Load telemetry routing metadata from a signed component DLL; remove admin registry policy by richiemsft · Pull Request #1673 · microsoft/mxc

Richie Gomez (richiemsft) · 2026-11-04T21:17:39Z

This PR moves the Windows telemetry routing metadata out of the MXC source tree and into a signed mxc_telemetry.dll. The DLL is built in a separate pipeline. build.rs checks its Authenticode signature, loads it, and reads the metadata at build time. Release builds on Windows use the bundled DLL by default.

Details

Signed component: build_mxc_telemetry_component.rs resolves the DLL to an absolute path, verifies the signature (signer Microsoft Corporation) before loading it, calls mxc_telemetry_metadata_v1, and fails closed on a bad signature, a null result, or a parse error. The numbers reach the crate as MXC_BUILD_* env vars.
Bundled DLLs: signed x64 and arm64 DLLs are committed under src/mxc-sdk/resources/telemetry-component/. Release builds on a Windows host use the one for the host architecture. Debug builds, non-Windows hosts and non-Windows targets are not routed. MXC_TELEMETRY_COMPONENT_PATH overrides the DLL; an empty value forces an unrouted build.
Group input removed: MXC_TELEMETRY_PROVIDER_GROUP_GUID is no longer supported. A nonempty value fails Windows builds, so routing only comes from the verified component.
Public source: the real classification values are removed from source, tests and docs. Tests use mock placeholder values. The Windows CI telemetry test executor is built with an empty MXC_TELEMETRY_COMPONENT_PATH so it stays unrouted.
Registry policy unchanged: the V1 administrative registry policy (HKLM\SOFTWARE\Policies\Mxc\AllowTelemetry), PolicyState, the FFI and the SDK policy APIs keep their existing behavior.
Docs: updated README.md, docs/telemetry.md and the developer telemetry and CI docs to explain that Windows release builds from source are routed, and how to build without routing.
CI: a new Windows step in Build.Windows.Job.yml checks the default bundled release build, the empty-path unrouted build, and that a tampered DLL fails the signature check.
Packaging: the crate package now includes the DLLs, so crates.io consumers get routing in release builds.

References

Follows Improve MXC execution telemetry and lifecycle correlation #1575.

Tests

From src:

cargo fmt --all -- --check: passed
cargo test --locked -p mxc-sdk --lib --features test-support,isolation_session -- telemetry: 284 passed
cargo clippy --locked -p mxc-sdk -p mxc_ffi -p wxc --all-targets --features test-support,isolation_session -- -D warnings: passed
cargo check --locked --release -p mxc-sdk --lib: passed with the bundled DLL, passed with an empty MXC_TELEMETRY_COMPONENT_PATH, and failed with "no valid Authenticode signature" for a tampered copy

Other checks:

node scripts/check-telemetry-policy-parity.js: passed
Both DLLs have a valid signature; the x64 DLL's live ETW run on a VM passed.

Not run: Node and .NET SDK tests after the revert, the .ps1 scripts on an elevated Windows host, Linux/macOS Clippy locally, and Microsoft ingestion acceptance.

Load mxc_telemetry.dll from the module directory, check its ABI version, and write the four Required development-contract events through it. Fall back to the in-process ETW path when the DLL is missing, incompatible, or a write fails. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 08308f81-0ab1-4b64-9efa-f373a119e864

Open the component with write sharing denied, require a trusted Authenticode signature from the same signer as the SDK module in release builds, and pass the host module path to the component (ABI 2) so it can authorize its caller. Failures fall back to the in-process provider. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 08308f81-0ab1-4b64-9efa-f373a119e864

Products that build MXC from source sign with their own identity, so release builds now require the component to be signed by Microsoft Corporation and no longer compare it to the host's signer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 08308f81-0ab1-4b64-9efa-f373a119e864

This reverts commit 050e279.

This reverts commit c6fd92b.

This reverts commit 4dc2e5f.

