Skip to content

Prevent AI Guard HTTP pool workers from retaining request context - #12612

Open
amarziali wants to merge 2 commits into
masterfrom
andrea.marziali/fix-ai-guard-pool-context
Open

amarziali wants to merge 2 commits into
masterfrom
andrea.marziali/fix-ai-guard-pool-context

Conversation

@amarziali

Copy link
Copy Markdown
Contributor

What Does This Do

The first AI Guard evaluation can start a shaded OkHttp connection-pool worker while the ai_guard span is active. Thread instrumentation captures that context and keeps it active for the worker’s lifetime.

The evaluation span itself finishes correctly, but pool maintenance is not part of the request and should not retain its context. Smoke continuation diagnostics exposed this unintended propagation.

flowchart LR
  A[AI Guard evaluation] --> B[Synchronous HTTP call]
  B -->|Before: captures evaluation context| C[Long-lived pool worker]
  B -->|Fixed: async propagation disabled| D[Pool worker without request context]
  D --> E[Restore previous propagation setting]

  classDef broken fill:#fee2e2,stroke:#dc2626
  classDef healthy fill:#dcfce7,stroke:#16a34a
  class C broken
  class D,E healthy
Loading

Motivation

Disable async propagation only around AI Guard’s synchronous HTTP execution, restoring the previous setting in finally.

Additional Notes

Contributor Checklist

Jira ticket: [PROJ-IDENT]

@amarziali
amarziali requested review from a team as code owners September 23, 2026 14:21
@amarziali
amarziali requested review from AlexeyKuznetsov-DD and removed request for a team September 23, 2026 14:21
@amarziali amarziali added type: bug fix Bug fix tag: ai generated Largely based on code generated by an AI or LLM labels Sep 23, 2026
@amarziali amarziali added the comp: ai-guard AI Guard label Sep 23, 2026
@amarziali
amarziali requested a review from jandro996 September 23, 2026 14:21
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 23, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-09-23T14:25:45.494302Z 564380a PR opened
🔒 Security Review Completed 2026-09-23T14:26:08.627575Z 564380a PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@AlexeyKuznetsov-DD AlexeyKuznetsov-DD left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.
Left minor code-style comments.

@datadog-datadog-prod-us1-2

datadog-datadog-prod-us1-2 Bot commented Sep 23, 2026

Copy link
Copy Markdown
Contributor

🎯 Code Coverage (details)
Patch Coverage: 100.00%
Overall Coverage: 59.29% (-0.02%)

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: a67a990 | Docs | Give us feedback!

@datadog-datadog-prod-us1-2 datadog-datadog-prod-us1-2 Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bits Code Review: PASS

More details

The code disables asynchronous propagation only during the synchronous HTTP call. The finally block restores the caller setting on each exit path.

Was this helpful? React 👍 or 👎

Open Bits AI session

🤖 Bits Code Review · Commit 564380a · @DataDog review to ask questions

@dd-octo-sts

dd-octo-sts Bot commented Sep 23, 2026

Copy link
Copy Markdown
Contributor

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite Status
Startup 🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results
Scenario Candidate master Δ (95% CI of mean)
startup:insecure-bank:iast:Agent 14.78 s 14.68 s [-0.1%; +1.6%] (no difference)
startup:insecure-bank:tracing:Agent 13.61 s 13.67 s [-1.3%; +0.4%] (no difference)
startup:petclinic:appsec:Agent 16.96 s 16.78 s [+0.2%; +2.0%] (maybe worse)
startup:petclinic:iast:Agent 16.32 s 16.90 s [-7.6%; +0.7%] (no difference)
startup:petclinic:profiling:Agent 16.72 s 16.22 s [-1.1%; +7.2%] (no difference)
startup:petclinic:sca:Agent 16.91 s 16.78 s [-0.2%; +1.8%] (no difference)
startup:petclinic:tracing:Agent 15.97 s 15.68 s [-2.4%; +6.1%] (no difference)

Commit: a67a9909 · CI Pipeline · Benchmarking Platform UI


Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

comp: ai-guard AI Guard tag: ai generated Largely based on code generated by an AI or LLM type: bug fix Bug fix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants