Report agentic onboarding marker in configuration telemetry (RFC-1113)#11983
Conversation
christophe-papazian
added
type: feature
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 79d7375567
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
🎯 Code Coverage (details) 🔗 Commit SHA: 2da690c | Docs | Datadog PR Page | Give us feedback! |
79d7375 to
b91b3e2
Compare
🟢 Java Benchmark SLOs — All performance SLOs passed
PR vs. master results
Commit: Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion. |
![datadog-prod-us1-3[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
There was a problem hiding this comment.
More details
Validated across three standalone test programs covering 26 adversarial scenarios (origin precedence/presence-only semantics, key transformations, APPSEC_WAF_STARTED state management in all startup paths, and finally-block behavior). All scenarios pass: the DD_APPSEC_AGENTIC_ONBOARDING env var key is derived consistently across all lookup paths, the flag reports false for every non-WAF-started case (disabled, WAF init failure, exception path), and AgenticOnboarding.report() fires in the finally block under all conditions including AppSec errors.
📊 Validated against 26 scenarios · Open Bits AI session
🤖 Datadog Autotest · Commit b91b3e2 · What is Autotest? · Any feedback? Reach out in #autotest
PerfectSlayer
left a comment
PerfectSlayer
left a comment
There was a problem hiding this comment.
Need a review from SDK team or @mhlidd before merging.
I find it suspicious it needs to re-implement config origin on top of the existing config telemetry reporting system.
That might be related with Config loading time but better double checking first before.
b91b3e2 to
d9c93f6
Compare
christophe-papazian
changed the title
d9c93f6 to
c9b6e38
Compare
christophe-papazian
changed the title
Register DD_APPSEC_AGENTIC_ONBOARDING as an ordinary string configuration so its value is reported verbatim in the app-started configuration telemetry through the standard config pipeline. It is always emitted (empty string with origin=default when unset). Per RFC-1113 (which supersedes RFC-1110) there is no derived boolean and no code reading AppSec's runtime state: activation/drop-off is computed downstream in Metabase by joining this marker against existing AppSec telemetry. This removes all the tracer-side logic the previous approach required. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
c9b6e38 to
2392d85
Compare
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
Build pipeline has failing jobs for 83d9f61: What to do next?
DetailsSince those jobs are not marked as being allowed to fail, the pipeline will most likely fail. |
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
Build pipeline has failing jobs for 0bdc804:
What to do next?
DetailsSince those jobs are not marked as being allowed to fail, the pipeline will most likely fail. |
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
Build pipeline has failing jobs for b782da3: What to do next?
DetailsSince those jobs are not marked as being allowed to fail, the pipeline will most likely fail. |
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
christophe.papazian@datadoghq.com cancelled this merge request build |
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
|
613b386
into
master
…(RFC-1113) (#8920) APPSEC-69228 Implements RFC-1113 — a runtime telemetry signal that a service was onboarded by the AAP agentic onboarding solution. Ports DataDog/dd-trace-java#11983 to .NET. `DD_APPSEC_AGENTIC_ONBOARDING` is registered as an ordinary **string** configuration key. Its value is reported verbatim in the `app-started` configuration telemetry through the standard config pipeline, with the usual `origin`. It is always emitted — empty string with `origin=default` when unset. ## Changes - `supported-configurations.yaml` — register `DD_APPSEC_AGENTIC_ONBOARDING` (string, default empty, product AppSec). - `SecuritySettings.cs` — read the value via the standard config builder so it's recorded to config telemetry. - `ConfigurationKeys.AppSec.g.cs` (all TFMs) — regenerated constant. ## Testing Standard registered config key reported through the existing config-telemetry path. Runtime behavior is validated by system tests and the Metabase funnel per RFC-1113. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Andrew Lock <andrew.lock@datadoghq.com>
4 participants
What Does This Do
Implements RFC-1113 (supersedes RFC-1110) — a runtime telemetry signal that a service was onboarded by the AAP agentic onboarding solution.
DD_APPSEC_AGENTIC_ONBOARDINGis registered as an ordinary string configuration key. Its value is reported verbatim in theapp-startedconfiguration telemetry through the standard config pipeline, with the usualorigin. It is always emitted — empty string withorigin=defaultwhen unset.There is no derived boolean and no code reading AppSec's runtime state. Whether AppSec actually came up is computed downstream in Metabase by joining this marker against existing AppSec telemetry (e.g.
appsec.enabled), so all "did it work" logic lives in one place instead of being duplicated across tracers.Why the simplification
RFC-1110 computed a per-tracer boolean from AppSec's active state at startup, requiring new logic (and a WAF-state read) in every tracer. RFC-1113 drops all of that: the value is a pass-through of a registered config key, which every tracer already reports automatically.
Changes
AppSecConfig— newAPPSEC_AGENTIC_ONBOARDINGkey.ConfigDefaults— default empty string.Config— read the value via the standard config provider, getter,toString.metadata/supported-configurations.json— registerDD_APPSEC_AGENTIC_ONBOARDING(string).Testing
No tracer-specific logic to unit-test — this is a standard registered config key reported through the existing config-telemetry path. Runtime behavior is validated by system tests (APPSEC-69171) and the Metabase funnel per RFC-1113.
🤖 Generated with Claude Code