# aditya-180404/jocky architecture

> Architecture diagram of the GitHub repository aditya-180404/jocky, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-10-03). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/aditya-180404/jocky
- Repository: https://github.com/aditya-180404/jocky

## Overview

JOCKY is a digital-forensics platform: investigators author or select a `.jy` investigation, validate and compile it through the web IDE, API, or CLI, run the resulting target binary to collect endpoint evidence, then review and verify evidence and reports. The README documents compiler stages, broad collector domains, integrity, timeline, artifact analysis, correlation, and capability status. Arrows follow sampled routes/calls or explicit README workflow statements; collector-to-analysis runtime wiring is documented at a high level, while unsampled internals are kept unasserted.

Main entry points: [`runtime/evidence/src/lib.rs`](https://github.com/aditya-180404/jocky/blob/main/runtime/evidence/src/lib.rs) (Evidence integrity), [`compiler/cli/src/main.rs`](https://github.com/aditya-180404/jocky/blob/main/compiler/cli/src/main.rs) (JOCKY CLI), [`apps/api/src/main.rs`](https://github.com/aditya-180404/jocky/blob/main/apps/api/src/main.rs) (REST API), [`runtime/src/lib.rs`](https://github.com/aditya-180404/jocky/blob/main/runtime/src/lib.rs) (Forensic runtime)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_author["Authoring and access"]
  node_web["Web app<br/>[App.tsx]"]
  node_webide["Web IDE<br/>[WebIDE.tsx]"]
  node_playbooks["Examples and playbooks"]
  node_cli["JOCKY CLI<br/>[main.rs]"]
end

subgraph group_services["Platform services"]
  node_api["REST API<br/>[main.rs]"]
  node_compiler_service["Compiler service"]
  node_tools["Auth and tools<br/>[tools_service.rs]"]
end

subgraph group_compile["Compiler"]
  node_lexer["Lexer<br/>[lib.rs]"]
  node_parser["Parser<br/>[lib.rs]"]
  node_ast["AST<br/>[lib.rs]"]
  node_semantic["Semantic analysis<br/>[lib.rs]"]
  node_ir["IR and HIR/MIR<br/>[lib.rs]"]
  node_backend["Native backend<br/>[lib.rs]"]
  node_llvm["LLVM backend<br/>[llvm.rs]"]
end

subgraph group_collect["Forensic collection"]
  node_binary["Investigation binary<br/>[main.rs]"]
  node_runtime["Forensic runtime<br/>[lib.rs]"]
  node_collectors["Endpoint collectors<br/>[lib.rs]"]
  node_capabilities["Capability registry<br/>[lib.rs]"]
end

subgraph group_analysis["Evidence analysis"]
  node_integrity["Evidence integrity<br/>[lib.rs]"]
  node_timeline["Timeline<br/>[lib.rs]"]
  node_artifacts["Artifact analysis<br/>[lib.rs]"]
  node_correlation["Correlation<br/>[lib.rs]"]
  node_reports["CLI reports<br/>[main.rs]"]
end

node_investigator(("Investigator"))

node_investigator -->|"uses"| node_web
node_investigator -->|"invokes"| node_cli
node_web -->|"routes to"| node_webide
node_web -->|"routes to"| node_playbooks
node_webide -.->|"requests"| node_api
node_webide -->|"validates and builds"| node_compiler_service
node_api -->|"routes compiler requests"| node_compiler_service
node_api -->|"routes tool and auth requests"| node_tools
node_cli -->|"checks and compiles"| node_lexer
node_api -->|"checks and compiles"| node_lexer
node_lexer -->|"tokens to"| node_parser
node_parser -->|"parses to"| node_ast
node_ast -->|"analyzes"| node_semantic
node_semantic -->|"lowers to"| node_ir
node_ir -->|"generates with"| node_backend
node_backend -.->|"optionally selects"| node_llvm
node_backend -->|"emits binary"| node_binary
node_binary -->|"runs with"| node_runtime
node_runtime -.->|"collects via"| node_collectors
node_runtime -->|"exposes registry"| node_capabilities
node_runtime -->|"finalizes evidence"| node_integrity
node_cli -->|"verifies evidence"| node_integrity
node_integrity -.->|"feeds analysis"| node_timeline
node_integrity -.->|"feeds analysis"| node_artifacts
node_integrity -.->|"feeds analysis"| node_correlation
node_cli -->|"generates reports"| node_reports

