Add allowlisted telemetry projection subscriber

Add the telemetry subscriber for @rushstack/reporter (#5858).

- Add TelemetrySubscriber, which consumes canonical events before reporter
  filtering and produces an allowlisted aggregate at command completion
- Keep only allowlisted values: command and result, timing, operation status
  counts, diagnostic codes and categories, reporter mode, and protocol and
  producer versions
- Exclude messages, paths, raw output, command arguments, remediation
  parameters, stacks, and local-sensitive and secret values by construction
- Add createTelemetryReporter to wire the subscriber into the manager
- Preserve the legacy beforeLog hook through createBeforeLogAdapter
- Add allowlist schema and leakage tests

Assistant-model: GitHub Copilot
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 897dcf7e-e6e8-4a84-85ca-34b93fa29be3

Author: TheLarkInn

common/reviews/api/reporter.api.md

@@ -38,6 +38,9 @@ export type BootstrapPrivacyClassification = 'public' | 'local-sensitive' | 'sec
 // @beta
 export function computeEnvelopePrivacyFloor(classifications: Iterable<ReporterPrivacyClassification>): ReporterPrivacyClassification;
 
+// @beta
+export function createBeforeLogAdapter(hooks: readonly LegacyBeforeLogHook[]): (aggregate: ITelemetryAggregate) => void;
+
 // @beta
 export function createEngineSink(providedSink?: IReporterEventSink): IEngineSinkResolution;
 
@@ -53,6 +56,9 @@ export function createScopedLogger(reporter: IScopedReporter): IScopedLogger;
 // @beta
 export function createScopedReporter(options: ICreateScopedReporterOptions): IScopedReporter;
 
+// @beta
+export function createTelemetryReporter(subscriber: TelemetrySubscriber): IReporter;
+
 // @beta
 export const DEFAULT_FLUSH_TIMEOUT_MS: number;
 
@@ -480,6 +486,24 @@ export function isReporterProtocolCompatible(consumer: IReporterProtocolVersion,
 // @beta
 export function isValidRushDiagnosticCode(code: string): boolean;
 
+// @beta
+export interface ITelemetryAggregate {
+    readonly commandName?: string;
+    readonly diagnosticCategoryCounts: {
+        readonly [category: string]: number;
+    };
+    readonly diagnosticCodes: readonly string[];
+    readonly durationMs?: number;
+    readonly exitCode?: number;
+    readonly operationStatusCounts: {
+        readonly [status: string]: number;
+    };
+    readonly producerVersions: readonly string[];
+    readonly protocolVersion?: IReporterProtocolVersion;
+    readonly reporterMode?: string;
+    readonly result?: TelemetryResult;
+}
+
 // @beta
 export interface IWatchCycleCompletedPayload {
     readonly changedProjects?: readonly string[];
@@ -492,6 +516,9 @@ export interface IWriteBootstrapHandoffOptions {
     readonly pid?: number;
 }
 
+// @beta
+export type LegacyBeforeLogHook = (telemetry: Record<string, unknown>) => void;
+
 // @beta
 export class LegacyFallbackSink implements IReporterEventSink {
     // (undocumented)
@@ -672,6 +699,20 @@ export class RushSessionReporting {
 // @beta
 export function summarizeShadowResult(events: readonly IReporterEventEnvelope<unknown>[]): IShadowResultSummary;
 
+// @beta
+export const TELEMETRY_AGGREGATE_KEYS: readonly string[];
+
+// @beta
+export type TelemetryResult = 'succeeded' | 'failed';
+
+// @beta
+export class TelemetrySubscriber {
+    constructor();
+    buildAggregate(): ITelemetryAggregate;
+    ingest(event: IReporterEventEnvelope<unknown>): void;
+    setReporterMode(reporterMode: string): void;
+}
+
 // @beta
 export function writeBootstrapHandoffFileAsync(buffer: BootstrapEventBuffer, options?: IWriteBootstrapHandoffOptions): Promise<string>;
 

libraries/reporter/src/index.ts

@@ -143,6 +143,12 @@ export { LifecycleEmitter } from './lifecycle/LifecycleEmitter';
 export type { IShadowResultSummary } from './lifecycle/ShadowParity';
 export { deriveExitCodeFromEvents, summarizeShadowResult } from './lifecycle/ShadowParity';
 
