# kaitolim7/yamato-security-analysis architecture

> Architecture diagram of the GitHub repository kaitolim7/yamato-security-analysis, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/kaitolim7/yamato-security-analysis
- Repository: https://github.com/kaitolim7/yamato-security-analysis

## Overview

This Python tool collects Cloudflare Workers telemetry, normalizes and privacy-protects events, persists them with checkpoints, exports iwatobi-compatible logs, and runs analysis. The main path is daily.py or bridge.py coordinating bridge functions and the external iwatobi executable. The README also documents setup, diagnostics, and input-compatibility verification. Source excerpts show core calls, but omit portions of bridge.py; relationships for unsampled bridge internals are therefore not expanded.

Main entry points: [`code/bridge.py`](https://github.com/kaitolim7/yamato-security-analysis/blob/main/code/bridge.py) (Collection CLI), [`code/daily.py`](https://github.com/kaitolim7/yamato-security-analysis/blob/main/code/daily.py) (Daily scheduler), [`code/check_iwatobi.py`](https://github.com/kaitolim7/yamato-security-analysis/blob/main/code/check_iwatobi.py) (Compatibility verifier), [`code/iwatobi-formats.yaml`](https://github.com/kaitolim7/yamato-security-analysis/blob/main/code/iwatobi-formats.yaml) (Custom log format)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_collection["Collection"]
  node_cli["Collection CLI<br/>[bridge.py]"]
  node_daily["Daily scheduler<br/>[daily.py]"]
end

subgraph group_processing["Log processing"]
  node_normalization["Event normalization<br/>[bridge.py]"]
  node_sqlite[("Event and checkpoint store<br/>[bridge.py]")]
  node_export["Log export<br/>[bridge.py]"]
end

subgraph group_analysis["Analysis and verification"]
  node_verification["Compatibility verifier<br/>[check_iwatobi.py]"]
  node_formats["Custom log format"]
end

node_operator(("Operator"))
node_cloudflare["Cloudflare API"]
node_iwatobi["iwatobi engine"]

node_operator -->|"runs commands"| node_cli
node_operator -->|"starts job"| node_daily
node_cli -->|"queries telemetry"| node_cloudflare
node_cli -->|"normalizes events"| node_normalization
node_cli -->|"saves events"| node_sqlite
node_cli -->|"exports logs"| node_export
node_daily -->|"calls bridge"| node_cli
node_daily -->|"queries batches"| node_cloudflare
node_daily -->|"normalizes events"| node_normalization
node_daily -->|"stores progress"| node_sqlite
node_daily -->|"exports period"| node_export
node_cli -->|"runs analysis"| node_iwatobi
node_daily -->|"runs analysis"| node_iwatobi
node_verification -->|"probes input"| node_iwatobi
node_verification -->|"configures format"| node_formats
node_verification -->|"uses safe paths"| node_cli

click node_cli "https://github.com/kaitolim7/yamato-security-analysis/blob/main/code/bridge.py"
click node_daily "https://github.com/kaitolim7/yamato-security-analysis/blob/main/code/daily.py"
click node_normalization "https://github.com/kaitolim7/yamato-security-analysis/blob/main/code/bridge.py"
click node_sqlite "https://github.com/kaitolim7/yamato-security-analysis/blob/main/code/bridge.py"
click node_export "https://github.com/kaitolim7/yamato-security-analysis/blob/main/code/bridge.py"
click node_verification "https://github.com/kaitolim7/yamato-security-analysis/blob/main/code/check_iwatobi.py"
click node_formats "https://github.com/kaitolim7/yamato-security-analysis/blob/main/code/iwatobi-formats.yaml"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_daily toneBlue
class node_normalization,node_sqlite,node_export toneAmber
class node_verification,node_formats,node_cloudflare toneMint
class node_operator,node_iwatobi toneIndigo
```

## Components

### Collection

- [Collection CLI](https://github.com/kaitolim7/yamato-security-analysis/blob/main/code/bridge.py): `code/bridge.py`
- [Daily scheduler](https://github.com/kaitolim7/yamato-security-analysis/blob/main/code/daily.py): `code/daily.py`

### Log processing

- [Event normalization](https://github.com/kaitolim7/yamato-security-analysis/blob/main/code/bridge.py): `code/bridge.py`
- [Event and checkpoint store](https://github.com/kaitolim7/yamato-security-analysis/blob/main/code/bridge.py): `code/bridge.py`
- [Log export](https://github.com/kaitolim7/yamato-security-analysis/blob/main/code/bridge.py): `code/bridge.py`

### Analysis and verification

- [Compatibility verifier](https://github.com/kaitolim7/yamato-security-analysis/blob/main/code/check_iwatobi.py): `code/check_iwatobi.py`
- [Custom log format](https://github.com/kaitolim7/yamato-security-analysis/blob/main/code/iwatobi-formats.yaml): `code/iwatobi-formats.yaml`

### Other components

- **Operator**
- **Cloudflare API**
- **iwatobi engine**

## Connections

- Operator → Collection CLI: runs commands (evidence: `README.md`)
- Operator → Daily scheduler: starts job (evidence: `README.md`)
- Collection CLI → Cloudflare API: queries telemetry (evidence: `code/bridge.py`)
- Collection CLI → Event normalization: normalizes events (evidence: `README.md`)
- Collection CLI → Event and checkpoint store: saves events (evidence: `README.md`)
- Collection CLI → Log export: exports logs (evidence: `README.md`)
- Daily scheduler → Collection CLI: calls bridge (evidence: `code/daily.py`)
- Daily scheduler → Cloudflare API: queries batches (evidence: `code/daily.py`)
- Daily scheduler → Event normalization: normalizes events (evidence: `code/daily.py`)
- Daily scheduler → Event and checkpoint store: stores progress (evidence: `code/daily.py`)
- Daily scheduler → Log export: exports period (evidence: `code/daily.py`)
- Collection CLI → iwatobi engine: runs analysis (evidence: `README.md`)
- Daily scheduler → iwatobi engine: runs analysis (evidence: `code/daily.py`)
- Compatibility verifier → iwatobi engine: probes input (evidence: `code/check_iwatobi.py`)
- Compatibility verifier → Custom log format: configures format (evidence: `code/check_iwatobi.py`)
- Compatibility verifier → Collection CLI: uses safe paths (evidence: `code/check_iwatobi.py`)