Add telemetry consent and policy foundation

[RamonArjona4]

• I have signed the Contributor License Agreement.
• This pull request is related to an issue.
• If this PR changes build commands, project architecture, or key conventions, I have updated .github/copilot-instructions.md.

---

Summary

Introduces the privacy foundation behind stable MXC telemetry: versioned consent resources, fail-closed consent persistence and status, withdrawal, the administrative deny-only policy ceiling, and balanced ETW provider lifetime behavior.

This is PR 2 of 5 and depends on the normative contract in PR 1.

Stack

Order	Change	PR
1	Normative privacy and telemetry documentation	#818
2	Consent and policy foundation	#819
3	Stable config and executor integration	#820
4	Rust SDK and C ABI	#821
5	Node.js and .NET SDKs	#822

Review only this PR's diff; prerequisite design context is in the PR above.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Jeff Whiteside (jsidewhite)]

[Copilot]

Pull request overview

Adds Windows telemetry consent, administrative policy enforcement, localized consent resources, and balanced ETW provider lifetime management.

Changes:

• Adds persisted, versioned consent and withdrawal APIs.
• Adds deny-only machine policy handling.
• Embeds canonical consent resources and reference-counts ETW registration.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/mxc_telemetry/src/lib.rs	Reference-counts ETW registration.
src/core/wxc_common/src/telemetry/policy.rs	Implements administrative policy lookup.
src/core/wxc_common/src/telemetry/mod.rs	Exposes consent and policy modules.
src/core/wxc_common/src/telemetry/consent.rs	Implements consent persistence and actions.
src/core/wxc_common/src/telemetry/consent_prompt.rs	Exposes canonical prompt resources.
src/core/wxc_common/resources/telemetry/consent/en-US.json	Defines English consent wording.
src/core/wxc_common/Cargo.toml	Adds build and test-support configuration.
src/core/wxc_common/build.rs	Validates and embeds consent resources.
docs/telemetry/telemetry-consent-design.md	Updates consent design documentation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

Suppressed comments (4)

src/core/wxc_common/src/telemetry/consent.rs:682

• A current-version grant is accepted for any nonempty promptLocale, including values this build could never have presented (for example "fr-FR" or arbitrary text). Since the only embedded prompt currently resolves to en-US, such a malformed record must fail closed rather than authorize collection; validate the locale against the embedded supported resources.

 Some(CONSENT_RESOURCE_VERSION) if !record.prompt_locale.is_empty() => ConsentStatus {

src/core/wxc_common/src/telemetry/consent.rs:230

• The public API documentation says an unrecognized schema always resolves to Undetermined, but a record containing "consent":"denied" resolves to Denied regardless of schema version. Document the preserved-denial behavior so callers do not rely on an incorrect status contract.

/// Returns the current, persisted telemetry consent state.
///
/// Fail-closed: a missing file, an unreadable file, unparseable JSON, or an
/// unrecognized `schemaVersion` all resolve to [`ConsentState::Undetermined`]
/// — never to `Granted`. Always [`ConsentState::NotApplicable`] on
/// non-Windows platforms, without any filesystem access.

src/core/wxc_common/src/telemetry/consent.rs:679

• An unknown schema such as 999 is reported as prompt-version-missing whenever its prompt field is absent, even though ConsentSchemaUnsupported is the reason defined for this case. Reserve prompt-version-missing for the known schema-1 legacy record so status consumers receive an accurate diagnosis for unknown formats.

This issue also appears on line 682 of the same file.

 reason: Some(if record.prompt_resource_version.is_none() {
ConsentStatusReason::PromptVersionMissing
} else {
ConsentStatusReason::ConsentSchemaUnsupported
}),

src/core/wxc_common/src/telemetry/consent.rs:32

• This states that every older or unknown schema becomes Undetermined, but read_status intentionally preserves a stored denial before checking the schema version. Narrow the wording to grants so the persistence contract matches the implementation and the design document's “legacy denial remains denied” rule.

This issue also appears on line 225 of the same file.

