Expose telemetry through Rust SDK, C ABI, and .NET binding

[RamonArjona4]

• I have signed the Contributor License Agreement.
• This pull request is related to an issue.
• If this PR changes build commands, project architecture, or key conventions, I have updated .github/copilot-instructions.md.

---

Summary

Exposes stable telemetry consent and policy through the public Rust SDK, panic-safe C ABI, and managed .NET binding. Adds typed presenter/status/withdrawal APIs, native binding entry points, streaming and state-aware propagation, and binding-codegen coverage.

This is PR 4 of 5 and depends on the stable runtime integration in PR 3.

Stack

Order	Change	PR
1	Normative privacy and telemetry documentation	#818
2	Consent and policy foundation	#819
3	Stable config and executor integration	#820
4	Rust SDK, C ABI, and .NET binding	#821
5	Node.js and .NET SDK refinements	#822

Review only this PR's diff; prerequisite behavior is in the PR above.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Jeff Whiteside (jsidewhite)]

[Copilot]

Pull request overview

Exposes telemetry consent, policy, and per-run enablement through the Rust SDK and C ABI.

Changes:

• Adds typed Rust telemetry APIs.
• Adds panic-safe C ABI consent and policy entry points.
• Propagates telemetry settings and expands tests/codegen checks.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/ffi/mxc_ffi/src/streaming.rs	Propagates telemetry into streaming requests.
src/ffi/mxc_ffi/src/lib.rs	Adds telemetry ABI and tests.
src/ffi/mxc_ffi/Cargo.toml	Adds telemetry test support.
src/core/mxc-sdk/src/telemetry.rs	Implements the Rust telemetry facade.
src/core/mxc-sdk/src/lib.rs	Exports the telemetry module.
src/core/mxc-sdk/README.md	Documents telemetry APIs and usage.
src/Cargo.lock	Records the test dependency.
scripts/check-dotnet-bindings-codegen.js	Verifies generated telemetry entry points.

Suppressed comments (1)

src/ffi/mxc_ffi/src/lib.rs:622

• This new ABI entry point manually constructs a stable JSON contract, but no FFI-level test invokes it. Add a test that asserts every returned field (including reason: null where applicable), checks the platform-specific values, and frees the returned string; otherwise field omissions or ownership regressions can pass unnoticed.

pub unsafe extern "C" fn mxc_telemetry_get_consent_status(out_utf8: *mut *mut c_char) -> i32 {

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (3)

src/core/mxc-sdk/src/telemetry.rs:342

• This accessor returns inner_consent::get_status().effective_state, not the recorded state. For example, a legacy stored grant is returned as Undetermined; calling it “recorded” obscures the stored/effective distinction and can mislead SDK consumers. Point callers needing the persisted value to get_consent_status.

/// Return the user's recorded consent decision.

src/ffi/mxc_ffi/src/lib.rs:439

• The export marshals the effective state returned by get_consent(), not necessarily the persisted state. A version-invalid stored grant is reported as "undetermined", so describing this as persisted gives C callers the wrong contract; mxc_telemetry_get_consent_status is the API that exposes both values.

/// Read the persisted telemetry consent state.

src/ffi/mxc_ffi/src/lib.rs:627

• This is the only new telemetry export with no FFI-level test, so the JSON field names/values, allocation ownership, and null-output status can regress without this crate detecting it. Add a test using the isolated telemetry environment that calls this export, parses and frees the JSON, asserts storedState, effectiveState, reason, and policy, and covers a null out pointer.

pub unsafe extern "C" fn mxc_telemetry_get_consent_status(out_utf8: *mut *mut c_char) -> i32 {

[Copilot]

Pull request overview

Copilot reviewed 15 out of 16 changed files in this pull request and generated no new comments.

Suppressed comments (5)

sdk/dotnet/Microsoft.Mxc.Sdk/MxcTelemetry.cs:275

• A non-success native status is silently collapsed to false, and the catch below does the same for load/marshaling failures. Because false is also a legitimate answer, a broken native install becomes invisible to hosts that poll this getter. Keep the fail-closed return value, but report each distinct swallowed failure once through a non-throwing diagnostic path.

 int needsPrompt = 0;
var status = NativeMethods.mxc_telemetry_needs_consent_prompt(&needsPrompt);
return status == (int)ErrorCode.Success && needsPrompt != 0;

sdk/dotnet/Microsoft.Mxc.Sdk/MxcTelemetry.cs:302

• This non-success path (and the catch below) returns the legitimate Blocked state without reporting why, so native ABI/load failures are indistinguishable from an administrator actually blocking telemetry. Preserve the fail-closed result, but emit a non-throwing, once-per-distinct-failure diagnostic so polling does not spam logs.

 if (status != (int)ErrorCode.Success)
{
return TelemetryPolicyState.Blocked;
}

src/ffi/mxc_ffi/src/lib.rs:87

• This safety note overstates what the surrounding catch_unwind can protect. A panic escaping a Rust extern "C" presenter cannot unwind back to this frame; it normally aborts at the non-unwinding ABI boundary. The callback must catch Rust panics too, just as the managed bridge below catches managed exceptions, or binding authors may believe a presenter panic is recoverable.

