datadog 2.36.0 → 2.40.0

data/lib/datadog/error_tracking.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
-require_relative 'error_tracking/collector'
-require_relative 'error_tracking/component'
-require_relative 'error_tracking/configuration'
-require_relative 'error_tracking/ext'
-require_relative 'error_tracking/extensions'
-require_relative 'error_tracking/filters'
+require_relative "error_tracking/collector"
+require_relative "error_tracking/component"
+require_relative "error_tracking/configuration"
+require_relative "error_tracking/ext"
+require_relative "error_tracking/extensions"
+require_relative "error_tracking/filters"
 
 module Datadog
   # Namespace for Datadog ErrorTracking.

data/lib/datadog/kit/appsec/events/v2.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative '../../identity'
-require_relative '../../../appsec/trace_keeper'
+require_relative "../../identity"
+require_relative "../../../appsec/trace_keeper"
 
 module Datadog
   module Kit
@@ -9,14 +9,17 @@ module Datadog
       module Events
         # The second version of Business Logic Events SDK
         module V2
-          LOGIN_SUCCESS_EVENT = 'users.login.success'
-          LOGIN_FAILURE_EVENT = 'users.login.failure'
-          TELEMETRY_METRICS_NAMESPACE = 'appsec'
-          TELEMETRY_METRICS_SDK_EVENT = 'sdk.event'
-          TELEMETRY_METRICS_SDK_VERSION = 'v2'
+          SIGNUP_EVENT = "users.signup"
+          LOGIN_SUCCESS_EVENT = "users.login.success"
+          LOGIN_FAILURE_EVENT = "users.login.failure"
+
+          TELEMETRY_METRICS_NAMESPACE = "appsec"
+          TELEMETRY_METRICS_SDK_EVENT = "sdk.event"
+          TELEMETRY_METRICS_SDK_VERSION = "v2"
           TELEMETRY_METRICS_EVENTS_INTO_TYPES = {
-            LOGIN_SUCCESS_EVENT => 'login_success',
-            LOGIN_FAILURE_EVENT => 'login_failure'
+            LOGIN_SUCCESS_EVENT => "login_success",
+            LOGIN_FAILURE_EVENT => "login_failure",
+            SIGNUP_EVENT => "signup"
           }.freeze
 
           class << self
@@ -47,31 +50,31 @@ module Datadog
 
               if trace.nil? || span.nil?
                 return Datadog.logger.warn(
-                  'Kit::AppSec: Tracing is not enabled. Please enable tracing if you want to track events'
+                  "Kit::AppSec: Tracing is not enabled. Please enable tracing if you want to track events"
                 )
               end
 
-              raise TypeError, '`login` argument must be a String' unless login.is_a?(String)
-              raise TypeError, '`metadata` argument must be a Hash' unless metadata.is_a?(Hash)
+              raise TypeError, "`login` argument must be a String" unless login.is_a?(String)
+              raise TypeError, "`metadata` argument must be a Hash" unless metadata.is_a?(Hash)
 
               user_attributes = build_user_attributes(user_or_id, login)
 
               set_span_tags(span, metadata, namespace: LOGIN_SUCCESS_EVENT)
               set_span_tags(span, user_attributes, namespace: "#{LOGIN_SUCCESS_EVENT}.usr")
-              span.set_tag('appsec.events.users.login.success.track', 'true')
-              span.set_tag('_dd.appsec.events.users.login.success.sdk', 'true')
+              span.set_tag("appsec.events.users.login.success.track", "true")
+              span.set_tag("_dd.appsec.events.users.login.success.sdk", "true")
 
               ::Datadog::AppSec::TraceKeeper.keep!(trace)
 
               record_event_telemetry_metric(LOGIN_SUCCESS_EVENT)
-              ::Datadog::AppSec::Instrumentation.gateway.push('appsec.events.user_lifecycle', LOGIN_SUCCESS_EVENT)
+              ::Datadog::AppSec::Instrumentation.gateway.push("appsec.events.user_lifecycle", LOGIN_SUCCESS_EVENT)
 
               return Kit::Identity.set_user(trace, span, **user_attributes) if user_attributes.key?(:id)
 
               # NOTE: This is a fallback for the case when we don't have an ID,
               #       but need to trigger WAF.
               user = ::Datadog::AppSec::Instrumentation::Gateway::User.new(nil, login)
-              ::Datadog::AppSec::Instrumentation.gateway.push('identity.set_user', user)
+              ::Datadog::AppSec::Instrumentation.gateway.push("identity.set_user", user)
             end
 
