Add POSIX telemetry

[bmehta001]

Summary

Adds 1DS-backed telemetry to ONNX Runtime on Linux, macOS, Android, and iOS. Windows continues to use its existing ETW provider, with aligned metadata, redaction, and unit-test suppression. WebAssembly remains telemetry-free.

No public ABI is changed.

Behavior and controls

• Emits one process-level ProcessInfo event plus low-frequency session, model, execution-provider, error, and aggregate runtime events.
• Uses deterministic session-level sampling so correlated events are retained or dropped together. The current sampling rate is 100%, and retained events carry 1DS popSample metadata.
• Serializes map-valued metadata deterministically to avoid multiple telemetry values for identical logical data.
• Aggregates successful inference counts and durations in RuntimePerf. POSIX EvaluationStart/EvaluationStop are no-ops, and SystemMetrics follows the RuntimePerf cadence instead of running on every inference.
• Native telemetry is compiled only when configured with --use_telemetry; direct build.py/CMake builds can omit it completely.
• ORT_DISABLE_TELEMETRY=1 is a full non-Windows opt-out when set before initialization: no uploader, events, persistent device identifier, or offline cache is created. The decision is latched for the process lifetime.
• Runtime telemetry APIs suppress non-essential events. ONNX Runtime may already have emitted the minimal initialization event before the API can be called.
• CI hard-suppresses POSIX telemetry; ORT unit-test processes suppress both POSIX telemetry and Windows ETW.

Privacy, safety, and reliability

• Desktop builds send a product-salted hash of a locally generated per-user UUID; the raw UUID is never uploaded. Android and iOS retain the platform identity supplied by 1DS.
• Persistent device identity uses owner-only storage, bounded no-follow reads, dirfd-relative file operations, atomic publication, and serialized corruption repair shared with ONNX Runtime GenAI.
• Free-text fields scrub filesystem paths and cap payload size without splitting UTF-8 code points.
• Every complete POSIX telemetry operation - event construction, redaction, property insertion, and SDK emission - is contained by a no-throw boundary. Diagnostic failures are also contained.
• SDK initialization is transactional: partially created managers are released before configuration teardown, and logger state is published only after setup completes.
• Logging holds a shared lock while 1DS accepts an event; initialization and shutdown retain exclusive locking. Concurrent logging is not serialized by ORT.
• Shutdown is configured not to wait for network upload and remains safe during process teardown.

Build and package integration

• Uses the cpp-client-telemetry vcpkg port when available, with a pinned FetchContent fallback.
• Links the SDK statically where supported and includes its dependency metadata and third-party notices.
• Official Linux, macOS, Android, and iOS package configurations enable telemetry.
• Official Android AARs package and initialize the 1DS Java HTTP transport, including relocated bridge classes and required JNI exports so they can coexist with ONNX Runtime GenAI.
• Apple framework builds use the platform HTTP transport and static packaging path.
• An optional tenant-token override is emitted into a generated header rather than a compiler command line or pipeline YAML.

Performance

A Release benchmark using mul_1.onnx, alternating enabled/disabled samples, CPU affinity, isolated caches, and blocked network showed that the original synchronous per-inference 1DS events were too expensive:

Scenario	Before	After hot-path removal
Single thread	100.4 us enabled vs 3.5 us disabled (28.7x)	Difference below benchmark noise
Eight threads	11.3k enabled vs 306.5k disabled runs/s (96.3% loss)	294.3k enabled vs 295.5k disabled runs/s (0.4% difference)

Network upload remains asynchronous inside 1DS; this change removes serialized SDK intake from each successful Run().

Validation

• Telemetry-enabled Linux builds and focused environment, redaction, no-throw, and device-ID tests.
• Windows build/test coverage for shared telemetry helpers and ETW metadata changes.
• Android AAR build plus x86_64 emulator end-to-end session creation.
• Backend verification of ProcessInfo, SessionCreationStart, SessionCreation, and SessionCreationEnd, including shared process correlation and platform device identity.
• Concurrent first-run and corrupted-file device-ID recovery stress tests.
• Lint, material code review, and repeated Copilot review rounds.

[github-actions]

You can commit the suggested changes from lintrunner.

[Copilot]

Pull request overview

This PR introduces cross-platform build support for telemetry by extending the existing Windows ETW telemetry to non-Windows platforms via the 1DS (cpp_client_telemetry) SDK, wiring it through the build scripts and CMake.

