Skip to content
Crosswalker
🚧 Early alpha — building the foundation. See the roadmap →

Release change is re-attestation — Challenge 43 synthesis

Created Updated

1. Thirty seconds

Section titled “1. Thirty seconds”

The evidence inverted the premise. Challenge 43 assumed a source release usually renames concepts and strands the work attached to them. The measured ordinary releases did the opposite: every old identifier survived while content and classifications changed underneath those stable identifiers.

That changes the product ordering:

QuestionVerdict
What Crosswalker protects firstThe attestation (a human-approved claim that one thing supports, satisfies, or maps to another), not the vault address or note body.
Primary problemRe-attestation. Detect when the subject a human approved has changed, then stop the claim from counting as valid until it is reviewed again.
Derived problemDiff-and-migrate. Needed when identity genuinely changes through rename, split, merge, withdrawal, or replacement.
Durable before-stateOn the attestation as the reviewed subject identity and content fingerprint: reviewed_against: { curie, cid }.
Concept history in v0.1None. Tier 2 stays rebuildable; an import’s identity-level change set belongs in the already-planned Execution Record.
Lineage modelA version transition is a crosswalk between two release ontologies. Add superseded_by; do not build previous_ids.

The failure this ordering prevents is a green coverage report over claims whose subjects changed after approval. With an auditor as the reader, that is the most consequential form of Crosswalker’s recurring worst failure class: a silent wrong answer presented as current.

2. The measured release evidence

Section titled “2. The measured release evidence”

The direct and reconstructable pairs show that identifier survival and semantic stability are different variables.

Release pairIdentifier survivalWhat changed under surviving identitiesSplit / merge result
MITRE ATT&CK Enterprise 15.1 → 16.11,584 / 1,584 (100%)68 / 1,584 (4.3%) had material primary-description drift; MITRE classified 376 / 1,584 (23.7%) surviving objects as changed; 98 / 637 (15.4%) surviving techniques changed platform and/or data-source membership0 observed
CIS Controls 8.1 → 8.1.2171 / 171 (100%)11 / 171 (6.4%) had material prose drift; 4 / 171 (2.3%) changed classification0 observed
CIS Controls 8.0 → 8.1171 / 171 (100%)35 / 171 (20.5%) had material prose drift; 88 / 171 (51.5%) changed asset class and/or security function0 observed
NIST SP 800-53 Rev. 4 Appendix J → Rev. 5Structural-transition subset26 old privacy controls produced 54 lineage edges to 45 targets; 8 targets received material from multiple old controls15 / 26 (57.7%) old controls split across multiple destinations

Sources and methods are preserved in deliverable A § Distribution first.

Two regimes emerge:

  1. Ordinary release: identifiers survive, but prose, metadata, relations, or classifications drift. Nothing breaks visibly. That is the danger.
  2. Structural transition: one-to-one identity fails. Splits and merges become dominant enough that no flat alias field can represent the change honestly.

Splits were absent in the ordinary ATT&CK and CIS pairs. They were the majority shape in NIST Appendix J. Split frequency is therefore a property of the release regime, not a global constant.

3. Verdict 1 — re-attestation first

Section titled “3. Verdict 1 — re-attestation first”

An attestation is the reviewable claim. An evidence junction says that an artifact supports a concept; a crosswalk assertion says that one concept maps to another. Both are attestations because a person or producer asserts a relation whose validity can change when either endpoint changes.

The shipped substrate already preserves everything except the claim’s validity:

Shipped substrateWhy the user’s work already survivesCode evidence
Identity reconciliationA stable CURIE finds the same generated note regardless of path; an address change becomes an Obsidian rename rather than a duplicate.src/generation/identity-index.ts:73-123; src/generation/generation-engine.ts:784-824,2128-2145
Managed frontmatterUnmanaged keys and user_preserve values survive Replace.src/generation/frontmatter-merge.ts:34-105,108-153
Managed body regionsReplace regenerates only Crosswalker’s marked region and preserves every byte outside it.src/generation/managed-body.ts:206-369,464-565; src/generation/existing-note.ts:120-203
Stable attachmentEvidence coverage joins by subject_curie, not wikilink text.src/tier2/evidence-coverage.ts:137-169
Current content fingerprintGeneration computes concept_cid from canonical concept identity scope and writes the current value into provenance.src/generation/hash.ts:188-245; src/generation/generation-engine.ts:945-966,2088-2106

The managed-body delivery is recorded in the source-contract delivery log; the identity decision is re-import is identity reconciliation.

Nothing is lost in the ordinary regime:

  • the note survives;
  • the user’s prose survives;
  • preserved properties survive;
  • links still resolve;
  • the attestation remains present.