             # Attach user login failure information to the service entry span
@@ -99,30 +102,85 @@ module Datadog
 
               if trace.nil? || span.nil?
                 return Datadog.logger.warn(
-                  'Kit::AppSec: Tracing is not enabled. Please enable tracing if you want to track events'
+                  "Kit::AppSec: Tracing is not enabled. Please enable tracing if you want to track events"
                 )
               end
 
-              raise TypeError, '`login` argument must be a String' unless login.is_a?(String)
-              raise TypeError, '`metadata` argument must be a Hash' unless metadata.is_a?(Hash)
+              raise TypeError, "`login` argument must be a String" unless login.is_a?(String)
+              raise TypeError, "`metadata` argument must be a Hash" unless metadata.is_a?(Hash)
 
               unless user_exists.is_a?(TrueClass) || user_exists.is_a?(FalseClass)
-                raise TypeError, '`user_exists` argument must be a boolean'
+                raise TypeError, "`user_exists` argument must be a boolean"
               end
 
               set_span_tags(span, metadata, namespace: LOGIN_FAILURE_EVENT)
-              span.set_tag('appsec.events.users.login.failure.track', 'true')
-              span.set_tag('_dd.appsec.events.users.login.failure.sdk', 'true')
-              span.set_tag('appsec.events.users.login.failure.usr.login', login)
-              span.set_tag('appsec.events.users.login.failure.usr.exists', user_exists.to_s)
+              span.set_tag("appsec.events.users.login.failure.track", "true")
+              span.set_tag("_dd.appsec.events.users.login.failure.sdk", "true")
+              span.set_tag("appsec.events.users.login.failure.usr.login", login)
+              span.set_tag("appsec.events.users.login.failure.usr.exists", user_exists.to_s)
 
               ::Datadog::AppSec::TraceKeeper.keep!(trace)
 
               record_event_telemetry_metric(LOGIN_FAILURE_EVENT)
-              ::Datadog::AppSec::Instrumentation.gateway.push('appsec.events.user_lifecycle', LOGIN_FAILURE_EVENT)
+              ::Datadog::AppSec::Instrumentation.gateway.push("appsec.events.user_lifecycle", LOGIN_FAILURE_EVENT)
 
               user = ::Datadog::AppSec::Instrumentation::Gateway::User.new(nil, login)
-              ::Datadog::AppSec::Instrumentation.gateway.push('identity.set_user', user)
+              ::Datadog::AppSec::Instrumentation.gateway.push("identity.set_user", user)
+            end
+
+            # Attach user signup information to the service entry span
+            # and trigger AppSec event processing.
+            #
+            # @param login [String] The user login (e.g., username or email).
+            # @param user_or_id [String, Hash<Symbol, String>] (optional) If a
+            #   String, considered as a user ID, if a Hash, considered as a user
+            #   attributes. The Hash must include `:id` as a key.
+            # @param metadata [Hash<Symbol, String>] Additional flat free-form
+            #   metadata to attach to the event.
+            #
+            # @example Login only
+            #   Datadog::Kit::AppSec::Events::V2.track_user_signup('alice@example.com')
+            #
+            # @example Login, user attributes, and metadata
+            #   Datadog::Kit::AppSec::Events::V2.track_user_signup(
+            #     'alice@example.com',
+            #     { id: 'user-123', email: 'alice@example.com', name: 'Alice' },
+            #     ip: '192.168.1.1', device: 'mobile', 'usr.country': 'US'
+            #   )
+            #
+            # @return [void]
+            def track_user_signup(login, user_or_id = nil, metadata = {})
+              trace = service_entry_trace
+              span = service_entry_span
+
+              if trace.nil? || span.nil?
+                return Datadog.logger.warn(
+                  "Kit::AppSec: Tracing is not enabled. Please enable tracing if you want to track events"
+                )
+              end
+
+              raise TypeError, "`login` argument must be a String" unless login.is_a?(String)
+              raise TypeError, "`metadata` argument must be a Hash" unless metadata.is_a?(Hash)
+
+              user_attributes = build_user_attributes(user_or_id, login)
+
+              set_span_tags(span, metadata, namespace: SIGNUP_EVENT)
+              set_span_tags(span, user_attributes, namespace: "#{SIGNUP_EVENT}.usr")
+              span.set_tag("appsec.events.users.signup.track", "true")
+              span.set_tag("_dd.appsec.events.users.signup.sdk", "true")
+
+              ::Datadog::AppSec::TraceKeeper.keep!(trace)
+
+              record_event_telemetry_metric(SIGNUP_EVENT)
+
+              if user_attributes.key?(:id)
+                Kit::Identity.set_user(trace, span, **user_attributes)
+              else
+                # NOTE: {Datadog::Kit::Identity.set_user} requires an ID,
+                #       but WAF can evaluate login alone
+                user = ::Datadog::AppSec::Instrumentation::Gateway::User.new(nil, login)
+                ::Datadog::AppSec::Instrumentation.gateway.push("identity.set_user", user)
+              end
             end
 
