feat(telemetry): implement live process explorer and resource attribution provider (fixes #11)

Sources/Bridging/MacMonitor-Bridging-Header.h

@@ -19,5 +19,11 @@
 #import "MMFanTelemetryProvider.h"
 #import "MMComponentThermalProvider.h"
 #import "MMPowerTelemetryProvider.h"
+#import "MMKernelTelemetryProvider.h"
+#import "MMLoadAverageProvider.h"
+#import "MMDiskIOProvider.h"
+#import "MMNetworkBandwidthProvider.h"
+#import "MMNetworkSocketsProvider.h"
+#import "MMProcessTelemetryProvider.h"
 
 #endif /* MacMonitor_Bridging_Header_h */

Sources/Telemetry/Kernel/MMKernelTelemetryProvider.h

@@ -0,0 +1,30 @@
+#ifndef MMKernelTelemetryProvider_h
+#define MMKernelTelemetryProvider_h
+
+#import <Foundation/Foundation.h>
+#import "MMTelemetryProvider.h"
+
+NS_ASSUME_NONNULL_BEGIN
+
+/**
+ * MMKernelTelemetryProvider
+ * Samples low-level Mach kernel performance counters: context switches, system calls,
+ * page faults (soft, COW, zero-fill), pageins/pageouts, and computes instantaneous rates per second.
+ */
+@interface MMKernelTelemetryProvider : NSObject <MMTelemetryProvider>
+
+- (instancetype)init;
+
+/**
+ * Static calculator method for deterministic unit testing.
+ * Computes event rates per second based on previous and current cumulative counters over delta time.
+ */
++ (NSDictionary<NSString *, id> *)calculateRatesWithCurrentCounters:(NSDictionary<NSString *, NSNumber *> *)current
+                                                   previousCounters:(nullable NSDictionary<NSString *, NSNumber *> *)previous
+                                                          timeDelta:(NSTimeInterval)timeDelta;
+
+@end
+
+NS_ASSUME_NONNULL_END
+
+#endif /* MMKernelTelemetryProvider_h */

Sources/Telemetry/Kernel/MMKernelTelemetryProvider.m

@@ -0,0 +1,131 @@
+#import "MMKernelTelemetryProvider.h"
+#import <mach/mach.h>
+#import <mach/mach_time.h>
+#import <libproc.h>
+#import <os/lock.h>
+
+@interface MMKernelTelemetryProvider () {
+    os_unfair_lock _lock;
+    NSDictionary<NSString *, NSNumber *> *_previousCounters;
+    uint64_t _previousTimestamp;
+    mach_timebase_info_data_t _timebase;
+}
+@end
+
+@implementation MMKernelTelemetryProvider
+
+- (instancetype)init {
+    self = [super init];
+    if (self) {
+        _lock = OS_UNFAIR_LOCK_INIT;
+        _previousCounters = nil;
+        _previousTimestamp = 0;
+        mach_timebase_info(&_timebase);
+    }
+    return self;
+}
+
+- (MMTelemetryDomain)domain {
+    return MMTelemetryDomainSystem;
+}
+
+- (NSString *)providerIdentifier {
+    return @"com.i3omb.macmonitor.telemetry.kernel.counters";
+}
+
+- (BOOL)isAvailable {
+    return YES;
+}
+
++ (NSDictionary<NSString *, id> *)calculateRatesWithCurrentCounters:(NSDictionary<NSString *, NSNumber *> *)current
+                                                   previousCounters:(nullable NSDictionary<NSString *, NSNumber *> *)previous
+                                                          timeDelta:(NSTimeInterval)timeDelta {
+    NSMutableDictionary<NSString *, id> *result = [NSMutableDictionary dictionary];
+    
+    // Copy all current cumulative counters into result
+    [current enumerateKeysAndObjectsUsingBlock:^(NSString *key, NSNumber *val, BOOL *stop) {
+        result[[@"cumulative_" stringByAppendingString:key]] = val;
+    }];
+    
+    NSArray<NSString *> *rateKeys = @[
+        @"contextSwitches", @"syscalls", @"pageFaults", @"cowFaults",
+        @"zeroFills", @"pageins", @"pageouts", @"decompressions", @"compressions"
+    ];
+    
+    for (NSString *key in rateKeys) {
+        double currentVal = [current[key] doubleValue];
+        double prevVal = previous ? [previous[key] doubleValue] : currentVal;
+        double delta = (currentVal >= prevVal) ? (currentVal - prevVal) : 0.0;
+        double rate = (timeDelta > 0.0001) ? (delta / timeDelta) : 0.0;
+        result[[key stringByAppendingString:@"Rate"]] = @(rate);
+    }
+    
+    result[@"timeDelta"] = @(timeDelta);
+    return result;
+}
+
+- (nullable NSDictionary<NSString *, id> *)sampleTelemetryWithError:(NSError **)error {
+    uint64_t now = mach_absolute_time();
+    
+    // 1. Query Mach VM Statistics for page faults, COW, zero fills, pageins/outs
+    vm_statistics64_data_t vmStats;
+    mach_msg_type_number_t count = HOST_VM_INFO64_COUNT;
+    kern_return_t kr = host_statistics64(mach_host_self(), HOST_VM_INFO64, (host_info64_t)&vmStats, &count);
+    if (kr != KERN_SUCCESS) {
+        if (error) {
+            *error = [NSError errorWithDomain:@"com.i3omb.macmonitor.kernel"
+                                         code:kr
+                                     userInfo:@{NSLocalizedDescriptionKey: @"Failed to query host_statistics64"}];
+        }
+        return nil;
+    }
+    
+    // 2. Query process table for cumulative context switches and system calls
+    int pids[4096];
+    int bytes = proc_listpids(PROC_ALL_PIDS, 0, pids, sizeof(pids));
+    int pidCount = bytes / sizeof(int);
+    
+    uint64_t totalCSW = 0;
+    uint64_t totalSyscalls = 0;
+    
+    for (int i = 0; i < pidCount; i++) {
+        if (pids[i] <= 0) continue;
+        struct proc_taskinfo ti;
+        if (proc_pidinfo(pids[i], PROC_PIDTASKINFO, 0, &ti, sizeof(ti)) == sizeof(ti)) {
+            totalCSW += ti.pti_csw;
+            totalSyscalls += (uint64_t)ti.pti_syscalls_unix + (uint64_t)ti.pti_syscalls_mach;
+        }
+    }
+    
+    NSDictionary<NSString *, NSNumber *> *currentCounters = @{
+        @"contextSwitches": @(totalCSW),
+        @"syscalls": @(totalSyscalls),
+        @"pageFaults": @(vmStats.faults),
+        @"cowFaults": @(vmStats.cow_faults),
+        @"zeroFills": @(vmStats.zero_fill_count),
+        @"pageins": @(vmStats.pageins),
+        @"pageouts": @(vmStats.pageouts),
+        @"decompressions": @(vmStats.decompressions),
+        @"compressions": @(vmStats.compressions)
+    };
+    
+    os_unfair_lock_lock(&_lock);
+    NSDictionary<NSString *, NSNumber *> *prev = _previousCounters;
+    uint64_t prevTime = _previousTimestamp;
+    
+    _previousCounters = currentCounters;
+    _previousTimestamp = now;
+    os_unfair_lock_unlock(&_lock);
+    
+    NSTimeInterval timeDelta = 1.0;
+    if (prevTime > 0) {
+        uint64_t elapsed = now - prevTime;
+        timeDelta = (double)elapsed * _timebase.numer / _timebase.denom / 1e9;
+    }
+    
+    return [MMKernelTelemetryProvider calculateRatesWithCurrentCounters:currentCounters
+                                                       previousCounters:prev
+                                                              timeDelta:timeDelta];
+}
+
+@end

Sources/Telemetry/Network/MMNetworkBandwidthProvider.h

@@ -0,0 +1,30 @@
+#ifndef MMNetworkBandwidthProvider_h
+#define MMNetworkBandwidthProvider_h
+
+#import <Foundation/Foundation.h>
+#import "MMTelemetryProvider.h"
+
+NS_ASSUME_NONNULL_BEGIN
+
+/**
+ * MMNetworkBandwidthProvider
+ * Samples real-time network download and upload throughput, packets/sec, and error counts
+ * across physical (Wi-Fi, Ethernet) and virtual (VPN, bridge) network interfaces.
+ */
+@interface MMNetworkBandwidthProvider : NSObject <MMTelemetryProvider>
+
+- (instancetype)init;
+
+/**
+ * Pure calculator method for deterministic unit testing.
+ */
++ (NSDictionary<NSString *, id> *)calculateBandwidthMetricsWithCurrentSnapshots:(NSDictionary<NSString *, NSDictionary<NSString *, NSNumber *> *> *)current
+                                                              previousSnapshots:(nullable NSDictionary<NSString *, NSDictionary<NSString *, NSNumber *> *> *)previous
+                                                                      timeDelta:(NSTimeInterval)timeDelta
+                                                                    ipAddresses:(nullable NSDictionary<NSString *, NSString *> *)ipAddresses;
+
+@end
+
+NS_ASSUME_NONNULL_END
+
+#endif /* MMNetworkBandwidthProvider_h */