The build verifies the component's Authenticode signature, loads it, and passes the group, keywords, privacy tags, product and category to the crate through cargo rustc-env variables. Only the group literal is generated. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 08308f81-0ab1-4b64-9efa-f373a119e864

Required collection is no longer disabled by HKLM\SOFTWARE\Policies\Mxc\AllowTelemetry. Published contracts keep their consent and policy gates. Remove the Required-telemetry documentation on turning collection off. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 08308f81-0ab1-4b64-9efa-f373a119e864

Use placeholder metadata when no signed telemetry component is present and describe the component-supplied values in the architecture doc. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 08308f81-0ab1-4b64-9efa-f373a119e864

Release builds on Windows default to the signed mxc_telemetry.dll for the build host architecture. Debug builds stay unrouted. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 08308f81-0ab1-4b64-9efa-f373a119e864

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 08308f81-0ab1-4b64-9efa-f373a119e864

MXC no longer reads HKLM\SOFTWARE\Policies\Mxc\AllowTelemetry. The V1 policy API and wire values are unchanged; get_policy now reports unrestricted on Windows and not-applicable elsewhere. Consent is the only gate. Registry tests, hooks, scripts and docs are removed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 08308f81-0ab1-4b64-9efa-f373a119e864

azure-pipelines · 2026-11-04T21:17:49Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 08308f81-0ab1-4b64-9efa-f373a119e864

Copilot

🟡 Changes recommended

Unresolved V1 policy changes can bypass deployed telemetry restrictions, while a DLL path mismatch can execute code from a file whose signature was not verified.

7 open issues

What changed in this PR

This PR moves Windows telemetry routing metadata into a signed, build-time DLL and removes MXC’s administrative registry policy. It follows #1575’s Required-diagnostics work while retaining existing V1 policy types and wire formats.

Changes:

Loads verified component metadata for Windows release builds, with an explicit build-time override.
Removes registry-policy enforcement and related test fixtures while preserving consent handling for published contracts.
Updates telemetry documentation, SDK references, and Windows CI configuration.

File	Description
`tests/scripts/test_telemetry_etw_assertions.ps1`	Uses placeholder telemetry classifications.
`tests/scripts/run_telemetry_etw_smoke_test.ps1`	Removes registry setup and policy-gating scenarios.
`tests/scripts/run_telemetry_consent_smoke_test.ps1`	Tests consent without administrative policy.
`tests/scripts/run_telemetry_consent_release_test.ps1`	Removes real-registry mutation and policy checks.
`tests/scripts/run_isolation_session_state_aware_tests.ps1`	Requires only consent-store isolation for telemetry.
`tests/scripts/README.md`	Updates telemetry test descriptions and prerequisites.
`tests/scripts/lib/TelemetryEtwAssertions.ps1`	Expects local-test classification values.
`src/mxc-sdk/src/telemetry.rs`	Documents retained public policy states.
`src/mxc-sdk/src/core/mxc_telemetry/provider_codegen.rs`	Parses component metadata and generates build directives.
`src/mxc-sdk/src/core/mxc_telemetry/mod.rs`	Reads build-time metadata and updates unit tests.
`src/mxc-sdk/src/core/mxc_engine/state_aware.rs`	Removes policy setup from lifecycle tests.
`src/mxc-sdk/src/core/mxc_engine/mod.rs`	Removes policy setup from execution tests.
`src/mxc-sdk/src/core/mxc_common/telemetry/policy.rs`	Replaces registry evaluation with platform policy states.
`src/mxc-sdk/src/core/mxc_common/telemetry/mod.rs`	Removes policy authorization and simplifies test isolation.
`src/mxc-sdk/src/core/mxc_common/telemetry/consent.rs`	Removes policy-specific tests and updates documentation.
`src/mxc-sdk/src/core/mxc_common/telemetry/consent_cli.rs`	Removes blocked-policy CLI coverage.
`src/mxc-sdk/src/backends/isolation_session/common/owned_thread.rs`	Removes telemetry policy setup from tests.
`src/mxc-sdk/README.md`	Updates consent-gating guidance.
`src/mxc-sdk/Cargo.toml`	Adds Windows signature-verification and loader build dependencies.
`src/mxc-sdk/build/build_mxc_telemetry.rs`	Selects components and passes metadata into compilation.
`src/mxc-sdk/build/build_mxc_telemetry_component.rs`	Verifies signatures, loads the DLL, and reads metadata.
`src/ffi/mxc_ffi/src/lib.rs`	Updates policy documentation and platform-state tests.
`src/ffi/mxc_ffi/Cargo.toml`	Clarifies the consent-isolation dependency comment.
`sdk/node/src/v1/types.ts`	Updates telemetry opt-in documentation.
`sdk/node/src/bindings/telemetry.ts`	Updates the binding description comment.
`sdk/node/README.md`	Removes administrative-policy gating guidance.
`sdk/dotnet/README.md`	Updates telemetry consent guidance.
`sdk/dotnet/Microsoft.Mxc.Sdk/V1/TelemetryPolicyState.cs`	Documents compatibility states and failure fallback.
`sdk/dotnet/Microsoft.Mxc.Sdk/V1/TelemetryConsent.cs`	Updates consent-status documentation.
`sdk/dotnet/Microsoft.Mxc.Sdk/V1/MxcTelemetry.cs`	Documents current policy results.
`sdk/dotnet/Microsoft.Mxc.Sdk/V1/MxcLifecycle.cs`	Updates the telemetry-gating comment.
`sdk/dotnet/Microsoft.Mxc.Sdk/V1/LifecycleTypes.cs`	Updates lifecycle telemetry documentation.
`sdk/dotnet/Microsoft.Mxc.Sdk/V1/ContainerRequestSections.cs`	Updates opt-in documentation.
`sdk/dotnet/Microsoft.Mxc.Sdk.Tests/MxcTelemetryTests.cs`	Removes registry fixtures and policy-only tests.
`README.md`	Removes administrative telemetry controls from the overview.
`docs/telemetry.md`	Removes registry-policy deployment guidance.
`docs/schema.md`	Updates the telemetry example comment.
`docs/development/build-and-test/ci-validation-infrastructure.md`	Updates telemetry test-isolation guidance.
`docs/development/architecture/telemetry.md`	Documents component loading and revised authorization.
`docs/development/architecture/telemetry-consent-design.md`	Removes administrative policy from the consent model.
`docs/development/architecture/container-lifecycle.md`	Updates invocation telemetry constraints.
`docs/containment-policy/dev/policy.md`	Updates telemetry field documentation.
`docs/containment-policy/1.0.0/policy.md`	Removes the administrative-policy prerequisite.
`docs/containment-policy/0.9.0/policy.md`	Removes the administrative-policy prerequisite.
`docs/container-lifecycle.md`	Updates telemetry authorization guidance.
`docs/api-reference/rust/v1/types.md`	Updates telemetry and policy type descriptions.
`docs/api-reference/rust/v1/api.md`	Documents current policy API results.
`docs/api-reference/README.md`	Updates shared telemetry guidance.
`docs/api-reference/node/v1/types.md`	Documents retained policy-state values.
`docs/api-reference/dotnet/v1/types.md`	Updates telemetry type descriptions.
`docs/api-reference/dotnet/v1/api.md`	Updates policy and consent-status descriptions.
`.github/workflows/Build.Windows.Job.yml`	Disables components for debug telemetry tests and removes policy checks.
`.github/skills/mxc-code-review/SKILL.md`	Updates telemetry review guidance.
`.github/copilot-instructions.md`	Records removal of administrative telemetry policy.
`.gitattributes`	Marks DLL files as binary.