             private
@@ -144,7 +202,7 @@ module Datadog
             end
 
             def build_user_attributes(user_or_id, login)
-              raise TypeError, '`login` argument must be a String' unless login.is_a?(String)
+              raise TypeError, "`login` argument must be a String" unless login.is_a?(String)
 
               case user_or_id
               when nil
@@ -152,12 +210,12 @@ module Datadog
               when String
                 {login: login, id: user_or_id}
               when Hash
-                raise ArgumentError, 'missing required user key `:id`' unless user_or_id.key?(:id)
-                raise TypeError, 'user key `:id` must be a String' unless user_or_id[:id].is_a?(String)
+                raise ArgumentError, "missing required user key `:id`" unless user_or_id.key?(:id)
+                raise TypeError, "user key `:id` must be a String" unless user_or_id[:id].is_a?(String)
 
-                user_or_id.merge(login: login) #: {login: ::String, ?id: ::String?}
+                user_or_id.merge(login: login)
               else
-                raise TypeError, '`user_or_id` argument must be either String or Hash'
+                raise TypeError, "`user_or_id` argument must be either String or Hash"
               end
             end
 
@@ -177,7 +235,7 @@ module Datadog
 
               if telemetry.nil?
                 return Datadog.logger.debug(
-                  'Kit::AppSec: Telemetry component is unavailable. Skip recording SDK metrics'
+                  "Kit::AppSec: Telemetry component is unavailable. Skip recording SDK metrics"
                 )
               end
 

data/lib/datadog/kit/appsec/events.rb

@@ -1,17 +1,17 @@
 # frozen_string_literal: true
 
-require_relative '../identity'
-require_relative '../../appsec/trace_keeper'
+require_relative "../identity"
+require_relative "../../appsec/trace_keeper"
 
 module Datadog
   module Kit
     module AppSec
       # Tracking events
       module Events
-        LOGIN_SUCCESS_EVENT = 'users.login.success'
-        LOGIN_FAILURE_EVENT = 'users.login.failure'
-        SIGNUP_EVENT = 'users.signup'
-        USER_LOGIN_KEYS = ['usr.login', :"usr.login"].freeze
+        LOGIN_SUCCESS_EVENT = "users.login.success"
+        LOGIN_FAILURE_EVENT = "users.login.failure"
+        SIGNUP_EVENT = "users.signup"
+        USER_LOGIN_KEYS = ["usr.login", :"usr.login"].freeze
 
         class << self
           # Attach login success event information to the trace
@@ -29,12 +29,12 @@ module Datadog
           # @param others [Hash<String || Symbol, String>] Additional free-form
           #   event information to attach to the trace.
           def track_login_success(trace = nil, span = nil, user:, **others)
-            set_trace_and_span_context('track_login_success', trace, span) do |active_trace, active_span|
+            set_trace_and_span_context("track_login_success", trace, span) do |active_trace, active_span|
               user_options = user.dup
               user_id = user_options.delete(:id)
-              user_login = user_options[:login] || others[:"usr.login"] || others['usr.login'] || user_id
+              user_login = user_options[:login] || others[:"usr.login"] || others["usr.login"] || user_id
 
-              raise ArgumentError, 'missing required key: :user => { :id }' if user_id.nil?
+              raise ArgumentError, "missing required key: :user => { :id }" if user_id.nil?
 
