docs: describe WFP denial capture

[Richie Gomez (richiemsft)]

📖 Description

Documents WFP denial capture, runtime compatibility probing, and the caller-facing network denial contract.

• Distinguishes option-aware native network capture from legacy access-only capture.
• Documents the exact public source, reason, direction, endpoint, and filterId representation.
• Clarifies that Tessera is an internal component name and is not exposed in public JSON.
• Records validated OS build points and guarded fallback behavior.

This is PR 4 of 4 in the WFP Learning Mode stack. Its base is the integration-layer branch.

🔗 References

Related to #1286.

Depends on the preceding integration PR in this stack.

🔍 Validation

• git diff --check across the complete stack — passed.
• Reviewed against the final API, decoder, and integration behavior.

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation
• Updated Copilot instructions (not applicable)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (not applicable)

📋 Issue Type

• Bug fix
• Feature
• Task

🧱 Stack

1. feat: prefer option-aware Learning Mode trace startup #1417 — API startup and compatibility
2. feat: decode WFP Learning Mode network events #1418 — WFP event decoding
3. fix: route captured network decisions through Tessera #1419 — ProcessContainer integration
4. docs: describe WFP denial capture #1420 — Documentation

Review and merge in this order.

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Gudge (MGudgin)]

Verified review notes

The updated guide correctly distinguishes options-capable native capture from legacy access-only capture and explains why guarded WPR excludes brokered WFP network records. The two inline comments identify a newly incorrect .NET API reference and the undocumented PSEC capture-mode capability exception. This is a comment-only review.

Finding outside the diff

Low (documentation consistency) — Update the README's native/fallback shorthand. README.md:265 — Attribution: newly_exposed_by_change. The README is byte-identical between this PR's base and head, so the earlier wording is not presented as code changed here. This PR's new host-selection guide recognizes compatible legacy-start PSEC hosts as native access-only captures; the README still describes 'complete PSEC/V2' native hosts versus 'older' guarded-WPR tiers, leaving readers of the two linked documents with conflicting classifications. Fix: Align the README's audit-mode summary with the new compatible-export rule and distinguish legacy native capture from guarded WPR.

Verified pre-existing — not attributed to this PR

README.md and docs/process-container/networking.md are both byte-identical from base to head. Their old wording is relevant only insofar as the new guide introduces a conflicting host-selection description or newly documents capture behavior without qualifying the existing capability matrix. No unrelated pre-existing issue is attributed to this documentation PR.

[Richie Gomez (richiemsft)]

Gudge (@MGudgin) The documentation findings are fixed in 92693ee: the V1 .NET type names are restored, and both the denial-capture guide and ProcessContainer networking matrix explain the narrowly scoped native PSEC capture capability exception. The docs are restacked on the implementation fix. Please re-review the updated tip.

[Copilot]

🟡 Changes recommended

Several documented compatibility, artifact-version, and incomplete-endpoint behaviors conflict with the implementation.

3 open findings

• Align compatibility terminology across documentation · New
• Clarify actionable incomplete endpoint handling · New
• Document direction and filterId decoder representations · New

What changed in this PR

Documents WFP network-denial capture and its compatibility, output, and telemetry contracts.

Changes:

• Describes option-aware versus legacy capture.
• Documents network-denial records and verbose v5 diagnostics.
• Records ProcessContainer networking and OS compatibility behavior.

File	Description
docs/​logging-access-denied.md	Expands denial-capture and artifact contracts.
docs/​development/​architecture/​telemetry.md	Documents verbose telemetry projection.
docs/​backends/​process-container/​os-version-support.md	Adds runtime compatibility guidance.
docs/​backends/​process-container/​networking.md	Explains capture-only internetClient.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.