drydock-cli 3.0.63__tar.gz → 3.0.64__tar.gz

{drydock_cli-3.0.63/drydock_cli.egg-info → drydock_cli-3.0.64}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.63
+Version: 3.0.64
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0
@@ -137,6 +137,13 @@ control catalog into the knowledge base and ships four RMF skills — all
 /rmf-poam <finding>       # generate a POA&M entry from a scan/STIG finding
 ```
 
+Beyond text retrieval, `/rmf bootstrap` also builds a **typed ontology graph**
+(Control / Component / Vulnerability nodes; IMPLEMENTS / RESIDES_ON / ASSESSES
+edges). The agent records your system topology with `GraphAdd` and traces
+relationships with `GraphQuery` — including **control inheritance** ("which
+servers inherit physical controls from their enclave?"). Stdlib in-memory graph,
+no Neo4j.
+
 ## Install
 
 ```bash

{drydock_cli-3.0.63 → drydock_cli-3.0.64}/README.md

@@ -113,6 +113,13 @@ control catalog into the knowledge base and ships four RMF skills — all
 /rmf-poam <finding>       # generate a POA&M entry from a scan/STIG finding
 ```
 
+Beyond text retrieval, `/rmf bootstrap` also builds a **typed ontology graph**
+(Control / Component / Vulnerability nodes; IMPLEMENTS / RESIDES_ON / ASSESSES
+edges). The agent records your system topology with `GraphAdd` and traces
+relationships with `GraphQuery` — including **control inheritance** ("which
+servers inherit physical controls from their enclave?"). Stdlib in-memory graph,
+no Neo4j.
+
 ## Install
 
 ```bash

{drydock_cli-3.0.63 → drydock_cli-3.0.64}/drydock/rmf.py

@@ -123,4 +123,10 @@ def bootstrap(cwd: str, *, families: list[str] | None = None,
     store = graphrag.default_store_path(cwd)
     stats = graphrag.add_to_index([str(d) for d in docs], store, cwd=cwd)
     stats["family_docs"] = len(docs)
+    # Phase 2: also build the typed ontology graph (Control + Objective backbone)
+    # so the agent can TRACE relationships via GraphQuery, not just retrieve text.
+    from drydock import rmf_graph
+    g = rmf_graph.build_from_catalog(catalog, families=families)
+    g.save(rmf_graph.graph_path(cwd))
+    stats["graph"] = g.stats()
     return stats

