NativeRelay: Linux collector progress, event contract, and what's next

[VeloraTech]

I've been developing NativeRelay as a standalone, local-first OS telemetry layer for developer tools.

The motivation is straightforward: tools that need to understand activity on a machine shouldn't each have to implement their own platform-specific monitoring layer. NativeRelay aims to provide a common event interface while preserving the differences, limitations, and capabilities of each operating system.

Current progress

The first Linux implementation is in place.

It currently supports best-effort process lifecycle observations and process-attributed file-open and modification notifications within a selected workspace scope, using Linux's native process connector and fanotify mechanisms.

The implementation also exposes collector capabilities and status so consumers can distinguish available observations from degraded or unsupported functionality.

There are important limitations. Filesystem monitoring requires elevated privileges, event delivery is best-effort, and the current implementation does not provide complete audit coverage. File creation, deletion, and rename events are not currently emitted. Windows and macOS collectors remain future work.

How this fits into AgentTrace

NativeRelay and AgentTrace have separate responsibilities.

• NativeRelay observes OS-level events and exposes them through a normalized event interface.
• AgentTrace discovers running AI coding agents, separates concurrent instances, correlates observed process trees, and records trace history.

The longer-term direction is to let AgentTrace consume NativeRelay's native observations without making AgentTrace responsible for implementing every OS-specific collector itself.

That integration needs to preserve an important distinction: an event being recorded does not mean every relevant event was observed, and process attribution should only be claimed when the evidence supports it.

Where I'd appreciate technical feedback

I'm particularly interested in feedback from developers who have worked with OS telemetry, process monitoring, or cross-platform systems tooling.

A few questions I'm thinking through:

1. Collector interface: What should a platform-neutral collector contract guarantee, and what should remain explicitly platform-specific?
2. Capability reporting: Is the current distinction between available, degraded, permission-denied, unavailable, and unsupported states sufficient for consumers to make reliable decisions?
3. Event loss and coverage: How should collectors report dropped events and uncertainty when the underlying OS mechanism cannot provide an exact loss count?
4. Cross-platform design: What should be part of the shared event model, and what should remain a platform-specific extension?
5. Agent correlation: What evidence would you expect a downstream tool to require before attributing an OS event to a particular AI coding-agent instance?

I'm building this in the open, so concrete criticism, alternative designs, and implementation experience are welcome. I'm especially interested in feedback on the interface and its guarantees rather than just feature requests.

Repositories

• NativeRelay: https://github.com/VeloraTech/NativeRelay
• AgentTrace: https://github.com/VeloraTech/AgentTrace

If you've built something similar, I'd be interested in hearing what worked, what didn't, and what you would design differently.