barcoding.dev · by visibility.cloud

the explainer arc, told from the scanner's side

The blog.

One thesis per post, a proof artifact in every one — a worked check digit, a validator run, a real payload — and a named reader. No listicles.

  • 2026-07-31

    A door, not a second path: the MCP surface

    Every MCP tool re-dispatches through the same core the CLI calls — same verbs, same pinned tables, same typed errors, byte-identical payloads — because a second implementation is a second set of bugs wearing a trust costume. Tool list equals verb list, mechanically enforced.

    written for: ED-3 — the coding-class agent inside the platform engineer's session, the most likely first arrival at this property; the engineer reads over its shoulder

  • 2026-07-31

    A vehicle crosses the country: the full-family trace

    One VIN exercises the entire stack — scan the door jamb for identity, book transport with custody events whose who is the attested driver and whose capturedBy is the carrier account, and watch escrow release on the delivery-confirmed event. Vehicle logistics is the family's most complete worked showcase, and the pattern generalizes to any high-value serialized unit.

    written for: VC-7 — the Director of Solutions / Client Onboarding at a 3PL, where traceability clauses win competitive bids

  • 2026-07-31

    Agentic commerce built the rails and forgot the reference layer

    The 2025–26 agent-commerce wave — ACP, UCP, AP2, A2A, the settlement rails — is building transaction pipes and merchant feeds while the neutral "what is this GTIN?" reference layer stays empty. MCP wrappers over unlicensed aggregators are the entire field, and a reference layer is exactly the thing agents cannot bootstrap for themselves.

    written for: ED-1 — the VP Engineering / CTO reading the agent-commerce wave as a platform bet; the self-principal agent is the second reader

  • 2026-07-31

    Anyone may run a GS1-conformant resolver — the standard says so

    The GS1-Conformant Resolver standard 1.2.0, ratified January 2026, is royalty-free under the GS1 IP Policy and ownership-agnostic — nothing restricts resolver operation to GTIN owners. The real constraint is not permission. It is what lawfully populates the links.

    written for: ED-1 — the VP Engineering / CTO running diligence on whether a resolver layer is even legal to build on; B2D spec-citation deep dive

  • 2026-07-31

    GS1 Application Identifiers: the grammar inside the symbol

    AIs are the typed field system of the physical world — (01) GTIN, (10) lot, (17) expiry, (21) serial, (00) SSCC — and an FNC1-delimited element string is a binary wire format with parsing rules, not "text in a barcode." Parsed here byte by byte, from the AIM prefix to the last variable-length field.

    written for: ED-4 — the self-principal integration-class agent (AC-2 × ED-4); human twin, the ED-1 integration engineer who owns the parsing layer; B2A/B2D deep reference

  • 2026-07-31

    bridge: from SKU to GTIN candidates, with the evidence attached

    For the systems that carry no GTIN at all — small-business accounting, restaurant POS, parcel labels — candidate GTIN resolution with confidence and evidence, never a silent best guess, is the entire product. The bridge contract, the evidence object, and why exit code 1 is a feature.

    written for: VC-3 — the multi-unit QSR / fast-casual org (the integration-class agent deputized in the supplier-onboarding workflow); B2A2B, SPEC register

  • 2026-07-31

    Camera to event: the browser scan demo, explained

    A phone browser goes from camera frame to validated EPCIS event in four visible steps — decode, resolve, enrich, emit — and the demo publishes its own network trace, because a pipeline you can inspect is the honesty posture applied to scanning. What BarcodeDetector actually covers, where WASM fills in, and what each step's contract is.

    written for: ED-3 — the in-house supply-chain platform team (the platform / staff engineer who evaluates by running, never by taking a meeting); B2D motion

  • 2026-07-31

    Your scan SDK captures everything and answers nothing

    Capture vendors monetize the decode — SDK seats, shelf cameras — while the question the scan exists to ask still requires someone else's data. Capture and answer are different products, and conflating them is how deployments ship without a data layer. A scope-of-work diff for the bid that closes the gap.

    written for: ED-2 — the RFID / scanning systems-integrator practice (the sales engineer who must put a data-layer answer in a proposal); B2D motion