drydock_cli-3.0.64/drydock/rmf_graph.py

@@ -0,0 +1,155 @@
+"""RMF typed ontology graph — schema-typed nodes + relationships for RMF
+traceability (Phase 2 of Operation RMF Automata).
+
+Clean-room, stdlib only: a small in-memory typed graph persisted as JSON (NOT an
+external Neo4j) so it stays local-first and dependency-free. It complements the
+GraphRAG text KB: GraphRAG answers "what does the doc say", this answers "trace
+the relationships" — e.g. which controls a component inherits from its parent.
+
+Node types:  Control · Objective (assessment objective / test case) · Component ·
+             Vulnerability · STIG · STIGRule · Boundary
+Edge types:  ASSESSES (Objective→Control) · IMPLEMENTS (Component→Control) ·
+             RESIDES_ON (Component→Component/Boundary) · AFFECTS (Vuln→Component) ·
+             SATISFIED_BY (Control→STIGRule) · EVALUATES (STIGRule→Component) ·
+             PART_OF (STIGRule→STIG) · APPLIES_TO (STIG→Component) · MITIGATES
+
+All logic original to Drydock.
+"""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+
+def graph_path(cwd: str) -> Path:
+    return Path(cwd) / ".drydock" / "rmf" / "graph.json"
+
+
+class RmfGraph:
+    def __init__(self) -> None:
+        self.nodes: dict[str, dict] = {}   # id -> {type, attrs}
+        self.edges: list[dict] = []        # {src, rel, dst}
+        self._edge_keys: set[tuple] = set()
+
+    # ── mutation ────────────────────────────────────────────────────────────
+    def add_node(self, nid: str, ntype: str, **attrs) -> str:
+        nid = nid.strip()
+        node = self.nodes.setdefault(nid, {"type": ntype, "attrs": {}})
+        node["type"] = ntype
+        node["attrs"].update({k: v for k, v in attrs.items() if v is not None})
+        return nid
+
+    def add_edge(self, src: str, rel: str, dst: str) -> None:
+        key = (src, rel, dst)
+        if key in self._edge_keys:
+            return
+        self._edge_keys.add(key)
+        self.edges.append({"src": src, "rel": rel, "dst": dst})
+
+    # ── queries ─────────────────────────────────────────────────────────────
+    def get(self, nid: str) -> dict | None:
+        n = self.nodes.get(nid)
+        return {"id": nid, **n} if n else None
+
+    def of_type(self, ntype: str) -> list[str]:
+        return [nid for nid, n in self.nodes.items() if n["type"] == ntype]
+
+    def neighbors(self, nid: str, rel: str | None = None, *, direction: str = "out") -> list[str]:
+        out = []
+        for e in self.edges:
+            if rel and e["rel"] != rel:
+                continue
+            if direction == "out" and e["src"] == nid:
+                out.append(e["dst"])
+            elif direction == "in" and e["dst"] == nid:
+                out.append(e["src"])
+        return out
+
+    def inherited_controls(self, component: str) -> list[str]:
+        """Controls a component inherits from its ancestors (RESIDES_ON, transitive).
+        The PRD's "which servers inherit physical controls" / inheritance logic."""
+        inherited: list[str] = []
+        seen: set[str] = set()
+        frontier = self.neighbors(component, "RESIDES_ON", direction="out")
+        while frontier:
+            parent = frontier.pop()
+            if parent in seen:
+                continue
+            seen.add(parent)
+            inherited.extend(self.neighbors(parent, "IMPLEMENTS", direction="out"))
+            frontier.extend(self.neighbors(parent, "RESIDES_ON", direction="out"))
+        # de-dup, preserve order
+        s: set[str] = set()
+        return [c for c in inherited if not (c in s or s.add(c))]
+
+    # ── persistence ─────────────────────────────────────────────────────────
+    def save(self, path: str | Path) -> None:
+        p = Path(path)
+        p.parent.mkdir(parents=True, exist_ok=True)
+        p.write_text(json.dumps({"nodes": self.nodes, "edges": self.edges}), "utf-8")
+
+    @classmethod
+    def load(cls, path: str | Path) -> "RmfGraph":
+        g = cls()
+        p = Path(path)
+        if p.exists():
+            try:
+                data = json.loads(p.read_text("utf-8"))
+                g.nodes = data.get("nodes", {})
+                for e in data.get("edges", []):
+                    g.add_edge(e["src"], e["rel"], e["dst"])
+            except (OSError, ValueError, KeyError):
+                pass
+        return g
+
+    def stats(self) -> dict:
+        by_type: dict[str, int] = {}
+        for n in self.nodes.values():
+            by_type[n["type"]] = by_type.get(n["type"], 0) + 1
+        return {"nodes": len(self.nodes), "edges": len(self.edges), "by_type": by_type}
+
+
+# ── id helpers (stable, typed) ──────────────────────────────────────────────
+def control_id(cid: str) -> str:
+    return f"control:{cid.lower()}"
+
+
+def component_id(name: str) -> str:
+    return f"component:{name.strip().lower()}"
+
+
+def build_from_catalog(catalog: dict, *, families: list[str] | None = None) -> RmfGraph:
+    """Deterministically build Control + Objective nodes (and ASSESSES edges) from
+    an OSCAL 800-53 catalog. The typed backbone the user's components/vulns attach to."""
+    g = RmfGraph()
+    want = {f.lower() for f in families} if families else None
+    for group in catalog.get("catalog", {}).get("groups", []) or []:
+        fid = group.get("id", "")
+        if want is not None and fid.lower() not in want:
+            continue
+        family = group.get("title", fid)
+        for control in group.get("controls", []) or []:
+            _add_control(g, control, family)
+            for enh in control.get("controls", []) or []:
+                _add_control(g, enh, family, parent=control.get("id"))
+    return g
+
+
+def _add_control(g: RmfGraph, control: dict, family: str, parent: str | None = None) -> None:
+    cid = control.get("id", "")
+    if not cid:
+        return
+    node = control_id(cid)
+    g.add_node(node, "Control", control_id=cid.upper(), title=control.get("title", ""),
+               family=family)
+    if parent:
+        g.add_edge(node, "ENHANCES", control_id(parent))
+    params = {p["id"]: p.get("label") for p in control.get("params", []) or []}
+    for i, part in enumerate(control.get("parts", []) or []):
+        if part.get("name") == "assessment-objective":
+            from drydock.rmf import _part_prose
+            prose = _part_prose(part, params)
+            if prose:
+                oid = f"objective:{cid.lower()}:{i}"
+                g.add_node(oid, "Objective", prose=prose[:500])
+                g.add_edge(oid, "ASSESSES", node)

