Complete stable telemetry runtime and lifecycle integration

.github/workflows/Build.Windows.Job.yml

@@ -66,11 +66,32 @@ jobs:
              --no-default-features
              --features "${{ matrix.features }}"
 
+      - name: Test telemetry consent and policy in release mode
+        run: |
+          cargo test --locked --release --target ${{ matrix.target }} -p wxc_common telemetry::consent
+          cargo test --locked --release --target ${{ matrix.target }} -p wxc_common telemetry::policy
+
       - name: Test
         run: cargo test --locked --release --target ${{ matrix.target }}
              --no-default-features
              --features "${{ matrix.features }}"
 
+      - name: Build debug executor for isolated telemetry smoke tests
+        if: matrix.arch == 'x64'
+        run: cargo build --locked -p wxc --features test-support
+
+      - name: Run isolated telemetry consent smoke test
+        if: matrix.arch == 'x64'
+        working-directory: ${{ github.workspace }}
+        shell: pwsh
+        run: tests\scripts\run_telemetry_consent_smoke_test.ps1 -BinDir src\target\debug
+
+      - name: Run isolated telemetry ETW smoke test
+        if: matrix.arch == 'x64'
+        working-directory: ${{ github.workspace }}
+        shell: pwsh
+        run: tests\scripts\run_telemetry_etw_smoke_test.ps1 -BinDir src\target\debug
+
       - name: Upload binaries
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:

docs/schema.md

@@ -199,6 +199,11 @@ cannot mix both formats in one request.
         "extraMachLookups": []             // Additional Mach service global-names the inner process may resolve
     },
 
+    "telemetry": {                         // Telemetry (Windows only)
+        "enabled": true                    // Request emission for this run; MXC-owned user consent
+                                           // and a permitting administrative policy are also required
+    },
+
     "experimental": {                      // Experimental features (requires --experimental)
         "wslc": {                          // WSL Container settings
             "image": "alpine:latest",      // Container image name
@@ -210,9 +215,6 @@ cannot mix both formats in one request.
             "portMappings": [              // Host<->container port forwarding. TCP only -- the WSLC SDK runtime returns E_NOTIMPL for UDP, so the parser hard-rejects "udp" entries with a clear message.
                 { "windowsPort": 8080, "containerPort": 80, "protocol": "tcp" }
             ]
-        },
-        "telemetry": {                // Telemetry (Windows only)
-            "enabled": true                // Emit TraceLogging ETW events via pure Rust tracelogging crate
         }
     }
 }

