One thesis: an identifier layer is cheap to write and expensive to keep true — the cost is a perpetual subscription to other people's revisions — so the decision artifact is not a feature list but a ledger of everything that drifts, and a demonstration that someone else is already pinned to all of it.
Every engineering org that touches barcodes eventually writes the function: strip the FNC1, walk the AIs, check the mod-10. It works, it ships, and it starts decaying the day it merges — not because the code is wrong but because the ground it encodes moves. The build-vs-buy question for this layer is routinely argued about the wrong quantity. The build is an engineer-quarter. The tax is forever.
The ledger — what you would have to track, exhaustively
This is the list. Its length is the argument.
| Normative artifact | What drifts | Cadence |
|---|---|---|
| GS1 Application Identifier table | new AIs, format changes, fixed/variable-length termination rules | annual GenSpecs revisions, plus interim releases |
| GS1 prefix and range tables | company-prefix allocations, MO ranges, restricted-circulation ranges | continuous |
| Check-digit and reference vectors | nothing — but your tests must prove that, per release | per revision |
| GS1 Digital Link URI grammar | syntax releases (1.6.0 ratified 2025-03), compression rules, key-qualifier orderings | per release |
| Conformant-resolver requirements | linkset behavior, description-file schema (1.2.0 ratified January 2026) | per release |
| VIN rules | 49 CFR 565 amendments; vPIC dataset versions | regulatory; dataset updates |
| UDI issuing-agency formats | three agencies' grammars, FDA formats-doc revisions | per agency, per revision |
| NDC / openFDA | segment layouts, daily dataset refreshes | daily data, occasional structure |
| ISBN ranges | range-message updates from the international agency | continuous |
| Carrier tracking grammars | undocumented; reverse-engineered consensus that silently shifts | unannounced |
| Per-source license texts | the terms behind every enrichment rail — the clause that changes without a changelog | unannounced |
Two rows deserve the review's attention. The AI table is not folklore; parsing correctness is table correctness, and a stale table mis-parses real payloads silently. And the last row is the one nobody budgets: a data source's license is an input that drifts like a schema, except its failure mode is legal exposure rather than a failed test.
What "pinned" buys, concretely
This property's answer to the ledger is the family's pins discipline: every normative artifact vendored with a sha256 digest, every data source carrying a manifest that records the license text's URL, retrieval date, and the sha256 of the license text itself. barcoding pins prints the full set — this is the one-page handout for the review meeting:
$ barcoding pins
gs1.ai-table sha256:a91f… GenSpecs-derived, rev 26.0
gs1.prefix-ranges sha256:44c2… 2026-07 snapshot
checkdigit.vectors sha256:07b9… reference vectors, all schemes
dl.grammar sha256:be11… DL URI syntax 1.6.0
vin.49cfr565 sha256:d803… transliteration + weights
sources/usda-fdc sha256:9e5a… license: public-domain (CC0), fetched 2026-07-31
sources/openfda sha256:1c77… license: public-domain (CC0), fetched 2026-07-31
sources/openfoodfacts sha256:f2d4… license: share-alike-odbl, fetched 2026-07-31Pins change only by journaled human ruling — never by a dependency bump, never by a scraper run. For an auditor, that sentence converts "we keep our tables current" from an assurance into a checkable property: which digest, changed when, ruled by whom, against which upstream revision. An upstream license change is a failed pin that stops the build — not a silent drift discovered during diligence. The same digests gate the round-trip law (resolve(generate(x)) === x across the golden corpus), so table drift cannot hide behind passing unit tests; and because every door re-dispatches through one core, the pins you print are the pins every surface is running.
The blocker's question, answered before it is asked
Every architecture review has the seat that blocks on dependency risk: what happens if this vendor disappears? The answer here is structural, not contractual — the family idiom is an open-source engine with published pins, the same posture epcis.dev takes one layer up with its vendored GS1 schemas and PINS.json provenance. The escape hatch is a fork that keeps passing its own gates, which is the strongest form of the answer: you are not buying secret code, you are buying the maintained truth of the tables — the part a fork inherits only for a moment, and the part the ledger above prices.
Sizing it honestly
What an engineer-quarter buys, built in-house: a parser for the schemes you have met so far, tables current as of the sprint they were transcribed, no reference vectors, no license manifests, and a standing obligation — unowned by any roadmap — to track every row of the ledger above, forever, with failure modes that are silent until they are expensive. What a dependency line buys: the same verbs, pinned and digest-published, with the drift-tracking owned by the party whose entire product is the drift-tracking.
The identifier layer is the rare case where the buy argument is not about capability at all — you could absolutely build it — but about who should hold a perpetual subscription to other people's revisions. Run npx barcoding.dev pins and take the output to the review; that one page is the ledger, priced. If the review wants the deeper conversation — embedding the layer in your own product, the licensing posture per enrichment rail — that conversation starts here.
Keys open the network half of the verb set. Get an API key — say what arrives at your door, and the provisioning order follows the list.
We answer in writing. We take at most five conversations a month, only when you ask for one, and only after you already have the written read.