Transparency is not optional.
It's the foundation.

// ReadCPUStats reads /proc/stat and returns CPU counters
func ReadCPUStats() (*CPUStats, error) {
    data, err := os.ReadFile("/proc/stat")
    if err != nil {
        return nil, err
    }
    // Parse first line: cpu user nice system idle ...
    fields := strings.Fields(lines[0])
    return &CPUStats{
        User:   parseUint(fields[1]),
        System: parseUint(fields[3]),
        Idle:   parseUint(fields[4]),
        IOWait: parseUint(fields[5]),
    }, nil
}

// PostMetrics sends collected metrics to the HostAtlas API
func (c *Client) PostMetrics(m *Metrics) error {
    payload, _ := json.Marshal(m)
    req, _ := http.NewRequest(
        "POST",
        c.baseURL + "/agent/metrics",
        bytes.NewReader(payload),
    )
    req.Header.Set("Authorization", "Bearer "+c.token)
    req.Header.Set("Content-Type", "application/json")
    resp, err := c.http.Do(req)
    // Only outbound. No listeners. No open ports.
    return err
}

// knownServices defines which processes to detect
var knownServices = []ServiceDef{
    {Name: "nginx",      Binary: "nginx"},
    {Name: "apache2",    Binary: "apache2"},
    {Name: "mysql",      Binary: "mysqld"},
    {Name: "postgresql", Binary: "postgres"},
    {Name: "redis",      Binary: "redis-server"},
    {Name: "caddy",      Binary: "caddy"},
}

// ScanServices checks /proc for known service processes
func ScanServices() ([]Service, error) {
    entries, _ := os.ReadDir("/proc")
    for _, e := range entries {
        cmdline := readFile("/proc/"+e.Name()+"/cmdline")
        // Match against known binaries only
    }
}

// allowedCommands is the exhaustive whitelist
var allowedCommands = map[string]CommandDef{
    "service_status": {
        Cmd:     "systemctl",
        Args:    []string{"is-active", "{service}"},
        Timeout: 5 * time.Second,
    },
    "disk_usage": {
        Cmd:     "df",
        Args:    []string{"-h"},
        Timeout: 5 * time.Second,
    },
    "uptime": {
        Cmd:     "uptime",
        Args:    []string{},
        Timeout: 3 * time.Second,
    },
}

func Execute(name string) (string, error) {
    cmd, ok := allowedCommands[name]
    if !ok {
        return "", ErrCommandNotAllowed
    }
    // Direct exec, no shell interpretation
}

# Log files are opt-in, not auto-detected
logs:
  enabled: true
  paths:
    - /var/log/nginx/access.log
    - /var/log/nginx/error.log
    - /var/log/syslog
  max_lines_per_second: 500
  max_line_length: 4096