← The intake standard
MOD-01 · Supplier requirements · Marking

One part, one code, one identity

Requirement v0.1

Autonomous receiving cannot interpret a handwritten label. So Moduloa puts one uniform requirement on every supplier whose parts flow through a hub: everything arrives carrying a single 2D code holding a single globally unique identifier that resolves to supplier, part, revision, and lot or serial. Every part identified equally — whether it comes from a catalogue giant or a two-person machine shop. This page is the requirement, its reasoning, and the zero-cost path for the smallest supplier.

The precedents

This problem has been solved before — four times

Uniform identification across thousands of unequal suppliers is not a new problem. Four industries solved it, each teaching one lesson this requirement copies.

US defense · MIL-STD-130 The DoD's IUID mandates the carrier, the syntax, the print quality, and the uniqueness rule — but stays agnostic on who issues the identifier. Copy exactly that: fix the mechanics, never crown one issuer.
Medical devices · UDI Every device on the market carries a type-level identifier plus production data scaled by risk class — lot for the simple, serial for the implanted. Copy the risk-based split: serialize the critical, lot-track the rest.
Automotive · AIAG B-17, Odette GTL Data Matrix as the direct-marking standard; and even when parts are only lot-tracked, every package carries a globally unique license plate. Copy the license-plate idea: identity attaches to what receiving actually scans.
The umbrella · ISO/IEC 15459 Nearly every serious scheme guarantees global uniqueness the same way: issuing agency + company + the company's own reference. Requiring conformance to the umbrella — not to one scheme — is what makes IDs from a thousand suppliers collision-free in one database.

Today's EMS baseline is a Code 128 logistics label with part number, quantity, and lot — what the largest contract manufacturers require on incoming goods right now. This requirement is deliberately one step ahead of that baseline, and cheaply: a single 2D code whose content is a URL-capable identity, which is precisely the envelope the EU's Digital Product Passport standards fixed this month — the identifier and carrier standards were cited in the Official Journal on 15 July 2026, and both accepted schemes below sit inside them. Parts marked to this requirement are DPP-nodes-in-waiting for the 2027–2030 category mandates.

The requirement

Five rules

M-01 · The carrier Every delivered unit — or the smallest packaging unit for lot-tracked parts — carries one Data Matrix ECC 200 or QR code. Label or direct mark, the supplier's choice; direct marking only where the part's own spec demands permanence. Verified print quality (grade C labels, grade B direct marks). Human-readable PN and lot/serial beside the symbol. A 1D barcode may appear in addition, never instead. RFID is welcome, never required.
M-02 · The identifier — three accepted schemes Preferred: a GS1 Digital Link URI on the supplier's domain (GTIN plus lot or serial in the path). Accepted: an IEC 61406 Identification Link — one globally unique https URL, self-issued, costing the supplier nothing but a domain. Fallback: Moduloa issues the identity — labels pre-generated per handover line on Moduloa's own domain and prefix, printed on any printer or shipped pre-printed. Transitional until v1.0: existing automotive/EMS-style Data Matrix labels with standard data identifiers are read as-is.
M-03 · The minimum data set One scan resolves: supplier identity · part number as ordered · revision · lot (always) · serial (when M-04 demands it). Quantity, PO, and dates stay on the logistics label — identity codes identify; they do not manifest.
M-04 · Serialization follows the BOM, not the supplier The intake BOM's serialized flag is authoritative. Flag set — every physical unit carries its own code with a never-reused serial. Flag not set — lot-level identity, with every package carrying a unique license-plate ID so autonomous receiving can count and bind unambiguously. The customer decides what is critical; the requirement makes it stick.
M-05 · Rejection at receiving — autonomous, named, no interpretation Nonconforming: no carrier · symbol fails to decode · identifier not globally unique under an accepted scheme (reuse included) · identifier does not resolve to the expected supplier, part, and revision · scan contradicts the ASN. Disposition: quarantine, automatic supplier notification, relabel by the supplier or by Moduloa for a fee — which enrolls the material in the fallback scheme. The receiving dock runs on the same principle as the intake: a machine report, never a judgment call.
Worked example — three suppliers, one requirement
SensorCo GmbH · EX-120 (serialized: critical) QR per unit · https://id.sensorco.example/01/04012345678901/21/SN004217 — GS1 Digital Link, per-unit serial, scan resolves supplier + PN + rev D + serial.
Verft Mekanikk AS · EX-110 (lot-tracked) Data Matrix per box · https://verftmek.example/id/vm-110-b/L2607 — IEC 61406 self-issued link, lot in the path, zero licensing cost, frame-and-triangle marked.
A two-person shop · any part Downloads Moduloa-generated labels from the supplier portal — identity issued on Moduloa's domain under the buyer-assigned-component-ID model, printed on a €300 thermal printer or shipped pre-printed. No membership, no fees, no excuse.

Total capex for the smallest supplier: a label printer and a template. Marginal cost per label: cents. There is no equipment argument against uniform identity.

Our side of it

The requirement binds us too

What we demand of suppliers at the dock, we demand of ourselves on the line. Identity is not only received — it is created, at every step of the build.

M-06 · Every closed sub-BOM mints an identity When an operation completes an assembly node — a sub-BOM closes — the semi-finished unit gets its own code before it moves on, and the closure scan binds the identities it consumed. The final operation mints the master unit ID on the product itself. The result is an as-built tree of physical identities that mirrors the intake BOM's plan-tree, unit by unit, level by level.
M-07 · The product carries a customer-facing QR The master unit ID ships on the product as a scannable QR. It resolves — behind customer sign-in — to that unit's full record. Distribution and access models are future work; the commitment to the code on the product is not.
Marking as a humanoid task

On the line, direct marking is a natural task for the flexible layer: a humanoid with a laser engraver marks the closed assembly where a fixed station would need dedicated tooling per product — laser Data Matrix marking is already the automotive DPM standard, and the verification gear to grade it is commodity. It is also, honestly, a hypothesis stacked on a hypothesis: engraving works reliably on metals and many plastics, not on every cosmetic surface or tiny part, so labels remain the fallback the requirement always accepts — and humanoid marking earns its place the same way the rest of the humanoid layer does: measured, on the line, against the alternative.

Why it matters here

Identity is what the OS stands on

Every autonomous step downstream leans on this requirement. Receiving binds arriving material to intake BOM lines by scan, and checks it against the acceptance criteria with no human interpretation. The execution trace records which lot and serial went into which unit because the parts could say who they were. The shipped batch carries its history because identity never broke between the supplier's dock and the customer's door. And when a supplier confirms a part through the confirmation protocol, the thing they attest and the thing that later arrives are provably the same thing. Uniform identity is not an administrative preference — it is the load-bearing wall of a factory with no one standing at the receiving desk.

The honest limits

What has to be proven

A v0.1 draft, published to be corrected. The named risks: suppliers with entrenched label systems may resist a second code until the transitional lane expires — the bet is that the lane plus the zero-cost fallback removes every honest objection. The Moduloa resolver that makes fallback identities and scan-to-line binding real does not exist yet — this page is its specification. And enforcement is only as strong as the chargeback discipline behind rule M-05, which is a policy commitment in the same spirit as the commercial terms: easy to publish today, tested the first time it is expensive.

Sources

Where this requirement came from

← The intake standard The OS, played through →
Marking requirement v0.1 · Draft for review · Corrections welcome →