Skip to content

feat(appsec): report agentic onboarding marker in configuration telemetry (RFC-1113)#5055

Merged
gh-worker-dd-mergequeue-cf854d[bot] merged 1 commit into
mainfrom
christophe-papazian/appsec-agentic-onboarding
Jul 22, 2026
Merged

feat(appsec): report agentic onboarding marker in configuration telemetry (RFC-1113)#5055
gh-worker-dd-mergequeue-cf854d[bot] merged 1 commit into
mainfrom
christophe-papazian/appsec-agentic-onboarding

Conversation

@christophe-papazian

Copy link
Copy Markdown
Contributor

APPSEC-69229

Register DD_APPSEC_AGENTIC_ONBOARDING as an ordinary string configuration key, reported verbatim in the app-started configuration telemetry (RFC-1113). Always emitted: unset reports an empty value with origin=default. No derived boolean and no read of AppSec's runtime-enabled state.

Ports DataDog/dd-trace-dotnet#8920.

🤖 Generated with Claude Code

…etry (RFC-1113)

Register DD_APPSEC_AGENTIC_ONBOARDING as an ordinary string configuration
key whose raw value is reported verbatim in the app-started configuration
telemetry via stableconfig.String. It is always emitted: unset reports an
empty value with origin=default. No derived boolean and no read of AppSec's
runtime-enabled state.

Ports DataDog/dd-trace-dotnet#8920.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings July 22, 2026 07:49
@github-actions

Copy link
Copy Markdown
Contributor

Config Audit

PACKAGE: contrib/cloud.google.com/go/pubsubtrace
  STATUS      CONFIG                                            CALL_SITES
  UNMIGRATED  DD_GOOGLE_CLOUD_PUBSUB_PROPAGATION_AS_SPAN_LINKS  1

PACKAGE: contrib/confluentinc/confluent-kafka-go/kafkatrace
  STATUS      CONFIG                            CALL_SITES
  UNMIGRATED  DD_TRACE_KAFKA_ANALYTICS_ENABLED  1

PACKAGE: ddtrace/opentelemetry/log
  STATUS      CONFIG                            CALL_SITES
  STILL_READ  DD_AGENT_HOST                     2
  STILL_READ  DD_ENV                            1
  STILL_READ  DD_SERVICE                        1
  STILL_READ  DD_TAGS                           1
  STILL_READ  DD_TRACE_AGENT_URL                2
  STILL_READ  DD_TRACE_REPORT_HOSTNAME          1
  STILL_READ  DD_VERSION                        1
  STILL_READ  OTEL_EXPORTER_OTLP_ENDPOINT       4
  STILL_READ  OTEL_EXPORTER_OTLP_HEADERS        2
  UNMIGRATED  DD_HOSTNAME                       1
  UNMIGRATED  OTEL_BLRP_EXPORT_TIMEOUT          1
  UNMIGRATED  OTEL_BLRP_MAX_EXPORT_BATCH_SIZE   1
  UNMIGRATED  OTEL_BLRP_MAX_QUEUE_SIZE          1
  UNMIGRATED  OTEL_BLRP_SCHEDULE_DELAY          1
  UNMIGRATED  OTEL_EXPORTER_OTLP_LOGS_ENDPOINT  4
  UNMIGRATED  OTEL_EXPORTER_OTLP_LOGS_HEADERS   2
  UNMIGRATED  OTEL_EXPORTER_OTLP_LOGS_PROTOCOL  2
  UNMIGRATED  OTEL_EXPORTER_OTLP_LOGS_TIMEOUT   1
  UNMIGRATED  OTEL_EXPORTER_OTLP_PROTOCOL       2
  UNMIGRATED  OTEL_EXPORTER_OTLP_TIMEOUT        1
  UNMIGRATED  OTEL_RESOURCE_ATTRIBUTES          1

