Add AppSec agentic onboarding runtime telemetry (RFC-1110)

[christophe-papazian]

What Does This Do

Implements RFC-1110 — a runtime telemetry signal that a service was onboarded by the AAP agentic onboarding solution.

When the presence-only flag DD_APPSEC_AGENTIC_ONBOARDING is set (via env var, JVM property, or local/fleet stable config), the tracer emits a single boolean configuration entry appsec.agentic_onboarding in its app-started instrumentation-telemetry payload, tagged with the config source origin.

• The reported boolean is true only when AppSec fully came up at startup with its WAF module started, and false otherwise (AppSec disabled, remote-config-only, native WAF failed to load, or startup aborted). This mirrors the Python reference's "native WAF loaded" semantics and is stricter than bare isActive().
• The flag is presence-only: any value (including empty) counts as set; its value is never read or transmitted. When unset in all sources, nothing is reported.

Motivation

Prerequisite for Agentic Onboarding GA (APPSEC-68812): lets the usage→activation funnel be measured in production. Java counterpart of the merged Python implementation (dd-trace-py#19068).

Changes

• AppSecConfig — new APPSEC_AGENTIC_ONBOARDING config key; registered DD_APPSEC_AGENTIC_ONBOARDING in metadata/supported-configurations.json.
• ActiveSubsystems — new bootstrap-visible APPSEC_WAF_STARTED flag.
• AppSecSystem — sets it on full startup success (active + WAF module started), cleared per start attempt.
• Agent.maybeStartAppSec — reports the signal in a finally so the disabled/failed cases are covered.
• AgenticOnboarding (new) — presence/origin resolution (never via ConfigProvider, to keep the raw value out of telemetry) + reporting.

Testing

New JUnit 5 unit tests (AgenticOnboardingTest) cover presence-only semantics (incl. empty string), source precedence, the absent case, boolean value/origin, and the system-property end-to-end path. Behavioral coverage across languages is handled by system tests (APPSEC-69171).

🤖 Generated with Claude Code

[christophe-papazian]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 79d7375567

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[datadog-prod-us1-3]

🎯 Code Coverage (details)
• Patch Coverage: 58.00%
• Overall Coverage: 57.27% (-0.01%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: b91b3e2 | Docs | Datadog PR Page | Give us feedback!}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.00 s	13.96 s	[-0.4%; +0.9%] (no difference)
startup:insecure-bank:tracing:Agent	12.94 s	13.07 s	[-1.7%; -0.3%] (maybe better)
startup:petclinic:appsec:Agent	16.93 s	16.55 s	[+1.2%; +3.3%] (significantly worse)
startup:petclinic:iast:Agent	16.90 s	16.95 s	[-1.1%; +0.5%] (no difference)
startup:petclinic:profiling:Agent	16.60 s	16.95 s	[-3.4%; -0.7%] (maybe better)
startup:petclinic:sca:Agent	16.93 s	16.80 s	[-0.1%; +1.6%] (no difference)
startup:petclinic:tracing:Agent	15.94 s	15.66 s	[-2.5%; +6.0%] (no difference)

Commit: b91b3e24 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[datadog-prod-us1-3]

More details

Validated across three standalone test programs covering 26 adversarial scenarios (origin precedence/presence-only semantics, key transformations, APPSEC_WAF_STARTED state management in all startup paths, and finally-block behavior). All scenarios pass: the DD_APPSEC_AGENTIC_ONBOARDING env var key is derived consistently across all lookup paths, the flag reports false for every non-WAF-started case (disabled, WAF init failure, exception path), and AgenticOnboarding.report() fires in the finally block under all conditions including AppSec errors.

Was this helpful? React 👍 or 👎

_{📊 Validated against 26 scenarios · Open Bits AI session}

_{🤖 Datadog Autotest · Commit b91b3e2 · What is Autotest? · Any feedback? Reach out in #autotest}

[e-n-0]

LGTM!
However we might want to update the Feature Parity Dashboard to also set the config key that is special for java.