What should a portable host-event model actually guarantee?

[VeloraTech]

NativeRelay started from a practical problem in AgentTrace.

I wanted AgentTrace to distinguish things like:

file changed
≠
process opened file
≠
process actually read file

The problem is that operating systems expose this information through very different native mechanisms, with different permissions, guarantees, event types, and limitations.

Rather than building a platform-specific implementation directly into AgentTrace, I'm exploring NativeRelay as a separate open-source infrastructure layer.

The idea is simple:

Native OS telemetry
        ↓
   NativeRelay collector
        ↓
 normalized host events
        ↓
     developer tools

But there is an important design question:

What should a cross-platform host-event model actually guarantee?

I don't think the answer should be "make every platform look identical."

Instead, I'm currently leaning toward a model where NativeRelay provides a common event structure while explicitly preserving platform capabilities and limitations.

For example, an event might contain:

{
  "type": "file.access",
  "operation": "open",
  "path": "/project/.env",
  "pid": 4821,
  "platform": "linux",
  "source": "fanotify",
  "confidence": "observed"
}

But another platform may not be able to provide the same information with the same guarantees.

Questions

I'd particularly like input from people working with:

• Linux kernel telemetry
• fanotify
• eBPF
• Windows ETW
• Windows internals
• macOS Endpoint Security
• security telemetry
• observability infrastructure
• systems programming

Some things I'm currently trying to answer:

1. Which fields belong in a genuinely cross-platform event model?
2. Which information should remain platform-specific?
3. How should event loss be represented?
4. How should permissions and capability differences be exposed?
5. Should NativeRelay distinguish observed, derived, and inferred information at the schema level?
6. What guarantees would you expect before calling a collector "supported"?

This isn't a request for a finished architecture.

I'm interested in finding the boundaries of what a useful abstraction can realistically guarantee without lying about what the underlying OS actually observed.

If you work in this area, I'd especially appreciate criticism of the approach.