  • 2026-07-31

    GS1 Digital Link, explained from the URI down

    A Digital Link URI is the same AI map as an element string, spelled as an HTTP path — /01/{gtin}/10/{lot}/21/{serial} — which is what makes a barcode web-resolvable without making the web its master. The grammar, the round trip, and what resolution adds.

    written for: ED-3 — the platform / staff engineer who needs the actual grammar, not the marketing gloss; B2D evergreen reference

  • 2026-07-31

    Don't build the identifier layer: the maintenance-tax ledger

    The true cost of an in-house barcode layer is not the parser but the forever-tax — AI-table revisions, prefix-range drift, Digital Link grammar updates, per-source license watch. A pinned, versioned dependency with published sha256 provenance is the artifact that wins the architecture review.

    written for: ED-1 — the VP Engineering / CTO facing build-vs-buy on a pinned-spec surface; the ED-3 Engineering Manager defending the decision to an architecture review is the second reader

  • 2026-07-31

    Driver's licenses: parse, verify, never store

    AAMVA PDF417 payloads are the one scheme where the law, not the license file, sets the rule — state statutes criminalize retention beyond age and authenticity checks. The registry row carries a hard no_retention flag, and the enrich verb refuses by design. This post is the refusal, documented for your security review.

    written for: ED-3 — the security / architecture reviewer, the blocker persona, served directly: this is the questionnaire answer written before the questionnaire is sent; B2D trust content

  • 2026-07-31

    Element string or Digital Link URI: the encoding decision Sunrise leaves to you

    A 2D symbol can carry the same GTIN+lot+expiry as an FNC1 element string or as a GS1 Digital Link URI. One resolves in a consumer's phone, one does not — and the choice belongs to the GTIN owner, not to the Sunrise 2027 programme. The decision matrix, worked with generate.

    written for: VC-1 — the enterprise CPG brand-owner org (the VP / Senior Director of Supply-Chain Traceability running the programme office); B2B decision brief through the dev door

  • 2026-07-31

    Every 2D scan is a potential EPCIS event — and the standard has nowhere to put who scanned

    The moment a serialized 2D payload is written down as an event, EPCIS 2.0 §7.2.2's five dimensions record everything except the performer. That absence is structural — there is no field to leave blank — and the section numbers proving it are all public.

    written for: ED-3 — the in-house supply-chain platform team (the platform/staff engineer deciding what a scan becomes downstream); B2D wedge

  • 2026-07-31

    From scan to conformant event: constructing the ObjectEvent

    A parsed 2D payload deterministically populates an EPCIS 2.0 ObjectEvent — epcList or quantityList from the AIs, time, step, and disposition from scanning context — and the event is not done until it validates against the pinned official schema and its CBV §8.9 hash matches the reference vectors. The field-by-field mapping, published.

    written for: ED-3 — the in-house supply-chain platform team (the platform / staff engineer wiring scan capture into an event repository); B2D worked example

  • 2026-07-31

    GLN: the identifier that joins all three layers

    The Global Location Number names the party or place in EPCIS source and destination lists, in an X12 856's N1 loop under qualifier UL, and as Peppol endpoint scheme 0088 — one identifier, three wire formats, and the only cross-layer join the record gets for free. Also — verified across the commercial API landscape — almost nobody carries it.

    written for: ED-1 — the supply-chain ISV engineering org (the integration engineer wiring events to transactions across N systems)

  • 2026-07-31

    GTIN: the four lengths, one identity

    GTIN-8, -12, -13 and -14 are one identifier at four encodings. Canonical form is the zero-padded GTIN-14, the check digit is one public mod-10 algorithm anchored at the right, and most of what your bug tracker files as invalid barcode is actually a canonicalization bug.

    written for: ED-1 — the supply-chain ISV engineering org (the integration engineer who owns the parsing layer and a backlog of barcode mismatch tickets)

  • 2026-07-31

    hierarchy: each, inner, case, pallet — and inference that says it is inferring

    Packaging-level relationships come licensed or inferred — the GTIN-14 indicator digit and ITF-14 evidence support inference, GDSN standing supports the licensed graph — and an API that does not label which is which is manufacturing certainty it does not have. One GTIN family resolved to a packaging graph with per-edge provenance.

    written for: VC-7 — the 3PL / cold-chain custody org (the WMS integration manager maintaining N shippers × N formats); B2D worked example