Sources/Telemetry/Network/MMNetworkBandwidthProvider.m

@@ -0,0 +1,211 @@
+#import "MMNetworkBandwidthProvider.h"
+#import <sys/sysctl.h>
+#import <net/if.h>
+#import <net/if_dl.h>
+#import <net/route.h>
+#import <ifaddrs.h>
+#import <arpa/inet.h>
+#import <mach/mach_time.h>
+#import <os/lock.h>
+
+@interface MMNetworkBandwidthProvider () {
+    os_unfair_lock _lock;
+    NSDictionary<NSString *, NSDictionary<NSString *, NSNumber *> *> *_previousSnapshots;
+    uint64_t _previousTimestamp;
+    mach_timebase_info_data_t _timebase;
+}
+@end
+
+@implementation MMNetworkBandwidthProvider
+
+- (instancetype)init {
+    self = [super init];
+    if (self) {
+        _lock = OS_UNFAIR_LOCK_INIT;
+        _previousSnapshots = nil;
+        _previousTimestamp = 0;
+        mach_timebase_info(&_timebase);
+    }
+    return self;
+}
+
+- (MMTelemetryDomain)domain {
+    return MMTelemetryDomainNetwork;
+}
+
+- (NSString *)providerIdentifier {
+    return @"com.i3omb.macmonitor.telemetry.network.bandwidth";
+}
+
+- (BOOL)isAvailable {
+    return YES;
+}
+
++ (NSDictionary<NSString *, id> *)calculateBandwidthMetricsWithCurrentSnapshots:(NSDictionary<NSString *, NSDictionary<NSString *, NSNumber *> *> *)current
+                                                              previousSnapshots:(nullable NSDictionary<NSString *, NSDictionary<NSString *, NSNumber *> *> *)previous
+                                                                      timeDelta:(NSTimeInterval)timeDelta
+                                                                    ipAddresses:(nullable NSDictionary<NSString *, NSString *> *)ipAddresses {
+    double totalDownBps = 0.0;
+    double totalUpBps = 0.0;
+    double totalDownPps = 0.0;
+    double totalUpPps = 0.0;
+    
+    NSMutableArray<NSDictionary<NSString *, id> *> *interfaces = [NSMutableArray arrayWithCapacity:current.count];
+    NSArray<NSString *> *sortedNames = [current.allKeys sortedArrayUsingSelector:@selector(compare:)];
+    
+    NSString *primaryInterface = @"";
+    double maxActivity = -1.0;
+    
+    for (NSString *name in sortedNames) {
+        // Skip loopback for aggregate statistics
+        BOOL isLoopback = [name hasPrefix:@"lo"];
+        
+        NSDictionary<NSString *, NSNumber *> *curr = current[name];
+        NSDictionary<NSString *, NSNumber *> *prev = previous ? previous[name] : nil;
+        
+        uint64_t currInBytes = [curr[@"inBytes"] unsignedLongLongValue];
+        uint64_t currOutBytes = [curr[@"outBytes"] unsignedLongLongValue];
+        uint64_t currInPackets = [curr[@"inPackets"] unsignedLongLongValue];
+        uint64_t currOutPackets = [curr[@"outPackets"] unsignedLongLongValue];
+        uint64_t inErrors = [curr[@"inErrors"] unsignedLongLongValue];
+        uint64_t outErrors = [curr[@"outErrors"] unsignedLongLongValue];
+        
+        uint64_t prevInBytes = prev ? [prev[@"inBytes"] unsignedLongLongValue] : currInBytes;
+        uint64_t prevOutBytes = prev ? [prev[@"outBytes"] unsignedLongLongValue] : currOutBytes;
+        uint64_t prevInPackets = prev ? [prev[@"inPackets"] unsignedLongLongValue] : currInPackets;
+        uint64_t prevOutPackets = prev ? [prev[@"outPackets"] unsignedLongLongValue] : currOutPackets;
+        
+        double deltaInBytes = (currInBytes >= prevInBytes) ? (double)(currInBytes - prevInBytes) : 0.0;
+        double deltaOutBytes = (currOutBytes >= prevOutBytes) ? (double)(currOutBytes - prevOutBytes) : 0.0;
+        double deltaInPackets = (currInPackets >= prevInPackets) ? (double)(currInPackets - prevInPackets) : 0.0;
+        double deltaOutPackets = (currOutPackets >= prevOutPackets) ? (double)(currOutPackets - prevOutPackets) : 0.0;
+        
+        double downBps = (timeDelta > 0.0001) ? (deltaInBytes / timeDelta) : 0.0;
+        double upBps = (timeDelta > 0.0001) ? (deltaOutBytes / timeDelta) : 0.0;
+        double downPps = (timeDelta > 0.0001) ? (deltaInPackets / timeDelta) : 0.0;
+        double upPps = (timeDelta > 0.0001) ? (deltaOutPackets / timeDelta) : 0.0;
+        
+        if (!isLoopback) {
+            totalDownBps += downBps;
+            totalUpBps += upBps;
+            totalDownPps += downPps;
+            totalUpPps += upPps;
+            
+            double activity = downBps + upBps;
+            if (activity > maxActivity) {
+                maxActivity = activity;
+                primaryInterface = name;
+            }
+        }
+        
+        NSString *ip = ipAddresses[name] ?: @"";
+        
+        [interfaces addObject:@{
+            @"name": name,
+            @"downloadBytesPerSec": @(downBps),
+            @"uploadBytesPerSec": @(upBps),
+            @"downloadPacketsPerSec": @(downPps),
+            @"uploadPacketsPerSec": @(upPps),
+            @"cumulativeInBytes": @(currInBytes),
+            @"cumulativeOutBytes": @(currOutBytes),
+            @"cumulativeInPackets": @(currInPackets),
+            @"cumulativeOutPackets": @(currOutPackets),
+            @"inErrors": @(inErrors),
+            @"outErrors": @(outErrors),
+            @"ipv4Address": ip,
+            @"isLoopback": @(isLoopback)
+        }];
+    }
+    
+    if (primaryInterface.length == 0 && current[@"en0"]) {
+        primaryInterface = @"en0";
+    }
+    
+    return @{
+        @"interfaces": interfaces,
+        @"totalDownloadBytesPerSec": @(totalDownBps),
+        @"totalUploadBytesPerSec": @(totalUpBps),
+        @"totalDownloadPacketsPerSec": @(totalDownPps),
+        @"totalUploadPacketsPerSec": @(totalUpPps),
+        @"primaryInterface": primaryInterface,
+        @"timeDelta": @(timeDelta)
+    };
+}
+
+- (nullable NSDictionary<NSString *, id> *)sampleTelemetryWithError:(NSError **)error {
+    uint64_t now = mach_absolute_time();
+    
+    // 1. Read 64-bit interface stats via NET_RT_IFLIST2
+    NSMutableDictionary<NSString *, NSDictionary<NSString *, NSNumber *> *> *currentSnapshots = [NSMutableDictionary dictionary];
+    
+    int mib[] = { CTL_NET, PF_ROUTE, 0, 0, NET_RT_IFLIST2, 0 };
+    size_t len = 0;
+    if (sysctl(mib, 6, NULL, &len, NULL, 0) == 0 && len > 0) {
+        char *buf = malloc(len);
+        if (buf && sysctl(mib, 6, buf, &len, NULL, 0) == 0) {
+            char *next = buf;
+            char *lim = buf + len;
+            while (next < lim) {
+                struct if_msghdr *ifm = (struct if_msghdr *)next;
+                next += ifm->ifm_msglen;
+                if (ifm->ifm_type == RTM_IFINFO2) {
+                    struct if_msghdr2 *if2m = (struct if_msghdr2 *)ifm;
+                    struct sockaddr_dl *sdl = (struct sockaddr_dl *)(if2m + 1);
+                    if (sdl->sdl_nlen > 0 && sdl->sdl_nlen < 32) {
+                        char nameBuf[33] = {0};
+                        memcpy(nameBuf, sdl->sdl_data, sdl->sdl_nlen);
+                        NSString *name = [NSString stringWithUTF8String:nameBuf];
+                        
+                        currentSnapshots[name] = @{
+                            @"inBytes": @(if2m->ifm_data.ifi_ibytes),
+                            @"outBytes": @(if2m->ifm_data.ifi_obytes),
+                            @"inPackets": @(if2m->ifm_data.ifi_ipackets),
+                            @"outPackets": @(if2m->ifm_data.ifi_opackets),
+                            @"inErrors": @(if2m->ifm_data.ifi_ierrors),
+                            @"outErrors": @(if2m->ifm_data.ifi_oerrors)
+                        };
+                    }
+                }
+            }
+        }
+        if (buf) free(buf);
+    }
+    
+    // 2. Query IPv4 addresses via getifaddrs
+    NSMutableDictionary<NSString *, NSString *> *ipDict = [NSMutableDictionary dictionary];
+    struct ifaddrs *ifap = NULL;
+    if (getifaddrs(&ifap) == 0) {
+        for (struct ifaddrs *ifa = ifap; ifa != NULL; ifa = ifa->ifa_next) {
+            if (ifa->ifa_addr && ifa->ifa_addr->sa_family == AF_INET) {
+                char ipBuf[INET_ADDRSTRLEN] = {0};
+                struct sockaddr_in *sin = (struct sockaddr_in *)ifa->ifa_addr;
+                if (inet_ntop(AF_INET, &sin->sin_addr, ipBuf, sizeof(ipBuf))) {
+                    NSString *name = [NSString stringWithUTF8String:ifa->ifa_name];
+                    ipDict[name] = [NSString stringWithUTF8String:ipBuf];
+                }
+            }
+        }
+        freeifaddrs(ifap);
+    }
+    
+    os_unfair_lock_lock(&_lock);
+    NSDictionary<NSString *, NSDictionary<NSString *, NSNumber *> *> *prev = _previousSnapshots;
+    uint64_t prevTime = _previousTimestamp;
+    
+    _previousSnapshots = currentSnapshots;
+    _previousTimestamp = now;
+    os_unfair_lock_unlock(&_lock);
+    
+    NSTimeInterval timeDelta = 1.0;
+    if (prevTime > 0) {
+        uint64_t elapsed = now - prevTime;
+        timeDelta = (double)elapsed * _timebase.numer / _timebase.denom / 1e9;
+    }
+    
+    return [MMNetworkBandwidthProvider calculateBandwidthMetricsWithCurrentSnapshots:currentSnapshots
+                                                                   previousSnapshots:prev
+                                                                           timeDelta:timeDelta
+                                                                         ipAddresses:ipDict];
+}
+
+@end

