feat(openfeature): add agentless EVP fallback

[leoromanovsky]

Motivation

Python agentless Feature Flags must deliver exposure and flag-evaluation EVP payloads when no compatible local Agent EVP proxy route is available.

flowchart LR
  SDK["Python agentless Feature Flags"] --> Signals["Exposures + flag evaluations"]
  Signals --> Receiver["Local Agent or sidecar"]
  Receiver -->|"Compatible EVP route"| Intake["Event Platform intake"]
  Receiver -.->|"Discovery fails or route is absent"| Gap["No delivery path"]

Loading

Linear: FFL-1487

Changes

flowchart LR
  FirstFlush["First event flush"] --> Discover["Lazy /info discovery"]
  Discover -->|"v4 advertised"| V4["/evp_proxy/v4"]
  Discover -->|"v2 only"| V2["/evp_proxy/v2"]
  Discover -->|"Failure or no compatible route"| Direct["Direct intake + DD-API-KEY"]
  V4 --> Intake["Event Platform intake"]
  V2 --> Intake
  Direct --> Intake

Loading

• Add one lazy EVP route selector shared by exposure and flag-evaluation writers.
• Probe Agent /info on the first event flush, preferring EVP v4 and then v2 before selecting direct intake.
• Send direct-intake requests with DD-API-KEY and honor HTTPS proxy and NO_PROXY configuration.
• Validate DD_SITE as a bounded ASCII DNS name and verify the exact direct-intake hostname before attaching credentials.
• Reset route discovery after fork.
• Cover discovery, authentication, failure classification, site validation, fork/reset behavior, and both writers.

Decisions

• Route discovery runs once per process and its result remains sticky until fork reset.
• Direct intake is available only for agentless Feature Flags with an API key and a valid site.
• A definitive local rejection or refusal replays the current batch directly.
• An ambiguous local I/O failure switches only later batches to direct intake; the current batch is not retried or replayed.
• HTTP 429 and 5xx responses do not change the selected route.

Validation

The Python agentless system-test definition and enablement are in DataDog/system-tests#7592.

Ran the agentless direct exposure test against the freshly built branch artifact:

TEST_LIBRARY=python ./run.sh FEATURE_FLAGGING_AND_EXPERIMENTATION_AGENTLESS_DIRECT -F tests/ffe/test_exposure_egress.py::Test_FFE_Exposure_Egress_Agentless_Direct

The system test exercised config delivery and evaluation, then verified /api/v2/exposures used direct intake with the expected host, response status, API-key header, and route exclusion. The recorded local run covered the direct exposure row; it did not cover the sidecar or flag-evaluation rows.

[datadog-prod-us1-3]

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: cf3e0e2 | Docs | View more details | Give us feedback!}

[cit-pr-commenter-54b7da]

Dependency direction analysis

⚠️ Existing dependency direction violations

There are 240 dependency direction violations that already exist on the base branch and have not been changed by this PR.

Show existing violations (showing 5 of 240 highest severity)

ddtrace.internal.tracemethods -×-> ddtrace.trace  (internal-core -> product:tracing, score=135)
ddtrace.llmobs._integrations.crewai -×-> ddtrace.trace  (product:llmobs -> product:tracing, score=133)
ddtrace.llmobs._integrations.claude_agent_sdk -×-> ddtrace.trace  (product:llmobs -> product:tracing, score=133)
ddtrace.llmobs._integrations.bedrock -×-> ddtrace.trace  (product:llmobs -> product:tracing, score=133)
ddtrace.llmobs._integrations.llama_index -×-> ddtrace.trace  (product:llmobs -> product:tracing, score=133)

To see all violations, download the layers-base.json and layers-pr.json artifacts from this CI job and run:

uv run --script scripts/import-analysis/layers.py compare layers-base.json layers-pr.json

[cit-pr-commenter-54b7da]

Codeowners resolved as

Resolved from the full PR diff against main using the target branch CODEOWNERS file.
CODEOWNERS team requests not listed below are not required by the current file set.

ddtrace/internal/openfeature/_evp_transport.py                          @DataDog/feature-flagging-and-experimentation-sdk
ddtrace/internal/openfeature/_flagevaluation_writer.py                  @DataDog/feature-flagging-and-experimentation-sdk
ddtrace/internal/openfeature/_provider.py                               @DataDog/feature-flagging-and-experimentation-sdk
ddtrace/internal/openfeature/writer.py                                  @DataDog/feature-flagging-and-experimentation-sdk
ddtrace/internal/settings/_supported_configurations.py                  @DataDog/apm-python
releasenotes/notes/openfeature-agentless-evp-fallback-a9d7c4e2f1b60358.yaml  @DataDog/apm-python
supported-configurations.json                                           @DataDog/apm-python
tests/openfeature/test_evp_transport.py                                 @DataDog/feature-flagging-and-experimentation-sdk
tests/openfeature/test_exposure_writer.py                               @DataDog/feature-flagging-and-experimentation-sdk
tests/openfeature/test_flagevaluation_writer.py                         @DataDog/feature-flagging-and-experimentation-sdk

[cit-pr-commenter-54b7da]

Circular import analysis

⚠️ Existing circular imports

There are 3 circular imports that already exist on the base branch and have not been changed by this PR.

ddtrace.errortracking._handled_exceptions.bytecode_injector -> ddtrace.errortracking._handled_exceptions.callbacks -> ddtrace.errortracking._handled_exceptions.collector -> ddtrace.errortracking._handled_exceptions.bytecode_reporting -> ddtrace.errortracking._handled_exceptions.bytecode_injector
ddtrace.llmobs -> ddtrace.llmobs._evaluators -> ddtrace.llmobs._evaluators.format -> ddtrace.llmobs._experiment -> ddtrace.llmobs
ddtrace.appsec._asm_request_context -> ddtrace.appsec._iast._iast_request_context_base -> ddtrace.appsec._iast._iast_env -> ddtrace.appsec._iast.reporter -> ddtrace.appsec._exploit_prevention.stack_traces -> ddtrace.appsec._asm_request_context

[pr-commenter]

Benchmarks

Benchmark execution time: 2026-08-26 09:14:00

Comparing candidate commit 045318c in PR branch leo.romanovsky/ffe-agentless-evp-fallback-python with baseline commit 6ba690d in branch main.

