fix(openfeature): consume isolated malformed flags

[leoromanovsky]

Motivation

The canonical FFE corpus now verifies that malformed flags are rejected independently without poisoning valid neighbors, that rejected keys return ERROR with PARSE_ERROR, and that SemVer build metadata does not affect precedence.

The previous draft used a merge commit to import the canonical fixture work. That history caused Reno to observe the same release-note UID twice, so this replacement publishes the same final tree with linear commits.

Changes

• Replace duplicated OpenFeature fixtures with the shared ffe-system-test-data submodule pinned to ea8b5cc5ce335109f11f3efbc5fd608f98a3ca54.
• Assert canonical evaluation reasons and error codes.
• Pin the libdatadog dependencies to d20319f8a108b9ee738af41e7f49f1875ce3c245 from fix(ffe): report rejected flags as parse errors libdatadog#2339.
• Add the OpenFeature release note and configure CI to initialize the fixture submodule.

Decisions

• Reuse the already-green libdatadog contract fix in fix(ffe): report rejected flags as parse errors libdatadog#2339 instead of maintaining a duplicate implementation.
• Keep rejected configured flags distinct from absent flags: rejected flags report PARSE_ERROR; absent flags remain FLAG_NOT_FOUND.
• Publish linear signed commits so Reno validates the release-note fragment once.

Validation

• scripts/run-tests --venv 168ee03 -- -- tests/openfeature/test_provider_fixtures.py (697 passed, 2 skipped)
• cargo fmt --all -- --check
• cargo metadata --locked --no-deps --format-version 1
• scripts/lint fmt -- tests/openfeature/test_provider_fixtures.py
• scripts/lint suitespec-check
• scripts/lint spelling -- releasenotes/notes/openfeature-semver-build-metadata-6a5c429dcd884a36.yaml

[cit-pr-commenter-54b7da]

Codeowners resolved as

Resolved from the full PR diff against main using the target branch CODEOWNERS file.
CODEOWNERS team requests not listed below are not required by the current file set.

.github/dependabot.yml                                                  @DataDog/python-guild @DataDog/apm-core-python
.gitmodules                                                             @DataDog/apm-core-python
releasenotes/notes/openfeature-semver-build-metadata-6a5c429dcd884a36.yaml  @DataDog/apm-python
src/native/Cargo.lock                                                   @DataDog/apm-core-python
src/native/Cargo.toml                                                   @DataDog/apm-core-python
tests/openfeature/test_provider_fixtures.py                             @DataDog/feature-flagging-and-experimentation-sdk
tests/suitespec.yml                                                     @DataDog/python-guild

[cit-pr-commenter-54b7da]

Circular import analysis

⚠️ Existing circular imports

There are 7 circular imports that already exist on the base branch and have not been changed by this PR.

Show existing cycles (showing 5 of 7 shortest)

ddtrace.contrib.internal.django.patch -> ddtrace.contrib.internal.django.response -> ddtrace.contrib.internal.django.patch
ddtrace.aiguard._api_client -> ddtrace.aiguard._redaction -> ddtrace.aiguard._api_client
ddtrace.contrib.internal.pytorch._distributed -> ddtrace.contrib.internal.pytorch._rank_root -> ddtrace.contrib.internal.pytorch._distributed
ddtrace.appsec._common_module_patches -> ddtrace.appsec._listeners -> ddtrace.appsec._common_module_patches
ddtrace.llmobs -> ddtrace.llmobs._evaluators -> ddtrace.llmobs._evaluators.format -> ddtrace.llmobs._experiment -> ddtrace.llmobs

To see all cycles, download the cycles-base.json and cycles-pr.json artifacts from this CI job and run:

uv run --script scripts/import-analysis/cycles.py compare cycles-base.json cycles-pr.json

[cit-pr-commenter-54b7da]

Dependency direction analysis

⚠️ Existing dependency direction violations

There are 256 dependency direction violations that already exist on the base branch and have not been changed by this PR.

Show existing violations (showing 5 of 256 highest severity)

ddtrace.internal.tracemethods -×-> ddtrace.trace  (internal-core -> product:tracing, score=134)
ddtrace.llmobs._integrations.google_adk -×-> ddtrace.trace  (product:llmobs -> product:tracing, score=132)
ddtrace.llmobs._integrations.mcp -×-> ddtrace.trace  (product:llmobs -> product:tracing, score=132)
ddtrace.llmobs._integrations.bedrock -×-> ddtrace.trace  (product:llmobs -> product:tracing, score=132)
ddtrace.internal.opentelemetry.context -×-> ddtrace.trace  (product:opentelemetry -> product:tracing, score=132)

To see all violations, download the layers-base.json and layers-pr.json artifacts from this CI job and run:

uv run --script scripts/import-analysis/layers.py compare layers-base.json layers-pr.json

[datadog-datadog-prod-us1]

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 8683152 | Docs | Datadog PR Page | Give us feedback!}

[pr-commenter]

Benchmarks

Benchmark execution time: 2026-08-11 17:23:21

Comparing candidate commit 8683152 in PR branch agent/isolate-malformed-flags-v2 with baseline commit ec46d8b in branch main.

Found 0 performance improvements and 6 performance regressions! Performance is the same for 613 metrics, 10 unstable metrics.

scenario:httppropagationinject-ids_only

• 🟥 execution_time [+2.493µs; +2.657µs] or [+11.664%; +12.433%]

scenario:iastaspects-swapcase_aspect

• 🟥 execution_time [+50.359µs; +54.439µs] or [+14.961%; +16.173%]

scenario:iastaspectsospath-ospathbasename_aspect

• 🟥 execution_time [+101.424µs; +108.527µs] or [+24.038%; +25.721%]

scenario:span-start

• 🟥 execution_time [+1.456ms; +1.634ms] or [+9.221%; +10.350%]

scenario:telemetryaddmetric-1-count-metric-1-times

• 🟥 execution_time [+333.398ns; +387.511ns] or [+12.787%; +14.863%]

scenario:tracer-small

• 🟥 execution_time [+34.203µs; +35.920µs] or [+9.691%; +10.178%]