docs/telemetry/telemetry.md

@@ -31,14 +31,11 @@ C++ shim, WIL, or FFI is required.
 └──────────────────────────────────────────────────────┘
 ```
 
-## Why the Rust `tracelogging` Crate (Not WIL C++ Shim)
+## TraceLogging implementation
 
-An earlier design used a WIL C++ shim compiled via the `cc` crate. PR review
-feedback correctly noted that the WIL dependency added C++ compilation, NuGet
-download, FFI unsafety, and blocked non-Windows contributors from building the
-crate. The Rust `tracelogging` crate provides the core ETW primitives needed,
-and the small set of WIL features MXC actually uses can be replicated with
-Rust constants and `write_event!` struct fields.
+The Rust `tracelogging` crate provides MXC's required ETW primitives without a
+C++ build, NuGet dependency, or FFI boundary. MXC supplies the remaining
+provider metadata through Rust constants and `write_event!` struct fields.
 
 ### Feature comparison
 
@@ -183,9 +180,9 @@ Emitted on execution errors.
 | `__TlgCV__` | string | Microsoft Correlation Vector (MS-CV) — the lifecycle correlation key (see [Correlating a lifecycle](#correlating-a-lifecycle)); empty for one-shot executions |
 
 > **No free-form error text is emitted.** Error messages can contain paths,
-> usernames, or credentials, so `MXC.Error` deliberately carries only the
-> bounded `error_type` category and the numeric `exit_code` — never the
-> message string itself.
+> usernames, or credentials, so `MXC.Error` deliberately carries only bounded
+> attribution fields, the `error_type` category, and the numeric `exit_code` —
+> never the message string itself.
 
 ### Correlating a lifecycle
 

schemas/dev/mxc-config.schema.0.9.0-alpha.json

@@ -194,12 +194,6 @@
     "DeprovisionExperimental": {
       "additionalProperties": false,
       "description": "Experimental settings accepted by the `deprovision` phase.",
-      "properties": {
-        "telemetry": {
-          "$ref": "#/definitions/Telemetry",
-          "description": "Optional telemetry override."
-        }
-      },
       "type": "object"
     },
     "DeprovisionPhase": {
@@ -219,10 +213,6 @@
         "_comment": {
           "description": "Optional human-readable annotation ignored by the runtime."
         },
-        "correlationVector": {
-          "description": "Optional correlation vector relayed from provision.",
-          "type": "string"
-        },
         "experimental": {
           "$ref": "#/definitions/DeprovisionExperimental",
           "description": "Optional closed post-provision experimental settings."
@@ -235,6 +225,10 @@
           "description": "Identifier of the sandbox to deprovision.",
           "type": "string"
         },
+        "telemetry": {
+          "$ref": "#/definitions/Telemetry",
+          "description": "Optional telemetry configuration."
+        },
         "version": {
           "$ref": "#/definitions/Version",
           "description": "Exact development contract version."
@@ -250,12 +244,6 @@
     "ExecExperimental": {
       "additionalProperties": false,
       "description": "Experimental settings accepted by the `exec` phase.",
-      "properties": {
-        "telemetry": {
-          "$ref": "#/definitions/Telemetry",
-          "description": "Optional telemetry override."
-        }
-      },
       "type": "object"
     },
     "ExecPhase": {
@@ -275,10 +263,6 @@
         "_comment": {
           "description": "Optional human-readable annotation ignored by the runtime."
         },
-        "correlationVector": {
-          "description": "Optional correlation vector relayed from provision.",
-          "type": "string"
-        },
         "experimental": {
           "$ref": "#/definitions/ExecExperimental",
           "description": "Optional closed exec experimental settings."
@@ -299,6 +283,10 @@
           "description": "Identifier of the sandbox to execute in.",
           "type": "string"
         },
+        "telemetry": {
+          "$ref": "#/definitions/Telemetry",
+          "description": "Optional telemetry configuration."
+        },
         "version": {
           "$ref": "#/definitions/Version",
           "description": "Exact development contract version."
@@ -400,10 +388,6 @@
         "isolation_session": {
           "$ref": "#/definitions/StateAwareIsolationSession",
           "description": "Optional IsolationSession backend settings."
-        },
-        "telemetry": {
-          "$ref": "#/definitions/Telemetry",
-          "description": "Optional telemetry override."
         }
       },
       "type": "object"
@@ -435,6 +419,10 @@
           "$ref": "#/definitions/ProvisionPhase",
           "description": "Exact `provision` phase marker."
         },
+        "telemetry": {
+          "$ref": "#/definitions/Telemetry",
+          "description": "Optional telemetry configuration."
+        },
         "version": {
           "$ref": "#/definitions/Version",
           "description": "Exact development contract version."