               others = others.reject { |key, _| USER_LOGIN_KEYS.include?(key) }
               others[:"usr.login"] = user_login
@@ -60,12 +60,12 @@ module Datadog
           # @param others [Hash<String || Symbol, String>] Additional free-form
           #   event information to attach to the trace.
           def track_login_failure(trace = nil, span = nil, user_exists:, user_id: nil, **others)
-            set_trace_and_span_context('track_login_failure', trace, span) do |active_trace, active_span|
-              others[:"usr.login"] = user_id if user_id && !others.key?(:"usr.login") && !others.key?('usr.login')
+            set_trace_and_span_context("track_login_failure", trace, span) do |active_trace, active_span|
+              others[:"usr.login"] = user_id if user_id && !others.key?(:"usr.login") && !others.key?("usr.login")
               track(LOGIN_FAILURE_EVENT, active_trace, active_span, **others)
 
-              active_span.set_tag('appsec.events.users.login.failure.usr.id', user_id) if user_id
-              active_span.set_tag('appsec.events.users.login.failure.usr.exists', user_exists)
+              active_span.set_tag("appsec.events.users.login.failure.usr.id", user_id) if user_id
+              active_span.set_tag("appsec.events.users.login.failure.usr.exists", user_exists)
             end
           end
 
@@ -84,12 +84,12 @@ module Datadog
           # @param others [Hash<String || Symbol, String>] Additional free-form
           #   event information to attach to the trace.
           def track_signup(trace = nil, span = nil, user:, **others)
-            set_trace_and_span_context('track_signup', trace, span) do |active_trace, active_span|
+            set_trace_and_span_context("track_signup", trace, span) do |active_trace, active_span|
               user_options = user.dup
               user_id = user_options.delete(:id)
-              user_login = user_options[:login] || others[:"usr.login"] || others['usr.login'] || user_id
+              user_login = user_options[:login] || others[:"usr.login"] || others["usr.login"] || user_id
 
-              raise ArgumentError, 'missing required key: :user => { :id }' if user_id.nil?
+              raise ArgumentError, "missing required key: :user => { :id }" if user_id.nil?
 
               others = others.reject { |key, _| USER_LOGIN_KEYS.include?(key) }
               others[:"usr.login"] = user_login
@@ -118,23 +118,23 @@ module Datadog
             if trace && span
               check_trace_span_integrity(trace, span)
 
-              span.set_tag("appsec.events.#{event}.track", 'true')
-              span.set_tag("_dd.appsec.events.#{event}.sdk", 'true')
+              span.set_tag("appsec.events.#{event}.track", "true")
+              span.set_tag("_dd.appsec.events.#{event}.sdk", "true")
 
               others.each do |k, v|
-                raise ArgumentError, 'key cannot be :track' if k.to_sym == :track
+                raise ArgumentError, "key cannot be :track" if k.to_sym == :track
 
                 span.set_tag("appsec.events.#{event}.#{k}", v) unless v.nil?
               end
 
               ::Datadog::AppSec::TraceKeeper.keep!(trace)
             else
-              set_trace_and_span_context('track', trace, span) do |active_trace, active_span|
-                active_span.set_tag("appsec.events.#{event}.track", 'true')
-                active_span.set_tag("_dd.appsec.events.#{event}.sdk", 'true')
+              set_trace_and_span_context("track", trace, span) do |active_trace, active_span|
+                active_span.set_tag("appsec.events.#{event}.track", "true")
+                active_span.set_tag("_dd.appsec.events.#{event}.sdk", "true")
 
                 others.each do |k, v|
-                  raise ArgumentError, 'key cannot be :track' if k.to_sym == :track
+                  raise ArgumentError, "key cannot be :track" if k.to_sym == :track
 
                   active_span.set_tag("appsec.events.#{event}.#{k}", v) unless v.nil?
                 end
@@ -143,7 +143,7 @@ module Datadog
               end
             end
 
-            ::Datadog::AppSec::Instrumentation.gateway.push('appsec.events.user_lifecycle', event)
+            ::Datadog::AppSec::Instrumentation.gateway.push("appsec.events.user_lifecycle", event)
           end
 
           private
@@ -160,7 +160,7 @@ module Datadog
             unless trace && span
               Datadog.logger.debug(
                 "Tracing not enabled. Method ##{method} is a no-op. Please enable tracing if you want ##{method}" \
-                ' to track this events'
+                " to track this events"
               )
               return
             end