Changes:

• Adds a new POSIX telemetry provider implementation using the 1DS SDK and swaps it into the POSIX Env when enabled.
• Extends build and CMake plumbing to fetch/link cpp_client_telemetry on non-Windows and to expose a cross-platform --use_telemetry build flag.
• Updates top-level build wrappers and third-party notices for the new dependency.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
tools/ci_build/build_args.py	Moves --use_telemetry to cross-platform args.
tools/ci_build/build.py	Always sets -Donnxruntime_USE_TELEMETRY=ON/OFF based on --use_telemetry.
onnxruntime/core/platform/windows/telemetry.cc	Include ordering tweak only.
onnxruntime/core/platform/posix/telemetry.h	Introduces POSIX telemetry provider interface (1DS).
onnxruntime/core/platform/posix/telemetry.cc	Implements POSIX telemetry provider using cpp_client_telemetry.
onnxruntime/core/platform/posix/env.cc	Uses PosixTelemetry provider when USE_1DS_TELEMETRY is defined.
cmake/onnxruntime_common.cmake	Adds POSIX telemetry sources/defines and links 1DS + system libs when enabled.
cmake/onnxruntime_1ds_telemetry.cmake	New helper module for enabling 1DS telemetry on non-Windows.
cmake/external/onnxruntime_external_deps.cmake	Fetches cpp_client_telemetry only when telemetry is enabled on non-Windows.
cmake/deps.txt	Adds cpp_client_telemetry dependency entry.
cmake/CMakeLists.txt	Includes the new 1DS telemetry CMake module.
build.sh	Now passes --use_telemetry by default.
build.bat	Now passes --use_telemetry by default.
ThirdPartyNotices.txt	Adds cpp_client_telemetry license text (and an additional KleidiAi block).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

You can commit the suggested changes from lintrunner.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 6 comments.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 7 comments.

[Copilot]

Pull request overview

Copilot reviewed 59 out of 59 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

onnxruntime/core/platform/telemetry_environment.h:107

• The comment claims ORT_TELEMETRY_DISABLED is an opt-out that is "honored on every platform", but WindowsTelemetry does not consult this env var (and the public docs in this PR describe the env-var opt-out as non-Windows-only). This is misleading for future maintainers; either implement env-var handling on Windows or narrow the comment to the non-Windows (1DS) provider.

[Copilot]

Pull request overview

Copilot reviewed 59 out of 59 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 59 out of 59 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

onnxruntime/core/platform/windows/telemetry.cc:265

• Telemetry suppression in CI appears inconsistent with the new cross-platform suppression policy. telemetry_environment.h documents CI-based suppression, and PosixTelemetry::Initialize() returns early when IsRunningInCI(), but WindowsTelemetry only checks IsRunningUnitTests(). This means a CI job that happens to have an ETW trace session could still record ORT events, contradicting the stated hard-suppression behavior.

[Copilot]

Pull request overview

Copilot reviewed 59 out of 59 changed files in this pull request and generated no new comments.

[tianleiwu]

LGTM, as long as we can apply #29843 before or after merging this PR.

[Copilot]

Pull request overview

Copilot reviewed 59 out of 59 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

onnxruntime/core/platform/posix/telemetry.cc:225

• EventBuilder::AddStringMap serializes an std::unordered_map by iterating it directly, which makes the emitted string nondeterministic across runs. For telemetry, this can inflate cardinality and reduce aggregation usefulness for the same logical map contents. Consider sorting by key first to make the output stable.

  // Helper for string map
  EventBuilder& AddStringMap(const char* key, const std::unordered_map<std::string, std::string>& map) {
    if (!map.empty()) {
      std::string result;
      bool first = true;

onnxruntime/core/platform/posix/telemetry.cc:240

• EventBuilder::AddBatchSizeDurations builds a string from an unordered_map, so the output order can change across runs for identical input. For telemetry aggregation/debugging it’s usually preferable to keep this deterministic (e.g., sort by batch size).

  // Helper for batch size duration map
  EventBuilder& AddBatchSizeDurations(const std::unordered_map<int64_t, long long>& durations) {
    std::string result;
    for (const auto& [batch_size, duration] : durations) {
      if (!result.empty()) {

[Copilot]

Pull request overview

Copilot reviewed 59 out of 59 changed files in this pull request and generated no new comments.