chore(config): migrate APM and trace components to typed config

[webern]

Human Summary

TODO: human writes here

AI Summary

Build the APM/trace pipeline components from the typed SalukiConfiguration
model instead of the raw configuration map, and remove the shared ApmConfig
parsing helper they all leaned on.

Migrated components:

• DatadogApmStatsEncoderConfiguration (APM stats encoder)
• DatadogTraceConfiguration (Datadog trace encoder)
• TraceObfuscationConfiguration (trace obfuscation transform)
• ApmStatsTransformConfiguration (APM stats transform)

Details:

• Trace settings (env, sampling targets, error tracking, peer tags,
  obfuscation, OTLP trace knobs) are read from domains.traces. The shared
  encoder flush timeout is read from shared.metrics_encoding, and the
  compression settings from shared.endpoints.compression.
• The obfuscator's ObfuscationConfig is built from the typed Obfuscation
  model via a From conversion, so the obfuscation engine is untouched.
• ApmConfig in common/datadog/apm.rs is deleted; nothing else consumed it.
• The encoder flush timeout (flush_timeout_secs) becomes a required
  Saluki-only value whose 2s default is hoisted into the config layer and
  shared across the metrics, trace, and APM stats encoders.
• The per-struct config smoke tests are retired in favor of translator and
  component construction tests; classification metadata is unchanged.

Behavior is preserved: witnessed keys keep their schema defaults (which match
the old component defaults), and the OTLP probabilistic sampler default and
env fallback normalize to the same effective values as before.

Change Type

• Non-functional (chore, refactoring, docs)

How did you test this PR?

• make build-schema-overlay && make fmt (no file changes)
• make check-all
• make test
• make check-docs

References

• Progresses Centralize Datadog config inventory with build-time metadata support. #1788
• Merges into m/pr5-cutover

[Copilot]

Pull request overview

Migrates the APM/trace pipeline components away from GenericConfiguration parsing and onto the typed agent_data_plane_config::SalukiConfiguration model, removing the shared ApmConfig helper and centralizing the encoder flush-timeout default in the config layer.

Changes:

• Build trace/obfuscation/APM-stats components from the resolved traces domain model (domains.traces) plus shared settings (shared.metrics_encoding, shared.endpoints.compression).
• Delete common/datadog/apm.rs (ApmConfig) and replace obfuscation parsing with a From<&model::Obfuscation> conversion.
• Hoist the shared encoder flush_timeout default (2s) into agent-data-plane-config and apply it via saluki_only seeding.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
lib/saluki-components/src/transforms/trace_obfuscation/mod.rs	Builds obfuscation transform config from typed traces domain; replaces config smoke test with targeted unit test.
lib/saluki-components/src/transforms/apm_stats/mod.rs	Builds APM stats transform config from typed traces domain and removes dependency on ApmConfig.
lib/saluki-components/src/encoders/datadog/traces/mod.rs	Constructs trace encoder config from typed model + shared flush timeout + shared compression; simplifies tests.
lib/saluki-components/src/encoders/datadog/stats/mod.rs	Constructs APM stats encoder config from typed model + shared flush timeout; updates tests accordingly.
lib/saluki-components/src/common/datadog/obfuscation.rs	Adds From<&domains::traces::Obfuscation> to map typed model into obfuscator config.
lib/saluki-components/src/common/datadog/mod.rs	Removes the apm module export after ApmConfig deletion.
lib/saluki-components/src/common/datadog/apm.rs	Deletes legacy shared APM config parsing helper.
lib/agent-data-plane-config/src/shared.rs	Introduces shared default encoder flush timeout (2s) and implements Default for MetricsEncoding.
lib/agent-data-plane-config-system/src/saluki_only.rs	Makes flush_timeout_secs a defaulted Saluki-only setting and always seeds shared.metrics_encoding.flush_timeout.
bin/agent-data-plane/src/cli/run.rs	Wires traces pipeline component construction to use the typed configuration model.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[pr-commenter]

Binary Size Analysis (Agent Data Plane)

