CRC does not treat every graph edge as equal and it does not reduce graph risk to a connection count. It defines what authority and consequence may become reachable when a governed operation traverses beyond an isolation surface.
Surface sizing asks how much authority and value should sit inside one local isolation boundary. Reachability asks what becomes accessible when traversal crosses relationships. Federation asks what must move, coordinate, or become mutually visible when execution spans multiple governed surfaces.
The existing isolation-surface model remains intact:
S* answers a partitioning question. It should not be overloaded with graph or distributed-query variables that measure different phenomena.
Raw edge count is useful as a resource guard, but it is not the risk model. A descriptive, non-traversable edge is not equivalent to an authority-bearing edge into a production or regulated domain. CRC therefore models realized exposure over the relationships actually exercised by a plan.
| Symbol | Meaning |
|---|---|
| P | The candidate execution plan. |
| R(P) | External or boundary-significant relationships exercised by the plan. |
| q_e | Effective traversability of edge e under the relevant principal and operation. |
| V_e | Value or consequence exposed beyond the relationship. |
| A_e | Authority amplification associated with crossing the relationship. |
| B_e | Boundary significance or domain sensitivity factor. |
The exact weighting model is a standardization and qualification task; the important invariant is already clear: effective reachable authority and consequence matter more than connection count alone.
A CRC profile can place hard bounds on dimensions that remain directly measurable during execution:
| X_max | Maximum consequence-weighted reachable exposure. |
| D_max | Maximum traversal depth. |
| E_max | Maximum examined or traversed edges. |
| N_max | Maximum reachable/result nodes. |
| T_E | Permitted external edge classes or relationship types. |
A query can remain within its traversal budget and still create unnecessary cross-boundary movement. CRC therefore treats federation as a vector of constraints rather than forcing unlike costs into one arbitrary scalar.
| S_f | Participating governed surfaces. |
| C_f | Cross-surface exchanges or boundary crossings. |
| B_f | Bytes, records, or result material crossing boundaries. |
| V_f | Consequence-weighted information exported from a surface. |
| A_f | Authority differential crossed during federation. |
| U_f | Uncertainty introduced by snapshot age, incomplete remote knowledge, or coordination state. |
A CRC-aware planner first removes every plan that violates identity, authority, edge-class, reachability, or federation constraints. Only the remaining plans are candidates for cost optimization.
This ordering matters. CRC should not use a weighted objective in which enough CPU or latency savings can compensate mathematically for impermissible exposure. A forbidden traversal is not a high-cost plan; it is not a plan.
When multiple surfaces are needed, the preferred plan can minimize exposure as well as conventional compute cost. Predicate pushdown, surface-local filtering, remote aggregation, narrow projection, and returning attributed summaries instead of raw graph fragments can reduce boundary crossings and data movement while preserving the query's semantics.
A principal may be authorized for a broad envelope without every query consuming it. CRC should therefore distinguish the maximum permitted envelope from the exposure actually exercised by the selected execution plan. That enables attestation of both.
A serious standard cannot simply tell an administrator to invent limits. CRC profiles should ultimately derive recommended envelopes from measurable domain characteristics such as authority concentration, data consequence, external connectivity, autonomy level, reversibility, regulatory exposure, and recovery cost. High-exposure domains can then use conservative traversal and federation envelopes without pretending that one universal edge count is safe everywhere.
CRC should not validate its federation model only against a CRC-aware implementation. The v1.2 paper therefore defines an external reference program using established RDF/SPARQL federation engines as controls.
| Reference | Qualification role |
|---|---|
| Eclipse RDF4J FedX | Primary transparent-federation reference. FedX federates multiple SPARQL endpoints, performs source selection, and exposes an optimizer/evaluation strategy suitable for measuring selected sources, joins, remote work, and source-selection behavior. |
| Apache Jena ARQ / Fuseki | Explainable baseline. Explicit SPARQL federation and SERVICE-based workloads provide a simple control in which remote boundary crossings are directly visible in the query. |
| GraphDB | Production-oriented comparison for remote repositories and SPARQL federation. It is a comparison engine, not the source of CRC semantics. |
The same logical fixture should be executed with different plan shapes while measuring surfaces available, permitted, planned, and actually contacted; remote requests; cross-surface joins; bytes and bindings moved; graph edges examined; boundary edges crossed; maximum depth; latency; and the proposed CRC exposure quantities.
AletheiaGraph is a General Reasoning implementation candidate for CRC-aware execution, not evidence that CRC is correct. Its graph-native planner, bounded traversal, reasoning, proof/provenance, and authority model provide a place to enforce CRC admissibility before physical optimization. Marshaller is the intended cross-surface execution layer, where predicate pushdown, surface-local filtering, narrow projection, and attributed aggregation can reduce boundary movement.
The purpose of the independent FedX/ARQ/GraphDB qualification program is precisely to prevent CRC from becoming a standard that merely describes General Reasoning's own engine.