Add @ForegroundSafe/@BackgroundOnly declared-contract reachability check (J16) (AI perf review)

.agents/skills/apm-integrations/references/advice-class.md

@@ -23,7 +23,7 @@
 Enter method:
 1. `AgentSpan span = startSpan(DECORATE.operationName(), ...)`
 2. `DECORATE.afterStart(span)` + set domain-specific tags
-3. `AgentScope scope = activateSpan(span)` — return or store via `@Advice.Local`
+3. `ContextScope scope = activateSpan(span)` — return or store via `@Advice.Local`
 
 Exit method:
 4. `DECORATE.onError(span, throwable)` — only if throwable is non-null
@@ -39,10 +39,10 @@ The `onThrowable = Throwable.class` attribute on `@Advice.OnMethodExit` controls
 // Standard pattern — exit fires whether the target method returned or threw
 @Advice.OnMethodExit(onThrowable = Throwable.class, suppress = Throwable.class)
 public static void exit(
-    @Advice.Enter final AgentScope scope,
+    @Advice.Enter final ContextScope scope,
     @Advice.Thrown final Throwable thrown) {
   if (scope != null) {
-    AgentSpan span = scope.span();
+    AgentSpan span = spanFromScope(scope);
     DECORATE.onError(span, thrown);
     DECORATE.beforeFinish(span);
     scope.close();
@@ -147,7 +147,7 @@ if (span != null && routeMatch != null) {
 }
 ```
 
-For route-only enrichers: no `AgentScope`, no `startSpan()`, no `decorator.afterStart()`. This rule does NOT apply to standalone HTTP clients (which own their own span identity) or to handler-owning frameworks like JAX-RS / Ratpack (which legitimately create controller spans).
+For route-only enrichers: no `ContextScope`, no `startSpan()`, no `decorator.afterStart()`. This rule does NOT apply to standalone HTTP clients (which own their own span identity) or to handler-owning frameworks like JAX-RS / Ratpack (which legitimately create controller spans).
 
 ### Advice classes must not declare non-constant static fields
 

.github/CODEOWNERS

@@ -256,15 +256,14 @@
 /dd-trace-api/**/config/AppSecConfig*                                     @DataDog/asm-java
 **/*Rasp*                                                                 @DataDog/asm-java
 **/*Waf*                                                                  @DataDog/asm-java
-/dd-java-agent/instrumentation/**/appsec/                                 @DataDog/asm-java @DataDog/apm-idm-java
 /dd-java-agent/instrumentation/**/*CallSite*                              @DataDog/asm-java @DataDog/apm-idm-java
-/dd-java-agent/instrumentation/**/iast/                                   @DataDog/asm-java @DataDog/apm-idm-java
+/dd-java-agent/instrumentation/**/*appsec*                                @DataDog/asm-java @DataDog/apm-idm-java
+/dd-java-agent/instrumentation/**/*AppSec*                                @DataDog/asm-java @DataDog/apm-idm-java
+/dd-java-agent/instrumentation/**/*iast*                                  @DataDog/asm-java @DataDog/apm-idm-java
+/dd-java-agent/instrumentation/**/*rasp*                                  @DataDog/asm-java @DataDog/apm-idm-java
 /dd-java-agent/instrumentation/**/*Iast*                                  @DataDog/asm-java @DataDog/apm-idm-java
-/dd-java-agent/instrumentation/**/rasp/                                   @DataDog/asm-java @DataDog/apm-idm-java
 /dd-java-agent/instrumentation/**/*Rasp*                                  @DataDog/asm-java @DataDog/apm-idm-java
 /dd-java-agent/instrumentation/**/*Waf*                                   @DataDog/asm-java @DataDog/apm-idm-java