{drydock_cli-3.0.63 → drydock_cli-3.0.64}/drydock/tools/__init__.py

@@ -270,6 +270,48 @@ SCHEMAS = [
             "required": ["message"],
         },
     },
+    {
+        "name": "GraphQuery",
+        "description": (
+            "Query the RMF ontology GRAPH to TRACE relationships (typed: Control, "
+            "Component, Vulnerability, Objective). Use it for traceability the text "
+            "knowledge base can't give: a control's assessment objectives, which "
+            "components implement a control, or which controls a component INHERITS "
+            "from its parent system. ops: control <id>, family <id>, component "
+            "<name>, implementers <control>, inherited <component>."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "op": {"type": "string", "description": "control | family | component | implementers | inherited"},
+                "id": {"type": "string", "description": "control id, family id, or component name"},
+            },
+            "required": ["op", "id"],
+        },
+    },
+    {
+        "name": "GraphAdd",
+        "description": (
+            "Record a typed fact in the RMF ontology graph as you read an SSP / "
+            "scan / checklist, so relationships can be traced later. ops: component "
+            "(a system component), implements (component implements a control), "
+            "resides_on (component resides on a parent/boundary — enables control "
+            "inheritance), vulnerability (a finding affecting a component)."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "op": {"type": "string", "description": "component | implements | resides_on | vulnerability"},
+                "component": {"type": "string"},
+                "control": {"type": "string", "description": "control id, for op=implements"},
+                "parent": {"type": "string", "description": "parent component/boundary, for op=resides_on"},
+                "id": {"type": "string", "description": "vulnerability/STIG/CVE id, for op=vulnerability"},
+                "severity": {"type": "string"},
+                "os": {"type": "string"}, "ip": {"type": "string"}, "data_type": {"type": "string"},
+            },
+            "required": ["op"],
+        },
+    },
     {
         "name": "WebSearch",
         "description": (
@@ -1053,6 +1095,92 @@ def tool_gitcommit(params: dict, config: dict) -> str:
         return f"git commit failed: {e}"
 
