Refactor PLM to use the canonical Learning Mode analyzer

src/backends/learning_mode/windows/src/extractors.rs

@@ -323,7 +323,6 @@ fn parse_u32(raw: &str) -> Option<u32> {
 fn access_type_from_mask(mask: u32, is_registry: bool) -> AccessType {
     // Standard rights (object-type independent).
     const DELETE: u32 = 0x0001_0000;
-    const READ_CONTROL: u32 = 0x0002_0000;
     const WRITE_DAC: u32 = 0x0004_0000;
     const WRITE_OWNER: u32 = 0x0008_0000;
     // Generic rights (object-type independent).
@@ -343,12 +342,7 @@ fn access_type_from_mask(mask: u32, is_registry: bool) -> AccessType {
         const KEY_NOTIFY: u32 = 0x0010;
         const KEY_CREATE_LINK: u32 = 0x0020;
         (
-            KEY_QUERY_VALUE
-                | KEY_ENUMERATE_SUB_KEYS
-                | KEY_NOTIFY
-                | READ_CONTROL
-                | GENERIC_READ
-                | GENERIC_EXECUTE,
+            KEY_QUERY_VALUE | KEY_ENUMERATE_SUB_KEYS | KEY_NOTIFY | GENERIC_READ | GENERIC_EXECUTE,
             KEY_SET_VALUE
                 | KEY_CREATE_SUB_KEY
                 | KEY_CREATE_LINK
@@ -370,7 +364,7 @@ fn access_type_from_mask(mask: u32, is_registry: bool) -> AccessType {
         const FILE_READ_ATTRIBUTES: u32 = 0x0080;
         const FILE_WRITE_ATTRIBUTES: u32 = 0x0100;
         (
-            FILE_READ_DATA | FILE_READ_EA | FILE_READ_ATTRIBUTES | READ_CONTROL | GENERIC_READ,
+            FILE_READ_DATA | FILE_READ_EA | FILE_READ_ATTRIBUTES | GENERIC_READ,
             FILE_WRITE_DATA
                 | FILE_APPEND_DATA
                 | FILE_WRITE_EA
@@ -790,7 +784,12 @@ mod tests {
 
     #[test]
     fn file_mask_no_recognised_right_is_unknown() {
-        // SYNCHRONIZE (0x100000) alone and MAXIMUM_ALLOWED (0x02000000) alone.
+        // READ_CONTROL, SYNCHRONIZE, and MAXIMUM_ALLOWED alone grant no
+        // file-content access and must not become readonly recommendations.
+        assert_eq!(
+            access_type_from_mask(0x0002_0000, false),
+            AccessType::Unknown
+        );
         assert_eq!(
             access_type_from_mask(0x0010_0000, false),
             AccessType::Unknown
@@ -815,5 +814,9 @@ mod tests {
         assert_eq!(access_type_from_mask(0x0020, true), AccessType::Write); // KEY_CREATE_LINK (execute for files!)
                                                                             // Registry has no execute concept: 0x20 is a write here, not execute.
         assert_ne!(access_type_from_mask(0x0020, true), AccessType::Execute);
+        assert_eq!(
+            access_type_from_mask(0x0002_0000, true),
+            AccessType::Unknown
+        );
     }
 }

src/core/wxc/src/main.rs

@@ -533,6 +533,21 @@ fn config_file_path(cli: &Cli) -> Option<std::path::PathBuf> {
         .map(std::path::PathBuf::from)
 }
 
+#[cfg(target_os = "windows")]
+fn audit_stop_args(
+    config_path: Option<&std::path::Path>,
+    exit_code: i32,
+) -> Vec<std::ffi::OsString> {
+    let mut args = vec![std::ffi::OsString::from("stop")];
+    if let Some(config_path) = config_path {
+        args.push(std::ffi::OsString::from("--config-path"));
+        args.push(config_path.as_os_str().to_owned());
+    }
+    args.push(std::ffi::OsString::from("--exit-code"));
+    args.push(std::ffi::OsString::from(exit_code.to_string()));
+    args
+}
+
 #[cfg(target_os = "windows")]
 use audit::{
     cancel_active_audit_trace, mark_audit_active, release_audit_singleton, run_plm_command,
@@ -1313,11 +1328,7 @@ fn main() {
     // `Drop` runs `wpr -cancel` for us.
     #[cfg(target_os = "windows")]
     if cli.audit {
-        let mut stop_args: Vec<std::ffi::OsString> = vec![std::ffi::OsString::from("stop")];
-        if let Some(cfg) = audit_config_file.as_ref() {
-            stop_args.push(std::ffi::OsString::from("--config-path"));
-            stop_args.push(cfg.clone().into_os_string());
-        }
+        let stop_args = audit_stop_args(audit_config_file.as_deref(), response.exit_code);
         let borrowed: Vec<&std::ffi::OsStr> = stop_args
             .iter()
             .map(std::ffi::OsString::as_os_str)
@@ -1490,6 +1501,23 @@ mod tests {
         }
     }
 
+    #[cfg(target_os = "windows")]
+    #[test]
+    fn audit_stop_args_include_workload_exit_code() {
+        let args = audit_stop_args(Some(std::path::Path::new(r"C:\config.json")), 23);
+        assert_eq!(
+            args,
+            [
+                "stop",
+                "--config-path",
+                r"C:\config.json",
+                "--exit-code",
+                "23"
+            ]
+            .map(std::ffi::OsString::from)
+        );
+    }
+
     #[test]
     fn state_aware_dispatch_errors_use_only_auxiliary_diagnostic_sinks() {
         let directory = tempfile::tempdir().unwrap();

src/host/plm/Cargo.toml

@@ -22,12 +22,12 @@ test = false
 [dependencies]
 clap.workspace = true
 anyhow.workspace = true
-# Portable deps (config / access_event / event_parser) must compile on
-# every target so their unit tests run in cross-platform CI. The
-# `windows` crate stays target-gated below.
+# Portable config-generation dependencies must compile on every target so
+# their unit tests run in cross-platform CI. Windows capture and analysis
+# dependencies stay target-gated below.
 serde_json.workspace = true
+serde.workspace = true
 chrono.workspace = true
-quick-xml.workspace = true
 tempfile.workspace = true
 
 [target.'cfg(target_os = "windows")'.dependencies]
@@ -37,6 +37,8 @@ windows = { workspace = true, features = [
     "Win32_System_Threading",
 ] }
 wxc_common = { workspace = true }
+learning_mode_core = { workspace = true }
+learning_mode_windows = { workspace = true }
 
 [build-dependencies]
 mxc_build_common.workspace = true
@@ -46,3 +48,4 @@ embed-manifest = "1.4"
 
 [dev-dependencies]
 tempfile.workspace = true
+quick-xml.workspace = true