# jeevikas-19/cybersec architecture

> Architecture diagram of the GitHub repository jeevikas-19/cybersec, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-09). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/jeevikas-19/cybersec
- Repository: https://github.com/jeevikas-19/cybersec

## Overview

Chain of Custody is a tamper-evident logging and response system: a log-server agent seals bank transactions and sends signed records to a separate witness, which checks integrity and exposes alerts in an auditor view. Layer 1 detects or deceives unauthorized log edits; Layer 3 isolates an unreachable server and supports threshold-approved recovery. The README documents these capabilities; some implementation modules are unsampled, so edges below are limited to documented flows and indexed references.

Main entry points: [`witness/app.py`](https://github.com/jeevikas-19/cybersec/blob/main/witness/app.py) (Witness API), [`agent/agent.py`](https://github.com/jeevikas-19/cybersec/blob/main/agent/agent.py) (Signing Agent), [`layers/l1_tripwire/trip.py`](https://github.com/jeevikas-19/cybersec/blob/main/layers/l1_tripwire/trip.py) (Command Tripwire), [`witness/checks.py`](https://github.com/jeevikas-19/cybersec/blob/main/witness/checks.py) (Heartbeat and Chain Checks)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_platform["Log Server"]
  node_bank[("Bank Data Source<br/>[bank.py]")]
  node_source["Transaction Source<br/>[source.py]"]
  node_agent["Signing Agent<br/>[agent.py]"]
  node_crypto["Chain Cryptography<br/>[crypto.py]"]
  node_config["Layer Configuration<br/>[config.py]"]
end

subgraph group_tripwire["Layer 1 Tripwire"]
  node_trip["Command Tripwire<br/>[trip.py]"]
  node_profiles["Profile IDs<br/>[profiles.py]"]
  node_backstop["Edit Backstop<br/>[backstop.py]"]
  node_events["Layer Event Spool<br/>[events.py]"]
end

subgraph group_witness["Witness Checks"]
  node_witness_api["Witness API<br/>[app.py]"]
  node_checks["Heartbeat and Chain Checks<br/>[checks.py]"]
  node_records["Record Comparison<br/>[records.py]"]
  node_classify["Tamper Classification<br/>[classify.py]"]
  node_witness_events["Event Timeline<br/>[events.py]"]
  node_store[("Witness State Store<br/>[store.py]")]
  node_auditor["Auditor View<br/>[auditor.html]"]
end

subgraph group_response["Quarantine Response"]
  node_quarantine_agent["Local Quarantine<br/>[quarantine.py]"]
  node_sessions["Session Lockout<br/>[sessions.py]"]
  node_quarantine_witness["Witness Unlock Approval<br/>[quarantine.py]"]
  node_keyholders["Key Holder Shares<br/>[keyholders.py]"]
end

node_operator(("Bank Operator"))

node_operator -->|"runs transactions"| node_bank
node_bank -->|"provides records"| node_source
node_source -->|"supplies transactions"| node_agent
node_agent -->|"signs and chains"| node_crypto
node_agent -->|"posts signed entries"| node_witness_api
node_agent -->|"sends heartbeats"| node_witness_api
node_witness_api -->|"routes checks"| node_checks
node_witness_api -->|"routes events"| node_witness_events
node_witness_api -->|"routes quarantine"| node_quarantine_witness
node_witness_api -->|"serves mismatches"| node_records
node_checks -->|"verifies replies"| node_records
node_checks -->|"classifies alerts"| node_classify
node_checks -->|"reads and writes"| node_store
node_records -->|"reads and writes"| node_store
node_witness_events -->|"stores events"| node_store
node_witness_api -->|"serves view"| node_auditor
node_operator -->|"runs guarded commands"| node_trip
node_trip -->|"checks profile"| node_profiles
node_trip -->|"spools command events"| node_events
node_trip -->|"writes authorization marker"| node_backstop
node_backstop -->|"validates marker"| node_profiles
node_backstop -.->|"reports edits"| node_events
node_events -->|"agent signs and ships"| node_agent
node_agent -->|"triggers isolation"| node_quarantine_agent
node_quarantine_agent -->|"ends login sessions"| node_sessions
node_quarantine_agent -->|"records response"| node_events
node_agent -->|"reports quarantine"| node_witness_api
node_quarantine_witness -->|"collects approvals"| node_keyholders
node_quarantine_witness -->|"returns signed unlock"| node_witness_api
node_witness_api -->|"polls challenges"| node_agent
node_agent -->|"answers record checks"| node_bank
node_config -.->|"configures layer"| node_trip

