datadog 2.36.0 → 2.38.0

data/lib/datadog/di/remote.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative 'fatal_exceptions'
+
 module Datadog
   module DI
     # Provides an interface expected by the core Remote subsystem to
@@ -15,14 +17,125 @@ module Datadog
       class << self
         PRODUCT = 'LIVE_DEBUGGING'
 
+        # Declared here (not in Tracing::Remote::CAPABILITIES) so it is
+        # registered only with the gated DI block in Capabilities#register:
+        # when DI is explicitly disabled, or the runtime cannot run DI
+        # (JRuby, Ruby 2.5), that block — including this bit — is skipped.
+        # The enable signal itself is delivered in APM_TRACING payloads and
+        # routed here by Tracing::Remote.process_config.
+        CAPABILITIES = [
+          1 << 38, # APM_TRACING_ENABLE_DYNAMIC_INSTRUMENTATION: Implicit DI enablement
+        ].freeze
+
         def products
-          # TODO: do not send our product on unsupported runtimes
-          # (Ruby 2.5 / JRuby)
           [PRODUCT]
         end
 
         def capabilities
-          []
+          CAPABILITIES
+        end
+
+        # Entry point for the RC-driven DI enable/disable path.
+        #
+        # Invoked from {Datadog::Tracing::Remote.process_config} when an
+        # APM_TRACING payload carries `dynamic_instrumentation_enabled`. Runs
+        # on the remote-config thread; never raises.
+        #
+        # @param enabled [Boolean] desired state from RC: true to start DI,
+        #   false to stop it. The `DD_DYNAMIC_INSTRUMENTATION_ENABLED=false`
+        #   env var blocks an enable here (see {.explicitly_disabled?}).
+        # @param repository [Datadog::Core::Remote::Configuration::Repository, nil]
+        #   the RC repository, passed by {Datadog::Tracing::Remote.process_config}
+        #   so that a stopped->started transition can reconcile against probes that
+        #   were delivered in an earlier poll. nil when called outside the RC
+        #   dispatch path (e.g. unit tests), in which case no reconcile happens.
+        # @return [void]
+        def handle_rc_enablement(enabled, repository = nil)
+          # allow_initialization: false because this runs on the remote-config
+          # thread (a callback context). The default `true` would synchronously
+          # build the entire component tree from the wrong thread if the RC
+          # signal lands before Components#initialize completed.
+          components = Datadog.send(:components, allow_initialization: false)
+          component = components&.dynamic_instrumentation
+          unless component
+            # The component is nil because Component.build returned nil at
+            # startup — a runtime precondition is not met (RC disabled, MRI
+            # required, Ruby 2.6+ required, Rails dev env, C extension absent).
+            # On disable, silently no-op: RC asking us to turn off something we
+            # don't have is fine. On enable, warn with the reason: this is the
+            # implicit-enablement counterpart to the warn-on-explicit message
+            # at build time. The customer who clicked "create probe" in the UI
+            # gets the same visibility a customer who set
+            # DD_DYNAMIC_INSTRUMENTATION_ENABLED would have gotten at boot.
+            if enabled
+              if explicitly_disabled?
+                Datadog.logger.warn(
+                  "di: cannot enable dynamic instrumentation via remote configuration " \
+                  "because DD_DYNAMIC_INSTRUMENTATION_ENABLED is explicitly set to false",
+                )
+              else
+                reason = DI.unsupported_reason
+                Datadog.logger.warn(
+                  "di: cannot enable dynamic instrumentation via remote configuration: " \
+                  "#{reason || "dynamic instrumentation was not initialized at startup"}",
+                )
+              end
+            end
+            return
+          end
+
+          if enabled
+            if explicitly_disabled?
+              Datadog.logger.warn(
+                "di: ignoring implicit enablement signal from remote configuration " \
+                "because DD_DYNAMIC_INSTRUMENTATION_ENABLED is explicitly set to false. " \
+                "To allow remote enablement, unset DD_DYNAMIC_INSTRUMENTATION_ENABLED.",
+              )
+              return
+            end
+            # component is non-nil here only because Component.build's preconditions
+            # passed, which is the same condition under which di/base.rb is loaded
+            # and DI.activate_tracking is defined.
+            DI.activate_tracking
+            was_started = component.started?
+            component.start!
+            # A probe delivered in an earlier poll while the component was stopped
+            # was dropped by #receivers (which ignores changes while !started?) and
+            # never entered the probe repository. RC dispatch only re-delivers a
+            # config when its content hash changes (Core::Remote::Client#apply_config
+            # skips unchanged content), so the probe would otherwise stay dropped
+            # until the customer edits it. On the stopped->started transition,
+            # reconcile against the current LIVE_DEBUGGING contents so it installs now.
+            replay_current_probes(repository, component) if repository && !was_started
+          else
+            component.stop!
+          end
+        rescue => e
+          Datadog.logger.debug { "di: error handling implicit enablement: #{e.class}: #{e.message}" }
+          Datadog.send(:components, allow_initialization: false)&.telemetry&.report(
+            e,
+            description: "Error handling DI implicit enablement",
+          )
+        end
+
+        # Symmetric to {DI::Component.explicitly_enabled?} (see there for why
+        # using_default? rather than options[:enabled].default_precedence?).
+        #
+        # Canonical home for the explicit-disable check: it gates
+        # {DI::Component.build} and the DI block in
+        # {Core::Remote::Client::Capabilities#register}. The latter runs before
+        # DI::Component is loaded, so the check lives here on DI::Remote (always
+        # required by capabilities.rb) rather than on DI::Component. The
+        # `settings` argument lets those startup callers pass the settings being
+        # configured; the RC handler omits it and reads the global config.
+        #
+        # @param settings [Datadog::Core::Configuration::Settings]
+        # @return [Boolean] true when the customer set
+        #   `DD_DYNAMIC_INSTRUMENTATION_ENABLED=false` (or the programmatic
+        #   equivalent), which blocks DI build and RC-driven enablement.
+        def explicitly_disabled?(settings = Datadog.configuration)
+          !settings.dynamic_instrumentation.using_default?(:enabled) &&
+            !settings.dynamic_instrumentation.enabled
         end
 