 
+def _rmf_graph(config):
+    from drydock import rmf_graph
+    cwd = config.get("cwd") or os.getcwd()
+    path = rmf_graph.graph_path(cwd)
+    return rmf_graph, rmf_graph.RmfGraph.load(path), path
+
+
+def tool_graphquery(params: dict, config: dict) -> str:
+    """Traverse the RMF typed ontology graph (read-only)."""
+    rmf_graph, g, _ = _rmf_graph(config)
+    if not g.nodes:
+        return ("The RMF graph is empty. Run /rmf bootstrap to build the control "
+                "backbone, and use GraphAdd to record components/relationships.")
+    op = (params.get("op") or "").strip().lower()
+    ident = (params.get("id") or "").strip()
+    if op == "control":
+        node = rmf_graph.control_id(ident)
+        n = g.get(node)
+        if not n:
+            return f"No control {ident} in the graph."
+        objs = [g.get(o)["attrs"].get("prose", "") for o in g.neighbors(node, "ASSESSES", direction="in")]
+        impl = [g.get(c)["attrs"].get("name", c) for c in g.neighbors(node, "IMPLEMENTS", direction="in")]
+        out = [f"{n['attrs'].get('control_id', ident)} — {n['attrs'].get('title','')} "
+               f"(Family: {n['attrs'].get('family','')})"]
+        if objs:
+            out.append("Assessment objectives:\n" + "\n".join(f"  - {o}" for o in objs))
+        out.append("Implemented by: " + (", ".join(impl) if impl else "(no components recorded)"))
+        return "\n".join(out)
+    if op == "family":
+        ctrls = [g.get(c)["attrs"].get("control_id", c)
+                 for c in g.of_type("Control")
+                 if g.get(c)["attrs"].get("family", "").lower().startswith(ident.lower())
+                 or ident.lower() in g.get(c)["attrs"].get("family", "").lower()]
+        return f"Controls in '{ident}': " + (", ".join(sorted(ctrls)) or "(none)")
+    if op in ("component", "implementers", "inherited"):
+        comp = rmf_graph.component_id(ident)
+        if op == "implementers":
+            node = rmf_graph.control_id(ident)
+            comps = [g.get(c)["attrs"].get("name", c) for c in g.neighbors(node, "IMPLEMENTS", direction="in")]
+            return f"Components implementing {ident}: " + (", ".join(comps) or "(none)")
+        if op == "inherited":
+            inh = g.inherited_controls(comp)
+            names = [g.get(c)["attrs"].get("control_id", c) if g.get(c) else c for c in inh]
+            return (f"{ident} inherits {len(names)} control(s) from its parent system(s): "
+                    + (", ".join(names) or "(none — no RESIDES_ON recorded)"))
+        n = g.get(comp)
+        if not n:
+            return f"No component '{ident}' in the graph (add it with GraphAdd)."
+        impl = [g.get(c)["attrs"].get("control_id", c) for c in g.neighbors(comp, "IMPLEMENTS", direction="out")]
+        res = [g.get(p)["attrs"].get("name", p) for p in g.neighbors(comp, "RESIDES_ON", direction="out")]
+        vulns = [g.get(v)["attrs"].get("vuln_id", v) for v in g.neighbors(comp, "AFFECTS", direction="in")]
+        return (f"Component {ident} ({n['attrs'].get('os','')}): implements "
+                f"{', '.join(impl) or 'none'}; resides on {', '.join(res) or 'nothing'}; "
+                f"flaws {', '.join(vulns) or 'none'}.")
+    return "GraphQuery ops: control <id> | family <id> | component <name> | implementers <control> | inherited <component>"
+
+
+def tool_graphadd(params: dict, config: dict) -> str:
+    """Record a typed fact in the RMF ontology graph (write)."""
+    rmf_graph, g, path = _rmf_graph(config)
+    op = (params.get("op") or "").strip().lower()
+    comp = (params.get("component") or "").strip()
+    if op == "component" and comp:
+        g.add_node(rmf_graph.component_id(comp), "Component", name=comp,
+                   os=params.get("os"), ip=params.get("ip"), data_type=params.get("data_type"))
+        g.save(path); return f"Recorded component {comp}."
+    if op == "implements" and comp and params.get("control"):
+        g.add_node(rmf_graph.component_id(comp), "Component", name=comp)
+        g.add_edge(rmf_graph.component_id(comp), "IMPLEMENTS", rmf_graph.control_id(params["control"]))
+        g.save(path); return f"Recorded: {comp} IMPLEMENTS {params['control'].upper()}."
+    if op == "resides_on" and comp and params.get("parent"):
+        g.add_node(rmf_graph.component_id(comp), "Component", name=comp)
+        g.add_node(rmf_graph.component_id(params["parent"]), "Component", name=params["parent"])
+        g.add_edge(rmf_graph.component_id(comp), "RESIDES_ON", rmf_graph.component_id(params["parent"]))
+        g.save(path); return f"Recorded: {comp} RESIDES_ON {params['parent']}."
+    if op == "vulnerability" and params.get("id"):
+        vid = f"vuln:{params['id'].lower()}"
+        g.add_node(vid, "Vulnerability", vuln_id=params["id"], severity=params.get("severity"))
+        if comp:
+            g.add_node(rmf_graph.component_id(comp), "Component", name=comp)
+            g.add_edge(vid, "AFFECTS", rmf_graph.component_id(comp))
+        g.save(path); return f"Recorded vulnerability {params['id']}" + (f" affecting {comp}." if comp else ".")
+    return ("GraphAdd ops: component (name in `component`) | implements (`component`,`control`) "
+            "| resides_on (`component`,`parent`) | vulnerability (`id`, optional `component`,`severity`).")
+
+
 def tool_websearch(params: dict, config: dict) -> str:
     """Search the internet (DuckDuckGo). Read-only; clean message when offline."""
     from drydock import web
@@ -1128,6 +1256,8 @@ _TOOLS = [
     ("task", tool_task, True),
     ("Dispatch", tool_dispatch, True),
     ("Knowledge", tool_knowledge, True),
+    ("GraphQuery", tool_graphquery, True),
+    ("GraphAdd", tool_graphadd, False),
     ("WebSearch", tool_websearch, True),
     ("WebFetch", tool_webfetch, True),
     ("GitStatus", tool_gitstatus, True),
@@ -1144,14 +1274,15 @@ def register_all():
             "Bash": tool_bash, "Glob": tool_glob, "Grep": tool_grep,
             "todo": tool_todo, "task": tool_task, "Dispatch": tool_dispatch,
             "Knowledge": tool_knowledge,
+            "GraphQuery": tool_graphquery, "GraphAdd": tool_graphadd,
             "WebSearch": tool_websearch, "WebFetch": tool_webfetch,
             "GitStatus": tool_gitstatus, "GitDiff": tool_gitdiff,
             "GitLog": tool_gitlog, "GitCommit": tool_gitcommit,
         }[name]
         # Read-only w.r.t. the parent's files (GitStatus/Diff/Log inspect only;
-        # GitCommit writes a local, reversible commit).
+        # GitCommit + GraphAdd write).
         read_only = name in (
-            "Read", "Glob", "Grep", "task", "Dispatch", "Knowledge",
+            "Read", "Glob", "Grep", "task", "Dispatch", "Knowledge", "GraphQuery",
             "WebSearch", "WebFetch", "GitStatus", "GitDiff", "GitLog",
         )
         register(ToolDef(name=name, schema=schema, func=func, read_only=read_only))