_{Review effort: Balanced}

Copilot

🟡 Changes recommended

The change breaks the published V1 telemetry policy contract and can load an unverified DLL because signature verification and loading may resolve to different files.

8 open issues

2 previously missed issues

In code that hasn't changed since last review

Add Windows CI coverage for component signature rejection

src/mxc-sdk/build/build_mxc_telemetry_component.rs:178

[P2] Add CI regression coverage for the component's fail-closed build path. The new tests exercise only metadata parsing/mapping, the ETW executor explicitly disables the component, and the release consent script never tests DLL rejection. Consequently, removing or bypassing signature verification could still leave every existing check green. Add Windows build-flow cases using the bundled signed DLL as the positive control and an unsigned or signature-invalid copy as rejection controls, and assert that rejected components fail the build rather than producing an unrouted fallback. Wire these cases into Windows CI.

Update consumer docs for the routed release default

src/mxc-sdk/build/build_mxc_telemetry.rs:46

[P1] Update the consumer telemetry notice for the new release default. Selecting the bundled component makes ordinary Windows source and crates.io release builds routed too, and development-contract requests can then emit without consent or request opt-in. However, README.md still says local open-source builds do not route telemetry, and docs/telemetry.md explicitly says they do not acquire automatic Required collection. Integrators relying on those statements can ship collection without the required disclosure. Correct both consumer-facing descriptions and document the empty component-path opt-out alongside this default change.

_{Review effort: Balanced}

Require the signed component for routing, reject the legacy group input, verify and load the canonical component path, skip the bundled DLL on non-Windows hosts, gate the signer constant on Windows, add CI checks for the bundled, unrouted and tampered component, and update consumer docs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 08308f81-0ab1-4b64-9efa-f373a119e864

Removing the policy changed V1 SDK behavior: hosts with AllowTelemetry=0 would stop reporting Blocked. Restore the registry policy and its docs and tests, keeping the signed telemetry component changes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 08308f81-0ab1-4b64-9efa-f373a119e864

Copilot

🟡 Changes recommended

Published V1 telemetry APIs now ignore deployed blocking policies, breaking their behavioral contract and permitting consented telemetry that was previously prohibited.