         def receivers(telemetry)
@@ -32,17 +145,18 @@ module Datadog
             # DEV: Apply this refactor to AppSec as well if implemented.
 
             component = DI.component
-            # We should always have a non-nil DI component here, because we
-            # only add DI product to remote config request if DI is enabled.
-            # Ideally, we should be injected with the DI component here
-            # rather than having to retrieve it from global state.
-            # If the component is nil for some reason, we also don't have a
-            # logger instance to report the issue.
-            if component
+            if component&.started?
               changes.each do |change|
                 case change.type
                 when :insert
-                  add_probe(change.content, component) # steep:ignore NoMethod
+                  # A stopped->started reconcile (#replay_current_probes) may have
+                  # installed this probe earlier in the same dispatch — the enable
+                  # signal is carried by the Tracing receiver, which runs before the
+                  # DI receiver. Skip the redundant install rather than letting
+                  # probe_manager raise AlreadyInstrumented and report a false error.
+                  unless probe_in_content_known?(change.content, component) # steep:ignore NoMethod
+                    add_probe(change.content, component) # steep:ignore NoMethod
+                  end
                 when :update
                   # We do not implement updates at the moment, remove the
                   # probe and reinstall.
@@ -89,7 +203,8 @@ module Datadog
             # message.
             # TODO assert content state (errored for this example)
             content.errored("Error applying dynamic instrumentation configuration: #{exc.class}: #{exc.message}")
-          rescue => exc
+          rescue Exception => exc # standard:disable Lint/RescueException
+            Datadog::DI.reraise_if_fatal(exc)
             raise if component.settings.dynamic_instrumentation.internal.propagate_all_exceptions
 