click node_web "https://github.com/aditya-180404/jocky/blob/main/apps/web/src/App.tsx"
click node_webide "https://github.com/aditya-180404/jocky/blob/main/apps/web/src/pages/WebIDE.tsx"
click node_playbooks "https://github.com/aditya-180404/jocky/blob/main/apps/web/src/pages/PlaybookGallery.tsx"
click node_cli "https://github.com/aditya-180404/jocky/blob/main/compiler/cli/src/main.rs"
click node_api "https://github.com/aditya-180404/jocky/blob/main/apps/api/src/main.rs"
click node_compiler_service "https://github.com/aditya-180404/jocky/blob/main/apps/api/src/compiler_service.rs"
click node_tools "https://github.com/aditya-180404/jocky/blob/main/apps/api/src/tools_service.rs"
click node_lexer "https://github.com/aditya-180404/jocky/blob/main/compiler/lexer/src/lib.rs"
click node_parser "https://github.com/aditya-180404/jocky/blob/main/compiler/parser/src/lib.rs"
click node_ast "https://github.com/aditya-180404/jocky/blob/main/compiler/ast/src/lib.rs"
click node_semantic "https://github.com/aditya-180404/jocky/blob/main/compiler/semantic/src/lib.rs"
click node_ir "https://github.com/aditya-180404/jocky/blob/main/compiler/hir/src/lib.rs"
click node_backend "https://github.com/aditya-180404/jocky/blob/main/compiler/backend/src/lib.rs"
click node_llvm "https://github.com/aditya-180404/jocky/blob/main/compiler/backend/src/llvm.rs"
click node_binary "https://github.com/aditya-180404/jocky/blob/main/process/process_triage/src/main.rs"
click node_runtime "https://github.com/aditya-180404/jocky/blob/main/runtime/src/lib.rs"
click node_collectors "https://github.com/aditya-180404/jocky/blob/main/runtime/system/src/lib.rs"
click node_capabilities "https://github.com/aditya-180404/jocky/blob/main/runtime/capabilities/src/lib.rs"
click node_integrity "https://github.com/aditya-180404/jocky/blob/main/runtime/evidence/src/lib.rs"
click node_timeline "https://github.com/aditya-180404/jocky/blob/main/runtime/timeline/src/lib.rs"
click node_artifacts "https://github.com/aditya-180404/jocky/blob/main/runtime/artifacts/src/lib.rs"
click node_correlation "https://github.com/aditya-180404/jocky/blob/main/runtime/correlation/src/lib.rs"
click node_reports "https://github.com/aditya-180404/jocky/blob/main/compiler/cli/src/main.rs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_web,node_webide,node_playbooks,node_cli toneBlue
class node_api,node_compiler_service,node_tools toneAmber
class node_lexer,node_parser,node_ast,node_semantic,node_ir,node_backend,node_llvm toneMint
class node_binary,node_runtime,node_collectors,node_capabilities toneRose
class node_integrity,node_timeline,node_artifacts,node_correlation,node_reports,node_investigator toneIndigo
```

## Components

### Authoring and access

- [Web app](https://github.com/aditya-180404/jocky/blob/main/apps/web/src/App.tsx): `apps/web/src/App.tsx`
- [Web IDE](https://github.com/aditya-180404/jocky/blob/main/apps/web/src/pages/WebIDE.tsx): `apps/web/src/pages/WebIDE.tsx`
- [Examples and playbooks](https://github.com/aditya-180404/jocky/blob/main/apps/web/src/pages/PlaybookGallery.tsx): `apps/web/src/pages/PlaybookGallery.tsx`
- [JOCKY CLI](https://github.com/aditya-180404/jocky/blob/main/compiler/cli/src/main.rs): `compiler/cli/src/main.rs`

### Platform services

- [REST API](https://github.com/aditya-180404/jocky/blob/main/apps/api/src/main.rs): `apps/api/src/main.rs`
- [Compiler service](https://github.com/aditya-180404/jocky/blob/main/apps/api/src/compiler_service.rs): `apps/api/src/compiler_service.rs`
- [Auth and tools](https://github.com/aditya-180404/jocky/blob/main/apps/api/src/tools_service.rs): `apps/api/src/tools_service.rs`

### Compiler

- [Lexer](https://github.com/aditya-180404/jocky/blob/main/compiler/lexer/src/lib.rs): `compiler/lexer/src/lib.rs`