PACKAGE: ddtrace/opentelemetry/metric
  STATUS      CONFIG                                             CALL_SITES
  STILL_READ  DD_AGENT_HOST                                      2
  STILL_READ  DD_ENV                                             1
  STILL_READ  DD_METRICS_OTEL_ENABLED                            1
  STILL_READ  DD_SERVICE                                         1
  STILL_READ  DD_TAGS                                            1
  STILL_READ  DD_TRACE_AGENT_URL                                 2
  STILL_READ  DD_TRACE_REPORT_HOSTNAME                           1
  STILL_READ  DD_VERSION                                         1
  STILL_READ  OTEL_EXPORTER_OTLP_ENDPOINT                        2
  STILL_READ  OTEL_EXPORTER_OTLP_HEADERS                         1
  STILL_READ  OTEL_EXPORTER_OTLP_METRICS_ENDPOINT                2
  STILL_READ  OTEL_EXPORTER_OTLP_METRICS_HEADERS                 1
  STILL_READ  OTEL_METRICS_EXPORTER                              1
  UNMIGRATED  DD_HOSTNAME                                        1
  UNMIGRATED  OTEL_EXPORTER_OTLP_METRICS_PROTOCOL                2
  UNMIGRATED  OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE  1
  UNMIGRATED  OTEL_EXPORTER_OTLP_PROTOCOL                        2
  UNMIGRATED  OTEL_EXPORTER_OTLP_TIMEOUT                         1
  UNMIGRATED  OTEL_RESOURCE_ATTRIBUTES                           1
  UNMIGRATED  OTEL_SERVICE_NAME                                  1

PACKAGE: ddtrace/tracer
  STATUS      CONFIG                                    CALL_SITES
  STILL_READ  DD_TRACE_PROPAGATION_BEHAVIOR_EXTRACT     1
  STILL_READ  DD_TRACE_PROPAGATION_EXTRACT_FIRST        1
  STILL_READ  DD_TRACE_PROPAGATION_STYLE_EXTRACT        1
  STILL_READ  DD_TRACE_PROPAGATION_STYLE_INJECT         1
  UNMIGRATED  DD_APM_TRACING_ENABLED                    1
  UNMIGRATED  DD_LLMOBS_AGENTLESS_ENABLED               1
  UNMIGRATED  DD_LLMOBS_ENABLED                         1
  UNMIGRATED  DD_LLMOBS_ML_APP                          1
  UNMIGRATED  DD_LLMOBS_PROJECT_NAME                    1
  UNMIGRATED  DD_TRACE_128_BIT_TRACEID_LOGGING_ENABLED  1
  UNMIGRATED  DD_TRACE_DEBUG_SEELOG_WORKAROUND          1
  UNMIGRATED  OTEL_TRACES_SAMPLER_ARG                   1

PACKAGE: instrumentation
  STATUS      CONFIG                                       CALL_SITES
  STILL_READ  DD_DATA_STREAMS_ENABLED                      1
  UNMIGRATED  DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED  1

PACKAGE: instrumentation/graphql
  STATUS      CONFIG                             CALL_SITES
  UNMIGRATED  DD_TRACE_GRAPHQL_ERROR_EXTENSIONS  1

PACKAGE: instrumentation/httptrace
  STATUS      CONFIG                                                 CALL_SITES
  UNMIGRATED  DD_GOOGLE_CLOUD_PUBSUB_PROPAGATION_AS_SPAN_LINKS       1
  UNMIGRATED  DD_TRACE_BAGGAGE_TAG_KEYS                              1
  UNMIGRATED  DD_TRACE_CLIENT_IP_ENABLED                             1
  UNMIGRATED  DD_TRACE_HTTP_SERVER_ERROR_STATUSES                    1
  UNMIGRATED  DD_TRACE_HTTP_URL_QUERY_STRING_ALLOWLIST               1
  UNMIGRATED  DD_TRACE_HTTP_URL_QUERY_STRING_ALLOWLIST_CLIENT        1
  UNMIGRATED  DD_TRACE_HTTP_URL_QUERY_STRING_ALLOWLIST_SERVER        1
  UNMIGRATED  DD_TRACE_HTTP_URL_QUERY_STRING_DISABLED                1
  UNMIGRATED  DD_TRACE_INFERRED_PROXY_SERVICES_ENABLED               1
  UNMIGRATED  DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP               2
  UNMIGRATED  DD_TRACE_RESOURCE_RENAMING_ALWAYS_SIMPLIFIED_ENDPOINT  1
  UNMIGRATED  DD_TRACE_RESOURCE_RENAMING_ENABLED                     1

PACKAGE: instrumentation/internal/namingschema
  STATUS      CONFIG                                             CALL_SITES
  STILL_READ  DD_SERVICE                                         1
  STILL_READ  DD_TRACE_SPAN_ATTRIBUTE_SCHEMA                     1
  UNMIGRATED  DD_TRACE_REMOVE_INTEGRATION_SERVICE_NAMES_ENABLED  1