             component.logger.debug { "di: unhandled exception adding #{probe.type} probe at #{probe.location} (#{probe.id}) in DI remote receiver: #{exc.class}: #{exc.message}" }
@@ -113,8 +228,9 @@ module Datadog
           # we need to note it as being current so that we do not
           # try to remove instrumentation that is still supposed to be
           # active.
-          #current_probe_ids[probe_spec.fetch('id')] = true
-        rescue => exc
+          # current_probe_ids[probe_spec.fetch('id')] = true
+        rescue Exception => exc # standard:disable Lint/RescueException
+          Datadog::DI.reraise_if_fatal(exc)
           raise if component.settings.dynamic_instrumentation.internal.propagate_all_exceptions
 
           component.logger.debug { "di: unhandled exception handling a probe in DI remote receiver: #{exc.class}: #{exc.message}" }
@@ -124,6 +240,50 @@ module Datadog
           content.errored("Error applying dynamic instrumentation configuration: #{exc.class}: #{exc.message}")
         end
 
+        # Reconciles the DI probe repository against the LIVE_DEBUGGING configs
+        # currently held by the RC repository. Called on the stopped->started
+        # transition to install probes that arrived while DI was stopped: those
+        # were dropped by {.receivers} and RC will not re-dispatch them because
+        # their content hash is unchanged.
+        #
+        # Probes already tracked by the component (installed, pending, or failed)
+        # are skipped, so a probe handled in the same dispatch by {.receivers} is
+        # not added twice.
+        def replay_current_probes(repository, component)
+          repository.contents.each do |content|
+            next unless content.path.product == PRODUCT
+
+            begin
+              probe_id = parse_content(content)["id"]
+            rescue => exc
+              component.logger.debug { "di: skipping unparseable LIVE_DEBUGGING content on enable reconcile: #{exc.class}: #{exc.message}" }
+              next
+            end
+
+            next if probe_id && probe_known?(probe_id, component)
+
+            add_probe(content, component)
+          end
+        end
+
+        def probe_known?(probe_id, component)
+          repo = component.probe_manager.probe_repository
+          !!(repo.find_installed(probe_id) ||
+            repo.find_pending(probe_id) ||
+            repo.find_failed(probe_id))
+        end
+
+        # True when the probe carried by +content+ is already tracked by the
+        # component. Returns false when the id cannot be determined, so add_probe
+        # still runs and reports the parse error through its own handling.
+        def probe_in_content_known?(content, component)
+          probe_id = parse_content(content)["id"]
+          !!(probe_id && probe_known?(probe_id, component))
+        rescue => exc
+          component.logger.debug { "di: could not check probe id for insert dedup: #{exc.class}: #{exc.message}" }
+          false
+        end
+
         # This method does not mark +previous_content+ as succeeded or errored,
         # because that content is from a previous RC response and has already
         # been marked. Removal of probes happens when an RC entry disappears,
@@ -133,7 +293,8 @@ module Datadog
           probe_spec = parse_content(previous_content)
           probe_id = probe_spec.fetch('id')
           component.probe_manager.remove_probe(probe_id)
-        rescue => exc
+        rescue Exception => exc # standard:disable Lint/RescueException
+          Datadog::DI.reraise_if_fatal(exc)
           raise if component.settings.dynamic_instrumentation.internal.propagate_all_exceptions
 
           component.logger.debug { "di: unhandled exception removing probes in DI remote receiver: #{exc.class}: #{exc.message}" }

data/lib/datadog/di/serializer.rb

@@ -44,8 +44,11 @@ module Datadog
     class Serializer
       # Exception classes that should never be caught during serialization.
       # These represent fatal conditions (signals, interrupts, system exit)
-      # that must propagate to the caller.
-      FATAL_EXCEPTION_CLASSES = [SignalException, Interrupt, SystemExit].freeze
+      # that must propagate to the caller. NoMemoryError is deliberately
+      # excluded (unlike DI::FATAL_EXCEPTION_CLASSES): serialization of large
+      # or deeply recursive objects can exhaust memory, and the serializer must
+      # return a safe stub rather than tear the process down.
+      SERIALIZABLE_FATAL_EXCEPTION_CLASSES = [SystemExit, SignalException].freeze
 
