echo

How it works

Echo is the agent’s local telemetry warehouse. Each capture source has a collector that reads current OS state on a timer, compares it with the baseline saved at the previous tick and appends only the differences, as change events, to a SQLite database (echo.db) on the device. Four interval triggers run the collectors and a fifth rolls the live rows up into hourly, daily and monthly tiers and then trims every tier to its limit. Three sources (power, removable, registry) do not diff a snapshot: they follow a saved position in an OS log or callback stream, and when that position is lost they record a capture_gap row and start again from the log’s current end instead of replaying history. All 17 sources are on by default on every OS (default_enabled in echo_schema_registry.cpp, enforced by a registry-wide test). configure turns any of them off per host, which stops capture and keeps the rows already stored; purge_source then deletes that source’s rows. Reads are on demand and local: status, query, export and sql read echo.db, snapshot forces an out-of-cycle collection, and fleet_snapshot re-enumerates processes and connections without touching echo.db.

Deliberately not: Echo does not stream events to the server in real time (everything lands in the local warehouse first and is pulled by a read action), it does not replay history from zero when a cursor-model source loses its position, and it never fabricates OS support (a leg with no collector reports planned, not a guessed read).

The fast interval must stay below the slow interval. A diffed source’s first tick records its baseline and no events, so a quiet first tick is not evidence about the past.

What you can decide with it

What a result proves. A row says the collector saw that change at that tick; it does not say nothing else happened. An empty table on a planned leg means Echo is not collecting there, never that nothing occurred. An empty table on a live leg can also mean the source is disabled (check <source>_enabled in status), the first tick was a baseline, or the last tick reported capture_incomplete. snapshot answers complete or partial|<sources>; a partial answer names the sources that kept a stale baseline.

Safe workflow for the changing actions:

1. configure (Write, admin only): run compatibility and status first, apply the setting, then read status again. The setting is undone by writing the old value back; rows already stored are not touched, and re-enabling a source re-baselines it so nothing is invented for the paused window.
2. purge_source (Delete, irreversible): export what you need, disable the source with configure, run purge_source, then confirm with status that its row count is zero. It accepts only a registered source name that is confirmed disabled.
3. rollup (Delete, irreversible): runs by itself every 900 s; a manual run only brings that same pass forward. The server refuses to dispatch a Destructive action fleet-wide, so both rollup and purge_source need explicit device ids.

Capture sources by OS

live means the collector is wired and is the primary mechanism; constrained means it works with a stated limit; planned means the leg is declared with no collector (its tables are queryable and empty); n/a means the source does not apply to that OS. The table is read from the schema registry (build_sources() in echo_schema_registry.cpp); compatibility reports the same data on a host.

Source notes

• Retention. Live tables are row-count capped; the hourly, daily and monthly tiers are time-based (typically 24 hours, 31 days and about a year; a few tiers differ). Each pass deletes at most 5000 rows per table, and a disabled source’s rows are never pruned.
• netconn and power/removable history. On first enablement the read can reach back into OS-retained history, bounded by netconn_lookback_seconds, power_lookback_seconds (effective on macOS only) and removable_lookback_seconds (default 7 days, 0 means forward-only). If the setting cannot be read, Echo reads forward-only.
• mapdrive history backfill. A one-time historical pass runs at agent init. A profile it could not read is retried individually, at most 7 attempts in total and no more than once per 24 hours, until it resolves or is abandoned. A hive mount that exceeds its 30 s bound ends that run’s mounting. The stuck mount’s thread cannot be stopped: until it returns it keeps the process-wide offline-hive lock (every other per-user hive read on the agent waits behind it) and keeps the backup and restore privileges enabled on the agent process, and if it stalls after the hive has loaded, that hive stays mounted and the profile’s NTUSER.DAT stays locked. The plugin module is pinned in memory before the first mount; if the pin fails no hive is read, and while a stuck mount is still running later runs do not start new mounts. purge_source mapdrive also clears the pending-retry list so a retry cannot re-insert purged rows.
• registry. Values are stored unmasked and rows carry actor_pid 0; see Caveats.

