refactor(appsec): remove ASM and IAST import cycle

[florentinl]

Description

Extracts lightweight IAST request state from the lifecycle module and makes stack-trace span selection independent of the ASM request context. Taint tracking and telemetry now depend on focused state leaves, removing the ASM/IAST circular import while retaining the concrete IastSpanReporter type. The implementation does not use casts or object typing for IAST-controlled state.

The circular-import analyzer drops from 6 cycles to 5. Dependency-direction violations remain at 256 with no new edge.

Testing

• ./scripts/run-tests --venv 248da41 -- -- tests/appsec/appsec/test_stack_traces.py tests/appsec/iast/taint_tracking/test_disable_taint_sources.py tests/appsec/iast/taint_tracking/test_context.py tests/appsec/iast/test_overhead_control_engine.py (31 passed)
• scripts/lint checks
• Targeted typing checks for the 15 changed source files
• Circular-import analysis: 6 to 5 cycles
• Dependency-direction analysis: 256 to 256 violations, with no new edge

An exploratory expanded AppSec run collected substantially more than the requested files: 736 passed and 5 failed. Four failures were caused by the test environment missing Crypto; one was a patch-state interaction after the extra weak-hash tests. The focused run above is clean.

Risks

Low. The refactor changes how an implicit stack-trace span is resolved. Focused tests cover RASP service-entry placement and IAST root-span placement, plus request-context and overhead-control lifecycle behavior.

Additional Notes

Internal-only change; no release note is required.

[datadog-prod-us1-3]

 

⚠️ Warnings

🚦 9 Pipeline jobs failed

DataDog/apm-reliability/dd-trace-py | build linux serverless: [amd64, cp315-cp315, v113741238-d2b8243-manylinux2014_x86_64, 1]     

DataDog/apm-reliability/dd-trace-py | build linux serverless: [amd64, cp315-cp315, v126532274-233089d-musllinux_1_2_x86_64, 1]     

DataDog/apm-reliability/dd-trace-py | build linux serverless: [arm64, cp315-cp315, v113741357-d2b8243-manylinux2014_aarch64, 1]     

View all 9 failed jobs.

ℹ️ Info

No other issues found (see more)

🧪 All tests passed
❄️ No new flaky tests detected

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 6c71a6d | Docs | Datadog PR Page | Give us feedback!}

[pr-commenter]

Benchmarks

Benchmark execution time: 2026-08-13 14:02:10

Comparing candidate commit 6c71a6d in PR branch florentin.labelle/refactor/appsec-stack-trace-cycle with baseline commit 3a825cc in branch main.

Found 0 performance improvements and 5 performance regressions! Performance is the same for 618 metrics, 9 unstable metrics.

scenario:httppropagationinject-ids_only

• 🟥 execution_time [+2.761µs; +2.886µs] or [+13.418%; +14.025%]

scenario:iastaspectsospath-ospathbasename_aspect

• 🟥 execution_time [+92.325µs; +100.463µs] or [+22.163%; +24.116%]

scenario:span-start

• 🟥 execution_time [+1.466ms; +1.634ms] or [+9.162%; +10.212%]

scenario:telemetryaddmetric-1-count-metric-1-times

• 🟥 execution_time [+481.354ns; +531.928ns] or [+17.948%; +19.833%]

scenario:tracer-small

• 🟥 execution_time [+30.474µs; +32.485µs] or [+8.715%; +9.291%]