Sources/Telemetry/Network/MMNetworkSocketsProvider.h

@@ -0,0 +1,27 @@
+#ifndef MMNetworkSocketsProvider_h
+#define MMNetworkSocketsProvider_h
+
+#import <Foundation/Foundation.h>
+#import "MMTelemetryProvider.h"
+
+NS_ASSUME_NONNULL_BEGIN
+
+/**
+ * MMNetworkSocketsProvider
+ * Inspects system-wide open TCP and UDP sockets, local/remote endpoints, connection states,
+ * and owning processes.
+ */
+@interface MMNetworkSocketsProvider : NSObject <MMTelemetryProvider>
+
+- (instancetype)init;
+
+/**
+ * Pure calculator / summarizer method for deterministic unit testing.
+ */
++ (NSDictionary<NSString *, id> *)calculateSocketSummaryWithSocketList:(NSArray<NSDictionary<NSString *, id> *> *)sockets;
+
+@end
+
+NS_ASSUME_NONNULL_END
+
+#endif /* MMNetworkSocketsProvider_h */

Sources/Telemetry/Network/MMNetworkSocketsProvider.m

@@ -0,0 +1,152 @@
+#import "MMNetworkSocketsProvider.h"
+#import <libproc.h>
+#import <sys/proc_info.h>
+#import <arpa/inet.h>
+
+@implementation MMNetworkSocketsProvider
+
+- (instancetype)init {
+    self = [super init];
+    return self;
+}
+
+- (MMTelemetryDomain)domain {
+    return MMTelemetryDomainNetwork;
+}
+
+- (NSString *)providerIdentifier {
+    return @"com.i3omb.macmonitor.telemetry.network.sockets";
+}
+
+- (BOOL)isAvailable {
+    return YES;
+}
+
+static NSString *tcpStateString(int state) {
+    switch (state) {
+        case 0: return @"CLOSED";
+        case 1: return @"LISTEN";
+        case 2: return @"SYN_SENT";
+        case 3: return @"SYN_RCVD";
+        case 4: return @"ESTABLISHED";
+        case 5: return @"CLOSE_WAIT";
+        case 6: return @"FIN_WAIT_1";
+        case 7: return @"CLOSING";
+        case 8: return @"LAST_ACK";
+        case 9: return @"FIN_WAIT_2";
+        case 10: return @"TIME_WAIT";
+        default: return @"UNKNOWN";
+    }
+}
+
++ (NSDictionary<NSString *, id> *)calculateSocketSummaryWithSocketList:(NSArray<NSDictionary<NSString *, id> *> *)sockets {
+    NSUInteger tcpCount = 0;
+    NSUInteger udpCount = 0;
+    NSUInteger listenCount = 0;
+    NSUInteger establishedCount = 0;
+    
+    for (NSDictionary<NSString *, id> *sock in sockets) {
+        NSString *proto = sock[@"protocol"];
+        NSString *state = sock[@"state"];
+        
+        if ([proto isEqualToString:@"TCP"]) {
+            tcpCount++;
+            if ([state isEqualToString:@"LISTEN"]) {
+                listenCount++;
+            } else if ([state isEqualToString:@"ESTABLISHED"]) {
+                establishedCount++;
+            }
+        } else if ([proto isEqualToString:@"UDP"]) {
+            udpCount++;
+        }
+    }
+    
+    return @{
+        @"socketCount": @(sockets.count),
+        @"tcpCount": @(tcpCount),
+        @"udpCount": @(udpCount),
+        @"listenCount": @(listenCount),
+        @"establishedCount": @(establishedCount),
+        @"sockets": sockets
+    };
+}
+
+- (nullable NSDictionary<NSString *, id> *)sampleTelemetryWithError:(NSError **)error {
+    int pids[2048];
+    int bytes = proc_listpids(PROC_ALL_PIDS, 0, pids, sizeof(pids));
+    int pidCount = bytes / sizeof(int);
+    
+    NSMutableArray<NSDictionary<NSString *, id> *> *sockets = [NSMutableArray array];
+    
+    for (int i = 0; i < pidCount; i++) {
+        pid_t pid = pids[i];
+        if (pid <= 0) continue;
+        
+        int sz = proc_pidinfo(pid, PROC_PIDLISTFDS, 0, NULL, 0);
+        if (sz <= 0) continue;
+        
+        struct proc_fdinfo *fds = malloc(sz);
+        if (!fds) continue;
+        
+        int actual = proc_pidinfo(pid, PROC_PIDLISTFDS, 0, fds, sz);
+        int fdCount = actual / sizeof(struct proc_fdinfo);
+        
+        char procNameBuf[256] = {0};
+        BOOL procNameFetched = NO;
+        
+        for (int j = 0; j < fdCount; j++) {
+            if (fds[j].proc_fdtype == PROX_FDTYPE_SOCKET) {
+                struct socket_fdinfo si;
+                if (proc_pidfdinfo(pid, fds[j].proc_fd, PROC_PIDFDSOCKETINFO, &si, sizeof(si)) == sizeof(si)) {
+                    int family = si.psi.soi_family;
+                    if (family == AF_INET || family == AF_INET6) {
+                        if (!procNameFetched) {
+                            proc_name(pid, procNameBuf, sizeof(procNameBuf));
+                            procNameFetched = YES;
+                        }
+                        
+                        char localIP[INET6_ADDRSTRLEN] = {0};
+                        char remoteIP[INET6_ADDRSTRLEN] = {0};
+                        int lport = 0, rport = 0;
+                        NSString *familyStr = (family == AF_INET) ? @"IPv4" : @"IPv6";
+                        NSString *proto = (si.psi.soi_type == SOCK_STREAM) ? @"TCP" : @"UDP";
+                        NSString *state = @"NONE";
+                        
+                        if (family == AF_INET) {
+                            inet_ntop(AF_INET, &si.psi.soi_proto.pri_in.insi_laddr.ina_46.i46a_addr4, localIP, sizeof(localIP));
+                            inet_ntop(AF_INET, &si.psi.soi_proto.pri_in.insi_faddr.ina_46.i46a_addr4, remoteIP, sizeof(remoteIP));
+                            lport = ntohs(si.psi.soi_proto.pri_in.insi_lport);
+                            rport = ntohs(si.psi.soi_proto.pri_in.insi_fport);
+                        } else {
+                            inet_ntop(AF_INET6, &si.psi.soi_proto.pri_in.insi_laddr.ina_6, localIP, sizeof(localIP));
+                            inet_ntop(AF_INET6, &si.psi.soi_proto.pri_in.insi_faddr.ina_6, remoteIP, sizeof(remoteIP));
+                            lport = ntohs(si.psi.soi_proto.pri_in.insi_lport);
+                            rport = ntohs(si.psi.soi_proto.pri_in.insi_fport);
+                        }
+                        
+                        if (si.psi.soi_type == SOCK_STREAM) {
+                            state = tcpStateString(si.psi.soi_proto.pri_tcp.tcpsi_state);
+                        }
+                        
+                        [sockets addObject:@{
+                            @"pid": @(pid),
+                            @"processName": [NSString stringWithUTF8String:procNameBuf],
+                            @"protocol": proto,
+                            @"family": familyStr,
+                            @"localAddress": [NSString stringWithUTF8String:localIP],
+                            @"localPort": @(lport),
+                            @"remoteAddress": [NSString stringWithUTF8String:remoteIP],
+                            @"remotePort": @(rport),
+                            @"state": state
+                        }];
+                    }
+                }
+            }
+        }
+        free(fds);
+    }
+    
+    return [MMNetworkSocketsProvider calculateSocketSummaryWithSocketList:sockets];
+}
+
+@end

