Emit captureDenials JSON output (replacement for #701) - #710
Open
richiemsft wants to merge 5 commits into
Open
Conversation
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
8 tasks
Contributor
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
…pability resolution (PR5)
Finalize the captureDenials deliverable as a single JSON document
({ "denials": [...], "summary": {...} }) that the launching app reads,
replacing the NDJSON frame stream. wxc-exec seals the internal ETL,
decodes it, writes the JSON file, and prints only the file-path pointer
on stderr.
Improvements:
- PID-stamped output filename: the wxc-exec pid is inserted into the
caller's outputPath stem (denials.json -> denials.<pid>.json) so
concurrent app instances don't collide; the real path is echoed in the
stderr pointer (insert_pid_into_stem).
- Rename DeniedResource.path -> resource, inclusive of file paths AND
AppContainer capabilities.
- Resolve capability identity: event-28 PackageSid/UserSid now decode via
a new capability_names resolver (well-known S-1-15-3-1..12 SID -> policy
name, else the SID string). Fix TDH_INTYPE_SID to 19 (was 22) so SID
fields decode instead of rendering <unsupported>.
Remove learning_mode_core::frame (NDJSON) in favor of the JSON document
emitter. Regenerate dev schema + SDK wire types (description-only). Update
schema.md, capabilities.md, and copilot-instructions.md. All changes
VM-validated on a learning-mode-enabled Windows build.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Stream denial JSON directly, remove incomplete output files after write failures, prevent output collisions, and correct the capture mode and generated filename documentation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: dfea4d42-e8a5-42ef-978a-6434e8bf89ec
Preserve polling exit codes, propagate internal ETL cleanup failures, and make pointer plus secondary teardown diagnostics safe when stderr is unavailable. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: dfea4d42-e8a5-42ef-978a-6434e8bf89ec
Delete the randomized JSON deliverable when stderr pointer publication fails, preserving both publication and cleanup errors so callers are not left with undiscoverable files. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: dfea4d42-e8a5-42ef-978a-6434e8bf89ec
Update the PR5 resource-field assertion retained while restacking onto the canonical path decoder change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: dfea4d42-e8a5-42ef-978a-6434e8bf89ec
richiemsft
force-pushed
the
user/saulg/learning-mode-output-replacement
branch
from
July 30, 2026 18:41
abde3da to
359d785
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📖 Description
Replacement for #701, which was mistakenly marked merged when the stacked parent branch temporarily received child-stack history during a stack-handling mistake. This PR restores the intended output-layer review boundary on top of replacement analysis PR #709.
Adds the caller-facing denial output layer:
denialsandsummary.captureDenialspointer line on stderr so callers can locate the actual deliverable.wait().This PR is intentionally stacked on #709 and should merge after #696 and #709.
🔗 References
🔍 Validation
cargo fmt --all -- --checkcargo test -p learning_mode_core -p learning_mode_windows -p appcontainer_commoncargo clippy -p learning_mode_core -p learning_mode_windows -p appcontainer_common --all-targets -- -D warningsblockandallowJSON output flows.✅ Checklist
Cargo.lock, thedependency-feed-checkcheck passes (see docs/pull-requests.md)📋 Issue Type
GitHub Actions runs the PR validation build automatically. The ADO pipeline
(
MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHubActions build; it runs on merge to
main, and Microsoft reviewers with write access can trigger iton a PR with
/azp run. See docs/pull-requests.md.Microsoft Reviewers: Open in CodeFlow