[P0][Telemetry regression] Restore record_host_exception in current Android Core binaries

[sheetalarkadam]

Description

The current Android Core v1.2.4 binary rejects the host-error telemetry command used by the Android service:

Executing command: 'record_host_exception'
Unknown command: record_host_exception
Host telemetry disabled for this process: RuntimeException: Unknown command

This prevents SDK-originated failures from reaching the Kusto error table even though the Android SDK successfully captures, buffers, parcels, and sends them across AIDL to the service.

Impact

microsoft/Foundry-Local-for-Android#723 adds release/runtime attribution to SDK-originated errors. Exact-commit real-device validation proved the Android path carries:

• foundry_ipc_sdk_version=0.1.6
• foundry_service_version_name=0.1.6
• foundry_ort_package_version=1.26.0
• foundry_genai_native_build_version=0.14.1

The SDK buffer changed from one queued event to zero only after IFoundryLocalManager.recordHostExceptions(...) returned, and the service reached JNI. However, Core rejected record_host_exception, so no Kusto error row was produced. This also means other Android host exceptions can be silently lost after the service disables host telemetry for the process.

Regression Evidence

• Android PR Will Foundry Local SDK support Microsoft.Extensions.AI? #434 / merge 4978e6c5 shipped an arm64 Core binary containing RecordHostException and reported end-to-end Kusto validation.
• Android PR bump dev version from 1.0.0 -> 1.1.0 #663 / merge 4e8cea06 replaced that binary with Core v1.2.4 while updating ORT/GenAI.
• Current arm64 Core SHA-256: 15F3F19BE5BD30B89599607999AEB23AE88B8E7123C752041B5CB55004D73620
• Current binary does not contain RecordHostException or HostException and returns Unknown command at runtime.
• Prior telemetry-capable arm64 Core SHA-256: 3A348A7E294633FAEFC8E7D8B647E919CD457B6E8D7776BFA36CF60067602671

Exact Samsung validation session: 4728d567-9cae-44a8-82a5-d013a5374177.

Kusto result after bounded polling:

deviceid rows = 1
action rows = 1
error rows = 0

Required Fix

Provide current ABI-matched Android Core binaries that preserve Core v1.2.4 / ORT 1.26.0 / GenAI 0.14.1 compatibility and restore:

• record_host_exception
• RecordExceptionFields
• successful host-error submission to the configured telemetry backend

Do not require an Android-side bypass, direct backend insertion, or test-only production API.

Acceptance Criteria

• record_host_exception is recognized by current arm64-v8a and x86_64 Core binaries.
• RecordExceptionFields accepts the Android service payload contract.
• Unknown/invalid fields fail explicitly without disabling valid subsequent host telemetry.
• An Android SDK-originated initialization or binding failure reaches the Kusto error table.
• The resulting row preserves all four release/runtime attribution keys from microsoft/Foundry-Local-for-Android#723 without truncation.
• Automated command-contract coverage prevents future native binary updates from silently dropping this command.

Scope Boundary

This issue is the native/Core command regression. Binder generation-safe recovery remains microsoft/Foundry-Local-for-Android#720, and tokenizer lifetime crashes remain #1091.

[sheetalarkadam]

Implemented and validated the Core v1.2.4 fix for record_host_exception.

Native source:

• Branch: shekadam/fix-record-host-exception-1095
• Commits: 86a36664ed76f3dff8e75b29d7fab99bdf5db4fd, 221cf05858d3a2888f396a40307e17b5919e42ee
• Draft source PR: https://dev.azure.com/microsoft/windows.ai.toolkit/_git/neutron-server/pullrequest/16766819
• Focused contract/unit tests: 19/19 passed, including registration, strict field validation, invalid-then-valid recovery, transient telemetry failure recovery, and foreign-thread handoff.

Genuine NativeAOT Android artifacts were built for linux-bionic-arm64 and linux-bionic-x64, stripped with NDK 26.3, and integrated in Android commit a605dcf45daee09c12d349df0c9d7d6990f9a9b2 (PR https://github.com/microsoft/Foundry-Local-for-Android/pull/723):

• arm64-v8a SHA-256 CAC9F6F88FE5BA32A4BDB36DD00FB4BA6DA20AFA82D5691F977670A1569727C0
• x86_64 SHA-256 69EFB385A60C58BB58B190B368C6043F7A1E15896FB7FD4A2F96E51D88B9A3E6

Final real-device validation:

• Samsung Galaxy S24 / SM-S921B / Android 14 / Arm64
• Actions run: https://github.com/microsoft/Foundry-Local-for-Android/actions/runs/34495482715
• BrowserStack build 3b829aef362198da6f819aedd01159bf1bd0db91, session 4f61f5c835bd30b1bce9359cecbd8efb15344a8a, 1/1 passed
• FLTelemetry sessionId d6da12bd-0fc3-4a71-90e9-a32850e2b07d
• deviceid: Core 1.2.4, Arm64, samsung SM-S921B
• action: CoreInitialize/Success
• error: android.sdk.api.core_1095_final_validation / SdkCore1095FinalValidation
• Error row contains SDK 0.1.6, service 0.1.6, ORT 1.26.0, and GenAI 0.14.1.

No downgrade or older binary was used, and nothing was merged automatically.

[sheetalarkadam]

Exact unchanged-production-source validation follow-up:

The deterministic SDK error path now passes on physical arm64 using Android product commit a605dcf45daee09c12d349df0c9d7d6990f9a9b2. The temporary validation commit added only instrumentation/workflow code; SDK, service, Contract, and Core production sources were unchanged.