  • 2026-07-31

    Identity questions come first: why an agent's first family touch is a barcode

    Before an agent can capture an event or reconcile a transaction it must answer — what is this, is it real, whose is it. The identifier layer is the family's natural first-touch surface for self-principal agents, its free zone is sized accordingly, and the price of everything gated is stated before the first call.

    written for: ED-4 — the self-principal procurement-class agent, the only class that transacts; needs the ceiling's buying power stated up front

  • 2026-07-31

    An ISBN is a GTIN: what Bookland means for a universal resolver

    ISBN-13 is a valid GTIN-13 under the 978/979 prefixes, which means a universal resolver needs no "books mode" — it needs prefix routing. The ISBN row is the cleanest demonstration that scheme detection is a table, not a heuristic, and its enrichment column is the cleanest demonstration of what honest license posture looks like.

    written for: ED-4 — the self-principal integration-class agent (AC-2 × ED-4), whose value is a machine-readable result, not a narrative; B2A reference content

  • 2026-07-31

    Linksets: the resolver answer is a list of doors, and every door carries its provenance

    RFC 9264 linksets turn "where does this barcode go" into typed navigation. A linkset whose every link carries source, license class, and freshness is a combination no resolver in the field ships — and it is the difference between a list of URLs and an answer an agent can act on.

    written for: ED-4 — the self-principal verifier-class agent (AC-3 × ED-4), which needs deterministic answers and nothing narrative, and most often arrives with presence absent; B2A machine reference

  • 2026-07-31

    NDC: the identifier with no check digit, and what validation means without one

    The National Drug Code is ten digits in three segments and carries no check digit at all — so "valid" can only ever mean structurally parseable plus present in the registry. The NDC is the scheme that forces a resolver to be honest about validation tiers, and the honesty generalizes.

    written for: ED-1 — the Product Manager, Standards & Compliance at a pharma-serving ISV, who must state exactly what "validated" means in a customer-facing claim; B2D reference content

  • 2026-07-31

    No bare values: the per-attribute provenance envelope

    Every attribute an enrich response carries travels inside an envelope — value, source record, dataset version, sha256, license class, fetched-at, confidence — because a product record is a mosaic of licenses, and a license that does not travel with its value is a lawsuit deferred. The schema, the closed enum, and the enforcement rule.

    written for: ED-4 — the self-principal verifier-class agent (deterministic answers, nothing narrative); B2A — with the ED-3 security reviewer as the human twin

  • 2026-07-31

    One resolver, every scheme: the universal generalization

    Scheme detection is registry data — grammar, check digit, canonicalization, pinned per scheme — so a single well-known-described door serves a GTIN, a VIN, an ISBN, a UDI, an NDC, and a tracking number with one linkset contract: conformant where a standard exists, explicit where none does.

    written for: ED-4 — the self-principal integration-class agent (AC-2 × ED-4); human twin, the ED-3 platform / staff engineer deciding whether one identifier layer can really replace five; B2A/B2D architecture thesis

  • 2026-07-31

    One scan, three layers: identity, event, transaction

    A single QR on a case answers three different questions at three layers — which thing (barcoding.dev), what happened and who performed it (epcis.dev + id.org.ai), against which PO and ASN (transactions.dev). The joins are spec-sanctioned core fields, not glue, and the field that offers all three layers together is — as of our last search — empty.

    written for: VC-3 — the VP of Supply Chain & Distribution at a multi-unit QSR/fast-casual operator, RFID rollout funded and in flight, no data layer attached; B2B thesis through the dark door

  • 2026-07-31

    Pharma already lives in 2027: DSCSA as the serialization precedent

    Every US prescription-drug package already carries a GS1 DataMatrix with GTIN, serial, lot, and expiry under DSCSA — the one US vertical where serialized 2D is universal at the unit level. Parsed live, with the NDC-inside-GTIN embedding shown, and the lessons a cross-vertical CTO can actually reuse.

    written for: ED-1 — the supply-chain ISV / traceability-vendor engineering org (the VP Engineering / CTO mining an adjacent vertical for lessons); B2D precedent thesis

  • 2026-07-31

    QR or GS1 DataMatrix? One question decides it: who scans

    GS1 DataMatrix clears the POS lane; QR is what a consumer's phone camera reliably decodes. Symbology choice is an audience choice, it belongs to the GTIN owner, and the same GTIN and AIs render as either symbol — two marks, one identity, proven by round-trip.