Baseline: 7b98c6f · Comparison: 7f63ad4 · diff
Analysis Configuration: stripped binaries · Pass/Fail Threshold: +5%
Sizes: 41.63 MiB (baseline) vs 42.37 MiB (comparison)
Size Change: +751.18 KiB (+1.76%)

✅ Binary size difference within threshold

Changes by Module

Module	File Size	Symbols
serde_json	+252.41 KiB	512
figment	-156.85 KiB	448
datadog_agent_config::generated::datadog_configuration	+144.34 KiB	46
core	+126.10 KiB	9342
alloc	+56.39 KiB	1466
agent_data_plane_config_system::saluki_env_overlay::PathRecorder	+52.14 KiB	23
tokio	+51.47 KiB	3250
[sections]	+47.41 KiB	8
serde_core	+47.21 KiB	939
agent_data_plane_config_system::translators::datadog_translator	+38.97 KiB	20
hyper_util	+30.94 KiB	37
h2	-27.87 KiB	421
saluki_common::task::instrument	+25.78 KiB	55
resource_accounting::groups::Tracked	-25.75 KiB	6
agent_data_plane_config_system::saluki_only::_	+23.55 KiB	8
serde	-23.49 KiB	94
http_body_util	+18.44 KiB	160
tonic	-17.33 KiB	365
tracing	-16.24 KiB	114
saluki_components::sources::otlp	+15.79 KiB	228

Detailed Symbol Changes

    FILE SIZE        VM SIZE    
 --------------  -------------- 
  +4.4%  +684Ki  +4.1%  +494Ki    [34058 Others]
  [NEW] +84.2Ki  [NEW] +83.8Ki    _<datadog_agent_config::generated::datadog_configuration::_::<impl serde_core::de::Deserialize for datadog_agent_config::generated::datadog_configuration::DatadogConfiguration>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::h59abc0a47db21533
  [NEW] +56.6Ki  [NEW] +56.5Ki    saluki_components::common::datadog::io::run_endpoint_io_loop::_{{closure}}::h3ef2a484186f0bb8
  [NEW] +44.7Ki  [NEW] +44.6Ki    agent_data_plane::cli::run::handle_run_command::_{{closure}}::he5819430e26508ec
  [NEW] +39.0Ki  [NEW] +38.8Ki    _<saluki_components::forwarders::otlp::OtlpForwarder as saluki_core::components::forwarders::Forwarder>::run::_{{closure}}::h3d7ef516f362b9a8
  [NEW] +32.5Ki  [NEW] +32.4Ki    saluki_components::sources::dogstatsd::drive_stream::_{{closure}}::h16acca5cc1c6ba60
  [NEW] +31.9Ki  [NEW] +31.8Ki    saluki_components::sources::otlp::metrics::translator::OtlpMetricsTranslator::translate_metrics::hd269a5b16c8f1266
  [NEW] +31.7Ki  [NEW] +31.5Ki    _<saluki_components::transforms::aggregate::Aggregate as saluki_core::components::transforms::Transform>::run::_{{closure}}::h6809d072204e0804
  [NEW] +29.1Ki  [NEW] +29.0Ki    agent_data_plane::cli::dogstatsd::handle_dogstatsd_command::_{{closure}}::hd22ba2289c2b0af8
  [NEW] +26.0Ki  [NEW] +25.8Ki    _<saluki_components::sources::dogstatsd::DogStatsDConfiguration as saluki_core::components::sources::builder::SourceBuilder>::build::_{{closure}}::h6b9140c89e43d005
  [NEW] +25.3Ki  [NEW] +25.2Ki    saluki_components::transforms::trace_obfuscation::TraceObfuscation::obfuscate_span::he071dadbc68b1790
  [DEL] -25.0Ki  [DEL] -24.8Ki    agent_data_plane::internal::remote_agent::run_remote_agent_registration_loop::_{{closure}}::h64859e60eb17f920
  [DEL] -25.6Ki  [DEL] -25.4Ki    saluki_components::sources::dogstatsd::drive_stream::_{{closure}}::h3fe2520e3abdfc38
  [DEL] -26.6Ki  [DEL] -26.4Ki    _<saluki_components::sources::dogstatsd::DogStatsDConfiguration as saluki_core::components::sources::builder::SourceBuilder>::build::_{{closure}}::h2c2a33d551977c6d
  [DEL] -27.2Ki  [DEL] -26.9Ki    _<saluki_components::sources::dogstatsd::_::<impl serde_core::de::Deserialize for saluki_components::sources::dogstatsd::DogStatsDConfiguration>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::hfc578ba92a99992a
  [DEL] -28.6Ki  [DEL] -28.5Ki    saluki_components::sources::otlp::metrics::translator::OtlpMetricsTranslator::translate_metrics::h1e8351a6f731e9df
  [DEL] -28.6Ki  [DEL] -28.5Ki    agent_data_plane::cli::dogstatsd::handle_dogstatsd_command::_{{closure}}::h84db3f7ad161eab2
  [DEL] -32.6Ki  [DEL] -32.4Ki    _<saluki_components::transforms::aggregate::Aggregate as saluki_core::components::transforms::Transform>::run::_{{closure}}::h72e4b09fd816d94f
  [DEL] -38.7Ki  [DEL] -38.5Ki    _<saluki_components::forwarders::otlp::OtlpForwarder as saluki_core::components::forwarders::Forwarder>::run::_{{closure}}::h3cd6ee67f0471508
  [DEL] -44.7Ki  [DEL] -44.6Ki    agent_data_plane::cli::run::handle_run_command::_{{closure}}::h83501a7881036c5f
  [DEL] -56.8Ki  [DEL] -56.6Ki    saluki_components::common::datadog::io::run_endpoint_io_loop::_{{closure}}::h54fbb73bb30184e6
  +1.8%  +751Ki  +1.6%  +560Ki    TOTAL