data/lib/datadog/kit/enable_core_dumps.rb

@@ -11,9 +11,9 @@ module Datadog
         current_size, maximum_size = Process.getrlimit(:CORE)
         core_pattern =
           begin
-            File.read('/proc/sys/kernel/core_pattern').strip
+            File.read("/proc/sys/kernel/core_pattern").strip
           rescue
-            '(Could not open /proc/sys/kernel/core_pattern)'
+            "(Could not open /proc/sys/kernel/core_pattern)"
           end
 
         enabled_status = "Maximum size: #{maximum_size} Output pattern: '#{core_pattern}'"

data/lib/datadog/kit/identity.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative '../appsec/instrumentation/gateway/argument'
+require_relative "../appsec/instrumentation/gateway/argument"
 
 module Datadog
   module Kit
@@ -39,39 +39,39 @@ module Datadog
         def set_user(
           trace = nil, span = nil, id:, email: nil, name: nil, session_id: nil, role: nil, scope: nil, **others
         )
-          raise ArgumentError, 'missing required key: :id' if id.nil?
+          raise ArgumentError, "missing required key: :id" if id.nil?
 
           # enforce types
 
-          raise TypeError, ':id must be a String' unless id.is_a?(String)
-          raise TypeError, ':email must be a String' unless email.nil? || email.is_a?(String)
-          raise TypeError, ':name must be a String' unless name.nil? || name.is_a?(String)
-          raise TypeError, ':session_id must be a String' unless session_id.nil? || session_id.is_a?(String)
-          raise TypeError, ':role must be a String' unless role.nil? || role.is_a?(String)
-          raise TypeError, ':scope must be a String' unless scope.nil? || scope.is_a?(String)
+          raise TypeError, ":id must be a String" unless id.is_a?(String)
+          raise TypeError, ":email must be a String" unless email.nil? || email.is_a?(String)
+          raise TypeError, ":name must be a String" unless name.nil? || name.is_a?(String)
+          raise TypeError, ":session_id must be a String" unless session_id.nil? || session_id.is_a?(String)
+          raise TypeError, ":role must be a String" unless role.nil? || role.is_a?(String)
+          raise TypeError, ":scope must be a String" unless scope.nil? || scope.is_a?(String)
 
           others.each do |k, v|
             raise TypeError, "#{k.inspect} must be a String" unless v.nil? || v.is_a?(String)
           end
 
-          set_trace_and_span_context('set_user', trace, span) do |_active_trace, active_span|
+          set_trace_and_span_context("set_user", trace, span) do |_active_trace, active_span|
             # set tags once data is known consistent
-            active_span.set_tag('usr.id', id)
-            active_span.set_tag('usr.email', email) unless email.nil?
-            active_span.set_tag('usr.name', name) unless name.nil?
-            active_span.set_tag('usr.session_id', session_id) unless session_id.nil?
-            active_span.set_tag('usr.role', role) unless role.nil?
-            active_span.set_tag('usr.scope', scope) unless scope.nil?
+            active_span.set_tag("usr.id", id)
+            active_span.set_tag("usr.email", email) unless email.nil?
+            active_span.set_tag("usr.name", name) unless name.nil?
+            active_span.set_tag("usr.session_id", session_id) unless session_id.nil?
+            active_span.set_tag("usr.role", role) unless role.nil?
+            active_span.set_tag("usr.scope", scope) unless scope.nil?
 
             others.each do |k, v|
               active_span.set_tag("usr.#{k}", v) unless v.nil?
             end
 
             if Datadog::AppSec.active_context
-              active_span.set_tag('_dd.appsec.user.collection_mode', 'sdk')
+              active_span.set_tag("_dd.appsec.user.collection_mode", "sdk")
 
               user = ::Datadog::AppSec::Instrumentation::Gateway::User.new(id, others[:login], session_id)
-              ::Datadog::AppSec::Instrumentation.gateway.push('identity.set_user', user)
+              ::Datadog::AppSec::Instrumentation.gateway.push("identity.set_user", user)
             end
           end
         end
@@ -96,7 +96,7 @@ module Datadog
           unless trace && span
             Datadog.logger.debug(
               "Tracing not enabled. Method ##{method} is a no-op. Please enable tracing if you want ##{method}" \
-              ' to track this events'
+              " to track this events"
             )
             return
           end

data/lib/datadog/kit/tracing/method_tracer.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 # Needed since this file can be loaded without core
-require_relative '../../ruby_version'
+require_relative "../../ruby_version"
 
 module Datadog
   module Kit
@@ -56,8 +56,8 @@ module Datadog
           # @param dynamic [Boolean] if true, skip method existence check (for method_missing-handled methods)
           # @return [void]
           def trace_method(mod, method_name, span_name: nil, dynamic: false)
-            raise ArgumentError, 'mod is not a module' unless mod.is_a?(Module)
-            raise ArgumentError, 'ambiguous span name: provide one or define mod.name' if mod.name.nil? && span_name.nil?
+            raise ArgumentError, "mod is not a module" unless mod.is_a?(Module)
+            raise ArgumentError, "ambiguous span name: provide one or define mod.name" if mod.name.nil? && span_name.nil?
 
