How aditya-180404/jocky works
JOCKY is a digital-forensics platform: investigators author or select a .jy investigation, validate and compile it through the web IDE, API, or CLI, run the resulting target binary to collect endpoint evidence, then review and verify evidence and reports. The README documents compiler stages, broad collector domains, integrity, timeline, artifact analysis, correlation, and capability status. Arrows follow sampled routes/calls or explicit README workflow statements; collector-to-analysis runtime wiring is documented at a high level, while unsampled internals are kept unasserted.
Main entry points: src/lib.rs Evidence integrity · src/main.rs JOCKY CLI · src/main.rs REST API · src/lib.rs Forensic runtime
Components 24
Authoring and access
- Web app
apps/web/src/App.tsx - Web IDE
apps/web/src/pages/WebIDE.tsx - Examples and playbooks
apps/web/src/pages/PlaybookGallery.tsx - JOCKY CLI
compiler/cli/src/main.rs
Platform services
- REST API
apps/api/src/main.rs - Compiler service
apps/api/src/compiler_service.rs - Auth and tools
apps/api/src/tools_service.rs
Compiler
- Lexer
compiler/lexer/src/lib.rs - Parser
compiler/parser/src/lib.rs - AST
compiler/ast/src/lib.rs - Semantic analysis
compiler/semantic/src/lib.rs - IR and HIR/MIR
compiler/hir/src/lib.rs - Native backend
compiler/backend/src/lib.rs - LLVM backend
compiler/backend/src/llvm.rs
Forensic collection
- Investigation binary
process/process_triage/src/main.rs - Forensic runtime
runtime/src/lib.rs - Endpoint collectors
runtime/system/src/lib.rs - Capability registry
runtime/capabilities/src/lib.rs
Evidence analysis
- Evidence integrity
runtime/evidence/src/lib.rs - Timeline
runtime/timeline/src/lib.rs - Artifact analysis
runtime/artifacts/src/lib.rs - Correlation
runtime/correlation/src/lib.rs - CLI reports
compiler/cli/src/main.rs
Other components
- Investigator
Connections 26
- Investigator → Web app: uses
README.md - Investigator → JOCKY CLI: invokes
README.md - Web app → Web IDE: routes to
apps/web/src/App.tsx - Web app → Examples and playbooks: routes to
apps/web/src/App.tsx - Web IDE → REST API: requests
- Web IDE → Compiler service: validates and builds
README.md - REST API → Compiler service: routes compiler requests
apps/api/src/main.rs - REST API → Auth and tools: routes tool and auth requests
apps/api/src/main.rs - JOCKY CLI → Lexer: checks and compiles
README.md - REST API → Lexer: checks and compiles
README.md - Lexer → Parser: tokens to
README.md - Parser → AST: parses to
README.md - AST → Semantic analysis: analyzes
README.md - Semantic analysis → IR and HIR/MIR: lowers to
README.md - IR and HIR/MIR → Native backend: generates with
README.md - Native backend → LLVM backend: optionally selects
README.md - Native backend → Investigation binary: emits binary
README.md - Investigation binary → Forensic runtime: runs with
README.md - Forensic runtime → Endpoint collectors: collects via
- Forensic runtime → Capability registry: exposes registry
runtime/src/lib.rs - Forensic runtime → Evidence integrity: finalizes evidence
README.md - JOCKY CLI → Evidence integrity: verifies evidence
README.md - Evidence integrity → Timeline: feeds analysis
README.md - Evidence integrity → Artifact analysis: feeds analysis
README.md - Evidence integrity → Correlation: feeds analysis
README.md - JOCKY CLI → CLI reports: generates reports
README.md