Diagrams

Dispatch and read path

flowchart LR
  TRIG["Internal triggers: 60 s, 300 s, 30 s, 3600 s, 900 s"] --> EX
  OP["Operator or workflow"] --> SRV["Server: authorizes Infrastructure Read, Write or Delete, or Response Read for fleet_snapshot, and records the audit row"]
  SRV -->|"gRPC mTLS"| HOST["Agent plugin host"] --> EX["echo execute: refuses when echo.db is not open"]
  EX --> COL["Collectors: ETW, Endpoint Security, procfs, SCM, systemctl, launchctl, iphlpapi"]
  COL --> DB[("echo.db SQLite warehouse")]
  EX --> FS["fleet_snapshot: bypasses the warehouse"]
  DB --> READ["status, query, export, sql, rollup, purge_source"]
  READ --> RS[("ResponseStore")]
  FS --> RS
  RS --> API["REST /api/responses and the /echo dashboard"]

Operators reach the plugin through the server, which authorizes and audits the dispatch. The triggers call the same entry point inside the agent. Every action except fleet_snapshot works on echo.db, and every result comes back as a normal instruction response.

Collector pipeline and retention

flowchart TD
  T["echo.fast, echo.slow, echo.perf, echo.software"] --> G{"Source enabled and flag readable?"}
  G -->|"no"| SK["Skip the tick: rows and baseline are kept"]
  G -->|"yes"| E["Enumerate current OS state"]
  E --> D["Diff against the baseline in echo_state, first tick records the baseline only"]
  D --> L[("Live tables in echo.db")]
  R["echo.rollup every 900 s"] --> A["run_aggregation: live to hourly to daily to monthly"]
  L --> A
  A --> H[("Hourly, daily and monthly tables")]
  A --> C{"run_retention: clock guard on time-based tiers"}
  C -->|"plausible clock"| X["Delete aged rows, at most 5000 per table per pass"]
  C -->|"anomaly, first time seen"| N["Decline that table and count it in status"]
  C -->|"same anomaly seen again"| X

Collectors write only the difference from the last complete snapshot, and a failed or partial read keeps the old baseline rather than inventing events. Aggregation always runs before retention so each tier is consumed before the tier below it can be trimmed. The clock guard declines a time-based pass that looks like a wall-clock jump (a pass that would wipe a table, more than 30 days since the last pass, a stored reading ahead of now, or no stored reading) and counts it in retention_guard_declines_total. It declines once per distinct anomaly: while the same anomaly persists, later passes delete again but never more than 5000 rows per table per pass. Row-count trimming needs no clock and is not clock-guarded, though it has the same per-pass cap.

Disable, then purge a source

sequenceDiagram
  participant Op as Operator
  participant P as echo plugin
  participant DB as echo.db
  Op->>P: configure process_enabled=false
  P->>DB: one transaction: set flag, paused_at, clear baseline
  P-->>Op: config line for the new value
  Note over P,DB: collectors skip the source and retention leaves its rows alone
  Op->>P: purge_source source=process
  P->>P: take collect_mu_ so no re-enable can interleave
  P->>DB: read the enable flag once
  alt flag unreadable
    P-->>Op: error config_unreadable
  else flag still true
    P-->>Op: error source_not_paused
  else flag confirmed false
    P->>DB: delete every tier, commit, truncate the write-ahead log
    P-->>Op: JSON with rows_deleted and status purged
  end

The enable check and the delete happen under the same collector lock that configure takes, so a concurrent re-enable cannot slip between them and have a collecting source purged. An unreadable flag is treated as unconfirmed and refused, never as disabled. The best-effort truncation of the SQLite write-ahead log (WAL) clears the purged pages from that log so the erasure is complete.