             is_private = mod.private_method_defined?(method_name)
             is_protected = mod.protected_method_defined?(method_name)
@@ -72,19 +72,19 @@ module Datadog
             span_name ||= hook_point
 
             unless span_name.is_a?(String)
-              raise ArgumentError, 'span name is not a String'
+              raise ArgumentError, "span name is not a String"
             end
 
-            args = RubyVersion.is?('>= 2.7') ? '...' : '*args, &block'
+            args = RubyVersion.is?(">= 2.7") ? "..." : "*args, &block"
 
             hook_module = Module.new do
               define_singleton_method(:inspect) do
-                suffix = custom_span_name ? ", #{custom_span_name.inspect}" : ''
+                suffix = custom_span_name ? ", #{custom_span_name.inspect}" : ""
                 name || "#<Datadog::Tracing::Kit::MethodTracer(#{method_name.inspect}#{suffix})>"
               end
 
               define_singleton_method(:to_s) do
-                suffix = custom_span_name ? ", #{custom_span_name.inspect}" : ''
+                suffix = custom_span_name ? ", #{custom_span_name.inspect}" : ""
                 name || "#<Datadog::Tracing::Kit::MethodTracer(#{method_name.inspect}#{suffix})>"
               end
 

data/lib/datadog/kit.rb

@@ -8,4 +8,4 @@ module Datadog
   end
 end
 
-require_relative 'kit/identity'
+require_relative "kit/identity"

data/lib/datadog/open_feature/component.rb

@@ -1,32 +1,36 @@
 # frozen_string_literal: true
 
-require_relative 'transport'
-require_relative 'evaluation_engine'
-require_relative 'exposures/buffer'
-require_relative 'exposures/worker'
-require_relative 'exposures/deduplicator'
-require_relative 'exposures/reporter'
-require_relative 'metrics/flag_eval_metrics'
+require_relative "transport"
+require_relative "evaluation_engine"
+require_relative "exposures/buffer"
+require_relative "exposures/worker"
+require_relative "exposures/deduplicator"
+require_relative "exposures/reporter"
+require_relative "metrics/flag_eval_metrics"
+require_relative "flag_evaluation/writer"
+require_relative "hooks/flag_eval_metrics_hook"
+require_relative "hooks/flag_eval_evp_hook"
+require_relative "hooks/span_enrichment_hook"
 
 module Datadog
   module OpenFeature
     # This class is the entry point for the OpenFeature component
     class Component
-      attr_reader :engine, :flag_eval_hook
+      attr_reader :engine, :flag_eval_metrics_hook, :flag_eval_evp_hook, :span_enrichment_hook
 
       def self.build(settings, agent_settings, logger:, telemetry:)
         return unless settings.respond_to?(:open_feature) && settings.open_feature.enabled
 
         unless settings.respond_to?(:remote) && settings.remote.enabled
-          message = 'OpenFeature could not be enabled as Remote Configuration is currently disabled. ' \
-            'To enable Remote Configuration, see https://docs.datadoghq.com/remote_configuration/.'
+          message = "OpenFeature could not be enabled as Remote Configuration is currently disabled. " \
+            "To enable Remote Configuration, see https://docs.datadoghq.com/remote_configuration/."
 
           logger.warn(message)
           return
         end
 
-        if RUBY_ENGINE != 'ruby'
-          message = 'OpenFeature could not be enabled as MRI is required, ' \
+        if RUBY_ENGINE != "ruby"
+          message = "OpenFeature could not be enabled as MRI is required, " \
             "but running on #{RUBY_ENGINE.inspect}"
 
           logger.warn(message)
@@ -34,9 +38,9 @@ module Datadog
         end
 
         if (libdatadog_api_failure = Core::LIBDATADOG_API_FAILURE)
-          message = 'OpenFeature could not be enabled as `libdatadog` is not loaded: ' \
+          message = "OpenFeature could not be enabled as `libdatadog` is not loaded: " \
             "#{libdatadog_api_failure.inspect}. For help solving this issue, " \
-            'please contact Datadog support at https://docs.datadoghq.com/help/.'
+            "please contact Datadog support at https://docs.datadoghq.com/help/."
 