-/dd-java-agent/instrumentation/*iast*                                     @DataDog/asm-java @DataDog/apm-idm-java
-/dd-java-agent/instrumentation/*appsec*                                   @DataDog/asm-java @DataDog/apm-idm-java
 /dd-java-agent/instrumentation/beanshell-2.0/                             @DataDog/asm-java @DataDog/apm-idm-java
 /dd-java-agent/instrumentation/commons-fileupload-1.5/                    @DataDog/asm-java @DataDog/apm-idm-java
 /dd-java-agent/instrumentation/datadog/asm/                               @DataDog/asm-java @DataDog/apm-idm-java

.gitlab-ci.yml

@@ -5,7 +5,7 @@ include:
   - local: ".gitlab/ci-visibility-tests.yml"
   - project: 'DataDog/apm-reliability/apm-sdks-benchmarks'
     file: '.gitlab/ci-java-spring-petclinic-parallel.yml'
-    ref: &apm_sdks_benchmarks_sha '0899730be7696774b222937adfc6583932c050e1' # pinned by "Update apm-sdks-benchmarks reference" workflow
+    ref: &apm_sdks_benchmarks_sha '5e416ea523f39bbdf9e44f39e6895a07d3715ff5' # pinned by .github/workflows/update-apm-sdks-benchmarks-reference.yaml
   - project: 'DataDog/apm-reliability/apm-sdks-benchmarks'
     file: '.gitlab/ci-java-load-parallel.yml'
     ref: *apm_sdks_benchmarks_sha
@@ -47,8 +47,8 @@ stages:
 variables:
   APM_SDKS_BENCHMARKS_SHA: *apm_sdks_benchmarks_sha
   # Test the OpenTelemetry Operator-compatible Java image jobs from one-pipeline.
-  OTEL_OPERATOR_IMAGES_ENABLED: "true"
-  OTEL_OPERATOR_LANGUAGE: java
+  CI_OTEL_OPERATOR_IMAGES_ENABLED: "true"
+  CI_OTEL_OPERATOR_LANGUAGE: java
   # Gitlab runner features; see https://docs.gitlab.com/runner/configuration/feature-flags.html
   # Fold and time all script sections
   FF_SCRIPT_SECTIONS: 1

.gitlab/exploration-tests.yml

@@ -50,6 +50,7 @@ build-exploration-tests-image:
   tags: [ "arch:amd64"]
   image: $EXPLORATION_TESTS_IMAGE
   artifacts:
+    when: always
     paths:
       - "*_agent.log.gz"
       - "*_surefire-reports.tar.gz"
@@ -128,3 +129,18 @@ exploration-tests-method-okhttp:
     - sdk use java 17.0.10-tem
     - java -XshowSettings:system -version
     - ./run-exploration-tests.sh "method" "$PROJECT" "GRADLE_OPTS=-XX:ActiveProcessorCount=4 ./gradlew --max-workers 4 jvmTest -Dtest.java.version=11" "include_${PROJECT}.txt" "exclude_$PROJECT.txt"
+  after_script:
+    - cp /exploration-tests/${PROJECT}/agent.log ${PROJECT}_agent.log || true
+    - gzip ${PROJECT}_agent.log || true
+    - tar czf ${PROJECT}_debugger-dumps.tar.gz /tmp/debugger || true
+    - mkdir -p ${PROJECT}-test-results
+    - (cd /exploration-tests/${PROJECT} && find . -path "*/build/test-results/*/TEST-*.xml" -exec cp --parents {} $CI_PROJECT_DIR/${PROJECT}-test-results/ \;) || true
+  artifacts:
+    when: always
+    paths:
+      - "*_agent.log.gz"
+      - "*_debugger-dumps.tar.gz"
+      - "${PROJECT}-test-results/"
+    reports:
+      junit:
+        - "${PROJECT}-test-results/**/TEST-*.xml"

.gitlab/one-pipeline.locked.yml

@@ -1,4 +1,4 @@
 # DO NOT EDIT THIS FILE MANUALLY
 # This file is auto-generated by automation.
 include:
-  - remote: https://gitlab-templates.ddbuild.io/libdatadog/include/versions/1.5.1/one-pipeline.yml
+  - remote: https://gitlab-templates.ddbuild.io/libdatadog/include/versions/1.5.3/one-pipeline.yml

.gitlab/upload_ciapp.sh

@@ -78,9 +78,16 @@ junit_upload() {
         custom_tags_args+=(--tags "test.configuration.job_name:${job_base_name}")
     fi
 
-    DD_API_KEY=$1 \
+    # The commit message must contain the exact, case-sensitive token [ci: DEBUG_LOGS].