/// Current schema version for the persisted consent record. Bump when the
/// on-disk shape changes in a way that isn't purely additive; unknown/older
/// versions are treated as [`ConsentState::Undetermined`] on read (fail
/// closed) rather than guessed at.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Suppressed comments (4)

src/core/wxc_common/src/telemetry/mod.rs:300

• This has the same claim-versus-completion race as the completion path: a panic or console handler can claim HAS_EMITTED and still be writing when this branch unregisters the provider. Returning without shutdown on the losing path avoids truncating the winning terminal emission; process teardown cleans up when the out-of-band path wins.

 shutdown();

src/core/wxc_common/src/telemetry/mod.rs:670

• A state-aware terminal path can also race the installed panic/control handler. Since already_emitted() indicates only that another path claimed the slot—not that its writes finished—unregistering here can cut off that winner's ETW writes. Leave cleanup to the winner or process teardown when this path loses.

 shutdown();

src/core/wxc_common/src/telemetry/consent.rs:1258

• This 40 ms wall-clock bound can fail solely because the test process was descheduled, making the Windows test suite flaky. The preceding injected-operation test deterministically verifies that NotFound performs one attempt; remove this timing-only test or replace elapsed-time measurement with an injected sleeper/counter.

 assert!(
started.elapsed() < std::time::Duration::from_millis(40),
"fresh-store read took {:?}; the retry loop is sleeping on NotFound again",
started.elapsed()
);

src/core/wxc_common/src/telemetry/consent.rs:1243

• This wall-clock assertion is nondeterministic: scheduler preemption or a slow CI host can exceed 20 ms even though the closure was called only once and no retry sleep occurred. The call-count assertion already proves NotFound was not retried, so keep that deterministic check and remove the timing bound.

This issue also appears on line 1254 of the same file.

 assert!(
started.elapsed() < std::time::Duration::from_millis(20),
"NotFound must not sleep on the retry delay"
);

[RamonArjona4]

Branden Bonaby (@bbonaby) Merged & resolved and verified suppressed comments, now just waiting for checks.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated no new comments.

Suppressed comments (3)

Previously missed (1) — in code that hasn't changed since the last review.

.github/copilot-instructions.md:232

• This edit accidentally removes docs/host-prep.md from the core-reference list even though the document and host-preparation workflow are unchanged. Restore that bullet so the contributor instructions retain the existing setup reference.

- `docs/sandbox-policy/v1/policy.md` — sandbox policy v1 specification
- `docs/telemetry/telemetry.md` — telemetry overview; `docs/telemetry/telemetry-consent-design.md` (Windows-only consent design and per-SDK surface) and `docs/telemetry/telemetry-administrative-policy.md` (the MDM / Group Policy ceiling)

src/core/wxc_common/src/telemetry/consent.rs:942

• The lock-free read can still return a stale Granted after withdrawal begins: a reader can observe the marker as absent here, then a writer creates the marker and replaces the record with denied, while the reader finishes reading the old file. Because get_consent() feeds telemetry authorization, that permits an emission after a completed withdrawal. Coordinate reads with the writer lock or use an optimistic read that revalidates both the marker and record identity before accepting a grant, as required by the consent contract's reader-coordination/live-enforcement rules.

 match marker_check(&marker_path) {
Ok(WithdrawalMarkerState::Absent) => {}
Ok(WithdrawalMarkerState::Pending) | Err(_) => {
return unreadable_status();
}
Ok(WithdrawalMarkerState::Stale) => {
if recover_stale(&path, &marker_path).is_err() {
return unreadable_status();
}
}
}
let data = match with_io_retry(|| read_bounded(&path)) {

sdk/dotnet/README.md:180

• The .NET SDK does not gain consent or policy query APIs in this PR—the stack assigns those surfaces to PR 5—so this present-tense claim is inaccurate for this revision. Keep the wording prospective until the SDK methods are introduced, or defer this README update to that PR.

for the stable registry contract and interaction rules. Policy and consent
queries fail closed rather than upgrading an unreadable device state into
collection.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 3 comments.

Suppressed comments (6)

src/core/wxc_common/src/telemetry/consent.rs:990

• A current-version grant is accepted for any nonempty promptLocale, even though this build can only present and persist the embedded en-US resource. A corrupt/foreign record such as promptLocale: "fr-FR" therefore authorizes collection despite being impossible to produce through MXC's presenter flow. Validate the locale against the embedded resource so unsupported provenance fails closed.

 Some(CONSENT_RESOURCE_VERSION) if !record.prompt_locale.is_empty() => ConsentStatus {

tests/scripts/run_telemetry_etw_smoke_test.ps1:196

• This removes the only on-wire check for the newly added mxc.sandbox_kind field. The test sink bypasses mxc_telemetry, and the source-text test specifically checks only MXC.Error, so MXC.Execution could omit this field while all remaining tests pass. Keep the field in the ETW smoke assertion.