click node_bank "https://github.com/jeevikas-19/cybersec/blob/main/victim/bank.py"
click node_source "https://github.com/jeevikas-19/cybersec/blob/main/agent/source.py"
click node_agent "https://github.com/jeevikas-19/cybersec/blob/main/agent/agent.py"
click node_crypto "https://github.com/jeevikas-19/cybersec/blob/main/shared/crypto.py"
click node_config "https://github.com/jeevikas-19/cybersec/blob/main/layers/common/config.py"
click node_trip "https://github.com/jeevikas-19/cybersec/blob/main/layers/l1_tripwire/trip.py"
click node_profiles "https://github.com/jeevikas-19/cybersec/blob/main/layers/l1_tripwire/profiles.py"
click node_backstop "https://github.com/jeevikas-19/cybersec/blob/main/layers/l1_tripwire/backstop.py"
click node_events "https://github.com/jeevikas-19/cybersec/blob/main/layers/common/events.py"
click node_witness_api "https://github.com/jeevikas-19/cybersec/blob/main/witness/app.py"
click node_checks "https://github.com/jeevikas-19/cybersec/blob/main/witness/checks.py"
click node_records "https://github.com/jeevikas-19/cybersec/blob/main/witness/records.py"
click node_classify "https://github.com/jeevikas-19/cybersec/blob/main/witness/classify.py"
click node_witness_events "https://github.com/jeevikas-19/cybersec/blob/main/witness/events.py"
click node_store "https://github.com/jeevikas-19/cybersec/blob/main/witness/store.py"
click node_auditor "https://github.com/jeevikas-19/cybersec/blob/main/witness/auditor.html"
click node_quarantine_agent "https://github.com/jeevikas-19/cybersec/blob/main/layers/l3_quarantine/quarantine.py"
click node_sessions "https://github.com/jeevikas-19/cybersec/blob/main/layers/l3_quarantine/sessions.py"
click node_quarantine_witness "https://github.com/jeevikas-19/cybersec/blob/main/witness/quarantine.py"
click node_keyholders "https://github.com/jeevikas-19/cybersec/blob/main/witness/keyholders.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_bank,node_source,node_agent,node_crypto,node_config toneBlue
class node_trip,node_profiles,node_backstop,node_events toneAmber
class node_witness_api,node_checks,node_records,node_classify,node_witness_events,node_store,node_auditor toneMint
class node_quarantine_agent,node_sessions,node_quarantine_witness,node_keyholders toneRose
class node_operator toneIndigo
```

## Components

### Log Server

- [Bank Data Source](https://github.com/jeevikas-19/cybersec/blob/main/victim/bank.py): `victim/bank.py`
- [Transaction Source](https://github.com/jeevikas-19/cybersec/blob/main/agent/source.py): `agent/source.py`
- [Signing Agent](https://github.com/jeevikas-19/cybersec/blob/main/agent/agent.py): `agent/agent.py`
- [Chain Cryptography](https://github.com/jeevikas-19/cybersec/blob/main/shared/crypto.py): `shared/crypto.py`
- [Layer Configuration](https://github.com/jeevikas-19/cybersec/blob/main/layers/common/config.py): `layers/common/config.py`

### Layer 1 Tripwire

- [Command Tripwire](https://github.com/jeevikas-19/cybersec/blob/main/layers/l1_tripwire/trip.py): `layers/l1_tripwire/trip.py`
- [Profile IDs](https://github.com/jeevikas-19/cybersec/blob/main/layers/l1_tripwire/profiles.py): `layers/l1_tripwire/profiles.py`
- [Edit Backstop](https://github.com/jeevikas-19/cybersec/blob/main/layers/l1_tripwire/backstop.py): `layers/l1_tripwire/backstop.py`
- [Layer Event Spool](https://github.com/jeevikas-19/cybersec/blob/main/layers/common/events.py): `layers/common/events.py`

### Witness Checks

- [Witness API](https://github.com/jeevikas-19/cybersec/blob/main/witness/app.py): `witness/app.py`
- [Heartbeat and Chain Checks](https://github.com/jeevikas-19/cybersec/blob/main/witness/checks.py): `witness/checks.py`
- [Record Comparison](https://github.com/jeevikas-19/cybersec/blob/main/witness/records.py): `witness/records.py`