       # Third-party library integration / custom serializers.
       #
@@ -128,9 +131,12 @@ module Datadog
       # in upstream code.
       def serialize_args(args, kwargs, target_self,
         depth: settings.dynamic_instrumentation.max_capture_depth,
-        attribute_count: settings.dynamic_instrumentation.max_capture_attribute_count)
+        attribute_count: settings.dynamic_instrumentation.max_capture_attribute_count,
+        length: nil,
+        collection_size: nil)
         combined = combine_args(args, kwargs, target_self)
-        serialize_vars(combined, depth: depth, attribute_count: attribute_count)
+        serialize_vars(combined, depth: depth, attribute_count: attribute_count,
+          length: length, collection_size: collection_size)
       end
 
       # Serializes variables captured by a line probe.
@@ -139,9 +145,12 @@ module Datadog
       # of executed code.
       def serialize_vars(vars,
         depth: settings.dynamic_instrumentation.max_capture_depth,
-        attribute_count: settings.dynamic_instrumentation.max_capture_attribute_count)
+        attribute_count: settings.dynamic_instrumentation.max_capture_attribute_count,
+        length: nil,
+        collection_size: nil)
         vars.each_with_object({}) do |(k, v), agg|
-          agg[k] = serialize_value(v, name: k, depth: depth, attribute_count: attribute_count)
+          agg[k] = serialize_value(v, name: k, depth: depth, attribute_count: attribute_count,
+            length: length, collection_size: collection_size)
         end
       end
 
@@ -160,6 +169,8 @@ module Datadog
       def serialize_value(value, name: nil,
         depth: settings.dynamic_instrumentation.max_capture_depth,
         attribute_count: nil,
+        length: nil,
+        collection_size: nil,
         type: nil)
         attribute_count ||= settings.dynamic_instrumentation.max_capture_attribute_count
         cls = type || value.class
@@ -177,7 +188,9 @@ module Datadog
             if condition
               begin
                 condition_result = condition.call(value)
-              rescue => e
+              rescue Exception => e # standard:disable Lint/RescueException
+                raise if SERIALIZABLE_FATAL_EXCEPTION_CLASSES.any? { |klass| e.is_a?(klass) }
+
                 # If a custom serializer condition raises an exception (e.g., regex match
                 # against invalid UTF-8), skip it and continue with the next serializer.
                 # We don't want custom serializer conditions to break the entire serialization.
@@ -230,7 +243,8 @@ module Datadog
             #
             # Truncate binary data BEFORE escaping to avoid cutting mid-escape-sequence.
             # For regular strings, the limit is applied to string length in characters.
-            max = settings.dynamic_instrumentation.max_capture_string_length
+            length ||= settings.dynamic_instrumentation.max_capture_string_length
+            max = length
 