+    if [[ "${CI_COMMIT_MESSAGE:-}" == *"[ci: DEBUG_LOGS]"* ]]; then
+        DD_CIVISIBILITY_LOGS_ENABLED=true
+    fi
+    if [[ "${DD_CIVISIBILITY_LOGS_ENABLED:-false}" == "true" ]]; then
+        echo "Datadog JUnit log forwarding is enabled"
+    fi
+
+    DD_API_KEY=$1 DD_CIVISIBILITY_LOGS_ENABLED=${DD_CIVISIBILITY_LOGS_ENABLED:-false} \
         datadog-ci junit upload --service $SERVICE_NAME \
-        --logs \
         --tags "test.traits:{\"category\":[\"$CACHE_TYPE\"]}" \
         --tags "git.repository_url:https://github.com/DataDog/dd-trace-java" \
         "${custom_tags_args[@]}" \

ARCHITECTURE.md

@@ -157,7 +157,8 @@ Core tracing abstractions:
 
 - `AgentTracer` — Static tracer facade. Instrumentations call `AgentTracer.startSpan()`,
   `AgentTracer.activateSpan()`, etc.
-- `AgentSpan` / `AgentScope` / `AgentSpanContext` — Internal span/scope/context interfaces.
+- `AgentSpan` / `AgentSpanContext` — Internal span/context interfaces. Scopes use the tracer-agnostic
+  `ContextScope` (`components/context`); `AgentSpan.fromScope(scope)` extracts the active span from one.
 - `AgentPropagation` — Context propagation interfaces (`Getter`, `Setter`) that instrumentations
   implement to inject/extract trace context from framework-specific carriers (HTTP headers, message
   properties, etc.).

build-logic/smoke-test/src/main/resources/datadog/buildlogic/smoketest/proxy-repositories.init.gradle.kts

@@ -1,41 +1,96 @@
 import org.gradle.api.Action
 import org.gradle.api.Project
+import org.gradle.api.artifacts.dsl.RepositoryHandler
+import org.gradle.api.artifacts.repositories.MavenArtifactRepository
 import org.gradle.api.initialization.Settings
+import java.net.URI
 
 gradle.beforeSettings(Action<Settings> {
   val gradlePluginProxy = providers.gradleProperty("gradlePluginProxy").orNull
   val mavenRepositoryProxy = providers.gradleProperty("mavenRepositoryProxy").orNull
+  val mavenCentralUrls = setOf(
+    "https://repo.maven.apache.org/maven2",
+    "https://repo1.maven.org/maven2",
+  )
+  // Marks the proxy repository this script injects, so the deduplication below can tell it apart
+  // from a redirected mavenCentral() the nested build declared itself.
+  val injectedProxyName = "ddSmokeTestMavenRepositoryProxy"
+
+  fun RepositoryHandler.redirectMavenCentral() {
+    val proxy = mavenRepositoryProxy?.takeIf { it.isNotBlank() } ?: return
+    withType(MavenArtifactRepository::class.java).configureEach {
+      // A repository declared without a URL has a null one until Gradle validates it; leave it be
+      // so the nested build reports that itself instead of failing inside this init script.
+      val repositoryUrl = url?.toString()?.trimEnd('/')
+      if (repositoryUrl != null && repositoryUrl in mavenCentralUrls) {
+        url = URI(proxy)
+        isAllowInsecureProtocol = true
+      }
+    }
+  }
+
+  fun RepositoryHandler.removeDuplicateMavenProxy() {
+    val proxyUrl = mavenRepositoryProxy?.takeIf { it.isNotBlank() }?.trimEnd('/') ?: return
+    val proxies = withType(MavenArtifactRepository::class.java)
+      .filter { it.url?.toString()?.trimEnd('/') == proxyUrl }
+    // Keep the injected repository: it is the only one known to be unrestricted, since a declared
+    // mavenCentral() may carry content filters that redirectMavenCentral() does not lift.
