Report effective AppSec state in app-started telemetry

[jandro996]

What Does This Do

• TelemetryRequest.writeProducts() reads ActiveSubsystems.APPSEC_ACTIVE for products.appsec.enabled in app-started, instead of getAppSecActivation() != FULLY_DISABLED.
• appStartedMustIncludeActivatedProductsInfo now varies both the AppSec config and the active state, and shows that only the active state is reported (inactive + not active -> false, inactive + activated by RC -> true, enabled + startup failed -> false).
• TelemetryServiceTest pins APPSEC_ACTIVE to false per test, and TestTelemetryRouter.products() defaults appsec to false.

Motivation

With the default DD_APPSEC_ENABLED (inactive), app-started reported appsec.enabled=true while AppSec was not active.
When remote config is enabled, AppSecSystem.setActive(false) queues an app-product-change that is sent right after app-started. But no correction is ever sent when AppSec never reaches setActive:

• remote config disabled and DD_APPSEC_ENABLED unset (AppSec is not started at all),
• startup aborted with AbortStartupException (e.g. user rules file fails to load),
• reflection / class loading failure when starting AppSec.

In those cases apm_tables.asm_enabled stayed true. AppSec starts before telemetry on the same thread (Agent.InstallDatadogTracerCallback.execute), so APPSEC_ACTIVE already holds the effective state when app-started is built. This matches the .NET tracer and the Python fix (DataDog/dd-trace-py#20674).

Additional Notes

• Behavior change: services in the default inactive mode now report appsec: false at startup until remote config activates AppSec. system-tests Test_ProductsDisabled uses DD_APPSEC_ENABLED=false and is not affected.
• Tests: ./gradlew :telemetry:test (269 tests, 0 failures), :telemetry:spotlessCheck passes.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Once approved, use merge queue to merge the PR

Jira ticket: APPSEC-70505

[datadog-datadog-prod-us1-2]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 58.69% (-1.13%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 7316f0f | Docs | Give us feedback!}

[dd-octo-sts]

🟡 Java Benchmark SLOs — Performance SLO warning (near threshold)

Suite	Status
Startup	🟡 warning

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.88 s	13.91 s	[-0.9%; +0.5%] (no difference)
startup:insecure-bank:tracing:Agent	12.84 s	12.92 s	[-1.2%; +0.1%] (no difference)
startup:petclinic:appsec:Agent	17.81 s	17.73 s	[-0.7%; +1.5%] (no difference)
startup:petclinic:iast:Agent	17.48 s	17.66 s	[-1.9%; -0.2%] (maybe better)
startup:petclinic:profiling:Agent	17.42 s	17.53 s	[-1.8%; +0.6%] (no difference)
startup:petclinic:sca:Agent	17.76 s	17.71 s	[-0.6%; +1.2%] (no difference)
startup:petclinic:tracing:Agent	16.62 s	16.80 s	[-2.3%; +0.1%] (no difference)

Commit: 7316f0ff · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[jandro996]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T09:55:32.709042Z	7316f0f	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-16T09:55:57.658303Z	7316f0f	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 7316f0ffa0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 7316f0ffa0

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[datadog-datadog-prod-us1-2]

More details

Startup telemetry reflects AppSec’s effective activation state, including inactive configurations and startup failures, while preserving subsequent remote-config updates.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 7316f0f}

[dd-octo-sts]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-10-19 12:57:40 UTC ℹ️ Start processing command /merge

---

2026-10-19 12:57:45 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

---

2026-10-19 14:01:42 UTC ℹ️ MergeQueue: This merge request was merged