             if value.encoding == Encoding::BINARY || !value.valid_encoding?
               # Truncate binary data BEFORE escaping to avoid cutting mid-escape-sequence
@@ -258,7 +272,8 @@ module Datadog
             if depth <= 0
               serialized.update(notCapturedReason: "depth")
             else
-              max = settings.dynamic_instrumentation.max_capture_collection_size
+              collection_size ||= settings.dynamic_instrumentation.max_capture_collection_size
+              max = collection_size
               if max != 0 && value.length > max
                 serialized.update(notCapturedReason: "collectionSize", size: value.length)
                 # same steep failure with array slices.
@@ -266,7 +281,7 @@ module Datadog
                 value = value[0...max] || []
               end
               entries = value.map do |elt|
-                serialize_value(elt, depth: depth - 1)
+                serialize_value(elt, depth: depth - 1, length: length, collection_size: collection_size, attribute_count: attribute_count)
               end
               serialized.update(elements: entries)
             end
@@ -274,7 +289,8 @@ module Datadog
             if depth <= 0
               serialized.update(notCapturedReason: "depth")
             else
-              max = settings.dynamic_instrumentation.max_capture_collection_size
+              collection_size ||= settings.dynamic_instrumentation.max_capture_collection_size
+              max = collection_size
               cur = 0
               entries = []
               value.each do |k, v|
@@ -283,7 +299,8 @@ module Datadog
                   break
                 end
                 cur += 1
-                entries << [serialize_value(k, depth: depth - 1), serialize_value(v, name: k, depth: depth - 1)]
+                entries << [serialize_value(k, depth: depth - 1, length: length, collection_size: collection_size, attribute_count: attribute_count),
+                  serialize_value(v, name: k, depth: depth - 1, length: length, collection_size: collection_size, attribute_count: attribute_count)]
               end
               serialized.update(entries: entries)
             end
@@ -322,7 +339,7 @@ module Datadog
                   break
                 end
                 cur += 1
-                fields[ivar] = serialize_value(value.instance_variable_get(ivar), name: ivar, depth: depth - 1)
+                fields[ivar] = serialize_value(value.instance_variable_get(ivar), name: ivar, depth: depth - 1, length: length, collection_size: collection_size, attribute_count: attribute_count)
               end
               serialized.update(fields: fields)
             end
@@ -331,7 +348,7 @@ module Datadog
         rescue Exception => exc # standard:disable Lint/RescueException
           # Re-raise fatal exceptions that should not be caught
           # (signals, interrupts, system exit)
-          raise if FATAL_EXCEPTION_CLASSES.any? { |klass| exc.is_a?(klass) }
+          raise if SERIALIZABLE_FATAL_EXCEPTION_CLASSES.any? { |klass| exc.is_a?(klass) }
 
           # Catch all other exceptions including SystemStackError and NoMemoryError.
           # These inherit from Exception (not StandardError) but can occur during
@@ -429,7 +446,9 @@ module Datadog
           end
           "#<#{class_name(value.class)}#{serialized}>"
         end
-      rescue => exc
+      rescue Exception => exc # standard:disable Lint/RescueException
+        raise if SERIALIZABLE_FATAL_EXCEPTION_CLASSES.any? { |klass| exc.is_a?(klass) }
+
         telemetry&.report(exc, description: "Error serializing for message")
         # TODO class_name(foo) can also fail, which we don't handle here.
         # Telemetry reporting could potentially also fail?

data/lib/datadog/di/transport/input.rb

@@ -7,6 +7,7 @@ require_relative '../../core/transport/parcel'
 require_relative '../../core/transport/request'
 require_relative '../../core/transport/transport'
 require_relative '../error'
+require_relative '../fatal_exceptions'
 require_relative 'http/input'
 
 module Datadog
@@ -77,7 +78,8 @@ module Datadog
                 next
               end
               encoded_snapshots << encoded
-            rescue => exc
+            rescue Exception => exc # standard:disable Lint/RescueException
+              Datadog::DI.reraise_if_fatal(exc)
               # Serialization failed for this snapshot - report via callback
               # This catches JSON::GeneratorError, Encoding errors, TypeError, etc.
               probe_id = snapshot.dig(:debugger, :snapshot, :probe, :id)
@@ -87,7 +89,8 @@ module Datadog
               if probe_id
                 begin
                   on_serialization_error.call(probe_id, exc)
-                rescue => callback_exc
+                rescue Exception => callback_exc # standard:disable Lint/RescueException
+                  Datadog::DI.reraise_if_fatal(callback_exc)
                   logger.debug { "di: error in serialization error callback for probe #{probe_id}: #{callback_exc.class}: #{callback_exc.message}" }
                   telemetry&.report(callback_exc, description: "Error in serialization error callback")
                 end
@@ -109,8 +112,9 @@ module Datadog
               # subsequent chunks are attempted to be sent.
               begin
                 send_input_chunk(chunked_payload, serialized_tags)
-              rescue => exc
-                logger.debug { "di: failed to send snapshot chunk: #{exc.class}: #{exc.message} (at #{exc.backtrace.first})" }
+              rescue Exception => exc # standard:disable Lint/RescueException
+                Datadog::DI.reraise_if_fatal(exc)
+                logger.debug { "di: failed to send snapshot chunk: #{exc.class}: #{exc.message} (at #{exc.backtrace&.first})" }
                 telemetry&.report(exc, description: "Error sending snapshot chunk")
               end
             end