    written for: VC-1 — the enterprise CPG brand-owner supply-chain org (the VP / Senior Director of Supply-Chain Traceability — the seat that decides the mark)

  • 2026-07-31

    Resolved through brand doors, never over them

    Where a brand publishes its own Digital Link redirect, a neutral resolver's duty is to carry that link in the linkset and resolve through it — because allocation is homed with the issuer, and a resolver that replaces the brand's door is just another walled network with better manners.

    written for: VC-1 — the enterprise CPG brand-owner org (the Director of Digital / DTC & Consumer Insights); B2B trust brief through the dev door

  • 2026-07-31

    Why an agent can call resolve without asking permission

    Pure, local, readOnlyHint-true verbs with complete tool descriptions clear agent auto-approval frameworks and fire inside already-granted authority — so identity questions get answered with no human in the loop, by design rather than by workaround. The gate lands on durable state and licensed data, never on compute.

    written for: ED-4 — the self-principal verifier-class agent, most likely to arrive with presence absent, for whom the fail-closed rule binds hardest

  • 2026-07-31

    Scan the door jamb: VIN to vehicle, listing, and every other door

    A door-jamb Code 39 scan resolves through the whole pipeline — validate, decode, linkset — with a typed failure at every step that can fail. The worked transcript, from framing strip and 49 CFR 565.15 arithmetic to the RFC 9264 linkset of live doors — history, recalls, sticker, valuation, transport.

    written for: ED-2 — the RFID / scanning systems-integrator practice (the field deployment engineer commissioning a site); B2D worked example

  • 2026-07-31

    See your 2D mark today: generating a Digital Link QR from a GTIN

    A brand deciding its Sunrise mark can render its own GTIN as a GS1 Digital Link QR in one command — before any agreement, account, or vendor exists — because constructing the URI and rendering the symbol are royalty-free under GS1's own IP policy. One command, three outputs, and an honest list of what it does not settle.

    written for: VC-2 — the co-manufactured mid-market CPG brand (the VP of Operations & Supply Chain — one seat, everything — who buys outcomes and refuses projects); B2B on-ramp through the dev door

  • 2026-07-31

    Serial vs lot: what SGTIN and LGTIN actually mean

    "Serialized" is a grain decision. GTIN+serial names this unit; GTIN+lot names this batch; and the choice decides forever which questions your event history can answer, at materially different marking cost. The same physical case, eventized both ways, with the recall-scope difference run as a query.

    written for: VC-6 — the food-processor / co-manufacturer plant (the Plant IT / MES integration lead who buys capture without a UI); B2D motion

  • 2026-07-31

    SSCC: the logistic unit is the unit of custody

    The SSCC is the only identifier that names this pallet — not the product class, not the shipment abstraction, the physical unit that crosses your dock. That is why it parents every EPCIS AggregationEvent, why the ASN hangs on it, and why the parcel networks throwing it away severs product identity at the label.

    written for: VC-7 — the 3PL and cold-chain custody org (the WMS Integration Manager who maintains N shippers times N formats and evaluates by running a real file)

  • 2026-07-31

    Sunrise 2027, stated exactly: what GS1's program requires, and the six things it doesn't

    GS1's own program expects retail POS to scan and process 2D barcodes by end of December 2027, baseline GTIN extraction. Almost everything else said about it in vendor copy fails a GS1-literate reader's check. The six standing corrections, each paired with its primary source.

    written for: VC-4 — the grocery retail store-systems org (the VP of Store Systems / Retail Technology who owns the lanes and the December-2027 date)

  • 2026-07-31

    A symbology is a pipe, not a payload: 1D, 2D, and what each square can carry

    UPC-A carries twelve digits and nothing else; a 2D symbol carries a full AI payload. The symbology registry and the identifier registry are orthogonal, and confusing the pipe with the payload is the root error in every barcode program. Worked here with one GTIN through three carriers.

    written for: ED-3 — the in-house supply-chain platform team (the platform/staff engineer handed a traceability mandate); B2D evaluation-first motion

  • 2026-07-31

    The 2026 scanning stack: who decodes what, from lane firmware to a browser tab

    Dedicated scanners, phone cameras, browser APIs, and fixed cameras all emit the same payload bytes now — decoding is commoditized. The differentiated question moved one layer up: what happens the millisecond after the decode. The capability matrix, and where the answer layer went missing.

