Scope verbose diagnostics to Learning Mode events

[Jacob Dereje (jacobdereje-msft)]

Retains sanitized verbose diagnostics for all resource types within known Learning Mode events. Filters by provider and event ID, records decoding failures, and caches unavailable manifest schemas within the existing limit.

Tests

Ran 224 Windows decoder tests and Clippy locally; all passed. Replayed 48 native and controlled traces, verifying unchanged actionable JSON and preservation of selected event properties and counts.

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

Review effort: Lite
Findings: 1 · 1

Open (2)

• The new embedded-path detection scans every character offset and runs multiple path heuristics… · New
• Reusing looks_like_file_path_property with an empty property name to detect *path-like property… · New

What changed in this PR

This PR updates Learning Mode verbose logging so unfamiliar ETW providers/event IDs are retained as bounded, sanitized diagnostics (with explicit failure reasons), and adjusts guarded relogging + telemetry projection accordingly.

Changes:

• Preserve unknown providers/events in verbose logs (including schema event names when available) and record closed diagnostic reasons on decode failures instead of aborting analysis.
• Update guarded relogging + analysis to handle relogger transport headers and keep all in-scope provider events.
• Bump verbose logging document schema to v3 and update tests/docs to match.

File	Description
src/​testing/​wxc_e2e_tests/​tests/​e2e_telemetry_etw.rs	Updates E2E fixture to build plm, uses a local denied file, and bumps expected verbose doc version to v3.
src/​host/​plm/​src/​stop.rs	Adjusts truncation/adjusted-config test fixture to include a denial entry.
src/​host/​plm/​src/​elevated.rs	Switches guarded analysis to the “relogged trace” analyzer entry point.
src/​core/​mxc_engine/​src/​verbose_telemetry.rs	Re-aggregates signatures for telemetry after dropping provider GUIDs/properties and removing schema event names.
src/​core/​learning_mode_platforms/​windows/​src/​tdh_decode.rs	Adds schema event name to decoded parts and test support for schema injection.
src/​core/​learning_mode_platforms/​windows/​src/​extractors.rs	Extends redaction heuristics (embedded paths, path-like property names) and adds sanitize_event_name.
src/​core/​learning_mode_platforms/​windows/​src/​etl_filter.rs	Relogs all in-scope events (not just known providers) and adds an ETW-based regression test for unknown-event preservation.
src/​core/​learning_mode_platforms/​windows/​src/​etl_decode.rs	Records diagnostics for unknown/malformed events, adds relogged-trace analysis path, and treats schema failures as non-fatal (with incompleteness marking).
src/​core/​learning_mode_platforms/​windows/​src/​capability_dacl.rs	Updates test fixtures for the new event_name field in decoded parts.
src/​core/​learning_mode_platforms/​windows/​Cargo.toml	Adds Windows-only dev-deps for new ETW relogging test (tempfile, tracelogging).
src/​core/​learning_mode_core/​src/​verbose_logging.rs	Adds other provider, schemaUnavailable outcome, schema eventName, and bumps document version to v3.
src/​core/​learning_mode_core/​src/​analyze.rs	Updates test fixtures for the new event_name field.
src/​backends/​process_container/​common/​src/​capture_output.rs	Updates test fixture signatures for the new event_name field.
docs/​learning-mode/​capabilities.md	Documents v3 schema, new diagnostics behavior, redaction rules, and relogging semantics.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Schema-name sanitization can retain account identifiers that payload sanitization removes.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• The new embedded-path detection scans every character offset and runs multiple path heuristics…
• Reusing looks_like_file_path_property with an empty property name to detect *path-like property…

Previously missed (1)

In code that hasn't changed since last review

Sanitize schema names using payload identity context

src/​core/​learning_mode_platforms/​windows/​src/​extractors.rs:625

Sanitizing the schema name in isolation loses the payload's identity-redaction context. For a TraceLogging event named jsmith with UserName=jsmith, the payload username is redacted but signature.eventName retains it; username components in named-object schema names have the same problem. Sanitize successful schema names using the raw payload's identity candidates before bounding or hashing, while keeping schema metadata separate from any payload field named EventName. Add regression tests for both forms.

[Copilot]

Copilot review overview

🟡 Changes recommended

The promised unfamiliar-event retention conflicts with the implementation’s explicit exclusion behavior and needs resolution.