Cursor source states

stateDiagram-v2
  [*] --> NoCursor
  NoCursor --> Ok: first read, token baseline
  Ok --> Ok: cursor_advanced, events and cursor commit together
  Ok --> Ok: capture_incomplete, transient failure, cursor kept
  Ok --> Gap: cursor_lost, log wrapped or cursor invalid
  Gap --> Ok: capture_gap row stored, cursor moved to log end
  Ok --> Paused: source disabled, buffered events discarded
  Paused --> Gap: source re-enabled, one gap covers the pause

power, removable and registry keep one saved position each in the echo_cursor table (readable through sql). A transient read failure raises an incomplete-capture error (IncompleteCaptureError), which keeps the cursor so the next tick retries from the same place. A lost cursor or wrapped log writes a single capture_gap row and re-baselines at the log’s current end, never a replay from zero, and the window of a disable is likewise reported only as a gap, never as its own events.

OS capability

Declared limits per leg (descriptor fallback text, verbatim):

• collect_fast / macOS — process/tcp fall back to a KERN_PROC_ALL/proc_pidfdinfo poll without the Endpoint Security entitlement or nstat root privilege; dns sub-source is PLANNED (no-op) on macOS; arp sub-source is native but constrained (route_sysctl, entry_type always ‘unknown’)
• collect_fast / Linux — dns sub-source is PLANNED (no-op) on Linux; arp sub-source is native (procfs, /proc/net/arp); core process/network/netqual collection is native
• collect_slow / macOS — service enumeration runs bounded argv (rung 2) via the shared subprocess runner; no startup_type; mapdrive source is wired but outbound-live-only (getfsstat, no username, no inbound, no history); netconn source is PLANNED (no-op) on macOS
• collect_slow / Linux — service enumeration runs bounded argv (rung 2) via the shared subprocess runner; startup_type reads ‘unknown’; netconn source is PLANNED (no-op) on Linux
• fleet_snapshot / macOS — inherent TOCTOU between pid enumeration and per-fd query; short-lived sockets may be missed
• snapshot / macOS — software collection is PLANNED on macOS; mapdrive is wired but outbound-live-only (getfsstat, no username, no inbound, no history); service enumeration runs bounded argv (rung 2) via the shared subprocess runner; process/tcp fall back to a poll without the Endpoint Security entitlement or nstat root privilege
• snapshot / Linux — software inventory collection is PLANNED (dpkg/rpm not yet wired) on Linux; service enumeration runs bounded argv (rung 2) via the shared subprocess runner

Privileges and prerequisites

Binaries/subprocesses/network: systemctl list-units --type=service --all --plain --no-pager --no-legend and launchctl list (both through the shared bounded-argv runner yuzu::agent::run_bounded_subprocess, never a shell string; see enumerate_services). The same runner executes smbstatus, wevtutil and journalctl for the mapdrive collector (enumerate_mapdrive, enumerate_mapdrive_history). Windows runs an ETW session on provider Microsoft-Windows-Kernel-Process (ProcEtwCollector::start) and a second session for module-load capture (ModuleEtwCollector::start). macOS runs an in-process Endpoint Security client (ProcEsCollector::start) and a PF_SYSTEM/SYSPROTO_CONTROL socket for the nstat client (NstatClient::start); Linux opens an AF_NETLINK/NETLINK_SOCK_DIAG socket for TCP quality (collect_tcp_quality). No popen, CreateProcess or posix_spawn call exists anywhere under agents/plugins/echo/src.

Data contract

Inputs

Outputs

Every action writes its response as a sequence of independent lines (one ctx.write_output call per line); most, but not all, actions follow the plugin-wide discriminator\|field\|field... pipe-delimited convention (see echo_status_format.hpp and echo_collectors.hpp). The four collection actions share one line shape, echo\|collect_<leg>\|<events_recorded>\|<token>, where <token> is one of source_disabled, unsupported_platform, baseline, sample_recorded, apps_recorded, cursor_advanced, cursor_lost, capture_incomplete, counters_unavailable, state_unreadable (the kCollectStatus* tokens in echo_collectors.hpp; state_unreadable is emitted by skip_token() in echo_plugin.cpp). Cursor sources (power, removable, registry) add their own echo|collect_<source>|<n>|<token> line to the collect_slow stream. status’s wire format is line-oriented key\|value pairs (storage_state\|ok, record_count\|<n>, config\|<key>\|<value>, …), not one positional row — the five YAML columns below correspond to five of those lines; the rest (config\|*, retention_guard\|*, retention_guard_failed\|*) are operational fields the YAML schema does not model. query’s rows match its five columns exactly, followed by an un-modelled total\|<n> summary line. sql (and every canned query in echo_warehouse.yaml) emits a leading __schema__\|<col>\|<col>... line, then one pipe-joined data line per row, then a trailing __total__\|<n> line — all three land in the single declared output column. snapshot’s and rollup’s actual lines do not decompose into their declared columns at all; see Caveats.