    written for: VC-3 — the multi-unit QSR / fast-casual org (the Director of Restaurant Technology, who owns the handhelds and inherits every integration); B2B landscape brief through the dark door

  • 2026-07-31

    The ASN knows everything about the shipment except who shipped it

    An EDI 856's HL tree maps cleanly onto EPCIS 2.0 — SSCC MAN values to AggregationEvent parents, LIN GTINs to EPC lists, BSN02 to the desadv reference, N1 GLNs to source and destination — and after the whole join lands, there is still no field on either side of the wire that names the person or agent who performed the handling.

    written for: ED-1 — the Integration Engineer at a supply-chain ISV; a decade of vendor EDI and XML; evaluates by running, never by meeting

  • 2026-07-31

    The case and the pallet: GS1-128, ITF-14, and generating SSCC labels

    Logistics marking is its own discipline — ITF-14 for the corrugate-printable case GTIN, GS1-128 for AI-bearing labels, SSCC allocation for the logistic unit — and the label is the first artifact where a generation error becomes physical. A complete pallet label generated, decomposed, and round-tripped before the print run.

    written for: VC-6 — the food-processor / co-manufacturer plant (the Plant IT / MES integration lead wiring marking into the line); B2D worked guide

  • 2026-07-31

    The check digit is public. The answer layer never was.

    Every validation algorithm a barcode system needs is public regulation or a royalty-free standard — worked here, digit by digit, for a VIN and an EAN-13. The layer above it is what has always been walled. That split is the architecture of barcoding.dev.

    written for: ED-1 — the supply-chain ISV engineering org (the staff engineer who owns the parsing layer); B2D embed motion

  • 2026-07-31

    Why there is no honest GTIN cache: the GS1 licensing wall, clause by clause

    Every GS1 data rail short of a negotiated agreement licenses display-and-verify only — the anti-caching clause, the internal-use-only clause, the competing-product clause, and the per-brand-owner consent regime, quoted verbatim with links to the agreements. What that means for anyone selling you a cached GTIN database, and what stays genuinely open.

    written for: ED-1 — the supply-chain ISV engineering org (the VP Engineering / CTO doing build-vs-buy diligence); B2D spec-citation deep dive

  • 2026-07-31

    The API economy is SKU-native: the GTIN gap, measured

    Across 37 verified commercial connector surfaces, GS1 identity lives only at the edges — the ERP top end, the regulated verticals, the standards rails — and is optional, unvalidated free text in the middle. Zero commercial APIs carry SSCC; two carry GLN. Product identity must be bridged into the transaction layer, never assumed.

    written for: ED-3 — the Engineering Manager / Director of Platform, defending buy-over-build to an architecture review with evidence artifacts

  • 2026-07-31

    The Meaning Behind the Stripes

    The manifesto. A barcode was never the stripes — it was always an address into meaning, just a short one. Sunrise 2027 makes the address long enough to hold a biography, and the record it feeds still has no line for who was there.

    written for: all eleven — the structural gap every ICP shares (canon §0.10); the founding read for any arrival, business or developer

  • 2026-07-31

    resolve(generate(x)) === x: generation and resolution are one function, tested

    The write side and the read side of an identifier layer must be exact inverses — every generated element string, Digital Link URI, and rendered symbol must resolve back to the identical canonical identity — and that law is a CI gate over a published golden corpus, not a design preference. The harness, the corpus split, and how to check the claim yourself.

    written for: ED-4 — the arriving self-principal agent (AC-1 coding class — judges the layer on a command's exit code); B2A motion

  • 2026-07-31

    The 1D UPC is a checkout token — the brand learns nothing from its own barcode

    A UPC is scanned millions of times by other people's point-of-sale systems, and the mark's owner is the only party it carries no signal for. The information budget of 12 digits versus a decoded 2D payload, computed — and the honest sentence about what nobody can promise you yet.

    written for: VC-2 — the co-manufactured mid-market CPG brand (the Head of Brand / DTC and Consumer Insights, who has never had a line to the consumer of a unit)

