How joshua-song007/shellhacks works
T-Cell is a host threat-detection and containment system: Scout observes process behavior, validates and scores events, then suspends detected threats and wakes Soldier to evolve and apply a containment gene. Soldier can consult and commit genes to the Solana program; the Electron app supervises the daemons and presents status and controls. Separate capabilities include peer mesh coordination, signed incident advice, and offline trace capture. The README is empty, so the map relies on the supplied source excerpts and tree; unsampled subsystem wiring is shown only where the excerpts document it.
Main entry points: pipeline.rs Event pipeline · main.rs Soldier daemon · server.js Advisor service · backend.cjs Daemon supervisor
Components 29
Detection
- Scout daemon
crates/scout/src/main.rs - Event adapter
crates/scout/src/source_eslogger.rs - TES validation
crates/tes/src/validate.rs - Lineage tracking
crates/scout/src/lineage.rs - Threat scoring
crates/scout/src/scoring.rs - Event pipeline
crates/scout/src/pipeline.rs - Process suspension
crates/scout/src/pipeline.rs
Response
- Soldier daemon
crates/soldier/src/main.rs - Trace replay
crates/soldier/src/replay_target.rs - Allele search
crates/soldier/src/allele_search.rs - Gene compile/apply
crates/soldier/src/gene_compile.rs - Trace capture
crates/trace-capture/src/main.rs
On-chain ledger
- Ledger client
crates/ledger-client/src/client.rs - T-Cell program
crates/ledger-program/programs/t_cell/src/instructions.rs - Genome registry
crates/ledger-program/programs/t_cell/src/state.rs
Coordination
- Mesh daemon
crates/mesh/src/bin/meshd.rs
App and advice
- Daemon supervisor
frontend/electron/backend.cjs - Electron interface
frontend/electron/main.cjs - T-Cell dashboard
frontend/src/main.js - Advisor client
frontend/src/data.js - Advisor service
advisor-service/server.js - Incident database
- Raw incident storage
Other components
- Host events
- Paired devices
- Narration model
- Solana RPC
- Operator
- Isolated host
Connections 32
- Host events → Scout daemon: emits events
- Scout daemon → Event pipeline: feeds events
- Event pipeline → Event adapter: maps lines
- Event pipeline → TES validation: validates events
- Event pipeline → Lineage tracking: tracks processes
- Event pipeline → Threat scoring: scores lineage
- Event pipeline → Process suspension: suspends threat
- Scout daemon → Daemon supervisor: reports detections
- Daemon supervisor → Soldier daemon: delivers wake
- Soldier daemon → Trace replay: replays traces
- Soldier daemon → Allele search: searches alleles
- Allele search → Trace replay: evaluates target
- Soldier daemon → Gene compile/apply: compiles and applies
- Soldier daemon → Ledger client: checks and commits
- Ledger client → Solana RPC: sends RPC transactions
- Solana RPC → T-Cell program: dispatches instructions
- T-Cell program → Genome registry: reads and writes
- Operator → Electron interface: uses
- Electron interface → Daemon supervisor: starts and controls
- Electron interface → T-Cell dashboard: loads interface
- Daemon supervisor → T-Cell dashboard: forwards events
- T-Cell dashboard → Advisor client: requests review
- Advisor client → Advisor service: sends signed incident
- Advisor service → Incident database: stores incidents
- Advisor service → Raw incident storage: stores raw data
- Advisor service → Narration model: requests narration
- Advisor service → Advisor client: returns review
- Operator → Mesh daemon: pairs and commands
- Mesh daemon → Paired devices: exchanges messages
- Operator → Trace capture: starts capture
- Trace capture → Isolated host: runs atomic
- Trace capture → TES validation: normalizes trace