crossplatform.echo.collect_fast — events_recorded

crossplatform.echo.collect_slow — events_recorded

crossplatform.echo.compatibility — output

crossplatform.echo.configure — key|value

crossplatform.echo.connections_to_ip — output

crossplatform.echo.daily_connection_summary — output

crossplatform.echo.daily_process_summary — output

crossplatform.echo.export — json_output

crossplatform.echo.fleet_snapshot — json_output

crossplatform.echo.hourly_process_summary — output

crossplatform.echo.listening_ports — output

crossplatform.echo.process_tree — output

crossplatform.echo.query — timestamp|event_type|event_action|snapshot_id|detail_json

crossplatform.echo.recent_arp — output

crossplatform.echo.recent_dns — output

crossplatform.echo.recent_mapdrive — output

crossplatform.echo.recent_processes — output

crossplatform.echo.recent_processes_iso — output

crossplatform.echo.rollup — status|rows_aggregated

crossplatform.echo.service_state_changes — output

crossplatform.echo.snapshot — status|events_recorded

crossplatform.echo.sql — output

crossplatform.echo.status — record_count|oldest_timestamp|newest_timestamp|db_size_bytes|retention_days

crossplatform.echo.tcp_by_process — output

crossplatform.echo.user_sessions — output

Actions without a definition. collect_perf writes echo\|collect_perf\|<n>\|<token>, the same shape as collect_fast/collect_slow (see do_collect_perf in echo_plugin.cpp). collect_software follows the same convention. A failed perf/procperf counter read reports counters_unavailable where the registry lists the OS as supported and unsupported_platform where it has no perf collector. status additionally emits db_health|<ok|quarantined>|<epoch>, config|perf_capture_method|<m>, config|procperf_procs_seen|<n> and, per capture source, config|<src>_last_status|<token>, config|<src>_consecutive_failures|<n> and config|<src>_last_status_at|<epoch> (process memory only; see the user manual). A failed baseline-only save emits error|<source> state_save_failed. purge_source writes a single JSON line, {"source":"<name>","rows_deleted":<n>,"status":"purged"} (see do_purge_source in echo_plugin.cpp), or an error| line if the named source is unknown, still enabled, or its enable flag cannot be read (config_unreadable).

Empty-result / not-yet-collected convention. A planned leg (see Capture sources by OS) ships its schema and config key with no collector, so its $..._* tables stay queryable and empty, which means “not yet collecting”, never “nothing happened”. module is the clearest case: Windows has a collector (ETW), Linux and macOS do not. The registry source is unsupported off Windows: the Windows registry does not exist there, so it records nothing and compatibility says so.

Result status

Echo sets a typed plugin_result_status in exactly one place in the whole plugin: do_snapshot calls ctx.set_result_status(YUZU_RESULT_STATUS_CONSTRAINED, YUZU_RESULT_COMPLETENESS_PARTIAL, "echo:snapshot_skipped_sources") when any capture source retained a stale baseline instead of collecting during a forced snapshot. No other action — including status, query, sql, rollup, collect_fast/collect_slow, and the early db_ guard that every action shares — ever calls the setter, so the agent records the default UNDECLARED / UNKNOWN for everything else, exactly as every sample below shows.