📊 Benchmarking dashboard

Found 0 performance improvements and 9 performance regressions! Performance is the same for 577 metrics, 10 unstable metrics, 2 known flaky benchmarks, 16 flaky benchmarks without significant changes.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

• 🟩 = significantly better candidate vs. baseline
• 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

scenario:httppropagationextract-wsgi_valid_headers_all

• 🟥 execution_time [+400.123ns; +441.718ns] or [+7.361%; +8.127%]

scenario:httppropagationinject-ids_only

• 🟥 execution_time [+1.989µs; +2.105µs] or [+10.510%; +11.126%]

scenario:iastaspects-add_aspect

• 🟥 execution_time [+13.301µs; +16.798µs] or [+12.880%; +16.266%]

scenario:iastaspects-join_aspect

• 🟥 execution_time [+49.378µs; +53.634µs] or [+23.436%; +25.456%]

scenario:iastaspects-title_aspect

• 🟥 execution_time [+67.279µs; +74.422µs] or [+25.123%; +27.790%]

scenario:iastaspectsospath-ospathbasename_aspect

• 🟥 execution_time [+132.415µs; +138.226µs] or [+31.866%; +33.264%]

scenario:iastaspectssplit-rsplit_aspect

• 🟥 execution_time [+16.885µs; +21.888µs] or [+11.888%; +15.410%]

scenario:telemetryaddmetric-1-count-metric-1-times

• 🟥 execution_time [+440.670ns; +492.639ns] or [+16.420%; +18.357%]

scenario:tracer-small

• 🟥 execution_time [+27.982µs; +31.497µs] or [+8.594%; +9.674%]

Unstable benchmarks

These benchmarks have a confidence interval too wide to call a change; treat them as noise rather than signal.

scenario:coreapiscenario-context_with_data_listeners

• unstable execution_time [-703.554ns; +778.277ns] or [-6.369%; +7.046%]

scenario:coreapiscenario-core_dispatch_1_listener

• unstable execution_time [-30.993ns; +35.857ns] or [-5.086%; +5.884%]

scenario:coreapiscenario-core_dispatch_50_listeners

• unstable execution_time [-1710.815ns; +1622.787ns] or [-9.973%; +9.460%]

scenario:coreapiscenario-core_dispatch_exception_listeners

• unstable execution_time [-1227.987ns; +1251.155ns] or [-9.485%; +9.664%]

scenario:coreapiscenario-core_dispatch_listeners

• unstable execution_time [-345.281ns; +311.409ns] or [-9.359%; +8.441%]

scenario:coreapiscenario-core_dispatch_no_args_listeners

• unstable execution_time [-262.465ns; +245.522ns] or [-9.002%; +8.421%]

scenario:coreapiscenario-core_dispatch_with_results_1_listener

• unstable execution_time [-75.204ns; +72.226ns] or [-6.586%; +6.325%]

scenario:coreapiscenario-core_dispatch_with_results_50_listeners

• unstable execution_time [-4150.644ns; +3743.591ns] or [-10.242%; +9.237%]

scenario:coreapiscenario-core_dispatch_with_results_listeners

• unstable execution_time [-829.061ns; +747.487ns] or [-10.232%; +9.226%]

scenario:packagesupdateimporteddependencies-import_many_stdlib_cached

• unstable execution_time [-61.257µs; +56.979µs] or [-9.786%; +9.103%]

Known flaky benchmarks

These benchmarks are marked as flaky and will not trigger a failure. Modify FLAKY_BENCHMARKS_REGEX to control which benchmarks are marked as flaky.

scenario:iastaspects-ljust_noaspect

• 🟥 execution_time [+47.915µs; +52.414µs] or [+16.246%; +17.772%]

scenario:span-start

• 🟥 execution_time [+1.663ms; +1.793ms] or [+11.435%; +12.324%]

Known flaky benchmarks without significant changes:

• scenario:errortrackingflasksqli-baseline
• scenario:flasksimple-iast-get
• scenario:iastaspects-casefold_aspect
• scenario:iastaspects-casefold_noaspect
• scenario:iastaspects-index_aspect
• scenario:iastaspects-lower_aspect
• scenario:iastaspects-replace_aspect
• scenario:iastaspects-swapcase_aspect
• scenario:iastaspects-title_noaspect
• scenario:iastaspects-translate_aspect
• scenario:iastaspects-translate_noaspect
• scenario:iastaspects-upper_noaspect
• scenario:packagespackageforrootmodulemapping-cache_off
• scenario:packagespackageforrootmodulemapping-cache_on
• scenario:sethttpmeta-all-enabled
• scenario:telemetryaddmetric-record-100-metrics

[linear-code]

FFL-1482

FFL-1487