- [Parser](https://github.com/aditya-180404/jocky/blob/main/compiler/parser/src/lib.rs): `compiler/parser/src/lib.rs`
- [AST](https://github.com/aditya-180404/jocky/blob/main/compiler/ast/src/lib.rs): `compiler/ast/src/lib.rs`
- [Semantic analysis](https://github.com/aditya-180404/jocky/blob/main/compiler/semantic/src/lib.rs): `compiler/semantic/src/lib.rs`
- [IR and HIR/MIR](https://github.com/aditya-180404/jocky/blob/main/compiler/hir/src/lib.rs): `compiler/hir/src/lib.rs`
- [Native backend](https://github.com/aditya-180404/jocky/blob/main/compiler/backend/src/lib.rs): `compiler/backend/src/lib.rs`
- [LLVM backend](https://github.com/aditya-180404/jocky/blob/main/compiler/backend/src/llvm.rs): `compiler/backend/src/llvm.rs`

### Forensic collection

- [Investigation binary](https://github.com/aditya-180404/jocky/blob/main/process/process_triage/src/main.rs): `process/process_triage/src/main.rs`
- [Forensic runtime](https://github.com/aditya-180404/jocky/blob/main/runtime/src/lib.rs): `runtime/src/lib.rs`
- [Endpoint collectors](https://github.com/aditya-180404/jocky/blob/main/runtime/system/src/lib.rs): `runtime/system/src/lib.rs`
- [Capability registry](https://github.com/aditya-180404/jocky/blob/main/runtime/capabilities/src/lib.rs): `runtime/capabilities/src/lib.rs`

### Evidence analysis

- [Evidence integrity](https://github.com/aditya-180404/jocky/blob/main/runtime/evidence/src/lib.rs): `runtime/evidence/src/lib.rs`
- [Timeline](https://github.com/aditya-180404/jocky/blob/main/runtime/timeline/src/lib.rs): `runtime/timeline/src/lib.rs`
- [Artifact analysis](https://github.com/aditya-180404/jocky/blob/main/runtime/artifacts/src/lib.rs): `runtime/artifacts/src/lib.rs`
- [Correlation](https://github.com/aditya-180404/jocky/blob/main/runtime/correlation/src/lib.rs): `runtime/correlation/src/lib.rs`
- [CLI reports](https://github.com/aditya-180404/jocky/blob/main/compiler/cli/src/main.rs): `compiler/cli/src/main.rs`

### Other components

- **Investigator**

## Connections

- Investigator → Web app: uses (evidence: `README.md`)
- Investigator → JOCKY CLI: invokes (evidence: `README.md`)
- Web app → Web IDE: routes to (evidence: `apps/web/src/App.tsx`)
- Web app → Examples and playbooks: routes to (evidence: `apps/web/src/App.tsx`)
- Web IDE → REST API: requests
- Web IDE → Compiler service: validates and builds (evidence: `README.md`)
- REST API → Compiler service: routes compiler requests (evidence: `apps/api/src/main.rs`)
- REST API → Auth and tools: routes tool and auth requests (evidence: `apps/api/src/main.rs`)
- JOCKY CLI → Lexer: checks and compiles (evidence: `README.md`)
- REST API → Lexer: checks and compiles (evidence: `README.md`)
- Lexer → Parser: tokens to (evidence: `README.md`)
- Parser → AST: parses to (evidence: `README.md`)
- AST → Semantic analysis: analyzes (evidence: `README.md`)
- Semantic analysis → IR and HIR/MIR: lowers to (evidence: `README.md`)
- IR and HIR/MIR → Native backend: generates with (evidence: `README.md`)
- Native backend → LLVM backend: optionally selects (evidence: `README.md`)
- Native backend → Investigation binary: emits binary (evidence: `README.md`)
- Investigation binary → Forensic runtime: runs with (evidence: `README.md`)
- Forensic runtime → Endpoint collectors: collects via
- Forensic runtime → Capability registry: exposes registry (evidence: `runtime/src/lib.rs`)
- Forensic runtime → Evidence integrity: finalizes evidence (evidence: `README.md`)
- JOCKY CLI → Evidence integrity: verifies evidence (evidence: `README.md`)
- Evidence integrity → Timeline: feeds analysis (evidence: `README.md`)
- Evidence integrity → Artifact analysis: feeds analysis (evidence: `README.md`)
- Evidence integrity → Correlation: feeds analysis (evidence: `README.md`)
- JOCKY CLI → CLI reports: generates reports (evidence: `README.md`)