@@ -876,10 +864,6 @@
       "additionalProperties": false,
       "description": "Experimental settings.",
       "properties": {
-        "telemetry": {
-          "$ref": "#/definitions/Telemetry",
-          "description": "Optional telemetry override."
-        },
         "test": {
           "$ref": "#/definitions/TestFeature",
           "description": "Optional placeholder test feature."
@@ -980,6 +964,10 @@
           "$ref": "#/definitions/Seatbelt",
           "description": "Optional macOS Seatbelt configuration."
         },
+        "telemetry": {
+          "$ref": "#/definitions/Telemetry",
+          "description": "Optional telemetry configuration."
+        },
         "ui": {
           "$ref": "#/definitions/Ui",
           "description": "Optional cross-platform user-interface policy."
@@ -1280,12 +1268,6 @@
     "StartExperimental": {
       "additionalProperties": false,
       "description": "Experimental settings accepted by the `start` phase.",
-      "properties": {
-        "telemetry": {
-          "$ref": "#/definitions/Telemetry",
-          "description": "Optional telemetry override."
-        }
-      },
       "type": "object"
     },
     "StartPhase": {
@@ -1305,10 +1287,6 @@
         "_comment": {
           "description": "Optional human-readable annotation ignored by the runtime."
         },
-        "correlationVector": {
-          "description": "Optional correlation vector relayed from provision.",
-          "type": "string"
-        },
         "experimental": {
           "$ref": "#/definitions/StartExperimental",
           "description": "Optional closed post-provision experimental settings."
@@ -1321,6 +1299,10 @@
           "description": "Identifier returned by the provision phase.",
           "type": "string"
         },
+        "telemetry": {
+          "$ref": "#/definitions/Telemetry",
+          "description": "Optional telemetry configuration."
+        },
         "version": {
           "$ref": "#/definitions/Version",
           "description": "Exact development contract version."
@@ -1358,12 +1340,6 @@
     "StopExperimental": {
       "additionalProperties": false,
       "description": "Experimental settings accepted by the `stop` phase.",
-      "properties": {
-        "telemetry": {
-          "$ref": "#/definitions/Telemetry",
-          "description": "Optional telemetry override."
-        }
-      },
       "type": "object"
     },
     "StopPhase": {
@@ -1383,10 +1359,6 @@
         "_comment": {
           "description": "Optional human-readable annotation ignored by the runtime."
         },
-        "correlationVector": {
-          "description": "Optional correlation vector relayed from provision.",
-          "type": "string"
-        },
         "experimental": {
           "$ref": "#/definitions/StopExperimental",
           "description": "Optional closed post-provision experimental settings."
@@ -1399,6 +1371,10 @@
           "description": "Identifier returned by the provision phase.",
           "type": "string"
         },
+        "telemetry": {
+          "$ref": "#/definitions/Telemetry",
+          "description": "Optional telemetry configuration."
+        },
         "version": {
           "$ref": "#/definitions/Version",
           "description": "Exact development contract version."
@@ -1413,7 +1389,7 @@
     },
     "Telemetry": {
       "additionalProperties": false,
-      "description": "One-shot telemetry override.",
+      "description": "Telemetry settings.",
       "properties": {
         "enabled": {
           "description": "Whether telemetry is enabled.",
@@ -1521,12 +1497,6 @@
     "WindowsSandboxExperimental": {
       "additionalProperties": false,
       "description": "Experimental settings accepted by a Windows Sandbox provision request.",
-      "properties": {
-        "telemetry": {
-          "$ref": "#/definitions/Telemetry",
-          "description": "Optional telemetry override."
-        }
-      },
       "type": "object"
     },
     "WindowsSandboxProvisionRequest": {
@@ -1556,6 +1526,10 @@
           "$ref": "#/definitions/ProvisionPhase",
           "description": "Exact `provision` phase marker."
         },
+        "telemetry": {
+          "$ref": "#/definitions/Telemetry",
+          "description": "Optional telemetry configuration."
+        },
         "version": {
           "$ref": "#/definitions/Version",
           "description": "Exact development contract version."
@@ -1593,10 +1567,6 @@
       "additionalProperties": false,
       "description": "Experimental settings accepted by a WSLC provision request.",
       "properties": {
-        "telemetry": {
-          "$ref": "#/definitions/Telemetry",
-          "description": "Optional telemetry override."
-        },
         "wslc": {
           "$ref": "#/definitions/StateAwareWslc",
           "description": "Optional WSLC backend settings."
@@ -1635,6 +1605,10 @@