Where the data goes

• Instruction result, primarily. status/query/export/sql/compatibility rows travel over the agent’s mTLS gRPC channel as the command response and land in the ResponseStore, queryable at /api/responses/{id} and rendered by the /echo dashboard (docs/echo-dashboard.md, docs/echo-implementer.md).
• fleet_snapshot feeds the server-side FleetTopologyStore on a cache miss, assembling the 3D /viz/fleet topology view (the fleet_snapshot definition in echo.yaml); it is not itself a warehouse read.
• rollup/purge_source mutate echo.db directly (aggregation, retention, source purge) — their effect is visible through later status/query/sql reads, not a separate sink.
• Not consumed by daily-sync inventory, DEX, or metrics — Echo has no /metrics endpoint; status’s retention-guard counters are the plugin’s only fleet-readable health signal (do_status in echo_plugin.cpp and format_retention_guard_lines in echo_aggregator.hpp).
• Sensitivity. user events name the logged-in account; process events carry the invoking user and, on Linux only, the command line (Windows and macOS capture names only; where a command line is kept it is redacted only against the configured *password*-style substring patterns); network/arp events carry remote IP/MAC addresses (device identifiers) and the owning process_name; the software source is an installed-software inventory (name/publisher/version) reachable via query type=software/sql; dns/mapdrive add resolved hostnames and mapped-drive usernames/remote hosts; removable events name an attached device’s vendor/product/serial and its BSD/udev device name; registry rows hold the old and new data of every changed watched value, unmasked.
• Siblings: crossplatform.echo.* (this plugin) is standalone; the installed_software daily-sync source (ADR-0016) is a separate, machine-scope inventory feed, distinct from Echo’s software capture source.
• MCP / REST. Discover: discover_plugins (summary) → yuzu://plugin-docs (this page as data) → discover_instructions / get_definition("crossplatform.echo.status"). Run: execute_instruction {definition_id, parameters}. Read: /api/responses/{id}, and /viz/fleet for fleet_snapshot.

Sample output

Windows — captured: windows Microsoft Windows NT 10.0.26200.0 x64 · bare-metal · 2026-09-07 · SYSTEM · leg-hash 20eab902257c

== action=status
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=query
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=snapshot
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=export
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=configure
[not captured] Mutating/Reversible: not executed on a live host

== action=collect_fast
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=collect_slow
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=collect_perf
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=collect_software
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=rollup
[not captured] Destructive/Irreversible: not executed on a live host

== action=sql sql="SELECT 1"
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=compatibility
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=fleet_snapshot
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=purge_source
[not captured] Destructive/Irreversible: not executed on a live host

macOS — captured: macos macOS 26.6.2 arm64 · bare-metal · 2026-09-07 · euid 501 (jsmith) · leg-hash 20eab902257c

== action=status
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=query
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=snapshot
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=export
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=configure
[not captured] Mutating/Reversible: not executed on a live host

== action=collect_fast
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=collect_slow
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=collect_perf
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=collect_software
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=rollup
[not captured] Destructive/Irreversible: not executed on a live host

== action=sql sql="SELECT 1"
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=compatibility
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=fleet_snapshot
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=purge_source
[not captured] Destructive/Irreversible: not executed on a live host

Linux — captured: linux Debian GNU/Linux 13 (trixie) aarch64 · container · 2026-09-06 · euid 0 · leg-hash 20eab902257c

== action=status
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=query
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=snapshot
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=export
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=configure
[not captured] Mutating/Reversible: not executed on a live host

== action=collect_fast
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=collect_slow
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=collect_perf
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=collect_software
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=rollup
[not captured] Destructive/Irreversible: not executed on a live host

== action=sql sql="SELECT 1"
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=compatibility
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=fleet_snapshot
error|Echo database not initialized
[result_status] UNDECLARED / UNKNOWN
[rc] 1

== action=purge_source
[not captured] Destructive/Irreversible: not executed on a live host

Every read-capable action on every OS returns the identical error|Echo database not initialized / rc=1 pair, including sql (invoked with sql="SELECT 1") and compatibility (a static-metadata action that touches neither the database nor the filesystem per its own description). This is not three broken legs; it is one chokepoint. See Caveats item 1.

