From d3aa693cb3c19f75ce778e27a81d11c57a1cd598 Mon Sep 17 00:00:00 2001 From: Christophe Papazian Date: Wed, 22 Jul 2026 10:57:23 +0200 Subject: [PATCH 1/3] Report agentic onboarding marker in configuration telemetry (RFC-1113) Register DD_APPSEC_AGENTIC_ONBOARDING as an ordinary string configuration key, reported verbatim in app-started configuration telemetry. Always emitted: empty value with origin=default when unset. No derived boolean and no read of AppSec's runtime-enabled state. Co-Authored-By: Claude Opus 4.8 (1M context) --- lib/datadog/appsec/configuration.rb | 8 +++++ .../configuration/supported_configurations.rb | 1 + .../appsec/configuration/settings_spec.rb | 32 +++++++++++++++++++ .../core/telemetry/event/app_started_spec.rb | 1 + supported-configurations.json | 7 ++++ 5 files changed, 49 insertions(+) diff --git a/lib/datadog/appsec/configuration.rb b/lib/datadog/appsec/configuration.rb index 047dcfde2a..c9443a6abc 100644 --- a/lib/datadog/appsec/configuration.rb +++ b/lib/datadog/appsec/configuration.rb @@ -52,6 +52,14 @@ def self.add_settings!(base) o.default false end + # Set by the agentic onboarding solution; no behavior, reported verbatim in + # configuration telemetry only (RFC-1113). + option :agentic_onboarding do |o| + o.type :string + o.env "DD_APPSEC_AGENTIC_ONBOARDING" + o.default "" + end + define_method(:instrument) do |integration_name| if enabled registered_integration = Datadog::AppSec::Contrib::Integration.registry[integration_name] diff --git a/lib/datadog/core/configuration/supported_configurations.rb b/lib/datadog/core/configuration/supported_configurations.rb index 337f3713bd..c1211853b9 100644 --- a/lib/datadog/core/configuration/supported_configurations.rb +++ b/lib/datadog/core/configuration/supported_configurations.rb @@ -24,6 +24,7 @@ module Configuration "DD_API_SECURITY_REQUEST_SAMPLE_RATE", "DD_API_SECURITY_SAMPLE_DELAY", "DD_APM_TRACING_ENABLED", + "DD_APPSEC_AGENTIC_ONBOARDING", "DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING", "DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE", "DD_APPSEC_BODY_PARSING_SIZE_LIMIT", diff --git a/spec/datadog/appsec/configuration/settings_spec.rb b/spec/datadog/appsec/configuration/settings_spec.rb index 6f5cadc960..9933702cd4 100644 --- a/spec/datadog/appsec/configuration/settings_spec.rb +++ b/spec/datadog/appsec/configuration/settings_spec.rb @@ -434,6 +434,38 @@ def patcher end end + describe "#agentic_onboarding" do + subject(:agentic_onboarding) { settings.appsec.agentic_onboarding } + + context "when DD_APPSEC_AGENTIC_ONBOARDING" do + around do |example| + ClimateControl.modify("DD_APPSEC_AGENTIC_ONBOARDING" => agentic_onboarding_env) do + example.run + end + end + + context "is not defined" do + let(:agentic_onboarding_env) { nil } + + it { is_expected.to eq("") } + end + + context "is defined" do + let(:agentic_onboarding_env) { "true" } + + it { is_expected.to eq("true") } + end + end + end + + describe "#agentic_onboarding=" do + subject(:set_agentic_onboarding) { settings.appsec.agentic_onboarding = "true" } + + before { set_agentic_onboarding } + + it { expect(settings.appsec.agentic_onboarding).to eq("true") } + end + describe "#obfuscator_key_regex" do subject(:obfuscator_key_regex) { settings.appsec.obfuscator_key_regex } diff --git a/spec/datadog/core/telemetry/event/app_started_spec.rb b/spec/datadog/core/telemetry/event/app_started_spec.rb index fdcd54322d..b1549a96c0 100644 --- a/spec/datadog/core/telemetry/event/app_started_spec.rb +++ b/spec/datadog/core/telemetry/event/app_started_spec.rb @@ -42,6 +42,7 @@ # ['tracing.writer_options.flush_interval', 456], # not reported by default # ['logger.instance', 'MyLogger'], # not