{drydock_cli-3.0.63 → drydock_cli-3.0.64}/drydock/tui/app.py

@@ -554,10 +554,12 @@ class DrydockApp(App):
 
         try:
             stats = rmf.bootstrap(cwd, families=families)
+            gstats = stats.get("graph", {})
             msg = (
                 f"✓ RMF catalog ingested: {stats['family_docs']} family doc(s), "
-                f"{stats['chunks']} chunks total in the knowledge base. Controls are "
-                "now queryable — try /rmf-control AC-2 or ask about a control."
+                f"{stats['chunks']} KB chunks + a typed graph ({gstats.get('nodes', 0)} "
+                f"nodes, {gstats.get('edges', 0)} edges). Try /rmf-control AC-2 (text) "
+                "or ask the agent to trace relationships (GraphQuery / GraphAdd)."
             )
         except Exception as e:  # noqa: BLE001
             msg = (f"RMF bootstrap failed: {e}. (Needs internet for the one-time "

{drydock_cli-3.0.63 → drydock_cli-3.0.64/drydock_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.63
+Version: 3.0.64
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0
@@ -137,6 +137,13 @@ control catalog into the knowledge base and ships four RMF skills — all
 /rmf-poam <finding>       # generate a POA&M entry from a scan/STIG finding
 ```
 
+Beyond text retrieval, `/rmf bootstrap` also builds a **typed ontology graph**
+(Control / Component / Vulnerability nodes; IMPLEMENTS / RESIDES_ON / ASSESSES
+edges). The agent records your system topology with `GraphAdd` and traces
+relationships with `GraphQuery` — including **control inheritance** ("which
+servers inherit physical controls from their enclave?"). Stdlib in-memory graph,
+no Neo4j.
+
 ## Install
 
 ```bash

{drydock_cli-3.0.63 → drydock_cli-3.0.64}/drydock_cli.egg-info/SOURCES.txt

@@ -18,6 +18,7 @@ drydock/loop_detect.py
 drydock/mcp.py
 drydock/providers.py
 drydock/rmf.py
+drydock/rmf_graph.py
 drydock/skills.py
 drydock/tool_registry.py
 drydock/tuning.py
@@ -69,6 +70,7 @@ tests/test_plan_autocontinue.py
 tests/test_providers_unreachable.py
 tests/test_read_index.py
 tests/test_rmf.py
+tests/test_rmf_graph.py
 tests/test_runaway_repetition.py
 tests/test_skills.py
 tests/test_stop.py