• Actions: https://github.com/microsoft/Foundry-Local-for-Android/actions/runs/34498939968
• BrowserStack build/session: 2066f97fcd6a286339e032c28848d1d0c65cca0f / 6dc9ec02496c2d7b11176d242965809f1cffc6da
• Test: cache-directory mismatch -> SDK InitFoundryLocalAppFailure -> force-stop/reconnect -> buffered AIDL drain -> native telemetry; 1/1 passed on Samsung Galaxy S24 Android 14.
• FLTelemetry session 11ad932e-c855-4fba-a7ba-f8239d1ece0c: deviceid=1 (Core 1.2.4, Arm64, SM-S921B), action=1 (CoreInitialize/Success), error=1 (android.sdk.aidl.initFoundryLocalApp / InitFoundryLocalAppFailure).
• The error row contains SDK 0.1.6, service 0.1.6, ORT 1.26.0, and GenAI 0.14.1.
• Post-restart session c9164997-bc53-4fe1-aafe-b991f8f7c71b contains the same evidence.

Final artifact review found no CRITICAL/HIGH issues and marked the fix ready for human merge consideration. Nothing was merged automatically.

[sheetalarkadam]

Independent rejection revision update (do not close yet):

• Reviewable Core source now exists as draft Azure DevOps PR https://dev.azure.com/microsoft/windows.ai.toolkit/_git/neutron-server/pullrequest/16772717 targeting releases/core/rel-1.2.4 at source revision 8ba5dc097f8e2c413b72e6b892934a877fa177e6.
• 19/19 targeted telemetry tests pass, including malformed-Unicode invalid→valid recovery and foreign-thread dispatch safety.
• Both Android ABI outputs reproduced byte-for-byte across two clean builds; final stripped hashes are arm64 72d898ca99569943a40343d22c51f77d20445165995fbf08547355f9641b1e61 and x86_64 142b73a055f32877adf42979b7f8a44a440167001381d53098cb2561dde7cdc8.
• Android consumer revision 5c5617df3be023b627cb8796b8e408744a45f5b3 adds deterministic both-ABI artifact checks and real packaged arm64 JNI invalid→valid routing coverage.
• Final BrowserStack/Kusto proof: build/session b07879460e50efe1131c5bd268cf6258bcb97caa / 416506c9e315507908bbefccd2b7fb775871893d; Kusto session c9164997-bc53-4fe1-aafe-b991f8f7c71b has Core 1.2.4 plus SDK 0.1.6, service 0.1.6, ORT 1.26.0, and GenAI 0.14.1.

Remaining blocker: both configured Core PR build-policy definitions (181102 and 181845) are disabled, leaving policy evaluations broken with error c7291080-fca7-4e12-0971-15f90da7591c. A maintainer must re-enable or replace them and review/merge the Core PR. Keeping #1095 open; no merge was performed.

[sheetalarkadam]

Independent revision follow-up: Android PR #723 is now at 20019278db427463cdac987523f49368634ced48 after addressing two additional telemetry-boundary findings. The current AAR is b285530fe9245e62f249f755747a6eab807214c76c8371b40b62433751049d34; BrowserStack fa4631226f6ada469b2cbdbe52cf09bb6a97c8bd and Kusto session c76bda0f-951e-4b02-8eea-ccd923cce3c4 validate real JNI routing with all four values. The original temporary-run evidence was authentic but not final-artifact-linked. Keeping this issue open because Core PR 16772717 remains draft and both blocking build-policy definitions are disabled. No merge performed.

[sheetalarkadam]

Native fix implemented and validated; no merge performed.

• Core 1.2.4 source revision: 8ba5dc097f8e2c413b72e6b892934a877fa177e6 (draft Core PR 16772717).
• Added and contract-tested record_host_exception, strict 64 KiB UTF-8/field validation, explicit stable errors, and retry after invalid or transiently failed submissions (19/19 focused tests).
• Reproducible Android Core artifacts: arm64 72d898ca99569943a40343d22c51f77d20445165995fbf08547355f9641b1e61; x86_64 142b73a055f32877adf42979b7f8a44a440167001381d53098cb2561dde7cdc8.
• Android integration: microsoft/Foundry-Local-for-Android#723 at a23cdc5a05d2a3aa3b003732fd274e4f606a72f4.
• Physical Samsung S24/Android 14 validation: 4/4 passed (Actions); Kusto sessions e3dd1bf8-4b6b-43a5-8e51-b7ee1fd8cc95, 709fae27-9032-4a4b-b95a-311ffbe84032, and 006c4fd6-dcde-449e-97c3-a5a9cb87a790 contain device/action/error rows with Core 1.2.4, SDK/service 0.1.6, ORT 1.26.0, and GenAI 0.14.1.

The Core PR remains draft because required build-policy definitions 181102/181845 currently return a broken evaluation. Keeping this issue open until source policy validation and merge are complete.

[sheetalarkadam]

Final Android head advanced to 7fb110b72196aa5ec8f2334188e5ff9bd6195614 to atomically snapshot the installed service PackageInfo(GET_META_DATA), preventing version/runtime fields from straddling an in-place APK update.

• Full SDK suite: 360 passed; final fat AAR SHA-256 0d04f73065cbee563b2e33f8c870127e9bd3b099e57b566bbea226ae606e207b.
• Physical Samsung S24/Android 14 BrowserStack build/session: a72d31e5691b10ca2335db6afac422ddceeab643 / 007deb3634a2908d2d10a0445c0e5e60a5cbee6f.
• Kusto session 0a5934b1-1d13-4685-9110-539309a1b94d contains the saturated record_host_exception error with SDK/service 0.1.6, ORT 1.26.0, GenAI 0.14.1, and Core 1.2.4 device/action context.
• Independent GPT-5.6 Sol review: READY.

Core source remains unchanged at 8ba5dc097f8e2c413b72e6b892934a877fa177e6; its draft PR/policy blocker remains open, so this issue remains open and nothing was merged.