           logger.warn(message)
           return
@@ -54,23 +58,51 @@ module Datadog
 
         @telemetry = telemetry
         @logger = logger
-        @flag_eval_hook = create_flag_eval_hook
+        @settings = settings
+        @agent_settings = agent_settings
+        @flag_eval_metrics_hook = create_flag_eval_metrics_hook
+        @flag_eval_evp_hook = create_flag_eval_evp_hook
+        @span_enrichment_hook = create_span_enrichment_hook
       end
 
       def shutdown!
         @worker.graceful_shutdown
+        @flag_eval_evp_writer&.stop
+        # Symmetric teardown: drop any accumulated span-enrichment state and
+        # subscriptions (Ruby CLAUDE.md mandates closing resources).
+        @span_enrichment_hook&.shutdown
       end
 
       private
 
-      def create_flag_eval_hook
-        require_relative 'hooks/flag_eval_hook'
-        return unless Hooks::FlagEvalHook.available?
+      def create_flag_eval_metrics_hook
+        return unless Hooks::FlagEvalMetricsHook.available?
 
         metrics = Metrics::FlagEvalMetrics.new(telemetry: @telemetry, logger: @logger)
-        Hooks::FlagEvalHook.new(metrics)
-      rescue LoadError
-        nil
+        Hooks::FlagEvalMetricsHook.new(metrics)
+      end
+
+      # Killswitch: DD_FLAGGING_EVALUATION_COUNTS_ENABLED (default on) gates only the EVP path.
+      # Read through the datadog config registry, not raw ENV.
+      def create_flag_eval_evp_hook
+        return unless @settings.open_feature.evaluation_counts_enabled
+        return unless Hooks::FlagEvalEVPHook.available?
+
+        evp_transport = Transport::HTTP.build_flagevaluations(
+          agent_settings: @agent_settings,
+          logger: @logger,
+        )
+        @flag_eval_evp_writer = FlagEvaluation::Writer.new(transport: evp_transport, logger: @logger, telemetry: @telemetry)
+        Hooks::FlagEvalEVPHook.new(@flag_eval_evp_writer)
+      end
+
+      # Construct the span-enrichment hook only when the opt-in gate is on, so
+      # there is no idle per-span overhead when disabled.
+      def create_span_enrichment_hook
+        return unless @settings.open_feature.span_enrichment_enabled
+
+        store = Hooks::SpanEnrichmentHook::SpanEnrichmentStateStore.new
+        Hooks::SpanEnrichmentHook.new(store, logger: @logger)
       end
     end
   end

data/lib/datadog/open_feature/configuration.rb

@@ -17,9 +17,30 @@ module Datadog
             settings :open_feature do
               option :enabled do |o|
                 o.type :bool
-                o.env 'DD_EXPERIMENTAL_FLAGGING_PROVIDER_ENABLED'
+                o.env "DD_EXPERIMENTAL_FLAGGING_PROVIDER_ENABLED"
                 o.default false
               end
+
+              # Opt-in gate for APM feature-flag span enrichment. When enabled,
+              # the provider attaches `ffe_*` tags to the local root APM span on
+              # finish. Distinct from `:enabled` (the provider gate) and off by
+              # default so it can be rolled out independently.
+              #
+              # TODO: benchmark the per-span-finish overhead on a high-span-count
+              # trace with this gate on before enabling it by default.
+              option :span_enrichment_enabled do |o|
+                o.type :bool
+                o.env "DD_EXPERIMENTAL_FLAGGING_PROVIDER_SPAN_ENRICHMENT_ENABLED"
+                o.default false
+              end
+
+              # Killswitch for the EVP `flagevaluation` emission path only. Default on; when
+              # disabled the existing OTel `feature_flag.evaluations` metric is unaffected.
+              option :evaluation_counts_enabled do |o|
+                o.type :bool
+                o.env "DD_FLAGGING_EVALUATION_COUNTS_ENABLED"
+                o.default true
+              end
             end
           end
         end