+    if (proxies.none { it.name == injectedProxyName }) {
+      return
+    }
+    proxies.filter { it.name != injectedProxyName }.forEach { remove(it) }
+  }
+
+  buildscript.repositories.redirectMavenCentral()
+  pluginManagement.repositories.redirectMavenCentral()
+  dependencyResolutionManagement.repositories.redirectMavenCentral()
 
   pluginManagement {
     repositories {
       mavenLocal()
       gradlePluginProxy?.takeIf { it.isNotBlank() }?.let { proxy ->
         maven {
-          url = java.net.URI(proxy)
+          url = URI(proxy)
           isAllowInsecureProtocol = true
         }
       }
       mavenRepositoryProxy?.takeIf { it.isNotBlank() }?.let { proxy ->
         maven {
-          url = java.net.URI(proxy)
+          name = injectedProxyName
+          url = URI(proxy)
           isAllowInsecureProtocol = true
         }
       }
       gradlePluginPortal()
-      mavenCentral()
+      if (mavenRepositoryProxy.isNullOrBlank()) {
+        mavenCentral()
+      }
     }
   }
 
+  gradle.settingsEvaluated(Action<Settings> {
+    pluginManagement.repositories.removeDuplicateMavenProxy()
+  })
+
   gradle.beforeProject(Action<Project> {
+    repositories.redirectMavenCentral()
+    buildscript.repositories.redirectMavenCentral()
     repositories {
       mavenLocal()
       mavenRepositoryProxy?.takeIf { it.isNotBlank() }?.let { proxy ->
         maven {
-          url = java.net.URI(proxy)
+          name = injectedProxyName
+          url = URI(proxy)
           isAllowInsecureProtocol = true
         }
       }
-      mavenCentral()
+      if (mavenRepositoryProxy.isNullOrBlank()) {
+        mavenCentral()
+      }
     }
   })
+
+  gradle.afterProject(Action<Project> {
+    repositories.removeDuplicateMavenProxy()
+  })
 })

build-logic/smoke-test/src/test/kotlin/datadog/buildlogic/smoketest/SmokeTestAppEndToEndTest.kt

@@ -265,7 +265,7 @@ class SmokeTestAppEndToEndTest {
   }
 
   @Test
-  fun `local proxy property prepends Maven proxy repositories exactly once`() {
+  fun `Maven proxy replaces Maven Central in nested repositories`() {
     writeOuterSettings()
     val proxyRepository = projectDir.resolve("proxy-maven-repo").toFile()
     val projectRepository = projectDir.resolve("project-maven-repo").toFile()
@@ -279,10 +279,37 @@ class SmokeTestAppEndToEndTest {
         sysProperty = "resolved.repositories.path",
       ),
     )
-    writeInnerSettings()
+    writeInnerSettings(
+      """
+      pluginManagement {
+        repositories {
+          mavenCentral()
+        }
+      }
+
+      gradle.settingsEvaluated {
+        val outputDir = java.io.File(providers.gradleProperty("appBuildDir").get())
+        outputDir.mkdirs()
+        outputDir.resolve("plugin-repositories.txt").writeText(
+          pluginManagement.repositories
+            .withType(org.gradle.api.artifacts.repositories.MavenArtifactRepository::class.java)
+            .joinToString(System.lineSeparator()) { "repository=" + it.url }
+        )
+      }
+
+      gradle.projectsLoaded {
+        gradle.rootProject.repositories.mavenCentral {
+          content {
+            includeGroup("com.unrelated")
+          }
+        }
+      }
+      """.trimIndent(),
+    )
     writeInnerBuild(
       """
       repositories {
+        mavenCentral()
         maven {
           url = uri("${projectRepository.toURI()}")
         }
@@ -301,8 +328,12 @@ class SmokeTestAppEndToEndTest {
           val artifacts = configurations.compileClasspath.get()
             .sortedBy { it.name }
             .map { it.name + "=" + it.readText() }
+          val repositoryUrls = repositories
+            .withType(org.gradle.api.artifacts.repositories.MavenArtifactRepository::class.java)
+            .map { "repository=" + it.url }
           resolved.get().asFile.writeText(