data/lib/datadog/di.rb

@@ -71,6 +71,69 @@ module Datadog
         Datadog.configuration.dynamic_instrumentation.enabled
       end
 
+      # Returns a human-readable reason why dynamic instrumentation cannot run
+      # under the given settings, or nil if all build-time preconditions are met.
+      #
+      # Single source of truth for the preconditions checked in
+      # {Component.build} and reported back by {Remote.handle_rc_enablement}
+      # when an implicit enablement signal arrives but the component was not
+      # built at startup. Checks are ordered from most-actionable to
+      # platform-constraint so the most useful reason wins.
+      #
+      # The settings argument is optional so the helper can be called from
+      # contexts that don't have settings in scope (e.g. the RC handler).
+      #
+      # @param settings [Datadog::Core::Configuration::Settings]
+      # @return [String, nil] reason string or nil when supported
+      def unsupported_reason(settings = Datadog.configuration)
+        # Symmetric to the respond_to?(:remote) guard below: in unusual
+        # configurations (test doubles, partial Settings) the DI namespace
+        # may be absent. Returning a reason here lets callers — most
+        # importantly Remote.handle_rc_enablement — emit the customer-facing
+        # warn instead of raising NoMethodError on the unguarded access at
+        # line 92 (`settings.dynamic_instrumentation.internal.development`).
+        unless settings.respond_to?(:dynamic_instrumentation)
+          return "dynamic instrumentation settings are not available"
+        end
+        unless settings.respond_to?(:remote) && settings.remote.enabled
+          return "Remote Configuration is not enabled. See https://docs.datadoghq.com/agent/remote_config"
+        end
+        unless settings.dynamic_instrumentation.internal.development
+          if Datadog::Core::Environment::Execution.development?
+            return "development environment detected"
+          end
+        end
+        if (reason = unsupported_platform_reason)
+          return reason
+        end
+        unless respond_to?(:exception_message)
+          return "C extension is not available"
+        end
+        nil
+      end
+
+      # Whether the current Ruby runtime can run dynamic instrumentation:
+      # MRI (CRuby) on Ruby 2.6 or later.
+      #
+      # @return [Boolean]
+      def supported_runtime?
+        unsupported_platform_reason.nil?
+      end
+
+      # Reason the current Ruby runtime cannot run dynamic instrumentation, or
+      # nil when the platform is supported. Single source of truth for the
+      # minimum-runtime definition, shared by {unsupported_reason} (which layers
+      # the settings and C-extension checks on top) and {supported_runtime?}.
+      #
+      # @return [String, nil]
+      private def unsupported_platform_reason
+        if RUBY_ENGINE != 'ruby'
+          "MRI is required, but running on #{RUBY_ENGINE}"
+        elsif Datadog::RubyVersion.is?('< 2.6')
+          "Ruby 2.6+ is required, but running on #{RUBY_VERSION}"
+        end
+      end
+
       # Returns iseqs that correspond to loaded files (filtering out eval'd code).
       #
       # There are several types of iseqs returned by +all_iseqs+:

data/lib/datadog/kit/appsec/events/v2.rb

@@ -9,14 +9,17 @@ module Datadog
       module Events
         # The second version of Business Logic Events SDK
         module V2
+          SIGNUP_EVENT = 'users.signup'
           LOGIN_SUCCESS_EVENT = 'users.login.success'
           LOGIN_FAILURE_EVENT = 'users.login.failure'
+
           TELEMETRY_METRICS_NAMESPACE = 'appsec'
           TELEMETRY_METRICS_SDK_EVENT = 'sdk.event'
           TELEMETRY_METRICS_SDK_VERSION = 'v2'
           TELEMETRY_METRICS_EVENTS_INTO_TYPES = {
             LOGIN_SUCCESS_EVENT => 'login_success',
-            LOGIN_FAILURE_EVENT => 'login_failure'
+            LOGIN_FAILURE_EVENT => 'login_failure',
+            SIGNUP_EVENT => 'signup'
           }.freeze
 
           class << self
@@ -125,6 +128,61 @@ module Datadog
               ::Datadog::AppSec::Instrumentation.gateway.push('identity.set_user', user)
             end
 
+            # Attach user signup information to the service entry span
+            # and trigger AppSec event processing.
+            #
+            # @param login [String] The user login (e.g., username or email).
+            # @param user_or_id [String, Hash<Symbol, String>] (optional) If a
+            #   String, considered as a user ID, if a Hash, considered as a user
+            #   attributes. The Hash must include `:id` as a key.
+            # @param metadata [Hash<Symbol, String>] Additional flat free-form
+            #   metadata to attach to the event.
+            #
+            # @example Login only
+            #   Datadog::Kit::AppSec::Events::V2.track_user_signup('alice@example.com')
+            #
+            # @example Login, user attributes, and metadata
+            #   Datadog::Kit::AppSec::Events::V2.track_user_signup(
+            #     'alice@example.com',
+            #     { id: 'user-123', email: 'alice@example.com', name: 'Alice' },
+            #     ip: '192.168.1.1', device: 'mobile', 'usr.country': 'US'
+            #   )
+            #
+            # @return [void]
+            def track_user_signup(login, user_or_id = nil, metadata = {})
+              trace = service_entry_trace
+              span = service_entry_span
+
+              if trace.nil? || span.nil?
+                return Datadog.logger.warn(
+                  'Kit::AppSec: Tracing is not enabled. Please enable tracing if you want to track events'
+                )
+              end
+
+              raise TypeError, '`login` argument must be a String' unless login.is_a?(String)
+              raise TypeError, '`metadata` argument must be a Hash' unless metadata.is_a?(Hash)
+
+              user_attributes = build_user_attributes(user_or_id, login)
+
+              set_span_tags(span, metadata, namespace: SIGNUP_EVENT)
+              set_span_tags(span, user_attributes, namespace: "#{SIGNUP_EVENT}.usr")
+              span.set_tag('appsec.events.users.signup.track', 'true')
+              span.set_tag('_dd.appsec.events.users.signup.sdk', 'true')
+
+              ::Datadog::AppSec::TraceKeeper.keep!(trace)
+
+              record_event_telemetry_metric(SIGNUP_EVENT)
+
+              if user_attributes.key?(:id)
+                Kit::Identity.set_user(trace, span, **user_attributes)
+              else
+                # NOTE: {Datadog::Kit::Identity.set_user} requires an ID,
+                #       but WAF can evaluate login alone
+                user = ::Datadog::AppSec::Instrumentation::Gateway::User.new(nil, login)
+                ::Datadog::AppSec::Instrumentation.gateway.push('identity.set_user', user)
+              end
+            end
+
             private
 
             # NOTE: Current tracer implementation does not provide a way to
@@ -155,7 +213,7 @@ module Datadog
                 raise ArgumentError, 'missing required user key `:id`' unless user_or_id.key?(:id)
                 raise TypeError, 'user key `:id` must be a String' unless user_or_id[:id].is_a?(String)
 