reported by default ["DD_APPSEC_ENABLED", false], + ["DD_APPSEC_AGENTIC_ONBOARDING", ""], # ['DD_APPSEC_SCA_ENABLED', false], # not reported by default ["DD_APM_TRACING_ENABLED", true] ].freeze diff --git a/supported-configurations.json b/supported-configurations.json index 0d63544cf3..cb4226a0f5 100644 --- a/supported-configurations.json +++ b/supported-configurations.json @@ -116,6 +116,13 @@ "sensitive": true } ], + "DD_APPSEC_AGENTIC_ONBOARDING": [ + { + "version": "A", + "type": "string", + "default": "" + } + ], "DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING": [ { "version": "A", From b9ea772209f7b61f07fc9439d61b5ab9139b24ac Mon Sep 17 00:00:00 2001 From: Christophe Papazian Date: Wed, 22 Jul 2026 11:58:28 +0200 Subject: [PATCH 2/3] Bump system-tests pin to include RFC-1113 agentic-onboarding tests The previously pinned ref predated the RFC-1113 rewrite of test_agentic_onboarding.py (it still had the RFC-1110 derived-boolean test). Bump to system-tests main so the agentic-onboarding config telemetry tests run against this change. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/system-tests.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/system-tests.yml b/.github/workflows/system-tests.yml index 9eccef5427..9213c156f6 100644 --- a/.github/workflows/system-tests.yml +++ b/.github/workflows/system-tests.yml @@ -72,7 +72,7 @@ jobs: test: needs: - build - uses: DataDog/system-tests/.github/workflows/system-tests.yml@a724f5b01554f65b27c4dca10bd0a27d28453bd6 # Automated: Updated by .github/workflows/update-system-tests.yml. + uses: DataDog/system-tests/.github/workflows/system-tests.yml@0a8708ceced299abfb0614d919f22789174f0022 # Automated: Updated by .github/workflows/update-system-tests.yml. permissions: contents: read id-token: write @@ -82,7 +82,7 @@ jobs: binaries_artifact: dd-trace-rb desired_execution_time: 300 # 5 minutes scenarios_groups: tracer_release - ref: a724f5b01554f65b27c4dca10bd0a27d28453bd6 # Automated: Updated by .github/workflows/update-system-tests.yml. + ref: 0a8708ceced299abfb0614d919f22789174f0022 # Automated: Updated by .github/workflows/update-system-tests.yml. force_execute: ${{ needs.build.outputs.forced_tests }} parametric_job_count: 8 push_to_test_optimization: true From d1026f2ac6312f65cdbb26cd4320ab7c1272da8f Mon Sep 17 00:00:00 2001 From: Christophe Papazian Date: Wed, 22 Jul 2026 13:35:07 +0200 Subject: [PATCH 3/3] Revert "Bump system-tests pin to include RFC-1113 agentic-onboarding tests" This reverts commit b9ea772209f7b61f07fc9439d61b5ab9139b24ac. --- .github/workflows/system-tests.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/system-tests.yml b/.github/workflows/system-tests.yml index 9213c156f6..9eccef5427 100644 --- a/.github/workflows/system-tests.yml +++ b/.github/workflows/system-tests.yml @@ -72,7 +72,7 @@ jobs: test: needs: - build - uses: DataDog/system-tests/.github/workflows/system-tests.yml@0a8708ceced299abfb0614d919f22789174f0022 # Automated: Updated by .github/workflows/update-system-tests.yml. + uses: DataDog/system-tests/.github/workflows/system-tests.yml@a724f5b01554f65b27c4dca10bd0a27d28453bd6 # Automated: Updated by .github/workflows/update-system-tests.yml. permissions: contents: read id-token: write @@ -82,7 +82,7 @@ jobs: binaries_artifact: dd-trace-rb desired_execution_time: 300 # 5 minutes scenarios_groups: tracer_release - ref: 0a8708ceced299abfb0614d919f22789174f0022 # Automated: Updated by .github/workflows/update-system-tests.yml. + ref: a724f5b01554f65b27c4dca10bd0a27d28453bd6 # Automated: Updated by .github/workflows/update-system-tests.yml. force_execute: ${{ needs.build.outputs.forced_tests }} parametric_job_count: 8 push_to_test_optimization: true