[PerfectSlayer]

What Does This Do

Resolves the Feature Flags settings in the agent like the dd-openfeature SDK does:

• Moves the Feature Flags settings to dd-trace-api and removes the feature-flagging-config module.
• Exposes the configuration source as an enum, parsed case insensitively without trimming, like the SDK.
• Adds ConfigurationResolutionParityTest, checking the agent and the SDK resolve enablement and source alike, including padded values.

Motivation

The agent and the SDK must agree on the configuration source (APMLP-1512). Done after the compatibility PR: released SDKs read the old settings class from the agent until they are guarded.

Additional Notes

Refactoring only for the agent settings; no change to the supported values.

Stack

The full change is in #12709. It was split into this stack to ease the review.

1. Resolve Feature Flags enablement from instrumenter config #12845 (merged)
2. Add dd-openfeature SDK flag configuration and evaluation core #12840 (merged)
3. Add dd-openfeature SDK settings and configuration delivery #12841 (merged)
4. Add dd-openfeature SDK exposure and flag evaluation pipelines #12842 (merged)
5. Add dd-openfeature SDK OpenFeature provider #12843 (merged)
6. Port master Feature Flags changes to the dd-openfeature SDK #12957 (merged)
7. Add the agent bridge for the dd-openfeature SDK #12975 (merged)
8. Connect the dd-openfeature SDK to the agent #12844
9. Keep released dd-openfeature SDKs working with the agent #12976
10. Resolve the Feature Flags settings like the SDK #12977 👈 this PR
11. Restore the agent Feature Flags behaviors through the bridge #12978
12. Add agentless and standalone OpenFeature smoke tests #12846

Jira ticket: APMLP-1512

🤖 Generated with Claude Code

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.93 s	13.91 s	[-0.6%; +0.8%] (no difference)
startup:insecure-bank:tracing:Agent	12.89 s	13.02 s	[-1.7%; -0.2%] (maybe better)
startup:petclinic:appsec:Agent	17.14 s	17.12 s	[-0.9%; +1.2%] (no difference)
startup:petclinic:iast:Agent	16.81 s	17.12 s	[-2.7%; -0.9%] (maybe better)
startup:petclinic:profiling:Agent	16.03 s	16.93 s	[-9.6%; -1.1%] (significantly better)
startup:petclinic:sca:Agent	17.12 s	17.01 s	[-0.3%; +1.6%] (no difference)
startup:petclinic:tracing:Agent	16.21 s	16.29 s	[-1.3%; +0.3%] (no difference)

Commit: cd834fda · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T11:39:35.160424Z	bbdf441	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-22T11:38:53.197456Z	bbdf441	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[datadog-datadog-prod-us1]

More details

The settings retain their existing keys and parsing behavior, and repository callers are consistently updated for the enum return type.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit bbdf441}

[sarahchen6]

Looks good!

[datadog-datadog-prod-us1]

The new event proxy can replay ambiguously delivered batches and permanently disable event delivery after failed startup discovery. Proxy origin metadata and Remote Configuration error acknowledgements also regress.

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 994142b}

---

Findings that could not be posted inline

products/feature-flagging/feature-flagging-lib/src/main/java/com/datadog/featureflag/EventProxy.java:81

[P2] Recover event delivery after failed startup discovery

If the Datadog Agent is unreachable during SDK initialization, discovery can return null clients, but resolved permanently caches that failure. JavaAgentBridge then returns no transport, and FeatureFlagsRuntime omits both event pipelines when direct fallback is unavailable. Agent recovery can restore flag configuration while event delivery remains disabled until runtime recreation. Recovery requires preserving a transport and retrying discovery, not merely resetting this flag.

React: 👍 useful · 👎 wrong · 😕 unclear · 👀 right, but not acting on it

What each reaction means

• 👍 Useful: correct, and you're fixing it or will.
• 👎 Wrong: the finding is incorrect, for example the bug can't happen or the code was misread.
• 😕 Unclear: you can't tell what it means or why it matters.
• 👀 Right, not acting: correct, but intended, out of scope for this PR, a known risk, or too minor.

_{🤖 Bits Code Review · Open Bits AI session}

products/feature-flagging/feature-flagging-lib/src/main/java/com/datadog/featureflag/RemoteConfigServiceImpl.java:44

[P2] Report rejected flag configurations as apply errors

For a malformed FFE_FLAGS document, this identity deserializer succeeds while the SDK's RemoteConfigurationService catches the parsing failure and returns normally. ProductState therefore reports APPLY_STATE_ACKNOWLEDGED although the SDK rejected the update and retained its previous configuration. The former parser propagated these failures as errors. Preserve a validation-error path through the SDK and bridge to the poller.

React: 👍 useful · 👎 wrong · 😕 unclear · 👀 right, but not acting on it

What each reaction means

• 👍 Useful: correct, and you're fixing it or will.
• 👎 Wrong: the finding is incorrect, for example the bug can't happen or the code was misread.
• 😕 Unclear: you can't tell what it means or why it matters.
• 👀 Right, not acting: correct, but intended, out of scope for this PR, a known risk, or too minor.

_{🤖 Bits Code Review · Open Bits AI session}

[PerfectSlayer]

[P2] Recover event delivery after failed startup discovery (EventProxy.java:81)

#12978 removes the cached discovery failure: the Remote Configuration route uses the fixed EVP v2 endpoint, and the agentless route without direct intake rediscovers the proxy at most once a minute. isAvailable() stays true when direct intake isn't available, so the SDK keeps both event pipelines.

[PerfectSlayer]

[P2] Report rejected flag configurations as apply errors (RemoteConfigServiceImpl.java:44)

#12978 reports them as apply errors again: the SDK RemoteConfigurationService rejects a malformed document by throwing instead of dropping it, and RemoteConfigServiceImpl.accept rethrows the first subscriber failure once every subscriber is notified, so the poller marks the FFE_FLAGS config as not applied. The bridge.v1 ConfigurationSource contract documents the rejection.