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7f63ad424d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[pr-commenter]

Regression Detector (Agent Data Plane)

Run ID: 534edb56-5f80-4f10-a1e1-079884d2ae82
Baseline: 7b98c6f1 · Comparison: 7f63ad42 · diff

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment (3)

Experiments configured erratic: true are tagged (ignored) and skipped when determining which experiments regressed or improved. Experiments which are detected as erratic at runtime are tagged (erratic) to flag that the run's sample dispersion was high, but their regression / improvement signal still counts.

experiment	goal	Δ mean %	links
quality_gates_rss_idle	memory	⚪ +1.89	metrics profiles logs
quality_gates_rss_dsd_low	memory	⚪ +1.71	metrics profiles logs
quality_gates_rss_dsd_medium	memory	⚪ +1.25	metrics profiles logs

Bounds Checks: ✅ Passed (3)

experiment	check	replicates	observed	links
quality_gates_rss_dsd_low	memory_usage	10/10	✅ 43.8 MiB ≤ 50 MiB	metrics profiles logs
quality_gates_rss_dsd_medium	memory_usage	10/10	✅ 65.4 MiB ≤ 75 MiB	metrics profiles logs
quality_gates_rss_idle	memory_usage	10/10	✅ 29.6 MiB ≤ 40 MiB	metrics profiles logs

Explanation

A change is flagged as a regression when |Δ mean %| > 5.00% in the regressing direction for its optimization goal AND SMP marks the experiment as a regression (is_regression: true). Improvements use the matching criteria for the improving direction. Experiments configured erratic: true (tagged (ignored)) are skipped outright; experiments detected as erratic at runtime (tagged (erratic)) still count, since that flag describes sample dispersion rather than directional certainty. The Δ mean % cell is colored accordingly: 🟢 = improvement, 🔴 = regression, ⚪ = neutral. Reduction in CPU or memory is an improvement; reduction in ingress throughput is a regression.

[webern]

Claude Code, reviewing on behalf of @webern.

I did a clean-room pass focused on default/behavior preservation. The migration is faithful on almost every axis I checked, but there is one real behavior change worth resolving before this rolls up.