Sources/Telemetry/Process/MMProcessTelemetryProvider.h

@@ -0,0 +1,34 @@
+#ifndef MMProcessTelemetryProvider_h
+#define MMProcessTelemetryProvider_h
+
+#import <Foundation/Foundation.h>
+#import "MMTelemetryProvider.h"
+
+NS_ASSUME_NONNULL_BEGIN
+
+/**
+ * MMProcessTelemetryProvider
+ * Live process explorer sampling CPU utilization, resident memory (RSS),
+ * virtual memory, thread counts, and process hierarchy.
+ */
+@interface MMProcessTelemetryProvider : NSObject <MMTelemetryProvider>
+
+- (instancetype)init;
+
+/**
+ * Safely terminates a process via SIGTERM or SIGKILL.
+ */
++ (BOOL)terminateProcessWithPID:(pid_t)pid force:(BOOL)force;
+
+/**
+ * Pure calculator method for deterministic unit testing.
+ */
++ (NSArray<NSDictionary<NSString *, id> *> *)calculateProcessListWithRawProcesses:(NSArray<NSDictionary<NSString *, id> *> *)rawProcesses
+                                                                previousCPUTimes:(nullable NSDictionary<NSNumber *, NSNumber *> *)previousCPUTimes
+                                                                       timeDelta:(NSTimeInterval)timeDelta;
+
+@end
+
+NS_ASSUME_NONNULL_END
+
+#endif /* MMProcessTelemetryProvider_h */

Sources/Telemetry/Process/MMProcessTelemetryProvider.m

@@ -0,0 +1,160 @@
+#import "MMProcessTelemetryProvider.h"
+#import <libproc.h>
+#import <sys/proc_info.h>
+#import <pwd.h>
+#import <signal.h>
+#import <mach/mach_time.h>
+#import <os/lock.h>
+
+@interface MMProcessTelemetryProvider () {
+    os_unfair_lock _lock;
+    NSMutableDictionary<NSNumber *, NSNumber *> *_previousCPUTimes;
+    uint64_t _previousTimestamp;
+    mach_timebase_info_data_t _timebase;
+    NSMutableDictionary<NSNumber *, NSString *> *_usernameCache;
+}
+@end
+
+@implementation MMProcessTelemetryProvider
+
+- (instancetype)init {
+    self = [super init];
+    if (self) {
+        _lock = OS_UNFAIR_LOCK_INIT;
+        _previousCPUTimes = [NSMutableDictionary dictionary];
+        _previousTimestamp = 0;
+        _usernameCache = [NSMutableDictionary dictionary];
+        mach_timebase_info(&_timebase);
+    }
+    return self;
+}
+
+- (MMTelemetryDomain)domain {
+    return MMTelemetryDomainProcess;
+}
+
+- (NSString *)providerIdentifier {
+    return @"com.i3omb.macmonitor.telemetry.process";
+}
+
+- (BOOL)isAvailable {
+    return YES;
+}
+
++ (BOOL)terminateProcessWithPID:(pid_t)pid force:(BOOL)force {
+    int sig = force ? SIGKILL : SIGTERM;
+    return kill(pid, sig) == 0;
+}
+
++ (NSArray<NSDictionary<NSString *, id> *> *)calculateProcessListWithRawProcesses:(NSArray<NSDictionary<NSString *, id> *> *)rawProcesses
+                                                                previousCPUTimes:(nullable NSDictionary<NSNumber *, NSNumber *> *)previousCPUTimes
+                                                                       timeDelta:(NSTimeInterval)timeDelta {
+    NSMutableArray<NSDictionary<NSString *, id> *> *processed = [NSMutableArray arrayWithCapacity:rawProcesses.count];
+    
+    for (NSDictionary<NSString *, id> *raw in rawProcesses) {
+        NSNumber *pidNum = raw[@"pid"];
+        uint64_t currCPUTime = [raw[@"cpuTimeNs"] unsignedLongLongValue];
+        
+        double cpuPercent = 0.0;
+        if (previousCPUTimes && previousCPUTimes[pidNum]) {
+            uint64_t prevCPUTime = [previousCPUTimes[pidNum] unsignedLongLongValue];
+            if (currCPUTime >= prevCPUTime && timeDelta > 0.001) {
+                uint64_t deltaNs = currCPUTime - prevCPUTime;
+                double deltaSec = (double)deltaNs / 1e9;
+                cpuPercent = (deltaSec / timeDelta) * 100.0;
+            }
+        }
+        
+        NSMutableDictionary<NSString *, id> *entry = [raw mutableCopy];
+        entry[@"cpuPercent"] = @(cpuPercent);
+        [processed addObject:entry];
+    }
+    
+    // Sort descending by cpuPercent
+    [processed sortUsingComparator:^NSComparisonResult(NSDictionary<NSString *, id> *obj1, NSDictionary<NSString *, id> *obj2) {
+        NSNumber *c1 = obj1[@"cpuPercent"];
+        NSNumber *c2 = obj2[@"cpuPercent"];
+        return [c2 compare:c1];
+    }];
+    
+    return processed;
+}
+
+- (nullable NSDictionary<NSString *, id> *)sampleTelemetryWithError:(NSError **)error {
+    uint64_t now = mach_absolute_time();
+    
+    int pids[4096];
+    int bytes = proc_listpids(PROC_ALL_PIDS, 0, pids, sizeof(pids));
+    int pidCount = bytes / sizeof(int);
+    
+    NSMutableArray<NSDictionary<NSString *, id> *> *rawList = [NSMutableArray arrayWithCapacity:pidCount];
+    NSMutableDictionary<NSNumber *, NSNumber *> *currentCPUTimes = [NSMutableDictionary dictionaryWithCapacity:pidCount];
+    
+    NSUInteger totalThreads = 0;
+    
+    for (int i = 0; i < pidCount; i++) {
+        pid_t pid = pids[i];
+        if (pid <= 0) continue;
+        
+        struct proc_taskallinfo tai;
+        if (proc_pidinfo(pid, PROC_PIDTASKALLINFO, 0, &tai, sizeof(tai)) != sizeof(tai)) {
+            continue;
+        }
+        
+        uint64_t cpuTimeNs = tai.ptinfo.pti_total_user + tai.ptinfo.pti_total_system;
+        currentCPUTimes[@(pid)] = @(cpuTimeNs);
+        
+        totalThreads += tai.ptinfo.pti_threadnum;
+        
+        // Resolve username
+        NSNumber *uidNum = @(tai.pbsd.pbi_uid);
+        NSString *username = _usernameCache[uidNum];
+        if (!username) {
+            struct passwd *pw = getpwuid(tai.pbsd.pbi_uid);
+            username = pw ? [NSString stringWithUTF8String:pw->pw_name] : [uidNum stringValue];
+            _usernameCache[uidNum] = username;
+        }
+        
+        NSString *pname = [NSString stringWithUTF8String:tai.pbsd.pbi_name];
+        
+        [rawList addObject:@{
+            @"pid": @(pid),
+            @"ppid": @(tai.pbsd.pbi_ppid),
+            @"uid": uidNum,
+            @"username": username,
+            @"name": pname,
+            @"cpuTimeNs": @(cpuTimeNs),
+            @"residentBytes": @(tai.ptinfo.pti_resident_size),
+            @"virtualBytes": @(tai.ptinfo.pti_virtual_size),
+            @"threadCount": @(tai.ptinfo.pti_threadnum),
+            @"runningThreads": @(tai.ptinfo.pti_numrunning)
+        }];
+    }
+    
+    os_unfair_lock_lock(&_lock);
+    NSDictionary<NSNumber *, NSNumber *> *prev = [_previousCPUTimes copy];
+    uint64_t prevTime = _previousTimestamp;
+    
+    _previousCPUTimes = currentCPUTimes;
+    _previousTimestamp = now;
+    os_unfair_lock_unlock(&_lock);
+    
+    NSTimeInterval timeDelta = 1.0;
+    if (prevTime > 0) {
+        uint64_t elapsed = now - prevTime;
+        timeDelta = (double)elapsed * _timebase.numer / _timebase.denom / 1e9;
+    }
+    
+    NSArray<NSDictionary<NSString *, id> *> *processed = [MMProcessTelemetryProvider calculateProcessListWithRawProcesses:rawList
+                                                                                                          previousCPUTimes:prev
+                                                                                                                 timeDelta:timeDelta];
+    
+    return @{
+        @"processCount": @(processed.count),
+        @"totalThreads": @(totalThreads),
+        @"processes": processed,
+        @"timeDelta": @(timeDelta)
+    };
+}
+
+@end

