[vjfridge]

Motivation

FFL-3020: evaluation payloads can reach intake while SDK identity is lost during Agent forwarding. Existing direct Agentless checks do not cover that path.

Changes

Add a dedicated Agent-backed test that checks the exact SDK producer and raw tracer version on Agent-to-intake captures while retaining the existing payload, variant/allocation, and evaluation-count assertions. Reject event-level source in the shared flagevaluation contract.

Reuse the identity helper for direct Agentless requests and include PHP in the producer mapping. Gate the new case at Agent 7.84.0+, Go 2.11.0+, and Python 4.16.0+. Enable the validated Python identity case in this PR; other language exclusions remain unchanged. Broader activation and #8093's harness repairs remain separate follow-ups.

Validation

The new identity case passed for every target below through Agent 7.84.2. The broader Agent-routed FFE suite was forced to execute disabled cases; the matrix does not establish Agentless coverage. This PR now enables the Python identity case at 4.16.0; other disabled cases remain excluded.

SDK/build	Identity case	Full selected FFE suite
Go 2.11.0	Passed	52 passed
Node.js 6.20.0	Passed	50 passed, 2 failed
Node.js 5.131.0	Passed	50 passed, 2 failed
Python 4.16.0	Passed	51 passed, 1 failed
Ruby 2.43.0	Passed	52 passed
Java 1.68.0-SNAPSHOT~54903d776d	Passed	50 passed, 2 failed
.NET merged support for 3.57.0, reporting 3.56.0	Passed	51 passed, 1 failed
PHP merged support for 1.27.0, reporting 1.26.0	Passed	47 passed, 5 failed

Java, .NET, and PHP used development builds, not the unreleased target release artifacts. Broader failures involve existing SDK behavior, a deliberately excluded Python case, Java/.NET weblog context conversion, and PHP context/stress behavior; the identity case is green throughout. Additional .NET #9511 and libdatadog #2716 builds also passed identity. Combined runs with #8093 validated the separate harness and SDK fixes; they are not results for this PR alone.

• Live captures contain the expected producer and exact version, account for all five identity evaluations, and omit event-level source.
• Scratch checks using real captures reject removed identity headers, duplicate headers, forbidden source, and missing captures. Split-batch checks reject a missing header on the second batch.
• After restoring the self-test file to base: 49 existing FFE assertion/manifest checks passed; ./format.sh --check passed. The SDK matrix predates the self-test removal and parameter rename. After the rename, the saved Python 4.16.0 live capture passes the identity test again; manifest checks confirm 4.16.0+ is enabled while earlier Python and Agent versions remain gated.
• Gate evidence: Agent 7.84.0 header allowlist and Go 2.11.0 EVP sender.

CI investigation

The earlier Go dev uds-echo Sidecar failure exposes an existing teardown-wait race: a flagevaluation event from the exposure test satisfies the path-only wait before the flagevaluation test's own events arrive. The captured event belongs to exposure-egress-user, while the failing test expects evp-egress-user. Base and head both reject the same CI capture; the wait implementation is unchanged by this PR. This is capture replay and source analysis, not a fresh live base run. Waiting for the expected events/count is a separate harness fix; a retry alone does not fix the race.

FFE reviewer selection

Reviewers: @leoromanovsky, @sameerank

Why: Flag evaluation on EVP — The PR adds system tests for flag evaluation telemetry sent over EVP through the Agent. Reviewers come from the matched pod.

_{🤖 Automated selection.}

Selection details

Initiative: project / flag-evaluation-evp

Why this match: The PR adds system tests for flag evaluation telemetry sent over EVP through the Agent. A new test checks that SDK identity (the DD-EVP-ORIGIN producer and DD-EVP-ORIGIN-VERSION headers) survives Agent-to-intake forwarding, while keeping the existing payload, variant/allocation and evaluation-count assertions. The direct Agentless path now uses a shared identity helper, and the producer mapping gains PHP. The manifests gate the new case to Agent 7.84.0+, Go 2.11.0+ and Python 4.16.0+. This is about delivering EVP evaluation events and their SDK metadata, which fits flag-evaluation-evp. It is not generic deployment-mode transport or onboarding diagnostics. The catalog has no supplemental_review entries, so no additional review areas apply.

• @leoromanovsky — primary (flag-evaluation-evp): Matched pod member. Existing review coverage preserved.
• @sameerank — floating (flag-evaluation-evp): Coverage and knowledge sharing. Existing review coverage preserved.

The PR author was excluded. Existing reviewers and teams were preserved.

Debug or fix a problem

Workflow run · Bits Code session

• Wrong project or pod? Clarify this PR’s purpose, or correct the reviewer registry and publish the change. Sheet edits take effect after publication.
• Need another reviewer now? Request them in GitHub. This workflow only adds requests and keeps existing reviewers.
• Stuck beyond five minutes or failed? Inspect the run’s failed step and available Bits session. After fixing the cause, rerun the workflow with this PR URL and dry_run=false. Unchanged completed runs are skipped. If the receipt says needs_reconciliation or a write outcome is uncertain, ask the workflow owner to reconcile GitHub and the receipt before retrying; do not delete the lock blindly.
• Report a problem: Comment on the reviewer-routing skill PR with this PR URL, the workflow run link, and the expected initiative or reviewer correction.

Evidence and run details

✅ Complete — reviewer coverage verified. The workflow checked pending requests or submitted reviews on the evaluated head.

Generated asynchronously by the FFE reviewer-routing workflow.

Changed paths: tests/ffe/test_flag_eval_evp.py, tests/ffe/utils/evp.py, tests/ffe/README.md, manifests/agent.yml, manifests/golang.yml, manifests/python.yml

Evaluated head: 9928edbb9276b209bfe2274d1df17b35092c55c3

Registry revision: revision:1946aa2a-530e-487a-84a7-83aff44a1089

Pinned skill source: d214cfc65ae154b97d39af5cf32caf48aaec9bf0

Instructions: workflow-injected snapshot (no plugin loaded)

Instruction snapshot SHA-256: f23b2a88c13c0da90e2dd58246a14f257af91e2195c555039bd555b52e6f3516

[github-actions]

CODEOWNERS have been resolved as:

manifests/agent.yml                                                     @DataDog/system-tests-reviewers
manifests/golang.yml                                                    @DataDog/system-tests-reviewers
manifests/python.yml                                                    @DataDog/system-tests-reviewers
tests/ffe/README.md                                                     @DataDog/feature-flagging-and-experimentation-sdk
tests/ffe/test_flag_eval_evp.py                                         @DataDog/feature-flagging-and-experimentation-sdk
tests/ffe/utils/evp.py                                                  @DataDog/feature-flagging-and-experimentation-sdk

[datadog-official]

 

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: ca2caa7 | Docs | View more details | Give us feedback!}

[aarsilv]

Nice work! Approving with some lower-priority comments you can take or leave as you see fit 💪

RC has been addressed

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T20:40:08.122155Z	c04c6a8	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.