How jeevikas-19/cybersec works
Chain of Custody is a tamper-evident logging and response system: a log-server agent seals bank transactions and sends signed records to a separate witness, which checks integrity and exposes alerts in an auditor view. Layer 1 detects or deceives unauthorized log edits; Layer 3 isolates an unreachable server and supports threshold-approved recovery. The README documents these capabilities; some implementation modules are unsampled, so edges below are limited to documented flows and indexed references.
Main entry points: app.py Witness API · agent.py Signing Agent · trip.py Command Tripwire · checks.py Heartbeat and Chain Checks
Components 21
Log Server
- Bank Data Source
victim/bank.py - Transaction Source
agent/source.py - Signing Agent
agent/agent.py - Chain Cryptography
shared/crypto.py - Layer Configuration
layers/common/config.py
Layer 1 Tripwire
- Command Tripwire
layers/l1_tripwire/trip.py - Profile IDs
layers/l1_tripwire/profiles.py - Edit Backstop
layers/l1_tripwire/backstop.py - Layer Event Spool
layers/common/events.py
Witness Checks
- Witness API
witness/app.py - Heartbeat and Chain Checks
witness/checks.py - Record Comparison
witness/records.py - Tamper Classification
witness/classify.py - Event Timeline
witness/events.py - Witness State Store
witness/store.py - Auditor View
witness/auditor.html
Quarantine Response
- Local Quarantine
layers/l3_quarantine/quarantine.py - Session Lockout
layers/l3_quarantine/sessions.py - Witness Unlock Approval
witness/quarantine.py - Key Holder Shares
witness/keyholders.py
Other components
- Bank Operator
Connections 32
- Bank Operator → Bank Data Source: runs transactions
README.md - Bank Data Source → Transaction Source: provides records
README.md - Transaction Source → Signing Agent: supplies transactions
agent/agent.py - Signing Agent → Chain Cryptography: signs and chains
- Signing Agent → Witness API: posts signed entries
README.md - Signing Agent → Witness API: sends heartbeats
README.md - Witness API → Heartbeat and Chain Checks: routes checks
witness/app.py - Witness API → Event Timeline: routes events
witness/app.py - Witness API → Witness Unlock Approval: routes quarantine
witness/app.py - Witness API → Record Comparison: serves mismatches
witness/app.py - Heartbeat and Chain Checks → Record Comparison: verifies replies
witness/checks.py - Heartbeat and Chain Checks → Tamper Classification: classifies alerts
witness/checks.py - Heartbeat and Chain Checks → Witness State Store: reads and writes
witness/checks.py - Record Comparison → Witness State Store: reads and writes
witness/records.py - Event Timeline → Witness State Store: stores events
witness/events.py - Witness API → Auditor View: serves view
README.md - Bank Operator → Command Tripwire: runs guarded commands
README.md - Command Tripwire → Profile IDs: checks profile
layers/l1_tripwire/trip.py - Command Tripwire → Layer Event Spool: spools command events
layers/l1_tripwire/trip.py - Command Tripwire → Edit Backstop: writes authorization marker
layers/l1_tripwire/trip.py - Edit Backstop → Profile IDs: validates marker
layers/l1_tripwire/backstop.py - Edit Backstop → Layer Event Spool: reports edits
layers/l1_tripwire/backstop.py - Layer Event Spool → Signing Agent: agent signs and ships
layers/common/events.py - Signing Agent → Local Quarantine: triggers isolation
agent/agent.py - Local Quarantine → Session Lockout: ends login sessions
layers/l3_quarantine/quarantine.py - Local Quarantine → Layer Event Spool: records response
layers/l3_quarantine/quarantine.py - Signing Agent → Witness API: reports quarantine
README.md - Witness Unlock Approval → Key Holder Shares: collects approvals
witness/quarantine.py - Witness Unlock Approval → Witness API: returns signed unlock
README.md - Witness API → Signing Agent: polls challenges
README.md - Signing Agent → Bank Data Source: answers record checks
README.md - Layer Configuration → Command Tripwire: configures layer