Sources/Telemetry/Storage/MMDiskIOProvider.h

@@ -0,0 +1,29 @@
+#ifndef MMDiskIOProvider_h
+#define MMDiskIOProvider_h
+
+#import <Foundation/Foundation.h>
+#import "MMTelemetryProvider.h"
+
+NS_ASSUME_NONNULL_BEGIN
+
+/**
+ * MMDiskIOProvider
+ * Samples real-time storage disk transfer rates (read/write bytes per second)
+ * and transaction rates (read/write IOPS) across internal and external block storage devices.
+ */
+@interface MMDiskIOProvider : NSObject <MMTelemetryProvider>
+
+- (instancetype)init;
+
+/**
+ * Pure calculator method for deterministic unit testing.
+ */
++ (NSDictionary<NSString *, id> *)calculateDiskIOMetricsWithCurrentSnapshots:(NSDictionary<NSString *, NSDictionary<NSString *, NSNumber *> *> *)current
+                                                           previousSnapshots:(nullable NSDictionary<NSString *, NSDictionary<NSString *, NSNumber *> *> *)previous
+                                                                   timeDelta:(NSTimeInterval)timeDelta;
+
+@end
+
+NS_ASSUME_NONNULL_END
+
+#endif /* MMDiskIOProvider_h */

Sources/Telemetry/Storage/MMDiskIOProvider.m

@@ -0,0 +1,170 @@
+#import "MMDiskIOProvider.h"
+#import <IOKit/IOKitLib.h>
+#import <IOKit/storage/IOBlockStorageDriver.h>
+#import <mach/mach_time.h>
+#import <os/lock.h>
+
+@interface MMDiskIOProvider () {
+    os_unfair_lock _lock;
+    NSDictionary<NSString *, NSDictionary<NSString *, NSNumber *> *> *_previousSnapshots;
+    uint64_t _previousTimestamp;
+    mach_timebase_info_data_t _timebase;
+}
+@end
+
+@implementation MMDiskIOProvider
+
+- (instancetype)init {
+    self = [super init];
+    if (self) {
+        _lock = OS_UNFAIR_LOCK_INIT;
+        _previousSnapshots = nil;
+        _previousTimestamp = 0;
+        mach_timebase_info(&_timebase);
+    }
+    return self;
+}
+
+- (MMTelemetryDomain)domain {
+    return MMTelemetryDomainStorage;
+}
+
+- (NSString *)providerIdentifier {
+    return @"com.i3omb.macmonitor.telemetry.storage.io";
+}
+
+- (BOOL)isAvailable {
+    return YES;
+}
+
++ (NSDictionary<NSString *, id> *)calculateDiskIOMetricsWithCurrentSnapshots:(NSDictionary<NSString *, NSDictionary<NSString *, NSNumber *> *> *)current
+                                                           previousSnapshots:(nullable NSDictionary<NSString *, NSDictionary<NSString *, NSNumber *> *> *)previous
+                                                                   timeDelta:(NSTimeInterval)timeDelta {
+    double totalReadBps = 0.0;
+    double totalWriteBps = 0.0;
+    double totalReadIOPS = 0.0;
+    double totalWriteIOPS = 0.0;
+    
+    NSMutableArray<NSDictionary<NSString *, id> *> *disks = [NSMutableArray arrayWithCapacity:current.count];
+    NSArray<NSString *> *sortedBsdNames = [current.allKeys sortedArrayUsingSelector:@selector(compare:)];
+    
+    for (NSString *bsdName in sortedBsdNames) {
+        NSDictionary<NSString *, NSNumber *> *curr = current[bsdName];
+        NSDictionary<NSString *, NSNumber *> *prev = previous ? previous[bsdName] : nil;
+        
+        uint64_t currReadBytes = [curr[@"readBytes"] unsignedLongLongValue];
+        uint64_t currWriteBytes = [curr[@"writeBytes"] unsignedLongLongValue];
+        uint64_t currReadOps = [curr[@"readOps"] unsignedLongLongValue];
+        uint64_t currWriteOps = [curr[@"writeOps"] unsignedLongLongValue];
+        
+        uint64_t prevReadBytes = prev ? [prev[@"readBytes"] unsignedLongLongValue] : currReadBytes;
+        uint64_t prevWriteBytes = prev ? [prev[@"writeBytes"] unsignedLongLongValue] : currWriteBytes;
+        uint64_t prevReadOps = prev ? [prev[@"readOps"] unsignedLongLongValue] : currReadOps;
+        uint64_t prevWriteOps = prev ? [prev[@"writeOps"] unsignedLongLongValue] : currWriteOps;
+        
+        double deltaReadBytes = (currReadBytes >= prevReadBytes) ? (double)(currReadBytes - prevReadBytes) : 0.0;
+        double deltaWriteBytes = (currWriteBytes >= prevWriteBytes) ? (double)(currWriteBytes - prevWriteBytes) : 0.0;
+        double deltaReadOps = (currReadOps >= prevReadOps) ? (double)(currReadOps - prevReadOps) : 0.0;
+        double deltaWriteOps = (currWriteOps >= prevWriteOps) ? (double)(currWriteOps - prevWriteOps) : 0.0;
+        
+        double readBps = (timeDelta > 0.0001) ? (deltaReadBytes / timeDelta) : 0.0;
+        double writeBps = (timeDelta > 0.0001) ? (deltaWriteBytes / timeDelta) : 0.0;
+        double readIOPS = (timeDelta > 0.0001) ? (deltaReadOps / timeDelta) : 0.0;
+        double writeIOPS = (timeDelta > 0.0001) ? (deltaWriteOps / timeDelta) : 0.0;
+        
+        totalReadBps += readBps;
+        totalWriteBps += writeBps;
+        totalReadIOPS += readIOPS;
+        totalWriteIOPS += writeIOPS;
+        
+        [disks addObject:@{
+            @"bsdName": bsdName,
+            @"readBytesPerSec": @(readBps),
+            @"writeBytesPerSec": @(writeBps),
+            @"readIOPS": @(readIOPS),
+            @"writeIOPS": @(writeIOPS),
+            @"cumulativeReadBytes": @(currReadBytes),
+            @"cumulativeWriteBytes": @(currWriteBytes),
+            @"cumulativeReadOps": @(currReadOps),
+            @"cumulativeWriteOps": @(currWriteOps)
+        }];
+    }
+    
+    return @{
+        @"disks": disks,
+        @"totalReadBytesPerSec": @(totalReadBps),
+        @"totalWriteBytesPerSec": @(totalWriteBps),
+        @"totalReadIOPS": @(totalReadIOPS),
+        @"totalWriteIOPS": @(totalWriteIOPS),
+        @"timeDelta": @(timeDelta)
+    };
+}
+
+- (nullable NSDictionary<NSString *, id> *)sampleTelemetryWithError:(NSError **)error {
+    uint64_t now = mach_absolute_time();
+    
+    NSMutableDictionary<NSString *, NSDictionary<NSString *, NSNumber *> *> *currentSnapshots = [NSMutableDictionary dictionary];
+    
+    CFMutableDictionaryRef matching = IOServiceMatching(kIOBlockStorageDriverClass);
+    io_iterator_t iterator = IO_OBJECT_NULL;
+    if (IOServiceGetMatchingServices(kIOMainPortDefault, matching, &iterator) == KERN_SUCCESS && iterator != IO_OBJECT_NULL) {
+        io_registry_entry_t entry;
+        while ((entry = IOIteratorNext(iterator)) != IO_OBJECT_NULL) {
+            NSString *bsdName = nil;
+            io_iterator_t childIterator;
+            if (IORegistryEntryGetChildIterator(entry, kIOServicePlane, &childIterator) == KERN_SUCCESS) {
+                io_registry_entry_t child;
+                while ((child = IOIteratorNext(childIterator)) != IO_OBJECT_NULL) {
+                    CFTypeRef nameRef = IORegistryEntryCreateCFProperty(child, CFSTR("BSD Name"), kCFAllocatorDefault, 0);
+                    if (nameRef) {
+                        bsdName = CFBridgingRelease(nameRef);
+                        IOObjectRelease(child);
+                        break;
+                    }
+                    IOObjectRelease(child);
+                }
+                IOObjectRelease(childIterator);
+            }
+            
+            if (bsdName) {
+                CFTypeRef statsRef = IORegistryEntryCreateCFProperty(entry, CFSTR("Statistics"), kCFAllocatorDefault, 0);
+                if (statsRef) {
+                    NSDictionary *stats = CFBridgingRelease(statsRef);
+                    NSNumber *readBytes = stats[@"Bytes (Read)"] ?: @0;
+                    NSNumber *writeBytes = stats[@"Bytes (Write)"] ?: @0;
+                    NSNumber *readOps = stats[@"Operations (Read)"] ?: @0;
+                    NSNumber *writeOps = stats[@"Operations (Write)"] ?: @0;
+                    
+                    currentSnapshots[bsdName] = @{
+                        @"readBytes": readBytes,
+                        @"writeBytes": writeBytes,
+                        @"readOps": readOps,
+                        @"writeOps": writeOps
+                    };
+                }
+            }
+            IOObjectRelease(entry);
+        }
+        IOObjectRelease(iterator);
+    }
+    
+    os_unfair_lock_lock(&_lock);
+    NSDictionary<NSString *, NSDictionary<NSString *, NSNumber *> *> *prev = _previousSnapshots;
+    uint64_t prevTime = _previousTimestamp;
+    
+    _previousSnapshots = currentSnapshots;
+    _previousTimestamp = now;
+    os_unfair_lock_unlock(&_lock);
+    
+    NSTimeInterval timeDelta = 1.0;
+    if (prevTime > 0) {
+        uint64_t elapsed = now - prevTime;
+        timeDelta = (double)elapsed * _timebase.numer / _timebase.denom / 1e9;
+    }
+    
+    return [MMDiskIOProvider calculateDiskIOMetricsWithCurrentSnapshots:currentSnapshots
+                                                      previousSnapshots:prev
+                                                              timeDelta:timeDelta];
+}
+
+@end