What is silently invalidated is the claim. “This evidence satisfies AC-2” was approved against one meaning of AC-2. If AC-2 retains its CURIE but its content fingerprint changes, the link can remain perfectly healthy while the approval is no longer justified.

The re-attestation contract

Section titled “The re-attestation contract”
  1. At approval, the attestation records its subject’s identity and content fingerprint: reviewed_against: { curie, cid }.
  2. Re-import recomputes the subject’s current concept_cid.
  3. Coverage compares the reviewed CID with the current CID.
  4. A mismatch adds freshness reason subject-changed.
  5. The attestation still counts as present, but stops counting as valid until a human re-reviews and approves it against the new CID.
  6. The coverage report lists the attestation and its exclusion reason, following the diagnostic pattern already established by the evidence closeout.

Freshness therefore has three drivers:

DriverExample
Time since reviewstale
Explicit validity dateexpired
Subject contentsubject-changed

Only fresh, approved attestations count as valid coverage. Diff tooling can explain or route the review, but it cannot replace the review decision.

4. The honest cost of source updates

Section titled “4. The honest cost of source updates”

A content fingerprint is intentionally sensitive. Any byte-level change can flip it, including changes a reviewer would call cosmetic.

The mitigation is normalization before comparison over the measured cosmetic classes:

  • whitespace;
  • punctuation;
  • citation markers.

Correction (2026-08-28). This section originally claimed normalization suppresses “the roughly 4% cosmetic class”. That inverted the measurement and overstated the mitigation by roughly fourteen times for the ATT&CK pair. In deliverable A, 4.3% (68 / 1,584) is the material class that survives normalization; the cosmetic class is 0.3% (5 / 1,584). Caught by the implementation design pass reading the source table rather than the summary of it.

What normalization actually buys, stated honestly:

  • On ATT&CK 15.1 → 16.1 it is nearly free — the cosmetic class is 0.3%, so it removes almost nothing.
  • On CIS 8.1 → 8.1.2 it earns its keep: 8.8 percentage points, a 57.7% reduction in flagged links.
  • Because the fingerprint covers the whole row rather than the primary description alone, the realistic flag rate on ATT&CK is the 15-24% metadata band, not 4.3%.

So normalization is a correctness measure that stops trivial edits from flagging, not a workload reduction. The review load after a release is real, and the honest number is the metadata band. The remaining judgment stays human.

At ATT&CK’s measured 23.7% publisher-classified change rate, a vault with 200 attestations should expect roughly 47, operationally about 50, re-reviews per release. That is not overhead invented by Crosswalker. It is the true cost of asserting that evidence still satisfies requirements after the requirements changed, made visible instead of hidden behind stable identifiers.

A later “trivial diff” classifier may auto-clear near-identical changes. That is additive. It must not weaken the default rule that changed content invalidates the prior approval until a review policy says otherwise.

5. Verdict 2 — before-state lives on the attestation

Section titled “5. Verdict 2 — before-state lives on the attestation”

The common question is not “what did every concept used to say?” It is “did the thing I approved change?” That needs one durable fingerprint at the point where the approval was made.

Candidate homeVerdictReason
Attestation in Tier 1Adoptreviewed_against: { curie, cid } is canonical Markdown, portable, emittable by any producer, and survives a Tier 2 clear-and-rebuild. The thing that cares retains the state from the moment it cared.
Concept history in Tier 2Reject for v0.1Tier 2 is a deletable, reproducible projection. History stored only there disappears on clear-and-rebuild, violating the durable-before-state requirement. Current Tier 2 upserts one current row and retains no prior snapshot (src/tier2/schema.sql:24-122; src/tier2/projector.ts:414-552).
New standalone diff artifactRejectIt does not clear the artifact-roles and authority bar for independent identity, lifecycle, authority, and consumers.
Planned v0.1.8 Execution RecordAdopt as the aggregate homeThe Execution Record already has authority for what one run did. Its identity-level change set can record which CURIEs changed CID, vanished, or appeared without inventing another artifact noun.

No concept history is retained in v0.1. Teams that need the old text retain the source snapshots already required by the pilot guidance. Crosswalker retains only the fingerprint needed to know that the approved subject changed. The planned Execution Record becomes the reviewable “what happened in this import”; it does not become the authority for ontology truth.

6. The essence-level result — a version transition is a crosswalk

Section titled “6. The essence-level result — a version transition is a crosswalk”

A structural transition is not a special migration object. It is a mapping between two release ontologies:

Transition shapeCrosswalk cardinality
Rename or direct replacementone-to-one
Splitone-to-many
Mergemany-to-one
Redistributionmany-to-many

Crosswalker’s mapping sets, set-qualified assertion identities, endpoint CURIEs, provenance, SSSOM import/export, and closure machinery already model these cardinalities. The additive extension is one predicate value: superseded_by. The relationship remains an ordinary mapping assertion with provenance; it does not become concept-local history.