 $expectedFields = @('mxc.backend', 'mxc.exit_code', 'mxc.outcome', 'mxc.duration_ms')

.github/copilot-instructions.md:156

• This command documents run_telemetry_consent_smoke_test.ps1, but that file is not present in this pull request, so contributors following the test instructions get a path-not-found error. Add the script here or defer this entry to the stack change that introduces it.

tests\scripts\run_telemetry_consent_smoke_test.ps1 # Telemetry consent + policy CLI E2E (Windows; debug binary only)

.github/copilot-instructions.md:231

• This adds a core-reference link to docs/sandbox-policy/v1/policy.md, which is not present in this pull request, while replacing the existing docs/host-prep.md reference. Restore the existing reference and add the v1 entry only when its target lands.

- `docs/sandbox-policy/v1/policy.md` — sandbox policy v1 specification

sdk/dotnet/README.md:180

• The .NET SDK in this PR has no policy or consent query surface—the stack description assigns those APIs to PR #822—so this present-tense statement documents functionality consumers cannot call yet. Keep the prospective wording until the binding API lands.

for the stable registry contract and interaction rules. Policy and consent
queries fail closed rather than upgrading an unreadable device state into
collection.

src/core/wxc_common/src/telemetry/consent.rs:1151

• The consent contract requires releasing the writer lock only after replacement is durable (docs/telemetry/telemetry-consent-design.md:137-143). sync_all() flushes the temporary file, but this plain rename does not request write-through or flush the parent-directory metadata; the withdrawal marker is also removed immediately afterward. A withdrawal can therefore return success and then a power loss can restore the prior granted record. Use a Windows durable replace/write-through path (and durably order the withdrawal marker) before acknowledging the mutation.

 if let Err(e) = with_io_retry(|| fs::rename(&tmp_path, &path)) {
remove_best_effort(&tmp_path);
return Err(format!("failed to finalize {}: {e}", path.display()));
}
clear_withdrawal_marker(&path)

[Copilot]

Pull request overview

Copilot reviewed 15 out of 16 changed files in this pull request and generated no new comments.

Suppressed comments (1)

tests/scripts/run_telemetry_etw_smoke_test.ps1:196

• This weakens the only test that inspects serialized ETW output: it drops mxc.sandbox_kind and does not verify any of the new required Part A privacy fields. The source-text unit tests can still pass if TraceLogging fails to encode those fields, so keep the existing field and assert the new privacy metadata here as well.

 $expectedFields = @('mxc.backend', 'mxc.exit_code', 'mxc.outcome', 'mxc.duration_ms')

[Copilot]

Pull request overview

Copilot reviewed 15 out of 16 changed files in this pull request and generated no new comments.

Suppressed comments (2)

Previously missed (1) — in code that hasn't changed since the last review.

src/core/wxc_common/src/telemetry/policy.rs:203

• Unrecognized DWORD values are silently collapsed to Blocked. That hides a broken administrative deployment from operators, contrary to the repository rule that fail-closed failures must be reported once per distinct failure (.github/copilot-instructions.md:337). Report the invalid value through the same deduplicated failure reporter while still returning Blocked.

 // Every other value — including `0` (off) and `1` (required-only,
// a category MXC does not emit) — denies. Unrecognized values deny
// too rather than being guessed at: fail closed.
PolicyValue::Value(_) => PolicyState::Blocked,

tests/scripts/run_telemetry_etw_smoke_test.ps1:196

• The smoke test no longer validates the newly added mxc.sandbox_kind field, so an ETW encoding/regression in MXC.Execution can pass despite the documented collector contract. The source-text unit test only checks this field on MXC.Error; keep it in this end-to-end field list as well.

 $expectedFields = @('mxc.backend', 'mxc.exit_code', 'mxc.outcome', 'mxc.duration_ms')

[Copilot]

Pull request overview

Copilot reviewed 15 out of 16 changed files in this pull request and generated no new comments.

[Gudge (MGudgin)]

Re-verified the existing findings against 55ce0a7. The stale-presenter, bounded-read, async-storage, and crash-durable withdrawal findings are addressed, and the targeted release consent and telemetry-provider tests pass. The remaining emit-vs-final-unregister test-coverage gap is Low and non-blocking.