Sources/Telemetry/System/MMLoadAverageProvider.h

@@ -0,0 +1,33 @@
+#ifndef MMLoadAverageProvider_h
+#define MMLoadAverageProvider_h
+
+#import <Foundation/Foundation.h>
+#import "MMTelemetryProvider.h"
+
+NS_ASSUME_NONNULL_BEGIN
+
+/**
+ * MMLoadAverageProvider
+ * Samples 1m, 5m, and 15m system load averages, Mach concurrency factors,
+ * and system-wide task and thread counts.
+ */
+@interface MMLoadAverageProvider : NSObject <MMTelemetryProvider>
+
+- (instancetype)init;
+
+/**
+ * Pure calculator method for deterministic unit testing.
+ */
++ (NSDictionary<NSString *, id> *)calculateLoadMetricsWithLoad1:(double)load1
+                                                          load5:(double)load5
+                                                         load15:(double)load15
+                                                      taskCount:(int)taskCount
+                                                    threadCount:(int)threadCount
+                                                       cpuCount:(int)cpuCount
+                                                     machFactor:(double)machFactor;
+
+@end
+
+NS_ASSUME_NONNULL_END
+
+#endif /* MMLoadAverageProvider_h */

Sources/Telemetry/System/MMLoadAverageProvider.m

@@ -0,0 +1,92 @@
+#import "MMLoadAverageProvider.h"
+#import <mach/mach.h>
+#import <mach/processor_info.h>
+#import <sys/sysctl.h>
+#import <stdlib.h>
+
+@implementation MMLoadAverageProvider
+
+- (instancetype)init {
+    self = [super init];
+    return self;
+}
+
+- (MMTelemetryDomain)domain {
+    return MMTelemetryDomainSystem;
+}
+
+- (NSString *)providerIdentifier {
+    return @"com.i3omb.macmonitor.telemetry.system.load";
+}
+
+- (BOOL)isAvailable {
+    return YES;
+}
+
++ (NSDictionary<NSString *, id> *)calculateLoadMetricsWithLoad1:(double)load1
+                                                          load5:(double)load5
+                                                         load15:(double)load15
+                                                      taskCount:(int)taskCount
+                                                    threadCount:(int)threadCount
+                                                       cpuCount:(int)cpuCount
+                                                     machFactor:(double)machFactor {
+    int safeCpus = cpuCount > 0 ? cpuCount : 1;
+    double norm1 = load1 / (double)safeCpus;
+    double norm5 = load5 / (double)safeCpus;
+    double norm15 = load15 / (double)safeCpus;
+    
+    return @{
+        @"load1m": @(load1),
+        @"load5m": @(load5),
+        @"load15m": @(load15),
+        @"normalizedLoad1m": @(norm1),
+        @"normalizedLoad5m": @(norm5),
+        @"normalizedLoad15m": @(norm15),
+        @"taskCount": @(taskCount),
+        @"threadCount": @(threadCount),
+        @"logicalCpuCount": @(safeCpus),
+        @"machFactor": @(machFactor),
+        @"isOverloaded": @(norm1 > 1.0)
+    };
+}
+
+- (nullable NSDictionary<NSString *, id> *)sampleTelemetryWithError:(NSError **)error {
+    // 1. Get BSD load averages
+    double load[3] = {0.0, 0.0, 0.0};
+    int ret = getloadavg(load, 3);
+    if (ret <= 0) {
+        load[0] = 0.0;
+        load[1] = 0.0;
+        load[2] = 0.0;
+    }
+    
+    // 2. Query Mach processor set for task & thread counts and mach factor
+    mach_port_t host = mach_host_self();
+    processor_set_name_port_t pset = MACH_PORT_NULL;
+    processor_set_load_info_data_t loadInfo = {0};
+    mach_msg_type_number_t count = PROCESSOR_SET_LOAD_INFO_COUNT;
+    
+    kern_return_t kr = processor_set_default(host, &pset);
+    if (kr == KERN_SUCCESS && MACH_PORT_VALID(pset)) {
+        kr = processor_set_statistics(pset, PROCESSOR_SET_LOAD_INFO, (processor_set_info_t)&loadInfo, &count);
+        mach_port_deallocate(mach_task_self(), pset);
+    }
+    
+    double machFactor = (double)loadInfo.mach_factor / (double)LOAD_SCALE;
+    
+    // 3. Query logical CPU core count
+    int cpuCount = 1;
+    size_t size = sizeof(cpuCount);
+    sysctlbyname("hw.logicalcpu", &cpuCount, &size, NULL, 0);
+    if (cpuCount <= 0) cpuCount = 1;
+    
+    return [MMLoadAverageProvider calculateLoadMetricsWithLoad1:load[0]
+                                                          load5:load[1]
+                                                         load15:load[2]
+                                                      taskCount:loadInfo.task_count
+                                                    threadCount:loadInfo.thread_count
+                                                       cpuCount:cpuCount
+                                                     machFactor:machFactor];
+}
+
+@end

Tests/MMDiskIOTests.swift

@@ -0,0 +1,73 @@
+import XCTest
+@testable import MacMonitor
+
+final class MMDiskIOTests: XCTestCase {
+    
+    func testDiskIOMetricsCalculation() {
+        let prev: [String: [String: NSNumber]] = [
+            "disk0": [
+                "readBytes": NSNumber(value: 10_000_000),
+                "writeBytes": NSNumber(value: 5_000_000),
+                "readOps": NSNumber(value: 1_000),
+                "writeOps": NSNumber(value: 500)
+            ],
+            "disk1": [
+                "readBytes": NSNumber(value: 2_000_000),
+                "writeBytes": NSNumber(value: 1_000_000),
+                "readOps": NSNumber(value: 200),
+                "writeOps": NSNumber(value: 100)
+            ]
+        ]
+        
+        let curr: [String: [String: NSNumber]] = [
+            "disk0": [
+                "readBytes": NSNumber(value: 20_000_000), // delta = 10,000,000 bytes
+                "writeBytes": NSNumber(value: 7_000_000),  // delta = 2,000,000 bytes
+                "readOps": NSNumber(value: 1_200),         // delta = 200 ops
+                "writeOps": NSNumber(value: 600)           // delta = 100 ops
+            ],
+            "disk1": [
+                "readBytes": NSNumber(value: 4_000_000),  // delta = 2,000,000 bytes
+                "writeBytes": NSNumber(value: 1_000_000),  // delta = 0
+                "readOps": NSNumber(value: 250),           // delta = 50 ops
+                "writeOps": NSNumber(value: 100)           // delta = 0 ops
+            ]
+        ]
+        
+        let timeDelta: TimeInterval = 2.0 // 2 seconds
+        
+        let metrics = MMDiskIOProvider.calculateDiskIOMetrics(
+            withCurrentSnapshots: curr,
+            previousSnapshots: prev,
+            timeDelta: timeDelta
+        )
+        
+        let totalReadBps = metrics["totalReadBytesPerSec"] as? Double ?? 0
+        let totalWriteBps = metrics["totalWriteBytesPerSec"] as? Double ?? 0
+        let totalReadIOPS = metrics["totalReadIOPS"] as? Double ?? 0
+        let totalWriteIOPS = metrics["totalWriteIOPS"] as? Double ?? 0
+        let disks = metrics["disks"] as? [[String: Any]] ?? []
+        
+        // (10MB + 2MB) / 2s = 6,000,000 B/s
+        XCTAssertEqual(totalReadBps, 6_000_000.0, accuracy: 1.0)
+        // (2MB + 0) / 2s = 1,000,000 B/s
+        XCTAssertEqual(totalWriteBps, 1_000_000.0, accuracy: 1.0)
+        // (200 + 50) / 2s = 125 IOPS
+        XCTAssertEqual(totalReadIOPS, 125.0, accuracy: 0.1)
+        // (100 + 0) / 2s = 50 IOPS
+        XCTAssertEqual(totalWriteIOPS, 50.0, accuracy: 0.1)
+        XCTAssertEqual(disks.count, 2)
+    }
+    
+    func testLiveDiskIOProvider() throws {
+        let provider = MMDiskIOProvider()
+        XCTAssertEqual(provider.domain, .storage)
+        XCTAssertEqual(provider.providerIdentifier, "com.i3omb.macmonitor.telemetry.storage.io")
+        
+        let sample = try provider.sampleTelemetry()
+        XCTAssertNotNil(sample)
+        XCTAssertNotNil(sample["totalReadBytesPerSec"])
+        XCTAssertNotNil(sample["totalWriteBytesPerSec"])
+        XCTAssertNotNil(sample["disks"])
+    }
+}