PACKAGE: internal
  STATUS      CONFIG                         CALL_SITES
  STILL_READ  DD_AGENT_HOST                  1
  STILL_READ  DD_TAGS                        1
  STILL_READ  DD_TRACE_AGENT_PORT            1
  STILL_READ  DD_TRACE_AGENT_URL             1
  UNMIGRATED  DD_EXTERNAL_ENV                1
  UNMIGRATED  DD_GIT_COMMIT_SHA              1
  UNMIGRATED  DD_GIT_REPOSITORY_URL          1
  UNMIGRATED  DD_TRACE_GIT_METADATA_ENABLED  1

PACKAGE: internal/appsec
  STATUS      CONFIG           CALL_SITES
  UNMIGRATED  DD_APPSEC_RULES  1

PACKAGE: internal/appsec/config
  STATUS      CONFIG                                                CALL_SITES
  UNMIGRATED  DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE  1
  UNMIGRATED  DD_API_SECURITY_ENABLED                               1
  UNMIGRATED  DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS  1
  UNMIGRATED  DD_API_SECURITY_PROXY_SAMPLE_RATE                     1
  UNMIGRATED  DD_API_SECURITY_REQUEST_SAMPLE_RATE                   1
  UNMIGRATED  DD_API_SECURITY_SAMPLE_DELAY                          1
  UNMIGRATED  DD_APM_TRACING_ENABLED                                1
  UNMIGRATED  DD_APPSEC_AGENTIC_ONBOARDING                          1
  UNMIGRATED  DD_APPSEC_ENABLED                                     1
  UNMIGRATED  DD_APPSEC_RASP_ENABLED                                1
  UNMIGRATED  DD_APPSEC_RULES                                       1
  UNMIGRATED  DD_APPSEC_SCA_ENABLED                                 1
  UNMIGRATED  DD_APPSEC_TRACE_RATE_LIMIT                            1
  UNMIGRATED  DD_APPSEC_WAF_TIMEOUT                                 1

PACKAGE: internal/appsec/listener/httpsec
  STATUS      CONFIG                     CALL_SITES
  UNMIGRATED  DD_TRACE_CLIENT_IP_HEADER  1

PACKAGE: internal/bazel
  STATUS      CONFIG                                  CALL_SITES
  UNMIGRATED  DD_TEST_OPTIMIZATION_MANIFEST_FILE      1
  UNMIGRATED  DD_TEST_OPTIMIZATION_PAYLOADS_IN_FILES  1

PACKAGE: internal/civisibility/envconfig
  STATUS      CONFIG                   CALL_SITES
  STILL_READ  DD_CIVISIBILITY_ENABLED  1

PACKAGE: internal/civisibility/integrations
  STATUS      CONFIG                                               CALL_SITES
  STILL_READ  DD_SERVICE                                           1
  STILL_READ  DD_TRACE_DEBUG                                       1
  UNMIGRATED  DD_CIVISIBILITY_CODE_COVERAGE_REPORT_UPLOAD_ENABLED  1
  UNMIGRATED  DD_CIVISIBILITY_FLAKY_RETRY_COUNT                    1
  UNMIGRATED  DD_CIVISIBILITY_FLAKY_RETRY_ENABLED                  1
  UNMIGRATED  DD_CIVISIBILITY_GIT_UPLOAD_ENABLED                   1
  UNMIGRATED  DD_CIVISIBILITY_IMPACTED_TESTS_DETECTION_ENABLED     1
  UNMIGRATED  DD_CIVISIBILITY_SUBTEST_FEATURES_ENABLED             1
  UNMIGRATED  DD_CIVISIBILITY_TOTAL_FLAKY_RETRY_COUNT              1
  UNMIGRATED  DD_TEST_MANAGEMENT_ATTEMPT_TO_FIX_RETRIES            1
  UNMIGRATED  DD_TEST_MANAGEMENT_ENABLED                           1

PACKAGE: internal/civisibility/integrations/gotesting
  STATUS      CONFIG                                                           CALL_SITES
  UNMIGRATED  DD_CIVISIBILITY_INTERNAL_PARALLEL_EARLY_FLAKE_DETECTION_ENABLED  1
  UNMIGRATED  DD_TEST_MANAGEMENT_ENABLED                                       1