-                user_or_id.merge(login: login) #: {login: ::String, ?id: ::String?}
+                user_or_id.merge(login: login)
               else
                 raise TypeError, '`user_or_id` argument must be either String or Hash'
               end

data/lib/datadog/open_feature/component.rb

@@ -12,7 +12,7 @@ module Datadog
   module OpenFeature
     # This class is the entry point for the OpenFeature component
     class Component
-      attr_reader :engine, :flag_eval_hook
+      attr_reader :engine, :flag_eval_metrics_hook, :flag_eval_evp_hook
 
       def self.build(settings, agent_settings, logger:, telemetry:)
         return unless settings.respond_to?(:open_feature) && settings.open_feature.enabled
@@ -54,21 +54,44 @@ module Datadog
 
         @telemetry = telemetry
         @logger = logger
-        @flag_eval_hook = create_flag_eval_hook
+        @settings = settings
+        @agent_settings = agent_settings
+        @flag_eval_metrics_hook = create_flag_eval_metrics_hook
+        @flag_eval_evp_hook = create_flag_eval_evp_hook
       end
 
       def shutdown!
         @worker.graceful_shutdown
+        @flag_eval_evp_writer&.stop
       end
 
       private
 
-      def create_flag_eval_hook
-        require_relative 'hooks/flag_eval_hook'
-        return unless Hooks::FlagEvalHook.available?
+      def create_flag_eval_metrics_hook
+        require_relative 'hooks/flag_eval_metrics_hook'
+        return unless Hooks::FlagEvalMetricsHook.available?
 
         metrics = Metrics::FlagEvalMetrics.new(telemetry: @telemetry, logger: @logger)
-        Hooks::FlagEvalHook.new(metrics)
+        Hooks::FlagEvalMetricsHook.new(metrics)
+      rescue LoadError
+        nil
+      end
+
+      # Killswitch: DD_FLAGGING_EVALUATION_COUNTS_ENABLED (default on) gates only the EVP path.
+      # Read through the datadog config registry, not raw ENV.
+      def create_flag_eval_evp_hook
+        return unless @settings.open_feature.evaluation_counts_enabled
+
+        require_relative 'hooks/flag_eval_evp_hook'
+        return unless Hooks::FlagEvalEVPHook.available?
+
+        evp_transport = Transport::HTTP.build_flagevaluations(
+          agent_settings: @agent_settings,
+          logger: @logger,
+        )
+        require_relative 'flag_evaluation/writer'
+        @flag_eval_evp_writer = FlagEvaluation::Writer.new(transport: evp_transport, logger: @logger, telemetry: @telemetry)
+        Hooks::FlagEvalEVPHook.new(@flag_eval_evp_writer)
       rescue LoadError
         nil
       end

data/lib/datadog/open_feature/configuration.rb

@@ -20,6 +20,14 @@ module Datadog
                 o.env 'DD_EXPERIMENTAL_FLAGGING_PROVIDER_ENABLED'
                 o.default false
               end
+
+              # Killswitch for the EVP `flagevaluation` emission path only. Default on; when
+              # disabled the existing OTel `feature_flag.evaluations` metric is unaffected.
+              option :evaluation_counts_enabled do |o|
+                o.type :bool
+                o.env 'DD_FLAGGING_EVALUATION_COUNTS_ENABLED'
+                o.default true
+              end
             end
           end
         end

data/lib/datadog/open_feature/ext.rb

@@ -4,8 +4,10 @@ module Datadog
   module OpenFeature
     module Ext
       ERROR = 'ERROR'
+      DEFAULT = 'DEFAULT'
       INITIALIZING = 'INITIALIZING'
       UNKNOWN_TYPE = 'UNKNOWN_TYPE'
+      PARSE_ERROR = 'PARSE_ERROR'
       GENERAL = 'GENERAL'
       PROVIDER_FATAL = 'PROVIDER_FATAL'
       PROVIDER_NOT_READY = 'PROVIDER_NOT_READY'