Consequences

Section titled “Consequences”
  • Publisher lineage becomes an ordinary mapping-set import. NIST CSF markers such as [Withdrawn: Incorporated into …] and ATT&CK STIX lifecycle relationships are parsed into a release-to-release mapping set rather than handled by a special migration subsystem.
  • Erased lineage stays honestly absent. ATT&CK’s Excel export drops lifecycle facts carried by STIX. When the downloaded format does not contain a successor relation, Crosswalker must not infer one. The output is an orphan report plus a dangling-attestation report: “AC-2 has no successor known; 3 attestations point at it.”
  • Users and agents may author lineage. A human- or agent-authored mapping set can assert successors when the publisher does not, carrying provenance for who made the assertion and from what evidence.
  • Re-attestation can walk successor edges. An attestation whose subject is orphaned may surface subject-superseded with candidate successors; a human decides whether to move, duplicate, split, or retire the attestation.
  • previous_ids stays unbuilt. The archived brief preserves the correction that it never shipped. A flat field is one-directional, cannot express many-to-many lineage, and pollutes current concept identity with historical relations that belong on edges.

The import-set ownership decision supplies the ownership boundary, while the mapping set supplies the publisher or reviewer assertion about lineage. They are different roles and remain separate.

7. The two regimes are declared by how the user imports

Section titled “7. The two regimes are declared by how the user imports”
RegimeUser declarationResult
Ordinary release — stable identities, content driftImport with the same source.ontology id and ReplaceReconcile in place by CURIE. Compare attestation CID to current CID. subject-changed drives re-review. No lineage mapping is required.
Structural transition — splits, merges, renames, withdrawalsImport under a new source.ontology id, such as nist-800-53-r5, into a new folder side by sideOld concepts become orphans and their attestations dangle until a release-to-release mapping set supplies superseded_by edges or the user resolves them manually.

This is not automatic regime inference. The ontology id and Replace-versus-side-by-side choice are the declaration. Where publisher evidence is incomplete, Crosswalker reports uncertainty instead of switching regimes or guessing successors.

8. Additive-evolution proof

Section titled “8. Additive-evolution proof”

The verdict requires three optional additions and one artifact already planned:

AdditionExtension pointBehavior when absent
Attestation before-stateOptional reviewed_against objectExisting attestations retain today’s behavior; no historical CID comparison is available.
Content freshnessOptional freshness reason subject-changedExisting time-driven freshness behavior remains unchanged.
Release lineageAdditive predicate value superseded_byExisting mapping predicates and mapping sets remain unchanged.
Import change setPlanned v0.1.8 Execution RecordCurrent generation result and provenance behavior remain unchanged until that artifact ships.

No existing note, recipe, predicate, identity scheme, or Tier 2 row must change merely because these extensions exist. External producers remain first-class because the durable additions live in schema-governed Tier 1 and the runtime-agnostic mapping contract.

Deliberately uncovered case

Section titled “Deliberately uncovered case”

Meaning changes while text does not. A concept can retain identical bytes while a referenced definition, external term, or dependency changes underneath it. A content fingerprint over the concept alone cannot detect that.

The additive landing point is another freshness reason driven by a dependency edge. It does not require breaking the attestation shape or rewriting data already written against this version; it extends the same freshness-reason seam with dependency-aware invalidation later.

9. What is locked, rejected, and still open

Section titled “9. What is locked, rejected, and still open”
StatusItem
LockedRe-attestation is primary; diff-and-migrate is derived.
LockedThe attestation is the unit that stores reviewed subject identity and CID.
LockedContent change adds a freshness reason and blocks validity until re-review.
LockedNo concept history in Tier 2 for v0.1.
LockedThe Execution Record is the aggregate home for an import’s identity-level change set.
LockedStructural lineage is a crosswalk between release ontologies using superseded_by.
Rejectedprevious_ids and other flat concept-local lineage fields.
RejectedA separate migration/diff artifact noun.
Open, worker-tierExact schema placement and final spelling of the attestation field. The verdict uses reviewed_against: { curie, cid }; its final paragraph explicitly leaves field naming undecided.
Open, worker-tierExact content-normalization algorithm. Whitespace, punctuation, and citation markers are the locked cosmetic classes; canonicalization details remain unspecified.
Open, worker-tierSuccessor-walk UI, materiality assistance, and Execution Record serialization.
Section titled “Related”