investment, never as a gun to your head. If someone pitches you the FSMA deadline as your urgency, one search falsifies the pitch; we just ran it for you.
Take Sunrise as the clock and FSMA as the floor. What matters is not either date but what the grid makes possible.
What legibility means
The grid is not a denser stripe. A 2D barcode carries what the brand chooses to encode: lot, expiry, a serial number, a web link. The squares differ: a QR code carrying a GS1 Digital Link URI opens in an ordinary phone camera; a GS1 DataMatrix clears the lane but not, reliably, the phone. Which square prints is the brand's decision, made in the artwork cycle. And that Digital Link URI normalizes to the same GTIN key an EPCIS event record uses, so a lane scan and a dock scan land on the same product — down to the case when a serial or lot rides in the link — with no mapping table between them. The standard already gives you the join.
When the marks get richer and the lanes can read them, the supply chain becomes legible. Every scan is a potential event of record; every shelf, a data source. This is not a forecast about consumers scanning packs; nobody has evidence for that bet, including us. It runs entirely on scans at lanes, docks, and shelves by people and systems paid to be there.
Three facts about it are already on the public record. The return: McDonald's China and Cainiao reported +30% receiving and inventory efficiency from per-package RFID digital IDs ("One Box, One Code," 2024). The motive: Chipotle's nationwide RFID rollout, about 3,200 restaurants and some 330 product categories, described by the president of its software vendor Mojix as "driven by the compliance requirements of FSMA 204" (RFID Journal, 2023). The ambition: Sue Fangmann, US Supply Chain Services Director at McDonald's, in MIT Technology Review Insights research produced with GS1 US (2023): "create a golden digital thread of traceability." The return, the motive, and the ambition — none of it ours.
The lane's stripe answered one question: what is it? The grid, with a record behind it, can answer nearly everything: what, when, where, why, how. Which exposes the one question the standard behind it still cannot answer.
Who touched it?
The missing Who
Check this yourself; the specs are public. EPCIS 2.0, the GS1 standard for supply-chain event records, defines an event in five dimensions: what, when, where, why, how (§7.2.2). No performer is among them. The party fields it does have are organization-grain: a source or destination company, a GLN (§7.3.6.4; CBV 2.0 §8.7.1). The standard can answer a Company did a Process. It cannot answer this person, this agent, at this dock, at 6:14 a.m. There is no Who field to leave blank. The associate's signature lives on a clipboard because the record has no place to put it.
The gap was tolerable when every performer was an employee. It is not now, for three reasons.
First, the regulator's question is a performer-grain question with evidence attached: who received this, and how do you know? A record that answers at company grain is answering a different question.
Second, the performers are changing. Software agents already place orders, schedule freight, reconcile receipts; robots already move goods. A record grammar that cannot name a human performer certainly cannot name an agent.
Third, the standards world has just finished welding the company grain. In March 2026, schema.org v30.0 declared GS1's Organization equivalent to its own, with fifteen matching properties: the physical and digital vocabularies now agree on who a company is. That settles which Who is solved and leaves the worker-and-agent grain open.
The record must complete. Every event should carry two facts the standard omits: who touched it, the person or agent that observed the goods, and who says so, the account that stands behind the record. The standard's own extension mechanism permits exactly this: complete the record without breaking conformance. Never fork the standard; finish the sentence it started.
Verifiable without joining anything
Every incumbent in this market built a network that is authoritative because you joined it. That model answers at company grain, holds your evidence inside someone else's walls, and fails exactly when you need it: in a dispute, "our network says so" persuades no one on the other side.
A record of events should be verifiable whether or not you joined anything. Two properties make that real.
Conformance is provable, not asserted. Every record validates against GS1's official, pinned EPCIS 2.0 schemas, with the exact schema version provable by checksum. You can test this today with a real export and one curl: POST it to https://epcis.dev/validate, no account, no membership.
Identity is computed, never assigned. The identity of an event is the standard's own CBV 2.0 §8.9 hash of its normalized fields. When your supplier forwards you the receiving event, your copy and theirs are provably the same event; a copy altered anywhere is provably not. In a dispute, neither side asks an intermediary; either side recomputes. That is evidence because anyone can rerun the math, not because everyone subscribed to the same platform.
One record, two doors. epcis.dev is the open developer-and-agent door, where the record is written and proven — the validate endpoint above is its front step. visibility.cloud is the executive door, where questions get answered over the same record. Every answer it will ever sell is a view over the events the open door validates, which is why recomputability is structural, not audited.
And our own record, stated to your face: no customers, and no conformance attestation has ever been issued. Three doors answer by curl today — translate, validate, hash. Every open gap on our side is a named entry in the open P0 ledger. A manifesto argues what a thing is and why it must exist; the ledger says what is built. The separation is why you can trust either one.
The cycles you already own
The deadline is not the cost. The capital cycle is. You know your own refresh calendar. If you own lanes, count the POS refreshes between now and December 2027. If the count is one, that refresh is where this decision gets made, with money you were already going to spend. If it is zero, the decision has already been made — by default, and nobody signed it. If you own packs, count the artwork cycles the same way. Decide in a pure compliance frame and the squares still print: a lane that reads a record-grade mark with nowhere to put what it reads, or a pack that carries a link resolving to nothing. Waiting does not avoid the decision; it makes the default one, the wrong one, irreversibly, for a full cycle.
The alternative spends the same money: print the phone-readable square in the artwork cycle, land the lane capability in the refresh, and stand up a record layer underneath that keeps a witness in every event.
For fifty years the lane's mark was mute, the other stripes kept their silos, and "who touched it" was a question you answered with phone calls. The grid ends the muteness, the record supplies the join, and one question is left standing: who touched it? The company that can answer in writing, with evidence anyone can recompute, without asking anyone's permission, walks out of the regulator's room first.