The one real issue: obfuscation defaults flip from false to true

This is the same thing the Codex bot flagged, and I agree with it after tracing it through.

The old ApmConfig obfuscation path deserialized ObfuscationConfig with plain #[serde(default)], so every enabled flag defaulted to false when the key was absent. The typed model instead takes the vendored Datadog schema defaults, which are true for credit_cards, elasticsearch, memcached, mongodb, opensearch, redis, and valkey:

• datadog-agent/config/src/generated/datadog_configuration.rs — each ApmConfigObfuscation*::enabled is default_bool::<true>().
• datadog_translator.rs (consume_apm_config_obfuscation_*_enabled) writes those into domains.traces.obfuscation.
• The obfuscator gates on these (obfuscator.rs: if config.credit_cards.enabled, config.es.enabled, config.mongo.enabled, config.open_search.enabled, plus the per-span redis/memcached/valkey paths).

So an empty/default config now obfuscates those span fields where the removed path left them off. That directly contradicts the PR description's claim that "witnessed keys keep their schema defaults (which match the old component defaults)" — for obfuscation they do not match.

One nuance that affects severity: when a fully-resolved config is streamed in from the core Agent (the same situation the serializer_zstd_compressor_level handling in datadog_translator.rs is written around), these keys arrive as concrete values and both the old and new paths see true, so that path is unchanged. The divergence shows up when the keys are absent — standalone / default-config / test runs. Whether that path matters is your call.

Two reasonable resolutions:

• Accept the change (it matches upstream Agent behavior, and the old false default was arguably the ADP-side bug) and fix the PR description so it no longer claims defaults are unchanged; or
• Preserve the previous false defaults if standalone/default-config behavior needs to be bit-for-bit.

Either is fine, but it should be a decision rather than an accident.

Minor: lost env-var precedence coverage for error-tracking-standalone

The deleted apm.rs tests included ets_enabled_via_env_var and ets_env_var_overrides_yaml, which exercised the DD_APM_ERROR_TRACKING_STANDALONE_ENABLED → key aliasing and env-over-YAML precedence — real config-loading behavior, not just deserialization. The retained trace-encoder tests only cover the header/chunk-tag logic given a bool, and I couldn't find replacement coverage for error_tracking_standalone resolution in the config-system crate. Not blocking, but if that aliasing/precedence isn't covered generically elsewhere, it's now untested.

What checked out (no action needed)

• target_traces_per_second / errors_per_second (schema default 10/10) and compute_stats_by_span_kind / peer_tags_aggregation (schema default true/true) match the old ApmConfig defaults, and are driven unconditionally.
• env (top-level, empty→"none" fallback) and default_env (seeded from apm_config.default_env, default "none") preserve the old sourcing and defaults.
• The From<&model::Obfuscation> conversion maps every sub-field correctly, field-for-field.
• flush_timeout consolidation is faithful: the manual MetricsEncoding Default keeps 2s, seeding always writes it, and the metrics encoder is untouched (still reads its own flush_timeout_secs), so no metrics-side regression; the 0 → 10ms floor is preserved for traces/stats.
• Compression sourcing (serializer_compressor_kind/_zstd_compressor_level, zstd/3 via the existing translator override) is preserved.
• Hostname handling (set_hostname_if_empty → unwrap_or_default) and the OTLP ignore_missing_datadog_fields / sampling-percentage reads are equivalent.
• The config-smoke test deletions are acceptable losses; the new translator/construction tests cover the mapping.

[webern]

Claude Code, commenting on behalf of @webern.

Owner resolution: this behavior change is accepted.

These values come from the vendored Datadog schema, whose defaults are driven into the typed model by the translator. In the normal fully-resolved configuration path, those schema defaults already clobber the component-local fallback. Aligning the standalone/default-config path with that source of truth is preferable to preserving the old all-false ObfuscationConfig::default() behavior.

The PR description should describe this as intentional alignment with the Datadog schema rather than claiming that these particular defaults match the old component defaults.