/// **The callback must not unwind across the FFI boundary.** Only Rust panics
/// are caught by [`std::panic::catch_unwind`] on the Rust side; a C++
/// exception, a .NET/CLR exception, an Objective-C exception, a Go panic, or
/// any other foreign unwind mechanism escaping this callback into Rust is

sdk/dotnet/Microsoft.Mxc.Sdk/MxcTelemetry.cs:102

• The PR description and stack explicitly reserve the Node.js/.NET SDK surfaces for #822, but this file introduces the public .NET telemetry API in #821. That makes this PR contain the next stack layer and prevents the Rust SDK/C ABI change from being reviewed independently as described. Please move the .NET API, policy, error-code, and managed-test changes to #822 or update/split the stack consistently.

/// <summary>Telemetry consent helpers over the native <c>mxc_ffi</c> surface.</summary>
public static class MxcTelemetry

sdk/dotnet/Microsoft.Mxc.Sdk/MxcTelemetry.cs:149

• This catch converts native-load, marshaling, and malformed-native-response failures into the legitimate Undetermined consent state. Callers then cannot distinguish “no decision” from a broken installation. Consent reads should surface failures as the SDK's documented MxcException type; reserve never-throw fail-closed behavior for the polling helpers (NeedsConsentPrompt and GetPolicy).

This issue also appears in the following locations of the same file:

• line 273
• line 299

 catch
{
return TelemetryConsentState.Undetermined;
}

[Copilot]

🟡 Changes recommended

The callback unwind contract is inaccurate and the .NET README references a nonexistent state-aware telemetry property.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 23/24 changed files
• Comments generated: 2
• Review effort level: Balanced

[Copilot]

🔵 Needs a closer look

The privacy-sensitive public API spans Rust, native ABI, managed callbacks, and custom build integration, warranting final human validation.

Review details

• Files reviewed: 23/24 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

🔵 Needs a closer look

The privacy-sensitive API spans Rust, native ABI, managed callbacks, and custom test-build infrastructure, warranting final human review.

Review details

• Files reviewed: 23/24 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

🟡 Changes recommended

Public API documentation incorrectly describes effective consent as the persisted user decision.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 23/24 changed files
• Comments generated: 3
• Review effort level: Balanced

[Copilot]

🟡 Changes recommended

The asynchronous consent API can persist consent after its cancellation token has been canceled.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 23/24 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

🔵 Needs a closer look

Managed fail-closed query paths silently suppress failures instead of emitting required deduplicated diagnostics.

Review details

Suppressed comments (3)

Previously missed (1) — in code that hasn't changed since the last review.

sdk/dotnet/Microsoft.Mxc.Sdk/MxcTelemetry.cs:151

• This fallback silently hides native-load and managed parsing failures. Telemetry's fail-closed convention requires swallowed failures to remain diagnosable once per distinct failure (see docs/telemetry/telemetry-administrative-policy.md:47-49 and the native report_diagnostic_once helper), otherwise a broken binding is indistinguishable from a genuine undetermined state. Report the exception through a non-throwing, deduplicated diagnostic helper before returning Undetermined.

This issue also appears in the following locations of the same file:

• line 317
• line 351

sdk/dotnet/Microsoft.Mxc.Sdk/MxcTelemetry.cs:319

• This catch converts every resolver/native failure to false without any diagnostic. Because false is also the legitimate no-prompt result, a broken native installation becomes invisible; the telemetry failure-handling convention reports swallowed failures once per distinct failure (docs/telemetry/telemetry-administrative-policy.md:47-49). Use the same non-throwing, deduplicated managed diagnostic helper as the other fail-closed queries before returning.

 catch
{
return false;

sdk/dotnet/Microsoft.Mxc.Sdk/MxcTelemetry.cs:353

• Returning Blocked is correctly fail-closed, but silently swallowing this exception violates the policy contract that unreadable failures are reported once so operators can distinguish a broken deployment from an intentional block (docs/telemetry/telemetry-administrative-policy.md:43-49). Emit a non-throwing, deduplicated diagnostic before returning the fallback.

 catch
{
return TelemetryPolicyState.Blocked;

• Files reviewed: 26/27 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

🔵 Needs a closer look

The broad privacy-sensitive, cross-language API and FFI changes warrant final human validation despite the extensive coverage.

Review details

• Files reviewed: 26/27 changed files
• Comments generated: 0 new
• Review effort level: Balanced