- [Tamper Classification](https://github.com/jeevikas-19/cybersec/blob/main/witness/classify.py): `witness/classify.py`
- [Event Timeline](https://github.com/jeevikas-19/cybersec/blob/main/witness/events.py): `witness/events.py`
- [Witness State Store](https://github.com/jeevikas-19/cybersec/blob/main/witness/store.py): `witness/store.py`
- [Auditor View](https://github.com/jeevikas-19/cybersec/blob/main/witness/auditor.html): `witness/auditor.html`

### Quarantine Response

- [Local Quarantine](https://github.com/jeevikas-19/cybersec/blob/main/layers/l3_quarantine/quarantine.py): `layers/l3_quarantine/quarantine.py`
- [Session Lockout](https://github.com/jeevikas-19/cybersec/blob/main/layers/l3_quarantine/sessions.py): `layers/l3_quarantine/sessions.py`
- [Witness Unlock Approval](https://github.com/jeevikas-19/cybersec/blob/main/witness/quarantine.py): `witness/quarantine.py`
- [Key Holder Shares](https://github.com/jeevikas-19/cybersec/blob/main/witness/keyholders.py): `witness/keyholders.py`

### Other components

- **Bank Operator**

## Connections

- Bank Operator → Bank Data Source: runs transactions (evidence: `README.md`)
- Bank Data Source → Transaction Source: provides records (evidence: `README.md`)
- Transaction Source → Signing Agent: supplies transactions (evidence: `agent/agent.py`)
- Signing Agent → Chain Cryptography: signs and chains
- Signing Agent → Witness API: posts signed entries (evidence: `README.md`)
- Signing Agent → Witness API: sends heartbeats (evidence: `README.md`)
- Witness API → Heartbeat and Chain Checks: routes checks (evidence: `witness/app.py`)
- Witness API → Event Timeline: routes events (evidence: `witness/app.py`)
- Witness API → Witness Unlock Approval: routes quarantine (evidence: `witness/app.py`)
- Witness API → Record Comparison: serves mismatches (evidence: `witness/app.py`)
- Heartbeat and Chain Checks → Record Comparison: verifies replies (evidence: `witness/checks.py`)
- Heartbeat and Chain Checks → Tamper Classification: classifies alerts (evidence: `witness/checks.py`)
- Heartbeat and Chain Checks → Witness State Store: reads and writes (evidence: `witness/checks.py`)
- Record Comparison → Witness State Store: reads and writes (evidence: `witness/records.py`)
- Event Timeline → Witness State Store: stores events (evidence: `witness/events.py`)
- Witness API → Auditor View: serves view (evidence: `README.md`)
- Bank Operator → Command Tripwire: runs guarded commands (evidence: `README.md`)
- Command Tripwire → Profile IDs: checks profile (evidence: `layers/l1_tripwire/trip.py`)
- Command Tripwire → Layer Event Spool: spools command events (evidence: `layers/l1_tripwire/trip.py`)
- Command Tripwire → Edit Backstop: writes authorization marker (evidence: `layers/l1_tripwire/trip.py`)
- Edit Backstop → Profile IDs: validates marker (evidence: `layers/l1_tripwire/backstop.py`)
- Edit Backstop → Layer Event Spool: reports edits (evidence: `layers/l1_tripwire/backstop.py`)
- Layer Event Spool → Signing Agent: agent signs and ships (evidence: `layers/common/events.py`)
- Signing Agent → Local Quarantine: triggers isolation (evidence: `agent/agent.py`)
- Local Quarantine → Session Lockout: ends login sessions (evidence: `layers/l3_quarantine/quarantine.py`)
- Local Quarantine → Layer Event Spool: records response (evidence: `layers/l3_quarantine/quarantine.py`)
- Signing Agent → Witness API: reports quarantine (evidence: `README.md`)
- Witness Unlock Approval → Key Holder Shares: collects approvals (evidence: `witness/quarantine.py`)
- Witness Unlock Approval → Witness API: returns signed unlock (evidence: `README.md`)
- Witness API → Signing Agent: polls challenges (evidence: `README.md`)
- Signing Agent → Bank Data Source: answers record checks (evidence: `README.md`)
- Layer Configuration → Command Tripwire: configures layer