-            (listOf("init-script-count=" + gradle.startParameter.initScripts.size) + artifacts)
+            (listOf("init-script-count=" + gradle.startParameter.initScripts.size) +
+              repositoryUrls + artifacts)
               .joinToString(System.lineSeparator())
           )
         }
@@ -319,11 +350,31 @@ class SmokeTestAppEndToEndTest {
     assertThat(result.task(":resolveRepositories")?.outcome).isEqualTo(TaskOutcome.SUCCESS)
     val resolvedFile = applicationOutput("resolved-repositories.txt")
     assertThat(resolvedFile).exists()
-    assertThat(resolvedFile.readLines()).containsExactly(
+    val resolvedLines = resolvedFile.readLines()
+    assertThat(resolvedLines).contains(
       "init-script-count=1",
+      "repository=${proxyRepository.toURI()}",
       "project-only-1.0.jar=project-only",
       "shared-1.0.jar=proxy",
     )
+    assertThat(resolvedLines).containsOnlyOnce(
+      "repository=${proxyRepository.toURI()}",
+    )
+    assertThat(resolvedLines).doesNotContain(
+      "repository=https://repo.maven.apache.org/maven2/",
+    )
+    val pluginRepositoriesFile = applicationOutput("plugin-repositories.txt")
+    assertThat(pluginRepositoriesFile).exists()
+    val pluginRepositoryLines = pluginRepositoriesFile.readLines()
+    assertThat(pluginRepositoryLines).contains(
+      "repository=${proxyRepository.toURI()}",
+    )
+    assertThat(pluginRepositoryLines).containsOnlyOnce(
+      "repository=${proxyRepository.toURI()}",
+    )
+    assertThat(pluginRepositoryLines).doesNotContain(
+      "repository=https://repo.maven.apache.org/maven2/",
+    )
   }
 
   @Test
@@ -649,10 +700,11 @@ class SmokeTestAppEndToEndTest {
       "fake-mvnw"
     }
 
-  private fun writeInnerSettings() {
+  private fun writeInnerSettings(additionalContent: String = "") {
     File(applicationDir, "settings.gradle.kts").writeText(
       """
       rootProject.name = "smoke-test-app-fixture-application"
+      $additionalContent
       """.trimIndent(),
     )
   }

build.gradle.kts

@@ -6,19 +6,19 @@ import datadog.gradle.plugin.ci.testAggregate
 plugins {
   kotlin("jvm") version libs.versions.kotlin.plugin apply false
 
-  id("dd-trace-java.gradle-debug")
+  id("dd-trace-java.ci-jobs")
+  id("dd-trace-java.config-inversion-linter")
   id("dd-trace-java.dependency-locking")
-  id("dd-trace-java.tracer-version")
   id("dd-trace-java.dump-hanged-test")
-  id("dd-trace-java.config-inversion-linter")
-  id("dd-trace-java.ci-jobs")
+  id("dd-trace-java.gradle-debug")
+  id("dd-trace-java.tracer-version")
 
+  alias(libs.plugins.shadow) apply false
   alias(libs.plugins.spotless)
-  id("me.champeau.gradle.japicmp") version "0.4.3"
-  id("com.github.spotbugs") version "6.5.10"
+  id("com.github.spotbugs") version "6.5.11"
   id("de.thetaphi.forbiddenapis") version "3.10"
   id("io.github.gradle-nexus.publish-plugin") version "2.0.0"
-  alias(libs.plugins.shadow) apply false
+  id("me.champeau.gradle.japicmp") version "0.4.3"
   id("me.champeau.jmh") version "0.7.3" apply false
   id("org.gradle.playframework") version "0.16.0" apply false
 }

buildSrc/src/main/kotlin/datadog/gradle/plugin/config/ConfigInversionLinter.kt

@@ -89,7 +89,7 @@ private fun registerLogEnvVarUsages(target: Project, extension: SupportedTracerC
     val javaFiles = target.fileTree(target.projectDir) {
       include("**/src/main/java/**/*.java")
       exclude("**/build/**", "**/dd-smoke-tests/**")
-      // Undertow uses DD_UNDERTOW_CONTINUATION as a legacy key to store an AgentScope. It is not related to an environment variable
+      // Undertow uses DD_UNDERTOW_CONTINUATION as a legacy key to store a ContextContinuation. It is not related to an environment variable
       exclude("dd-java-agent/instrumentation/undertow/undertow-common/src/main/java/datadog/trace/instrumentation/undertow/UndertowDecorator.java")
     }
     inputs.files(javaFiles)