Caveats and known gaps

1. No sample exercises a real action. execute() returns error|Echo database not initialized with rc 1 whenever the plugin’s database handle is null, and that handle is opened only by init() (through EchoDatabase::open), which the plugin-capture driver never calls. Every action in the samples above, including compatibility which needs no database, fails at that one guard, so the samples show only that the plugin loads.
2. rollup is Destructive/Irreversible and its output is positional. do_rollup always runs run_aggregation() before run_retention(), which permanently deletes aged rows. Its response is the single line echo|rollup|<n>|rows_aggregated, so the declared status column is never populated, and snapshot has the same gap (echo|snapshot|complete or partial|<sources> carries no event count).
3. retention_days does not set how long data is kept. The setting is validated, stored and echoed by status, but run_retention prunes each tier against the window in the schema registry (row-count caps on live tables, typically 24 hours for hourly, 31 days for daily and about a year for monthly). Changing it alters nothing that is deleted.
4. Several legs are declared but have no collector. perf and procperf on macOS, software on Linux and macOS, module on Linux and macOS, and dns and netconn on Linux and macOS are planned: no code path exists for them (confirmed absent in echo_perf.cpp, echo_proc_perf.cpp and the non-Windows branch of echo_software_collector.cpp). A planned leg’s table is queryable and empty, which means “not yet collecting”, never “nothing happened”.
5. Registry capture stores values unmasked and does not name the writer. Every watched value, changed or not, is readable through sql (the per-key baseline in echo_state holds the current values, for example a Winlogon autologon DefaultPassword), and every row’s actor_pid is 0. A value written and reverted between two reads is not recorded, and a user hive that loads at logon is baselined silently at its first read.