5 open issues

1 previously missed issue

In code that hasn't changed since last review

Set the component path to empty to disable routing in release builds

src/mxc-sdk/build/build_mxc_telemetry_component.rs:187

[P2] This recovery instruction is incorrect for Windows release builds: unsetting the override selects the bundled component, rather than building without routing. If the bundled DLL caused the failure, following the advice repeats the failure; if an explicit override failed, it can instead produce a routed binary despite the promised unrouted result. Tell the caller to set MXC_TELEMETRY_COMPONENT_PATH to an empty value.

6 resolved since last review

_{Review effort: Balanced}

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 08308f81-0ab1-4b64-9efa-f373a119e864

Copilot

🟡 Changes recommended

Routed Windows builds bypass administrator restrictions on Required telemetry, while uncleared expected Cargo failures cause Windows CI to fail before subsequent validation and artifact uploads.

8 open issues

_{Review effort: Balanced}

Copilot

🔵 Needs a closer look

Required diagnostics bypass administrative telemetry denial, and the Windows negative test propagates an expected failure code, blocking subsequent verification and artifact uploads.

8 open issues

_{Review effort: Balanced}

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 08308f81-0ab1-4b64-9efa-f373a119e864

Copilot

🔵 Needs a closer look

Required telemetry bypasses the machine-wide administrative deny policy, and the Windows CI tamper-rejection step fails even when the component is correctly rejected.

8 open issues

_{Review effort: Balanced}

…t CI step Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 08308f81-0ab1-4b64-9efa-f373a119e864

Copilot

🔵 Needs a closer look

Required telemetry bypasses the administrative deny gate in routed Windows builds, allowing emission even when policy is disabled, invalid, or unreadable.

7 open issues

1 resolved since last review

Reset PowerShell exit code after the expected Cargo rejection

_{Review effort: Balanced}

… docs Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 08308f81-0ab1-4b64-9efa-f373a119e864

Copilot

🔵 Needs a closer look

Required telemetry can initialize and emit despite an administrative block or invalid or unreadable policy, bypassing the existing fail-closed privacy restriction.

4 open issues

3 resolved since last review

_{Review effort: Balanced}

Branden Bonaby (bbonaby) · 2026-11-05T19:12:19Z

+      - name: Verify telemetry component build checks
+        shell: pwsh


thought: Nice, lets put this in script form and we can probably move this to a CI check https://github.com/microsoft/mxc/tree/main/scripts/ci.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c55d62b9-4631-463d-a008-d146434dd8fb

Copilot

🟡 Changes recommended

The PowerShell opt-out example and CI check remove rather than preserve empty environment values on versions before 7.5, causing routed builds where unrouted builds are intended.

1 open issue

Empty-string opt-out fails on PowerShell versions before 7.5 · New

7 resolved since last review

_{Review effort: Balanced}

-Remove-Item Env:\MXC_TELEMETRY_PROVIDER_GROUP_GUID
-cargo build -p mxc-sdk
+# Release build without routing (local-only metadata)
+$env:MXC_TELEMETRY_COMPONENT_PATH = ''


Richie Gomez (richiemsft) and others added 12 commits November 3, 2026 13:43

Revert "Pin telemetry component signer instead of matching the host"

e63aa1e

This reverts commit 050e279.

Revert "Verify telemetry component signature and pass host path at init"

e6e6c5a

This reverts commit c6fd92b.

Revert "Route Required telemetry events through optional component DLL"

bd2cade

This reverts commit 4dc2e5f.

Keep telemetry test executor unrouted; correct target dir guidance

13dcd0e

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 08308f81-0ab1-4b64-9efa-f373a119e864

Richie Gomez (richiemsft) requested a review from a team November 4, 2026 21:17

Richie Gomez (richiemsft) requested a review from a team as a code owner November 4, 2026 21:17

Copilot AI balanced review requested due to automatic review settings November 4, 2026 21:17

Copilot started reviewing on behalf of Richie Gomez (richiemsft) November 4, 2026 21:18

View session

microsoft-github-policy-service Bot added the Copilot-Instructions label Nov 4, 2026

Richie Gomez (richiemsft) and others added 3 commits November 4, 2026 13:20

Drop generated provider definition details from telemetry docs

182b15c

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 08308f81-0ab1-4b64-9efa-f373a119e864

Remove target directory note from telemetry docs

80e991b

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 08308f81-0ab1-4b64-9efa-f373a119e864

Note that ETW assertion keyword values are mock values

55ee459

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 08308f81-0ab1-4b64-9efa-f373a119e864