PACKAGE: internal/civisibility/integrations/logs
  STATUS      CONFIG                        CALL_SITES
  UNMIGRATED  DD_CIVISIBILITY_LOGS_ENABLED  1

PACKAGE: internal/civisibility/utils
  STATUS      CONFIG                              CALL_SITES
  STILL_READ  DD_SERVICE                          1
  UNMIGRATED  DD_ACTION_EXECUTION_ID              1
  UNMIGRATED  DD_PIPELINE_EXECUTION_ID            1
  UNMIGRATED  DD_TEST_OPTIMIZATION_ENV_DATA_FILE  1
  UNMIGRATED  DD_TEST_SESSION_NAME                1

PACKAGE: internal/civisibility/utils/net
  STATUS      CONFIG                             CALL_SITES
  STILL_READ  DD_API_KEY                         1
  STILL_READ  DD_CIVISIBILITY_AGENTLESS_ENABLED  1
  STILL_READ  DD_CIVISIBILITY_AGENTLESS_URL      1
  STILL_READ  DD_ENV                             1
  STILL_READ  DD_SERVICE                         1
  STILL_READ  DD_SITE                            1
  STILL_READ  DD_TAGS                            1
  STILL_READ  DD_VERSION                         1
  UNMIGRATED  DD_CODE_COVERAGE_FLAGS             1

PACKAGE: internal/civisibility/utils/telemetry
  STATUS      CONFIG                                         CALL_SITES
  UNMIGRATED  DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER  1

PACKAGE: internal/globalconfig
  STATUS      CONFIG                           CALL_SITES
  UNMIGRATED  DD_INSTRUMENTATION_INSTALL_ID    1
  UNMIGRATED  DD_INSTRUMENTATION_INSTALL_TIME  1
  UNMIGRATED  DD_INSTRUMENTATION_INSTALL_TYPE  1

PACKAGE: internal/hostname
  STATUS      CONFIG       CALL_SITES
  UNMIGRATED  DD_HOSTNAME  1

PACKAGE: internal/namingschema
  STATUS      CONFIG                                             CALL_SITES
  STILL_READ  DD_SERVICE                                         1
  STILL_READ  DD_TRACE_SPAN_ATTRIBUTE_SCHEMA                     1
  UNMIGRATED  DD_TRACE_REMOVE_INTEGRATION_SERVICE_NAMES_ENABLED  1

PACKAGE: internal/processtags
  STATUS      CONFIG                                          CALL_SITES
  UNMIGRATED  DD_EXPERIMENTAL_PROPAGATE_PROCESS_TAGS_ENABLED  1

PACKAGE: internal/remoteconfig
  STATUS      CONFIG                                  CALL_SITES
  STILL_READ  DD_ENV                                  1
  UNMIGRATED  DD_RC_TUF_ROOT                          1
  UNMIGRATED  DD_REMOTE_CONFIGURATION_ENABLED         1
  UNMIGRATED  DD_REMOTE_CONFIG_POLL_INTERVAL_SECONDS  1

PACKAGE: internal/stacktrace
  STATUS      CONFIG                           CALL_SITES
  UNMIGRATED  DD_APPSEC_MAX_STACK_TRACE_DEPTH  1
  UNMIGRATED  DD_APPSEC_STACK_TRACE_ENABLED    1

PACKAGE: internal/telemetry
  STATUS      CONFIG                                             CALL_SITES
  STILL_READ  DD_API_KEY                                         1
  STILL_READ  DD_SITE                                            1
  UNMIGRATED  DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT  1
  UNMIGRATED  DD_INSTRUMENTATION_TELEMETRY_ENABLED               1
  UNMIGRATED  DD_TELEMETRY_DEBUG                                 1
  UNMIGRATED  DD_TELEMETRY_DEPENDENCY_COLLECTION_ENABLED         1
  UNMIGRATED  DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL           1
  UNMIGRATED  DD_TELEMETRY_HEARTBEAT_INTERVAL                    1
  UNMIGRATED  DD_TELEMETRY_LOG_COLLECTION_ENABLED                1
  UNMIGRATED  DD_TELEMETRY_METRICS_ENABLED                       1