Tests/MMKernelTelemetryTests.swift

@@ -0,0 +1,70 @@
+import XCTest
+@testable import MacMonitor
+
+final class MMKernelTelemetryTests: XCTestCase {
+    
+    func testKernelRatesCalculation() {
+        let prev: [String: NSNumber] = [
+            "contextSwitches": NSNumber(value: 100_000),
+            "syscalls": NSNumber(value: 200_000),
+            "pageFaults": NSNumber(value: 50_000),
+            "cowFaults": NSNumber(value: 1_000),
+            "zeroFills": NSNumber(value: 10_000),
+            "pageins": NSNumber(value: 500),
+            "pageouts": NSNumber(value: 100),
+            "decompressions": NSNumber(value: 200),
+            "compressions": NSNumber(value: 300)
+        ]
+        
+        let curr: [String: NSNumber] = [
+            "contextSwitches": NSNumber(value: 102_500), // delta = 2,500
+            "syscalls": NSNumber(value: 210_000),        // delta = 10,000
+            "pageFaults": NSNumber(value: 51_000),       // delta = 1,000
+            "cowFaults": NSNumber(value: 1_050),         // delta = 50
+            "zeroFills": NSNumber(value: 10_200),        // delta = 200
+            "pageins": NSNumber(value: 520),             // delta = 20
+            "pageouts": NSNumber(value: 105),            // delta = 5
+            "decompressions": NSNumber(value: 210),      // delta = 10
+            "compressions": NSNumber(value: 315)         // delta = 15
+        ]
+        
+        let timeDelta: TimeInterval = 2.0 // 2 seconds
+        
+        let rates = MMKernelTelemetryProvider.calculateRates(
+            withCurrentCounters: curr,
+            previousCounters: prev,
+            timeDelta: timeDelta
+        )
+        
+        let cswRate = rates["contextSwitchesRate"] as? Double ?? 0
+        let syscallRate = rates["syscallsRate"] as? Double ?? 0
+        let faultRate = rates["pageFaultsRate"] as? Double ?? 0
+        let cowRate = rates["cowFaultsRate"] as? Double ?? 0
+        let zeroFillRate = rates["zeroFillsRate"] as? Double ?? 0
+        let pageinsRate = rates["pageinsRate"] as? Double ?? 0
+        
+        XCTAssertEqual(cswRate, 1250.0, accuracy: 0.1)
+        XCTAssertEqual(syscallRate, 5000.0, accuracy: 0.1)
+        XCTAssertEqual(faultRate, 500.0, accuracy: 0.1)
+        XCTAssertEqual(cowRate, 25.0, accuracy: 0.1)
+        XCTAssertEqual(zeroFillRate, 100.0, accuracy: 0.1)
+        XCTAssertEqual(pageinsRate, 10.0, accuracy: 0.1)
+        
+        let cumCSW = rates["cumulative_contextSwitches"] as? UInt64 ?? 0
+        XCTAssertEqual(cumCSW, 102_500)
+    }
+    
+    func testLiveKernelProvider() throws {
+        let provider = MMKernelTelemetryProvider()
+        XCTAssertEqual(provider.domain, .system)
+        XCTAssertEqual(provider.providerIdentifier, "com.i3omb.macmonitor.telemetry.kernel.counters")
+        
+        let sample = try provider.sampleTelemetry()
+        XCTAssertNotNil(sample)
+        XCTAssertNotNil(sample["cumulative_contextSwitches"])
+        XCTAssertNotNil(sample["cumulative_syscalls"])
+        XCTAssertNotNil(sample["cumulative_pageFaults"])
+        XCTAssertNotNil(sample["contextSwitchesRate"])
+        XCTAssertNotNil(sample["syscallsRate"])
+    }
+}

Tests/MMLoadAverageTests.swift

@@ -0,0 +1,62 @@
+import XCTest
+@testable import MacMonitor
+
+final class MMLoadAverageTests: XCTestCase {
+    
+    func testLoadMetricsCalculation() {
+        let metrics = MMLoadAverageProvider.calculateLoadMetrics(
+            withLoad1: 4.0,
+            load5: 3.5,
+            load15: 2.5,
+            taskCount: 500,
+            threadCount: 2200,
+            cpuCount: 8,
+            machFactor: 1.25
+        )
+        
+        let load1 = metrics["load1m"] as? Double ?? 0
+        let norm1 = metrics["normalizedLoad1m"] as? Double ?? 0
+        let norm5 = metrics["normalizedLoad5m"] as? Double ?? 0
+        let taskCount = metrics["taskCount"] as? Int ?? 0
+        let threadCount = metrics["threadCount"] as? Int ?? 0
+        let isOverloaded = metrics["isOverloaded"] as? Bool ?? true
+        
+        XCTAssertEqual(load1, 4.0, accuracy: 0.01)
+        XCTAssertEqual(norm1, 4.0 / 8.0, accuracy: 0.01)
+        XCTAssertEqual(norm5, 3.5 / 8.0, accuracy: 0.01)
+        XCTAssertEqual(taskCount, 500)
+        XCTAssertEqual(threadCount, 2200)
+        XCTAssertFalse(isOverloaded)
+    }
+    
+    func testOverloadedStateDetection() {
+        let metrics = MMLoadAverageProvider.calculateLoadMetrics(
+            withLoad1: 12.0,
+            load5: 10.0,
+            load15: 8.0,
+            taskCount: 650,
+            threadCount: 3100,
+            cpuCount: 8,
+            machFactor: 0.4
+        )
+        
+        let isOverloaded = metrics["isOverloaded"] as? Bool ?? false
+        let norm1 = metrics["normalizedLoad1m"] as? Double ?? 0
+        
+        XCTAssertTrue(isOverloaded)
+        XCTAssertEqual(norm1, 1.5, accuracy: 0.01)
+    }
+    
+    func testLiveLoadAverageProvider() throws {
+        let provider = MMLoadAverageProvider()
+        XCTAssertEqual(provider.domain, .system)
+        XCTAssertEqual(provider.providerIdentifier, "com.i3omb.macmonitor.telemetry.system.load")
+        
+        let sample = try provider.sampleTelemetry()
+        XCTAssertNotNil(sample)
+        XCTAssertNotNil(sample["load1m"])
+        XCTAssertNotNil(sample["taskCount"])
+        XCTAssertNotNil(sample["threadCount"])
+        XCTAssertNotNil(sample["normalizedLoad1m"])
+    }
+}

Tests/MMNetworkBandwidthTests.swift

@@ -0,0 +1,85 @@
+import XCTest
+@testable import MacMonitor
+
+final class MMNetworkBandwidthTests: XCTestCase {
+    
+    func testNetworkBandwidthCalculation() {
+        let prev: [String: [String: NSNumber]] = [
+            "en0": [
+                "inBytes": NSNumber(value: 50_000_000),
+                "outBytes": NSNumber(value: 10_000_000),
+                "inPackets": NSNumber(value: 40_000),
+                "outPackets": NSNumber(value: 20_000),
+                "inErrors": NSNumber(value: 0),
+                "outErrors": NSNumber(value: 0)
+            ],
+            "lo0": [
+                "inBytes": NSNumber(value: 5_000_000),
+                "outBytes": NSNumber(value: 5_000_000),
+                "inPackets": NSNumber(value: 5_000),
+                "outPackets": NSNumber(value: 5_000),
+                "inErrors": NSNumber(value: 0),
+                "outErrors": NSNumber(value: 0)
+            ]
+        ]
+        
+        let curr: [String: [String: NSNumber]] = [
+            "en0": [
+                "inBytes": NSNumber(value: 60_000_000), // delta in = 10,000,000 bytes
+                "outBytes": NSNumber(value: 12_000_000), // delta out = 2,000,000 bytes
+                "inPackets": NSNumber(value: 48_000),    // delta in = 8,000 pkts
+                "outPackets": NSNumber(value: 24_000),   // delta out = 4,000 pkts
+                "inErrors": NSNumber(value: 0),
+                "outErrors": NSNumber(value: 0)
+            ],
+            "lo0": [
+                "inBytes": NSNumber(value: 7_000_000),
+                "outBytes": NSNumber(value: 7_000_000),
+                "inPackets": NSNumber(value: 7_000),
+                "outPackets": NSNumber(value: 7_000),
+                "inErrors": NSNumber(value: 0),
+                "outErrors": NSNumber(value: 0)
+            ]
+        ]
+        
+        let timeDelta: TimeInterval = 2.0 // 2 seconds
+        let ipDict: [String: String] = ["en0": "192.168.1.100", "lo0": "127.0.0.1"]
+        
+        let metrics = MMNetworkBandwidthProvider.calculateBandwidthMetrics(
+            withCurrentSnapshots: curr,
+            previousSnapshots: prev,
+            timeDelta: timeDelta,
+            ipAddresses: ipDict
+        )
+        
+        let totalDownBps = metrics["totalDownloadBytesPerSec"] as? Double ?? 0
+        let totalUpBps = metrics["totalUploadBytesPerSec"] as? Double ?? 0
+        let totalDownPps = metrics["totalDownloadPacketsPerSec"] as? Double ?? 0
+        let totalUpPps = metrics["totalUploadPacketsPerSec"] as? Double ?? 0
+        let primary = metrics["primaryInterface"] as? String ?? ""
+        let interfaces = metrics["interfaces"] as? [[String: Any]] ?? []
+        
+        // en0 delta in = 10MB / 2s = 5,000,000 B/s (lo0 is excluded from total)
+        XCTAssertEqual(totalDownBps, 5_000_000.0, accuracy: 1.0)
+        // en0 delta out = 2MB / 2s = 1,000,000 B/s
+        XCTAssertEqual(totalUpBps, 1_000_000.0, accuracy: 1.0)
+        // en0 delta in pkts = 8,000 / 2s = 4,000 pps
+        XCTAssertEqual(totalDownPps, 4000.0, accuracy: 0.1)
+        // en0 delta out pkts = 4,000 / 2s = 2,000 pps
+        XCTAssertEqual(totalUpPps, 2000.0, accuracy: 0.1)
+        XCTAssertEqual(primary, "en0")
+        XCTAssertEqual(interfaces.count, 2)
+    }
+    
+    func testLiveNetworkBandwidthProvider() throws {
+        let provider = MMNetworkBandwidthProvider()
+        XCTAssertEqual(provider.domain, .network)
+        XCTAssertEqual(provider.providerIdentifier, "com.i3omb.macmonitor.telemetry.network.bandwidth")
+        
+        let sample = try provider.sampleTelemetry()
+        XCTAssertNotNil(sample)
+        XCTAssertNotNil(sample["totalDownloadBytesPerSec"])
+        XCTAssertNotNil(sample["totalUploadBytesPerSec"])
+        XCTAssertNotNil(sample["interfaces"])
+    }
+}

Tests/MMNetworkSocketsTests.swift

@@ -0,0 +1,68 @@
+import XCTest
+@testable import MacMonitor
+
+final class MMNetworkSocketsTests: XCTestCase {
+    
+    func testSocketSummaryCalculation() {
+        let testSockets: [[String: Any]] = [
+            [
+                "pid": 100,
+                "processName": "web_server",
+                "protocol": "TCP",
+                "family": "IPv4",
+                "localAddress": "0.0.0.0",
+                "localPort": 8080,
+                "remoteAddress": "0.0.0.0",
+                "remotePort": 0,
+                "state": "LISTEN"
+            ],
+            [
+                "pid": 200,
+                "processName": "browser",
+                "protocol": "TCP",
+                "family": "IPv4",
+                "localAddress": "192.168.1.50",
+                "localPort": 54321,
+                "remoteAddress": "142.250.190.46",
+                "remotePort": 443,
+                "state": "ESTABLISHED"
+            ],
+            [
+                "pid": 300,
+                "processName": "dns_daemon",
+                "protocol": "UDP",
+                "family": "IPv4",
+                "localAddress": "0.0.0.0",
+                "localPort": 53,
+                "remoteAddress": "0.0.0.0",
+                "remotePort": 0,
+                "state": "NONE"
+            ]
+        ]
+        
+        let summary = MMNetworkSocketsProvider.calculateSocketSummary(withSocketList: testSockets)
+        
+        let total = summary["socketCount"] as? Int ?? 0
+        let tcp = summary["tcpCount"] as? Int ?? 0
+        let udp = summary["udpCount"] as? Int ?? 0
+        let listen = summary["listenCount"] as? Int ?? 0
+        let established = summary["establishedCount"] as? Int ?? 0
+        
+        XCTAssertEqual(total, 3)
+        XCTAssertEqual(tcp, 2)
+        XCTAssertEqual(udp, 1)
+        XCTAssertEqual(listen, 1)
+        XCTAssertEqual(established, 1)
+    }
+    
+    func testLiveNetworkSocketsProvider() throws {
+        let provider = MMNetworkSocketsProvider()
+        XCTAssertEqual(provider.domain, .network)
+        XCTAssertEqual(provider.providerIdentifier, "com.i3omb.macmonitor.telemetry.network.sockets")
+        
+        let sample = try provider.sampleTelemetry()
+        XCTAssertNotNil(sample)
+        XCTAssertNotNil(sample["socketCount"])
+        XCTAssertNotNil(sample["sockets"])
+    }
+}

Tests/MMProcessTests.swift

@@ -0,0 +1,69 @@
+import XCTest
+@testable import MacMonitor
+
+final class MMProcessTests: XCTestCase {
+    
+    func testProcessCPUPercentCalculation() {
+        let prevCPUTimes: [NSNumber: NSNumber] = [
+            100: NSNumber(value: 1_000_000_000), // 1.0s
+            200: NSNumber(value: 500_000_000)   // 0.5s
+        ]
+        
+        let rawProcesses: [[String: Any]] = [
+            [
+                "pid": 100,
+                "ppid": 1,
+                "uid": 501,
+                "username": "tester",
+                "name": "cpu_hog",
+                "cpuTimeNs": NSNumber(value: 2_000_000_000), // delta = 1.0s over 2.0s = 50% CPU
+                "residentBytes": NSNumber(value: 50_000_000),
+                "virtualBytes": NSNumber(value: 100_000_000),
+                "threadCount": 4,
+                "runningThreads": 1
+            ],
+            [
+                "pid": 200,
+                "ppid": 1,
+                "uid": 501,
+                "username": "tester",
+                "name": "idle_app",
+                "cpuTimeNs": NSNumber(value: 520_000_000), // delta = 0.02s over 2.0s = 1% CPU
+                "residentBytes": NSNumber(value: 20_000_000),
+                "virtualBytes": NSNumber(value: 50_000_000),
+                "threadCount": 2,
+                "runningThreads": 0
+            ]
+        ]
+        
+        let timeDelta: TimeInterval = 2.0
+        
+        let results = MMProcessTelemetryProvider.calculateProcessList(
+            withRawProcesses: rawProcesses,
+            previousCPUTimes: prevCPUTimes,
+            timeDelta: timeDelta
+        )
+        
+        XCTAssertEqual(results.count, 2)
+        // First entry should be highest CPU
+        XCTAssertEqual(results[0]["name"] as? String, "cpu_hog")
+        let hogCPU = results[0]["cpuPercent"] as? Double ?? 0
+        XCTAssertEqual(hogCPU, 50.0, accuracy: 0.1)
+        
+        let idleCPU = results[1]["cpuPercent"] as? Double ?? 0
+        XCTAssertEqual(idleCPU, 1.0, accuracy: 0.1)
+    }
+    
+    func testLiveProcessProvider() throws {
+        let provider = MMProcessTelemetryProvider()
+        XCTAssertEqual(provider.domain, .process)
+        XCTAssertEqual(provider.providerIdentifier, "com.i3omb.macmonitor.telemetry.process")
+        
+        let sample = try provider.sampleTelemetry()
+        XCTAssertNotNil(sample)
+        let processCount = sample["processCount"] as? Int ?? 0
+        XCTAssertGreaterThan(processCount, 0)
+        XCTAssertNotNil(sample["processes"])
+        XCTAssertNotNil(sample["totalThreads"])
+    }
+}