Review effort: Balanced
Findings: 2 · 1

Open (3)

• Unknown events are dropped, losing promised retention and diagnostics · New
• The new embedded-path detection scans every character offset and runs multiple path heuristics…
• Reusing looks_like_file_path_property with an empty property name to detect *path-like property…

[Copilot]

Copilot review overview

🟡 Changes recommended

Replay filtering can retain unrelated payloads, and diagnostic-only schema failures incorrectly mark actionable results incomplete.

Review effort: Balanced
Findings: 1 · 2

Open (3)

• Validate provider and event identity before ordinal injection · New
• Exclude diagnostic network decisions from actionable truncation · New
• Unknown events are dropped, losing promised retention and diagnostics

Resolved since last review (2)

• The new embedded-path detection scans every character offset and runs multiple path heuristics…
• Reusing looks_like_file_path_property with an empty property name to detect *path-like property…

[Copilot]

Copilot review overview

🟡 Changes recommended

The consumer reference still describes incompatible artifact and failure semantics, which can mislead callers about incomplete results.

Review effort: Balanced
Findings: 1

Open (1)

• Update capabilities docs for v4 partial-analysis contract · New

Resolved since last review (3)

• Validate provider and event identity before ordinal injection
• Exclude diagnostic network decisions from actionable truncation
• Unknown events are dropped, losing promised retention and diagnostics

[Copilot]

🔵 Needs a closer look

Canonical Learning Mode documentation still describes the previous artifact format and failure semantics.

1 open finding

• Update capabilities docs for v4 partial-analysis contract

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Windows relogging callback ordering, transport-header handling, and diagnostic privacy boundaries warrant final human validation.

0 open findings

1 resolved since last review

• Update capabilities docs for v4 partial-analysis contract

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Security-sensitive Windows relogging needs human validation, and the sanitizer’s quadratic processing remains unresolved.

1 open finding

• Avoid quadratic suffix scanning in path sanitization · New

🧠 Review effort: Balanced

[Jacob Dereje (jacobdereje-msft)]

@microsoft-github-policy-service agree company="Microsoft"

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Gudge (MGudgin)]

Summary

Reviewed PR #1396 at ca4e222 against 43c5da4 (13 files, +1399/-329). I request changes primarily because the changed guarded relog ordinal invariant has no committed nonempty-selection regression test, and because the new negative schema cache retains TDH failures that need not mean a manifest is unavailable. The other comments identify conditional performance, documentation, and test-design issues; Low items are non-blocking. No ordinal mismatch or transient TDH failure was reproduced.

Verified clean, with receipts: is_learning_mode_event accepts only the explicit provider/event-ID pairs (extractors.rs:218-235); verbose telemetry clears eventName and properties before emission (verbose_telemetry.rs:148-156); relogging rejects count and selected-PID mismatches (etl_filter.rs:93-112,323-333). The new private-session round trip emits only an unrelated provider, so its selected set is empty (etl_filter.rs:371-527); the guarded telemetry e2e is #[ignore] (wxc_e2e_tests_e2e_telemetry_etw.rs:441-443). Existing isolated selection tests do not replace a nonempty round trip.

Findings outside the diff

Low — telemetry projection documentation: docs/development/architecture/telemetry.md:204-206 is byte-identical between base and head. The new eventName removal and group merge in the changed verbose_telemetry.rs:148-163 newly expose the incomplete description. This is anchored on the added projection line and is not a pre-existing defect being charged to the PR.

Verified pre-existing — not attributed to this PR

No unchanged, unrelated defect is filed. The 4,096-entry cache limit and one-million-event global processing bound already existed; comments concern only the PR's newly stored negative entries. A provisional finding that an unscoped capability schema error can set truncated before identifying a PID was withdrawn: unknown PID deliberately fails closed. Another provisional suggestion to exempt NetworkDecision events from the global processing bound was withdrawn because that bound is intentional and no safe exception was established.

[Copilot]

🔵 Needs a closer look

Privacy-sensitive Windows trace scoping, relogging, and schema-failure recovery warrant final human validation.

0 open findings

🧠 Review effort: Balanced

[Gudge (MGudgin)]

Meant to approve #1395