  • 2026-07-31

    The aggregators never answer the upstream question

    The big barcode-lookup APIs share one silence — no per-attribute provenance, no license metadata, redistribution-hostile terms. An enrichment layer that cannot say where an attribute came from cannot say whether you may use it, and that is the question an RFP should ask first.

    written for: ED-1 — the supply-chain ISV org (the Product Manager, Standards & Compliance, who holds the RFP checkbox); B2D competitive thesis, respectful and linked

  • 2026-07-31

    Tracking numbers are a scheme family too: 1Z, IMpb, and the SSCC nobody keeps

    Carrier tracking formats are proprietary grammars doing a logistic-unit identifier's job — and the parcel APIs that mint them are SKU-poor and GS1-blind. Product identity dies at the label, and the registry treats carrier formats as first-class scheme rows so the death is at least visible.

    written for: ED-3 — the platform / staff engineer who owns a shipping stack and has watched product identity vanish the moment a label prints; B2D connector-demand content

  • 2026-07-31

    The two grains of Who: attested observer vs warrantor account

    who is the observer that performed the scan — human, agent, or embodied agent. capturedBy is the account that stands behind the record. An agent may observe under an account it does not own, and collapsing the two destroys exactly the evidence a custody record exists to carry. Worked twice at a receiving dock.

    written for: VC-7 — the 3PL and cold-chain custody org (the VP of Operations / Site General Manager whose docks run on temporary and agency labour)

  • 2026-07-31

    UDI: the FDA already runs a multi-scheme resolver, and it proves the architecture

    AccessGUDID accepts identifiers from three accredited issuing agencies — GS1, HIBCC, ICCBBA — detects the grammar, splits device identifier from production identifiers, and serves the answer from public-domain data. A working, government-scale precedent for a one-endpoint, every-scheme resolver.

    written for: ED-1 — the VP Engineering / CTO at a med-device-serving ISV, running build-vs-buy diligence on an identifier layer; B2D architecture-by-precedent

  • 2026-07-31

    UPC to nutrition facts, license-clean: the flagship chain

    The same label data the syndication networks gate arrives in the public domain through USDA FoodData Central — CC0, GTIN-keyed. The flagship enrichment chain runs entirely on rails like that, and every attribute in the answer carries its own source, license class and fetch time, so an agent can filter by what it is allowed to do.

    written for: the assistant-class agent deputized by a VC-2 mid-market CPG brand ops seat (no engineering staff; acting inside already-granted scope)

  • 2026-07-31

    VIN: the 17 characters the US government fully published

    VIN structure and check digit are federal regulation — 49 CFR 565 — and NHTSA vPIC decodes about 140 attributes in the public domain. The best-documented identifier in the registry, worked in full: transliteration, weights, mod-11, and the typed failure surface a caller can branch on.

    written for: ED-4 — the arriving self-principal agent, coding-class (judges this page by whether the command exits 0); B2A, with the human engineer reading over its shoulder

  • 2026-07-31

    What did I just scan? Payload identification from the first three bytes

    A scanner hands you bytes, not meaning. The AIM symbology identifier, the FNC1 position, Code-39 framing, and URI shape classify any payload deterministically — worked here on ten raw payloads, the way resolve does it, from a pinned decision table rather than folklore.

    written for: ED-2 — the RFID / scanning systems-integrator practice (the field deployment engineer commissioning a site under time pressure); B2D integration motion

  • 2026-07-31

    When the observer is a robot: the who that isn't human

    Autonomous MHE and scan tunnels are already the performing observer at custody events, and a record whose only party field is organisation-grain cannot even say that, let alone which unit. The embodied agent is the cleanest proof that the Who dimension is structurally missing, not merely under-filled.

    written for: VC-7 — the verifier-class agent operating over an embodied observer (robot / autonomous MHE), provisioned by a 3PL ops seat; the human twin is the VP of Operations reading over its shoulder

  • 2026-07-31

    Zebra proved the demand, then turned the lights off

    Zebra's Barcode Intelligence — "instant barcode data enrichment using a single API," in Zebra's own words — validated this exact category, then was discontinued entire on December 4, 2023, leaving the largest deployed scanner base in the industry with no first-party answer to "what did I just scan?" The public record, quoted, and the design lesson it carries.

    written for: ED-2 — the RFID / scanning systems-integrator practice (the practice lead who loses the "where does the data go" question on every deal); B2D motion