{drydock_cli-3.0.63 → drydock_cli-3.0.64}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 # PyPI distribution name is drydock-cli (the established install name, continued
 # from the retired v2 fork); the import package + CLI command stay `drydock`.
 name = "drydock-cli"
-version = "3.0.63"
+version = "3.0.64"
 description = "Drydock — a local, provider-agnostic terminal coding agent for local LLMs"
 readme = "README.md"
 requires-python = ">=3.11"

drydock_cli-3.0.64/tests/test_rmf_graph.py

@@ -0,0 +1,62 @@
+"""RMF Phase 2 — the typed ontology graph + GraphQuery/GraphAdd tools.
+Inheritance reasoning is the headline: a component inherits the controls its
+parent system implements (RESIDES_ON → IMPLEMENTS)."""
+from __future__ import annotations
+
+from drydock import rmf_graph as G
+from drydock.tools import tool_graphquery, tool_graphadd
+
+_CAT = {"catalog": {"groups": [
+    {"id": "ac", "title": "Access Control", "controls": [
+        {"id": "ac-2", "title": "Account Management",
+         "parts": [{"name": "assessment-objective", "prose": "accounts are managed"}]}]},
+    {"id": "pe", "title": "Physical and Environmental Protection", "controls": [
+        {"id": "pe-3", "title": "Physical Access Control", "parts": []}]},
+]}}
+
+
+def test_build_from_catalog_typed_nodes():
+    g = G.build_from_catalog(_CAT)
+    assert g.get(G.control_id("ac-2"))["attrs"]["title"] == "Account Management"
+    objs = g.neighbors(G.control_id("ac-2"), "ASSESSES", direction="in")
+    assert objs and g.get(objs[0])["type"] == "Objective"
+
+
+def test_inheritance_reasoning():
+    g = G.build_from_catalog(_CAT)
+    g.add_node(G.component_id("web-1"), "Component", name="web-1")
+    g.add_node(G.component_id("enclave"), "Boundary", name="enclave")
+    g.add_edge(G.component_id("web-1"), "RESIDES_ON", G.component_id("enclave"))
+    g.add_edge(G.component_id("enclave"), "IMPLEMENTS", G.control_id("pe-3"))
+    inh = g.inherited_controls(G.component_id("web-1"))
+    assert G.control_id("pe-3") in inh
+
+
+def test_persistence_roundtrip(tmp_path):
+    g = G.build_from_catalog(_CAT)
+    g.add_edge(G.component_id("a"), "RESIDES_ON", G.component_id("b"))
+    p = tmp_path / "g.json"; g.save(p)
+    g2 = G.RmfGraph.load(p)
+    assert g2.stats()["nodes"] == g.stats()["nodes"]
+    assert {"src": G.component_id("a"), "rel": "RESIDES_ON", "dst": G.component_id("b")} in g2.edges
+
+
+def test_graphadd_and_graphquery_tools(tmp_path):
+    from drydock import rmf_graph
+    # seed a catalog graph
+    g = G.build_from_catalog(_CAT)
+    g.save(rmf_graph.graph_path(str(tmp_path)))
+    cfg = {"cwd": str(tmp_path)}
+    # build a system via the write tool
+    assert "RESIDES_ON" in tool_graphadd({"op": "resides_on", "component": "srv1", "parent": "encl"}, cfg)
+    assert "IMPLEMENTS" in tool_graphadd({"op": "implements", "component": "encl", "control": "PE-3"}, cfg)
+    # query inheritance via the read tool
+    out = tool_graphquery({"op": "inherited", "id": "srv1"}, cfg)
+    assert "PE-3" in out and "inherits" in out
+    # control lookup + implementers
+    assert "Account Management" in tool_graphquery({"op": "control", "id": "AC-2"}, cfg)
+    assert "encl" in tool_graphquery({"op": "implementers", "id": "PE-3"}, cfg)
+
+
+def test_graphquery_empty_graph_is_graceful(tmp_path):
+    assert "empty" in tool_graphquery({"op": "control", "id": "AC-2"}, {"cwd": str(tmp_path)}).lower()