Add COM diagnostics to Learning Mode

[Jacob Dereje (jacobdereje-msft)]

Adds diagnostic labels for COM activation and interface calls, retaining the CLSID/IID in verbose logs. ## Tests Ran 214 decoder tests and Clippy locally; all passed. Replayed real VM COM traces and verified activation and interface-call diagnostics. Processing the same traces before and after produced identical actionable JSON. ###### Microsoft Reviewers: Open in CodeFlow

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

Review effort: Lite
Findings: 1

Open (1)

• The brace-stripping logic is difficult to reason about because it checks the suffix on the original… · New

What changed in this PR

Adds COM-specific verbose diagnostics to Windows Learning Mode decoding and telemetry projection, including distinct outcome reasons for COM activation and COM interface calls, while bumping the verbose document schema version.

Changes:

• Introduces ComActivation / ComInterfaceCall verbose outcome reasons and bumps verbose schema version to 3.
• Recognizes COM access-check object types as verbose-only outcomes and validates CLSID/IID is GUID-shaped.
• Updates tests and documentation to cover COM diagnostics and the version bump.

File	Description
src/​testing/​wxc_e2e_tests/​tests/​e2e_telemetry_etw.rs	Updates E2E ETW assertion for verbose document version 3.
src/​core/​mxc_engine/​src/​verbose_telemetry.rs	Adds test coverage ensuring telemetry projection preserves COM reason while stripping properties.
src/​core/​learning_mode_platforms/​windows/​src/​extractors.rs	Detects COM object types as verbose-only, validates GUID-shaped identifiers, adds helper functions + tests, and updates module/docs comments.
src/​core/​learning_mode_platforms/​windows/​src/​etl_decode.rs	Adds decoder tests ensuring COM checks remain verbose-only and malformed identifiers are classified as diagnostics.
src/​core/​learning_mode_core/​src/​verbose_logging.rs	Adds new verbose reasons, bumps schema version, and extends summary/serialization tests.
docs/​learning-mode/​capabilities.md	Documents COM access checks, verbose reasons, and updates schema version in examples.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation preserves actionable output, strips identifiers from telemetry, and comprehensively tests the new classifications.

Review effort: Balanced
Findings: 1

Open (1)

• The brace-stripping logic is difficult to reason about because it checks the suffix on the original…

[Copilot]

🟡 Changes recommended

The public verbose-artifact documentation still describes version 2 and omits the new COM outcomes.

1 open finding

• Update verbose-artifact docs for schema v3 and new outcomes · New

1 resolved since last review

• The brace-stripping logic is difficult to reason about because it checks the suffix on the original…

🧠 Review effort: Balanced

[Copilot]

🟢 Approval recommended

The implementation and coverage are consistent, with only a non-blocking rustdoc correction noted.

0 open findings

1 resolved since last review

• Update verbose-artifact docs for schema v3 and new outcomes

Previously missed (1)

In code that hasn't changed since last review

Update access-check docs for retained COM object outcomes

src/​core/​learning_mode_platforms/​windows/​src/​extractors.rs:661

The access-check documentation above this function is now inaccurate: it says all other object types are dropped until their access-mask vocabulary is understood, but these COM object types are retained as verbose-only outcomes and intentionally have no access classification. Please document the COM exception and its ComActivation/ComInterfaceCall outcomes so the extractor contract matches this branch.

🧠 Review effort: Balanced

[Jacob Dereje (jacobdereje-msft)]

@microsoft-github-policy-service agree company="Microsoft"

[Copilot]

🟢 Approval recommended

The scoped implementation preserves actionable output, sanitizes telemetry, and includes comprehensive focused coverage.

0 open findings

🧠 Review effort: Balanced

[Gudge (MGudgin)]

Summary

Reviewed PR #1395 at 559fdc5 against its PR base 63b71a3 (6 changed files, +307/-6). I request changes primarily to make the new COM diagnostic reason contract unambiguous and to exercise the privacy-provider path that the new "both modes" test does not cover. The mixed-version guardian issue is conditional: please confirm the supported deployment/update model and either handle v2 artifacts or enforce/document matched binaries. The documentation's "denied" wording is a claim mismatch, not a merge condition by itself. Low-priority test and API-documentation suggestions below are non-blocking.

Verified clean: Valid COM access checks still return non-actionable outcomes rather than actionable policy denials; telemetry projection removes signature properties before emission, including CLSID/IID values. The decoder test count increases from 48 to 50; the new COM integration tests use kernel_event rather than the existing permissive_event helper.

Findings outside the diff / claim-only findings

No finding requires an out-of-diff anchor. The misleading "denied" claim is on the newly added documentation line and is commented there as claim_mismatch; it is not independently blocking.

Verified pre-existing — not attributed to this PR

No pre-existing issue is being charged to this PR. guarded_capture.rs is byte-identical between base and head; the telemetry reader's exact-version check also predates the PR. Both are cited only because the new v2-to-v3 version change makes their combination relevant to a possible mixed-version deployment.

[Copilot]

🔵 Needs a closer look

Malformed COM identifiers can persist arbitrary ObjectName values in verbose artifacts.

0 open findings

Previously missed (1)

In code that hasn't changed since last review

Redact malformed COM ObjectName before recording error signatures

src/​mxc-sdk/​src/​core/​learning_mode_windows/​extractors.rs:683

Malformed COM identifiers are still passed through the generic property sanitizer when this error is recorded. That sanitizer only redacts recognized paths/usernames, so an invalid ObjectName such as an arbitrary token or email address is persisted verbatim even though only a validated CLSID/IID is safe to retain. Please drop or redact ObjectName for this malformed-COM path before recording the verbose signature.

🧠 Review effort: Balanced

[Copilot]

🟢 Approval recommended

The implementation preserves actionable output and includes focused validation of classification, sanitization, serialization, and telemetry behavior.

0 open findings

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Gudge (MGudgin)]

Correction to my Changes Requested review (5446248759): I withdraw the Medium finding about a v2 verbose artifact from an older co-located guardian (comment 4210188524). This was my incorrect assumption about artifact ownership.

In guarded capture, plm/elevated.rs:2154-2168 sends an AnalysisResult over the pipe, not a verbose document. The SDK's capture_output.rs:70-79 builds and writes the actionable and verbose siblings from that result using its own VerboseLoggingDocument::VERSION; the telemetry reader runs in that same SDK. An older signed guardian therefore cannot produce the alleged v2 artifact for a newer SDK reader through this path. Please disregard this finding as a merge condition.

This correction applies only to the version-compatibility finding. I am verifying the disposition of the other six comments against the updated head.