PACKAGE: openfeature
  STATUS      CONFIG                                                     CALL_SITES
  STILL_READ  DD_ENV                                                     2
  STILL_READ  DD_EXPERIMENTAL_FLAGGING_PROVIDER_ENABLED                  1
  STILL_READ  DD_SERVICE                                                 2
  STILL_READ  DD_VERSION                                                 2
  UNMIGRATED  DD_EXPERIMENTAL_FLAGGING_PROVIDER_SPAN_ENRICHMENT_ENABLED  1
  UNMIGRATED  DD_FLAGGING_EVALUATION_COUNTS_ENABLED                      1

PACKAGE: profiler
  STATUS      CONFIG                                    CALL_SITES
  STILL_READ  DD_API_KEY                                1
  STILL_READ  DD_ENV                                    1
  STILL_READ  DD_SERVICE                                1
  STILL_READ  DD_SITE                                   1
  STILL_READ  DD_TAGS                                   1
  STILL_READ  DD_TRACE_STARTUP_LOGS                     1
  STILL_READ  DD_VERSION                                1
  UNMIGRATED  DD_PROFILING_AGENTLESS                    1
  UNMIGRATED  DD_PROFILING_DEBUG_COMPRESSION_SETTINGS   1
  UNMIGRATED  DD_PROFILING_DELTA                        1
  UNMIGRATED  DD_PROFILING_ENABLED                      3
  UNMIGRATED  DD_PROFILING_ENDPOINT_COUNT_ENABLED       1
  UNMIGRATED  DD_PROFILING_EXECUTION_TRACE_ENABLED      1
  UNMIGRATED  DD_PROFILING_EXECUTION_TRACE_LIMIT_BYTES  1
  UNMIGRATED  DD_PROFILING_EXECUTION_TRACE_PERIOD       1
  UNMIGRATED  DD_PROFILING_FLUSH_ON_EXIT                1
  UNMIGRATED  DD_PROFILING_OUTPUT_DIR                   1
  UNMIGRATED  DD_PROFILING_UPLOAD_TIMEOUT               1
  UNMIGRATED  DD_PROFILING_URL                          1

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Registers DD_APPSEC_AGENTIC_ONBOARDING as a supported configuration key and reports it as configuration telemetry (RFC-1113), always emitting a value (empty string with origin=default when unset).

Changes:

  • Added DD_APPSEC_AGENTIC_ONBOARDING to the supported configuration keys list (JSON + generated Go map).
  • Registered the key via stableconfig.String in AppSec config init to emit configuration telemetry unconditionally.
  • Added unit test coverage to validate telemetry emission and origin/value behavior for set vs unset.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File Description
internal/env/supported_configurations.json Declares the new config key as a supported string configuration with default empty value.
internal/env/supported_configurations.gen.go Updates the generated supported-configurations map to include the new key.
internal/appsec/config/config.go Registers the new key for app configuration telemetry via stableconfig.String during package init.
internal/appsec/config/config_test.go Verifies telemetry is always emitted and that origin/value match set vs unset cases.
Files not reviewed (1)
  • internal/env/supported_configurations.gen.go: Generated file

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@datadog-official

datadog-official Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Tests

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
Patch Coverage: 100.00%
Overall Coverage: 62.83% (-3.56%)

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: bcf3746 | Docs | Datadog PR Page | Give us feedback!

@pr-commenter

pr-commenter Bot commented Jul 22, 2026

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2026-07-22 08:21:43

Comparing candidate commit bcf3746 in PR branch christophe-papazian/appsec-agentic-onboarding with baseline commit 9eae137 in branch main.

Found 0 performance improvements and 1 performance regressions! Performance is the same for 325 metrics, 0 unstable metrics, 1 flaky benchmarks without significant changes.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

  • 🟩 = significantly better candidate vs. baseline
  • 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

scenario:BenchmarkPayloadVersions/simple_1000spans/v1.0

  • 🟥 allocated_mem [+1 bytes; +1 bytes] or [+2.941%; +2.941%]

Known flaky benchmarks

These benchmarks are marked as flaky and will not trigger a failure. Modify FLAKY_BENCHMARKS_REGEX to control which benchmarks are marked as flaky.

Known flaky benchmarks without significant changes:

  • scenario:BenchmarkOTLPTraceWriterFlush

@e-n-0 e-n-0 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, be sure that the RFC 1113 system tests are correctly passing using this PR

Comment thread internal/appsec/config/config.go
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants