Complete stable telemetry runtime and lifecycle integration by RamonArjona4 · Pull Request #820 · microsoft/mxc

RamonArjona4 · 2026-08-12T01:07:52Z

I have signed the Contributor License Agreement.
This pull request is related to an issue.
If this PR changes build commands, project architecture, or key conventions, I have updated .github/copilot-instructions.md.

Summary

Completes stable telemetry runtime and lifecycle integration across MXC:

Promotes telemetry from an experimental field to the stable 0.9 configuration contract.
Updates wire models, exact-version contracts, adapters, generated schemas, and Node types.
Connects telemetry to the execution engine and all three executors: Windows, Linux, and macOS.
Covers one-shot, state-aware, attached, streaming, cancellation, timeout, error, panic, and abandoned-handle paths.
Enforces live consent and administrative-policy authorization.
Adds typed JSON consent-maintenance requests and retains the read-only status CLI.
Persists lifecycle correlation across separate state-aware invocations.
Registers the WINEXT provider contract and required privacy metadata.
Adds unit, schema, smoke, ETW, and end-to-end coverage.

This is PR 3 of 5 and depends on the consent/policy foundation in PR 2.

Stack

Order	Change	PR
1	Normative privacy and telemetry documentation	#818
2	Consent and policy foundation	#819
3	Stable config and executor integration	#820
4	Rust SDK and C ABI	#821
5	Node.js and .NET SDKs	#822

Review only this PR's diff; prerequisite behavior is in the PR above.

azure-pipelines · 2026-08-12T01:08:02Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Jeff Whiteside (jsidewhite)

Keep state-aware envelopes isolated from diagnostic output and align timeout and non-zero exit classification with one-shot telemetry. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6e20d046-910e-4ee7-b8e8-acb0fe007208

Copilot

🔵 Needs a closer look

Two moderate telemetry correctness and coverage issues remain unresolved.

Review details

Suppressed comments (3)

Previously missed (2) — in code that hasn't changed since the last review.

src/core/mxc_engine/src/state_aware.rs:363

Telemetry is initialized only after exec_attached_gate, so a valid telemetry-enabled exec request made from redirected/non-terminal stdio returns malformed_request without the promised failure Execution/Error events (or telemetry-init warnings). Initialize telemetry/correlation before this gate and emit the gate failure through the state-aware telemetry path before returning.
src/core/wxc_common/src/config_parser.rs:804
None means two different things here: omitted containment on a one-shot request (which correctly defaults to process) and an unrecognized/malformed sandboxId prefix on a non-provision state-aware request. In the latter case, telemetry-enabled dispatch failures are therefore recorded as mxc.sandbox_kind=process even though the caller did not request process containment. Preserve the context or use unknown for failed state-aware inference so error telemetry is not misattributed.

docs/telemetry/telemetry.md:206

This replaces the caller-visible correlation-vector contract with an internal identifier, but it never names the ETW field that consumers actually receive. Both MXC.Execution and MXC.Error emit this value as the string field __TlgCV__; documenting that name here (or in both event tables) is necessary for the event contract to be usable and auditable.

- An MXC-internal lifecycle correlation identifier. SDK callers neither supply
nor receive it.

Files reviewed: 89/92 changed files
Comments generated: 0 new
Review effort level: Balanced

Validate the presentation request and terminal failure emitted when a piped consent request reaches stdin EOF. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6e20d046-910e-4ee7-b8e8-acb0fe007208

Copilot

🟡 Changes recommended

Provider registration is not unwind-safe, and consent override ownership validation remains unresolved.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (2)

src/core/mxc_engine/src/state_aware.rs:363

This attached path also holds a successful provider registration only in a bool. If warning surfacing, backend resolution, correlation setup, or run_state_aware panics and the library caller catches the unwind, the provider reference leaks because the explicit emitter is never reached. Use the same RAII registration owner as the streaming path, disarming it after the terminal emitter releases the reference.
src/core/mxc_engine/src/state_aware.rs:445
A successful initialization is not unwind-safe here: any panic before emit_sdk_state_aware_with_kind leaves the reference count incremented. Since these engine APIs can be embedded in a long-lived host that catches panics, this can keep ETW registered indefinitely and make subsequent library unloading unsafe. Own the registration with an RAII guard and disarm it only after the explicit terminal emission.

Files reviewed: 89/92 changed files
Comments generated: 3
Review effort level: Balanced

Jeff Whiteside (jsidewhite) · 2026-09-02T22:33:39Z

// Copyright (c) Microsoft Corporation.

revert please

In reply to: 5515676524

Refers to: src/core/lxc/src/main.rs:1 in 4169b06. [](commit_id = 4169b06, deletion_comment = False)

Jeff Whiteside (jsidewhite) · 2026-09-02T22:34:46Z

// Copyright (c) Microsoft Corporation.

rvert

In reply to: 5515680362

Refers to: src/core/mxc_darwin/src/main.rs:1 in 4169b06. [](commit_id = 4169b06, deletion_comment = False)

Co-authored-by: RamonArjona4 <25335379+RamonArjona4@users.noreply.github.com>

Copilot

🔵 Needs a closer look

A moderate terminal cleanup defect remains within broad cross-platform lifecycle changes.

Review details

Suppressed comments (3)

Previously missed (1) — in code that hasn't changed since the last review.

src/core/wxc_common/src/telemetry/mod.rs:319

This terminal path skips shutdown() when live consent/policy was withdrawn, and it also leaves the terminal slot unclaimed. The provider reference therefore remains registered, and a later panic can emit for an already-completed invocation if authorization is restored. Claim the terminal slot independently of authorization, emit only when authorized, and always release the provider reference.

This issue also appears in the following locations of the same file:

line 426
line 930

src/core/wxc_common/src/telemetry/mod.rs:430

As in the completion path, authorization withdrawal returns before shutdown() and before claiming the terminal slot. This leaks the registration reference and allows a later out-of-band event to represent an invocation that has already terminated. Always claim the slot and release the provider, while gating only the event writes on live authorization.
src/core/wxc_common/src/telemetry/mod.rs:934
A live consent/policy change to deny collection makes this return without releasing the provider reference or consuming the process terminal slot. That breaks the balanced provider lifecycle and can permit a later panic/cancellation event after this phase already finished. Keep authorization around the writes only; terminal bookkeeping and shutdown() must still run.

Files reviewed: 89/92 changed files
Comments generated: 0 new
Review effort level: Balanced

Remove the remaining consent command documentation and the non-Windows consent CLI and parsing refactors, while retaining the stable telemetry wiring required by the promoted runtime model. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6e20d046-910e-4ee7-b8e8-acb0fe007208

Hold SDK telemetry registration with RAII until a streaming process wrapper takes ownership, and scope inherited consent-store overrides to direct child processes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6e20d046-910e-4ee7-b8e8-acb0fe007208

Stamp and restore the consent-store override owner for direct executor children as well as ProcessStartInfo launches. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6e20d046-910e-4ee7-b8e8-acb0fe007208

RamonArjona4 · 2026-09-02T23:08:17Z

Addressed macOS file revert request: c4aa355 removes the consent CLI and parsing refactors; only the stable telemetry promotion wiring remains.

RamonArjona4 · 2026-09-02T23:08:17Z

Confirmed the repeated LXC revert request is addressed by c4aa355.

RamonArjona4 · 2026-09-02T23:08:17Z

Addressed schema-codegen removal request: PR #820 has no changes to scripts/versioning/check-schema-codegen.js.

RamonArjona4 · 2026-09-02T23:08:17Z

Addressed LXC file revert request: c4aa355 removes the consent CLI and parsing refactors; only the stable telemetry promotion wiring remains.

RamonArjona4 · 2026-09-02T23:08:17Z

Confirmed the repeated macOS revert request is addressed by c4aa355.

Copilot

🔵 Needs a closer look

The public Node version-default documentation is incorrect, and the Rust telemetry opt-in remains undocumented.

Review details

Suppressed comments (2)

sdk/node/src/state-aware-types.ts:170

Adding telemetry changes the omitted-version default to 0.9.0-alpha, but the adjacent public JSDoc still promises 0.8.0-alpha. This will mislead WSLc callers; document the conditional default here, as the implementation does in buildStateAwareEnvelope.

 telemetry?: TelemetryConfig;

src/core/mxc_engine/src/policy.rs:706

This adds a public Rust SDK opt-in (SandboxRequest is re-exported by mxc-sdk), but the crate README and top-level usage example still do not mention how telemetry is enabled or that consent and policy are additional gates. The repository requires Rust SDK API changes to update the crate docs/README, so please document this method in src/core/mxc-sdk/README.md (and preferably show it in the crate-level usage docs).

Files reviewed: 88/91 changed files
Comments generated: 0 new
Review effort level: Balanced

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6e20d046-910e-4ee7-b8e8-acb0fe007208

Copilot

🔵 Needs a closer look

Moderate issues remain in Node versioning documentation and Windows dry-run telemetry behavior.

Review details

Suppressed comments (3)

Previously missed (1) — in code that hasn't changed since the last review.

src/core/wxc/src/main.rs:1341

--dry-run is documented as parsing and validating without execution, but this emits an Execution completion event before handle_dry_run_exit. Linux and macOS place this emission after their terminating dry-run branch, so Windows uniquely reports validation-only commands as executions. Move the emission below the dry-run branch.

docs/telemetry/telemetry.md:206

The new lifecycle identifier is emitted as __TlgCV__ on both MXC.Execution and MXC.Error, but neither event field table documents it. Add the field name, state-aware-only scope, and empty one-shot behavior to both tables so the documented event contract matches the provider payload.

- An MXC-internal lifecycle correlation identifier. SDK callers neither supply
nor receive it.

sdk/node/src/state-aware-types.ts:170

The public JSDoc immediately above still says an omitted WSLc version is always filled with 0.8.0-alpha, but adding telemetry makes buildStateAwareEnvelope select 0.9.0-alpha. Document this exception here so generated API docs do not contradict runtime behavior.

 telemetry?: TelemetryConfig;

Files reviewed: 88/91 changed files
Comments generated: 0 new
Review effort level: Balanced

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6e20d046-910e-4ee7-b8e8-acb0fe007208

Copilot

🟡 Changes recommended

Four moderate issues remain in API documentation, sandbox-kind attribution, consent isolation, and lifecycle correlation persistence.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

sdk/node/src/state-aware-types.ts:170

The preceding public JSDoc says an omitted WSLc version is always filled with 0.8.0-alpha, but adding this field changes the default to 0.9.0-alpha whenever telemetry is present. Document that conditional default here as the README already does, so generated API documentation does not mislead callers.

 telemetry?: TelemetryConfig;

Files reviewed: 88/91 changed files
Comments generated: 3
Review effort level: Balanced

+ let telemetry = cfg.telemetry.map(|raw| TelemetryConfig {
+ enabled: raw.enabled,
+ requested_sandbox_kind: Some(requested_sandbox_kind(cfg.containment.as_ref())),
+ });


+ let owner = owner?.to_str()?.parse::<u32>().ok()?;
+ (Some(owner) == parent_process_id).then_some(path)


+fn phase_vector(sandbox_id: &str) -> String {
+ match with_store(|store| store.load_and_prune(sandbox_id)) {
+ Some(root) if is_relayable(&root) => spin(&root),
+ _ => seed(),
+ }


Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6e20d046-910e-4ee7-b8e8-acb0fe007208

Copilot

🔵 Needs a closer look

Unresolved provider-registration leaks on panic violate telemetry unload-safety guarantees.

Review details

Suppressed comments (2)

src/core/mxc_engine/src/state_aware.rs:363

The attached path also owns a bare provider reference after telemetry::init. A backend panic can unwind to an SDK/FFI catch boundary without reaching emit_sdk_state_aware_with_kind, leaking the registration and violating the documented unload-safety invariant. Wrap this reference in TelemetryRegistration and transfer it only when emitting the terminal event.
src/core/mxc_engine/src/state_aware.rs:445
telemetry::init increments the process-wide ETW registration count, but this envelope path has no RAII owner. If run_state_aware (or warning injection/emission) panics and the library caller catches the unwind, shutdown is never called; subsequent calls retain a leaked reference, and unloading the FFI library can leave ETW callbacks pointing into unmapped code. Hold a TelemetryRegistration immediately after initialization and transfer it only to the terminal emitter, as the streaming path does.

Files reviewed: 88/91 changed files
Comments generated: 0 new
Review effort level: Balanced

Resolve the telemetry and diagnostic overlap with PR #791 while preserving top-level telemetry consent, internal state-aware correlation, requested sandbox attribution, and the scoped ETW audit events. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6e20d046-910e-4ee7-b8e8-acb0fe007208

Copilot

🟡 Changes recommended

The unresolved MS-CV boundary defect must be fixed before approval, and the stale telemetry documentation should be corrected.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Files reviewed: 89/92 changed files
Comments generated: 2
Review effort level: Balanced

+/// Maximum wire length of a v2.1 vector before it must be terminated.
+const MAX_LEN: usize = 128;


+> usernames, or credentials, so `MXC.Error` deliberately carries only bounded
+> attribution fields, the `error_type` category, and the numeric `exit_code` —
+> never the message string itself.


RamonArjona4 marked this pull request as ready for review August 12, 2026 01:22

RamonArjona4 requested a review from a team as a code owner August 12, 2026 01:22

This comment was marked as outdated.
Sign in to view

Jeff Whiteside (jsidewhite) requested a review from Gudge (MGudgin)August 12, 2026 22:39

Jeff Whiteside (jsidewhite) reviewed Aug 12, 2026
View reviewed changes

Comment threadschemas/dev/mxc-telemetry-consent.schema.1.json Outdated

Jeff Whiteside (jsidewhite) reviewed Aug 12, 2026
View reviewed changes

Comment threadsrc/core/wxc_common/src/config_parser.rs

Jeff Whiteside (jsidewhite) reviewed Aug 12, 2026
View reviewed changes

Comment threadschemas/dev/mxc-config.schema.0.9.0-dev.json

Jeff Whiteside (jsidewhite) previously approved these changes Aug 12, 2026
View reviewed changes

