fix(appsec): manage listener activation lifecycle

[florentinl]

Description

Replace the process-global _APPSEC_TO_BE_LOADED sentinel with explicit, symmetric listener registration and deregistration.

AppSec activation now registers every activation-sensitive listener it owns, including the typed HTTPX subscribers and listeners that were previously installed as import side effects. Deactivation unregisters those listeners and clears the request-scoped Flask blocking callback. Registration remains idempotent, so load/load and disable/disable sequences are safe.

The AppSec telemetry listener intentionally remains registered after deactivation so it can report the disabled state.

Testing

• rt run 248da41@12d4546 -- --no-cov tests/appsec/appsec/test_listeners.py tests/appsec/appsec/test_remoteconfiguration.py tests/appsec/appsec/test_processor.py (131 passed, 1 xfailed)
• rt run 248da41@12d4546 -- --no-cov tests/appsec/appsec/test_telemetry.py::test_appsec_enabled_metric tests/appsec/appsec/test_listeners.py (13 passed)
• rt run 1cdebe0@1625618 -- --no-cov tests/internal/test_subscribers.py (14 passed)
• scripts/lint checks
• Import-cycle analysis (no new cycles)

Risks

Listener ownership is spread across several AppSec integration modules. The lifecycle test covers each registration group, repeated activation/deactivation, HTTPX typed subscribers, and the dynamically registered Flask block callback. The telemetry test covers reporting both enabled and disabled AppSec states.

Additional Notes

This PR is intentionally limited to AppSec listener activation lifecycle. The common-module/subprocess signal redesign remains separate.

[cit-pr-commenter-54b7da]

Codeowners resolved as

ddtrace/appsec/_asm_request_context.py                                  @DataDog/asm-python
ddtrace/appsec/_contrib/aws_lambda/__init__.py                          @DataDog/asm-python
ddtrace/appsec/_contrib/django/__init__.py                              @DataDog/asm-python
ddtrace/appsec/_contrib/fastapi/__init__.py                             @DataDog/asm-python
ddtrace/appsec/_contrib/flask/__init__.py                               @DataDog/asm-python
ddtrace/appsec/_contrib/httpx/__init__.py                               @DataDog/asm-python
ddtrace/appsec/_contrib/httpx/subscribers.py                            @DataDog/asm-python
ddtrace/appsec/_contrib/openai/handlers.py                              @DataDog/asm-python
ddtrace/appsec/_contrib/stripe/handlers.py                              @DataDog/asm-python
ddtrace/appsec/_contrib/tornado/__init__.py                             @DataDog/asm-python
ddtrace/appsec/_handlers.py                                             @DataDog/asm-python
ddtrace/appsec/_listeners.py                                            @DataDog/asm-python
ddtrace/appsec/_processor.py                                            @DataDog/asm-python
ddtrace/appsec/_trace_utils.py                                          @DataDog/asm-python
ddtrace/internal/core/subscriber.py                                     @DataDog/apm-core-python
releasenotes/notes/appsec-listener-lifecycle-5b37baf46d536420.yaml      @DataDog/apm-python
tests/appsec/appsec/test_listeners.py                                   @DataDog/asm-python
tests/internal/test_subscribers.py                                      @DataDog/apm-core-python
tests/utils.py                                                          @DataDog/python-guild

[cit-pr-commenter-54b7da]

Circular import analysis

⚠️ Existing circular imports

There are 3 circular imports that already exist on the base branch and have not been changed by this PR.

ddtrace.trace -> ddtrace._trace.tracer -> ddtrace.internal.debug -> ddtrace.trace
ddtrace -> ddtrace.trace -> ddtrace._trace.tracer -> ddtrace.internal.debug -> ddtrace
ddtrace -> ddtrace.trace -> ddtrace._trace.tracer -> ddtrace.internal.debug -> ddtrace.internal.runtime.runtime_metrics -> ddtrace

[datadog-datadog-prod-us1]

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 5986b57 | Docs | Datadog PR Page | Give us feedback!}

[pr-commenter]

Benchmarks

Benchmark execution time: 2026-08-04 13:05:16

Comparing candidate commit 5986b57 in PR branch agent/appsec-listener-lifecycle with baseline commit 11c2498 in branch main.

Found 0 performance improvements and 7 performance regressions! Performance is the same for 601 metrics, 10 unstable metrics.

scenario:httppropagationinject-ids_only

• 🟥 execution_time [+1.579µs; +1.738µs] or [+7.305%; +8.038%]

scenario:iast_aspects-re_expand_aspect

• 🟥 execution_time [+275.469µs; +315.399µs] or [+7.997%; +9.156%]

scenario:iastaspects-index_aspect

• 🟥 execution_time [+12.318µs; +14.844µs] or [+9.487%; +11.432%]

scenario:iastaspectsospath-ospathbasename_aspect

• 🟥 execution_time [+90.854µs; +97.747µs] or [+21.245%; +22.857%]

scenario:span-start

• 🟥 execution_time [+1.546ms; +1.733ms] or [+9.939%; +11.143%]

scenario:telemetryaddmetric-1-count-metric-1-times

• 🟥 execution_time [+201.920ns; +237.311ns] or [+9.611%; +11.296%]

scenario:tracer-small

• 🟥 execution_time [+33.151µs; +35.664µs] or [+9.924%; +10.676%]