Skip to content
Crosswalker
🚧 Early alpha — building the foundation. See the roadmap →

Challenge 05: The transformation problem

Created

The assignment

Section titled “The assignment”

The ontology diff primitives detect WHAT changed. The handling strategies decide WHAT TO DO. But sometimes the handling isn’t a simple operation — it’s a transformation that requires computation.

Deeply explore what transformation means in this context and how to handle it at a fundamental level.

Examples of non-trivial transformations

Section titled “Examples of non-trivial transformations”

  1. Merge with evidence redistribution: NIST merges AC-19(2) into AC-19. You have 15 evidence notes linked to AC-19(2). They need to be re-linked to AC-19, but some may be duplicates of evidence already linked to AC-19. How do you detect and handle duplicates?

  2. ID scheme change: A framework changes from numeric IDs (4.7) to hierarchical IDs (IG1.4.7). Every crosswalk link needs a regex transformation. But some IDs are ambiguous (is “4.7” control 4.7 or section 4, item 7?).

  3. Semantic split: One control becomes three, and the original control’s evidence needs to be CLASSIFIED into which of the three new controls it applies to. This might require human judgment or AI classification.

  4. Cross-framework cascade: NIST changes, which invalidates NIST→CIS crosswalks, which invalidates CIS→your evidence mappings. The transformation cascades through multiple levels of the graph.

Questions to explore

Section titled “Questions to explore”

  1. Is transformation a primitive or a pluggable layer? The layer model puts custom transforms in the pluggable layer. But is there a set of PRIMITIVE transformations that belongs in the foundation?

  2. What do database migration tools do? Liquibase, Flyway, Alembic handle data transformations during schema changes. What patterns do they use? Are there analogies to ontology transformations?

  3. What about the transformation recipe vs EvolutionPattern question? If we store per-version transformation recipes, what format should they be in? Can they express all the examples above?

  4. AI-assisted transformation. Could an LLM take a transformation recipe and execute it? What would the interface look like? What are the trust/verification requirements for AI-generated transformations in a compliance context?

  5. Reversibility. Should transformations be reversible? If you transform NIST r5→r6 and it goes wrong, can you undo? What does “undo” mean for a graph transformation?

Context to read first

Section titled “Context to read first”

What success looks like

Section titled “What success looks like”

A taxonomy of transformation types (beyond the simple handling strategies), a proposal for how to express them (format/language), and an honest assessment of which can be automated vs. which require human judgment.