CopilotAI balanced review requested due to automatic review settings August 13, 2026 04:06

RamonArjona4 dismissed Jeff Whiteside (jsidewhite)’s stale review via 78c6ac3August 13, 2026 04:06

RamonArjona4 requested a review from a teamAugust 13, 2026 04:06

Copilotstarted reviewing on behalf of RamonArjona4 August 13, 2026 04:06 View session

This comment was marked as outdated.
Sign in to view

CopilotAI review requested due to automatic review settings August 13, 2026 05:28

Copilotstarted reviewing on behalf of RamonArjona4 August 13, 2026 05:28 View session

This comment was marked as outdated.
Sign in to view

Gudge (MGudgin) reviewed Aug 13, 2026
View reviewed changes

CopilotAI review requested due to automatic review settings August 18, 2026 18:50

RamonArjona4 force-pushed the user/ramonarjona4/telemetry-03-runtime branch from d297b29 to b1e1b8bCompare August 18, 2026 18:50

Copilotstarted reviewing on behalf of RamonArjona4 August 18, 2026 18:52 View session

This comment was marked as outdated.
Sign in to view

CopilotAI review requested due to automatic review settings August 18, 2026 19:04

CopilotAI reviewed Sep 2, 2026
View reviewed changes

Fix piped consent smoke assertion
291d015
Validate the presentation request and terminal failure emitted when a piped consent request reaches stdin EOF. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6e20d046-910e-4ee7-b8e8-acb0fe007208

CopilotAI reviewed Sep 2, 2026
View reviewed changes

Comment threadsrc/core/mxc_engine/src/lib.rs
Comment threadsrc/core/mxc_engine/src/state_aware.rs
Comment threadsrc/core/wxc_common/src/telemetry/consent.rs Outdated

Jeff Whiteside (jsidewhite) reviewed Sep 2, 2026
View reviewed changes

Comment threaddocs/telemetry/telemetry-consent-design.md Outdated

Jeff Whiteside (jsidewhite) reviewed Sep 2, 2026
View reviewed changes

Comment threaddocs/telemetry/telemetry-consent-design.md Outdated

Remove non-Windows executor detail
8879a7d
Co-authored-by: RamonArjona4 <25335379+RamonArjona4@users.noreply.github.com>

Jeff Whiteside (jsidewhite) reviewed Sep 2, 2026
View reviewed changes

Comment threadsrc/core/wxc_common/src/config_parser.rs

CopilotAI reviewed Sep 2, 2026
View reviewed changes

RamonArjona4 added 3 commits September 2, 2026 15:52

Scope smoke-test consent overrides
416f691
Stamp and restore the consent-store override owner for direct executor children as well as ProcessStartInfo launches. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6e20d046-910e-4ee7-b8e8-acb0fe007208

CopilotAI reviewed Sep 2, 2026
View reviewed changes

Fix consent test module ordering
e24bf5f
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6e20d046-910e-4ee7-b8e8-acb0fe007208

CopilotAI reviewed Sep 2, 2026
View reviewed changes

Merge main into telemetry runtime
1f5ace1
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6e20d046-910e-4ee7-b8e8-acb0fe007208

CopilotAI reviewed Sep 2, 2026
View reviewed changes

Jeff Whiteside (jsidewhite) previously approved these changes Sep 3, 2026
View reviewed changes

Merge main into telemetry runtime
42c0c12
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6e20d046-910e-4ee7-b8e8-acb0fe007208

CopilotAI reviewed Sep 4, 2026
View reviewed changes

Branden Bonaby (bbonaby) approved these changes Sep 4, 2026
View reviewed changes

		let owner = owner?.to_str()?.parse::<u32>().ok()?;
		(Some(owner) == parent_process_id).then_some(path)

		/// Maximum wire length of a v2.1 vector before it must be terminated.
		const MAX_LEN: usize = 128;

Uh oh!

Conversation

RamonArjona4 commented Aug 12, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Stack

Uh oh!

azure-pipelinesBot commented Aug 12, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Uh oh!

Jeff Whiteside (jsidewhite) left a comment

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Suppressed comments (3)

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Suppressed comments (2)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Jeff Whiteside (jsidewhite) commented Sep 2, 2026

Uh oh!

Jeff Whiteside (jsidewhite) commented Sep 2, 2026

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Suppressed comments (3)

Uh oh!

RamonArjona4 commented Sep 2, 2026

Uh oh!

RamonArjona4 commented Sep 2, 2026

Uh oh!

RamonArjona4 commented Sep 2, 2026

Uh oh!

RamonArjona4 commented Sep 2, 2026

Uh oh!

RamonArjona4 commented Sep 2, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Suppressed comments (2)

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Suppressed comments (3)

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Suppressed comments (1)

Uh oh!

RamonArjona4 commented Aug 12, 2026•
edited
Loading