Source and tests

• Plugin: agents/plugins/echo/src/echo_aggregator.cpp · agents/plugins/echo/src/echo_aggregator.hpp · agents/plugins/echo/src/echo_arp_collector.cpp · agents/plugins/echo/src/echo_arp_parsers.hpp · agents/plugins/echo/src/echo_capture_status.hpp · agents/plugins/echo/src/echo_collectors.hpp · agents/plugins/echo/src/echo_cursor.hpp · agents/plugins/echo/src/echo_cursor_sources.cpp · agents/plugins/echo/src/echo_db.cpp · agents/plugins/echo/src/echo_db.hpp · agents/plugins/echo/src/echo_diff.cpp · agents/plugins/echo/src/echo_dns_collector.cpp · agents/plugins/echo/src/echo_fleet_snapshot.cpp · agents/plugins/echo/src/echo_fleet_snapshot.hpp · agents/plugins/echo/src/echo_local_image_path.hpp · agents/plugins/echo/src/echo_mapdrive_backfill.hpp · agents/plugins/echo/src/echo_mapdrive_collector.cpp · agents/plugins/echo/src/echo_mapdrive_macos_parsers.hpp · agents/plugins/echo/src/echo_module_etw.cpp · agents/plugins/echo/src/echo_module_etw.hpp · agents/plugins/echo/src/echo_module_stream.cpp · agents/plugins/echo/src/echo_module_stream.hpp · agents/plugins/echo/src/echo_netconn.hpp · agents/plugins/echo/src/echo_netconn_win.cpp · agents/plugins/echo/src/echo_netqual.hpp · agents/plugins/echo/src/echo_netqual_boot.cpp · agents/plugins/echo/src/echo_netqual_boot.hpp · agents/plugins/echo/src/echo_netqual_nstat.cpp · agents/plugins/echo/src/echo_netqual_nstat.hpp · agents/plugins/echo/src/echo_network_collector.cpp · agents/plugins/echo/src/echo_perf.cpp · agents/plugins/echo/src/echo_perf.hpp · agents/plugins/echo/src/echo_plugin.cpp · agents/plugins/echo/src/echo_power_collector.cpp · agents/plugins/echo/src/echo_power_parsers.hpp · agents/plugins/echo/src/echo_proc_es.cpp · agents/plugins/echo/src/echo_proc_es.hpp · agents/plugins/echo/src/echo_proc_etw.cpp · agents/plugins/echo/src/echo_proc_etw.hpp · agents/plugins/echo/src/echo_proc_perf.cpp · agents/plugins/echo/src/echo_proc_perf.hpp · agents/plugins/echo/src/echo_proc_stream.cpp · agents/plugins/echo/src/echo_proc_stream.hpp · agents/plugins/echo/src/echo_registry_parsers.hpp · agents/plugins/echo/src/echo_registry_source.cpp · agents/plugins/echo/src/echo_registry_source.hpp · agents/plugins/echo/src/echo_removable_collector.cpp · agents/plugins/echo/src/echo_removable_diskarb.mm · agents/plugins/echo/src/echo_removable_parsers.hpp · agents/plugins/echo/src/echo_schema_registry.cpp · agents/plugins/echo/src/echo_schema_registry.hpp · agents/plugins/echo/src/echo_service_collector.cpp · agents/plugins/echo/src/echo_service_parsers.hpp · agents/plugins/echo/src/echo_software_collector.cpp · agents/plugins/echo/src/echo_software_core.cpp · agents/plugins/echo/src/echo_software_core.hpp · agents/plugins/echo/src/echo_source_health.hpp · agents/plugins/echo/src/echo_sql_executor.cpp · agents/plugins/echo/src/echo_sql_executor.hpp · agents/plugins/echo/src/echo_status_format.hpp · agents/plugins/echo/src/echo_usage.cpp · agents/plugins/echo/src/echo_usage.hpp · agents/plugins/echo/src/echo_user_collector.cpp · agents/plugins/echo/src/echo_version.hpp · agents/plugins/echo/src/echo_win_process_name.hpp · agents/plugins/echo/src/echo_win_raii_guards.hpp
• Definitions: content/definitions/echo.yaml · content/definitions/echo_warehouse.yaml
• Capability rows: server/core/src/capability_decls/core_dispatch_capabilities.hpp · server/core/src/capability_decls/plugin_action_catalogue_a.hpp
• Tests: tests/test_echo_adoption_wiring_lexical.py · tests/test_echo_mapdrive_pin_lexical.py · tests/test_echo_timeline_script_behaviour.py · tests/unit/server/test_echo_process_tree.cpp · tests/unit/server/test_echo_rename_migration_pg.cpp · tests/unit/server/test_echo_retention_tiers.cpp · tests/unit/server/test_echo_timeline_page.cpp · tests/unit/server/test_echo_timeline_render.cpp · tests/unit/server/test_echo_tree_routes.cpp · tests/unit/test_echo_aggregator.cpp · tests/unit/test_echo_arp.cpp · tests/unit/test_echo_capability_table.cpp · tests/unit/test_echo_capture_status.cpp · tests/unit/test_echo_cursor.cpp · tests/unit/test_echo_diff.cpp · tests/unit/test_echo_local_dispatcher.cpp · tests/unit/test_echo_mapdrive.cpp · tests/unit/test_echo_module_etw.cpp · tests/unit/test_echo_module_stream.cpp · tests/unit/test_echo_netconn.cpp · tests/unit/test_echo_netqual_nstat.cpp · tests/unit/test_echo_perf.cpp · tests/unit/test_echo_power.cpp · tests/unit/test_echo_proc_es.cpp · tests/unit/test_echo_proc_etw.cpp · tests/unit/test_echo_proc_perf.cpp · tests/unit/test_echo_registry_source.cpp · tests/unit/test_echo_removable.cpp · tests/unit/test_echo_retention_tiers_table.cpp · tests/unit/test_echo_schema_registry.cpp · tests/unit/test_echo_service.cpp · tests/unit/test_echo_software.cpp · tests/unit/test_echo_source_health.cpp · tests/unit/test_echo_store.cpp · tests/unit/test_echo_usage.cpp · tests/unit/test_echo_warehouse.cpp · tests/unit/test_echo_win_raii_guards.cpp
• Privilege row: docs/agent-privilege-model.md