+export type { TelemetryResult, ITelemetryAggregate } from './telemetry/TelemetryAggregate';
+export { TELEMETRY_AGGREGATE_KEYS } from './telemetry/TelemetryAggregate';
+export { TelemetrySubscriber, createTelemetryReporter } from './telemetry/TelemetrySubscriber';
+export type { LegacyBeforeLogHook } from './telemetry/BeforeLogAdapter';
+export { createBeforeLogAdapter } from './telemetry/BeforeLogAdapter';
+
 export type { IReporterEmitEventInput, IReporterEventSink } from './producers/IReporterEventSink';
 export type {
   ReporterMessageSeverity,

libraries/reporter/src/telemetry/BeforeLogAdapter.ts

@@ -0,0 +1,38 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { ITelemetryAggregate } from './TelemetryAggregate';
+
+/**
+ * The legacy `beforeLog` telemetry hook signature.
+ *
+ * @remarks
+ * Existing telemetry consumers register a `beforeLog` hook that runs with the
+ * telemetry record before it is written. The hook receives a plain object.
+ *
+ * @beta
+ */
+export type LegacyBeforeLogHook = (telemetry: Record<string, unknown>) => void;
+
+/**
+ * Adapts the allowlisted telemetry aggregate to the legacy `beforeLog` hook.
+ *
+ * @remarks
+ * During migration the existing `beforeLog` hook is preserved: the adapter runs
+ * each legacy hook with a plain-object copy of the new aggregate, so no hook
+ * observes non-allowlisted data.
+ *
+ * @param hooks - the legacy hooks to preserve
+ *
+ * @beta
+ */
+export function createBeforeLogAdapter(
+  hooks: readonly LegacyBeforeLogHook[]
+): (aggregate: ITelemetryAggregate) => void {
+  return (aggregate: ITelemetryAggregate): void => {
+    const record: Record<string, unknown> = { ...aggregate };
+    for (const hook of hooks) {
+      hook(record);
+    }
+  };
+}

libraries/reporter/src/telemetry/TelemetryAggregate.ts

@@ -0,0 +1,94 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IReporterProtocolVersion } from '../events/ReporterProtocolVersion';
+
+/**
+ * The command result recorded by telemetry.
+ *
+ * @beta
+ */
+export type TelemetryResult = 'succeeded' | 'failed';
+
+/**
+ * The allowlisted telemetry aggregate produced at command completion.
+ *
+ * @remarks
+ * Only these fields ever leave the machine. Messages, templates, paths, raw
+ * stdout/stderr, command arguments, remediation parameters, stack traces, and
+ * any local-sensitive or secret values are excluded by construction.
+ *
+ * @beta
+ */
+export interface ITelemetryAggregate {
+  /**
+   * The command name.
+   */
+  readonly commandName?: string;
+
+  /**
+   * Whether the command succeeded or failed.
+   */
+  readonly result?: TelemetryResult;
+
+  /**
+   * The process exit code.
+   */
+  readonly exitCode?: number;
+
+  /**
+   * The command or session duration in milliseconds.
+   */
+  readonly durationMs?: number;
+
+  /**
+   * The number of operations that reached each status.
+   */
+  readonly operationStatusCounts: { readonly [status: string]: number };
+
+  /**
+   * The distinct diagnostic codes emitted, sorted.
+   */
+  readonly diagnosticCodes: readonly string[];
+
+  /**
+   * The number of diagnostics emitted in each category.
+   */
+  readonly diagnosticCategoryCounts: { readonly [category: string]: number };
+
+  /**
+   * The selected reporter mode.
+   */
+  readonly reporterMode?: string;
+
+  /**
+   * The reporter protocol version.
+   */
+  readonly protocolVersion?: IReporterProtocolVersion;
+
+  /**
+   * The distinct `packageName@packageVersion` producers observed, sorted.
+   */
+  readonly producerVersions: readonly string[];
+}
+
+/**
+ * The complete set of allowlisted telemetry aggregate keys.
+ *
+ * @remarks
+ * Used to assert that no non-allowlisted field ever appears in the aggregate.
+ *
+ * @beta
+ */
+export const TELEMETRY_AGGREGATE_KEYS: readonly string[] = [
+  'commandName',
+  'result',
+  'exitCode',
+  'durationMs',
+  'operationStatusCounts',
+  'diagnosticCodes',
+  'diagnosticCategoryCounts',
+  'reporterMode',
+  'protocolVersion',
+  'producerVersions'
+];