           "$ref": "#/definitions/ProvisionPhase",
           "description": "Exact `provision` phase marker."
         },
+        "telemetry": {
+          "$ref": "#/definitions/Telemetry",
+          "description": "Optional telemetry configuration."
+        },
         "version": {
           "$ref": "#/definitions/Version",
           "description": "Exact development contract version."

schemas/dev/mxc-config.schema.0.9.0-dev.json

@@ -212,17 +212,6 @@
           ],
           "description": "Seatbelt backend config (pre-promotion alias)."
         },
-        "telemetry": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/Telemetry"
-            },
-            {
-              "type": "null"
-            }
-          ],
-          "description": "Telemetry configuration."
-        },
         "test": {
           "anyOf": [
             {
@@ -961,10 +950,11 @@
       "type": "object"
     },
     "Telemetry": {
-      "description": "Telemetry configuration (`experimental.telemetry`).",
+      "additionalProperties": false,
+      "description": "Telemetry configuration (`telemetry`).",
       "properties": {
         "enabled": {
-          "description": "Explicit telemetry override. `true` = force on, `false` = force off, omitted = disabled (default off).",
+          "description": "Explicit telemetry opt-in for this invocation. `true` = opt in (still subject to the user's consent and to administrative policy — it can never turn telemetry on for someone who has not consented), `false` = force off, omitted = off.",
           "type": [
             "boolean",
             "null"
@@ -1196,13 +1186,6 @@
       ],
       "description": "Containment backend to use for execution. Accepts abstract intents (`process`, `vm`) and concrete backends; the binary resolves intents to a concrete backend per host at run time."
     },
-    "correlationVector": {
-      "description": "Microsoft Correlation Vector (MS-CV) seeded at `provision` and returned in the provision result. The client relays it verbatim into every later state-aware phase so all phases of one lifecycle share a telemetry base prefix (emitted under `__TlgCV__`). The executor is the trust boundary: on each non-provision phase it validates the relayed value and *spins* a fresh child element off a mutable base (so multiple invocations of one phase stay distinct), passes an already-frozen vector through unchanged, and reseeds a brand-new base if the relayed value is absent or malformed — so a missing or hostile relay never reaches telemetry unvalidated. Ignored unless experimental telemetry is enabled; not valid on one-shot requests.",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
     "experimental": {
       "anyOf": [
         {
@@ -1331,6 +1314,17 @@
       ],
       "description": "macOS Seatbelt backend configuration. Used when containment is `seatbelt`."
     },
+    "telemetry": {
+      "anyOf": [
+        {
+          "$ref": "#/definitions/Telemetry"
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "description": "Telemetry configuration."
+    },
     "ui": {
       "anyOf": [
         {

sdk/node/README.md

@@ -329,7 +329,7 @@ await deprovisionSandbox(sandboxId, undefined, opts);
 
 `windows_sandbox` follows the same shape (substitute the containment string and provide `filesystem.readwritePaths` / `readonlyPaths` at provision if needed). See [`docs/windows-sandbox/windows-sandbox.md`](https://github.com/microsoft/mxc/blob/main/docs/windows-sandbox/windows-sandbox.md) for the per-phase config matrix.
 
-`wslc` follows the same shape and needs no provision config at all (it defaults to an `alpine:latest` container with no network). Provide `filesystem.readwritePaths` / `readonlyPaths` (mounted for the sandbox's lifetime), `network.defaultPolicy: 'allow'` (a bridged container; the default `'block'` gives no network), and/or a backend-specific `image` / `imageTarPath` at provision; inject a cooperative `network.proxy: { url }` per-exec. WSLc state-aware requests default to schema `0.8.0-alpha`. See [`docs/wsl/wslc-state-aware.md`](https://github.com/microsoft/mxc/blob/main/docs/wsl/wslc-state-aware.md) for the per-phase config matrix.
+`wslc` follows the same shape and needs no provision config at all (it defaults to an `alpine:latest` container with no network). Provide `filesystem.readwritePaths` / `readonlyPaths` (mounted for the sandbox's lifetime), `network.defaultPolicy: 'allow'` (a bridged container; the default `'block'` gives no network), and/or a backend-specific `image` / `imageTarPath` at provision; inject a cooperative `network.proxy: { url }` per-exec. WSLc state-aware requests normally default to schema `0.8.0-alpha`; requests that include `telemetry` default to `0.9.0-alpha`. See [`docs/wsl/wslc-state-aware.md`](https://github.com/microsoft/mxc/blob/main/docs/wsl/wslc-state-aware.md) for the per-phase config matrix.
 
 **Handling failures.** Every lifecycle call rejects with a typed `MxcError`. Branch on `code` first: