Add dd-apm-sdk-review skill and repo overrides, replace perf-review

[robertomonteromiguel]

What Does This Do

Adds the dd-apm-sdk-review skill to this repo: an automated, multi-lens code review that runs before a developer pushes, checking a diff for correctness, security, performance, design, maintainability, conventions, coherence, and cross-SDK consistency issues.

Concretely:

• .agents/skills/dd-apm-sdk-review/ — the skill itself (SKILL.md + one rule file per lens). This is a verbatim copy from dd-apm-sdk-review-core, the shared source of truth for all tracer repos.
• .agents/dd-apm-sdk-review-overrides/ — the dd-trace-java-specific layer: repo context and per-lens overrides that adapt the generic rules to this codebase.
• .llm-validation/ and .promptfoo/ — validation scaffolding to test the skill's review output against known cases.
• Replaces the old perf-review skill, and updates CODEOWNERS, .gitignore, and AGENTS.md accordingly.

This lands as a single, squashed commit for ease of review. The branch history (with intermediate fixes from earlier automated review passes) is preserved at backup/phase1-agentic-review-rollout if needed.

How To Review This

1. Start with dd-apm-sdk-review-core PR #1 — that's where the skill's design, rules, and rationale are reviewed in depth.
2. Skip .agents/skills/dd-apm-sdk-review/reviewers/*.md here — those are an exact copy of the core repo's rules, not authored in this PR.
3. Focus on .agents/dd-apm-sdk-review-overrides/ — this is the part specific to dd-trace-java and worth a real read.
4. Skim .llm-validation/ and .promptfoo/ to confirm the test cases match what you'd expect the skill to catch (see Additional Notes below).

Motivation

Today, review feedback on things like resource leaks, TOCTOU security gaps, or serialization bugs only surfaces once a human reviewer catches it — after the PR is already open. This skill runs the same categories of checks locally, before push, so common and recurring issues get caught earlier and human review time is spent on judgment calls rather than patterns we already know how to detect.

Additional Notes

• Testing approach is not finalized. We're evaluating Datadog's internal LLM Validation Platform against promptfoo side by side to decide which one drives validation going forward. Nothing here should be read as a final choice.
• Some test cases were generated using Sphinx, an internal tool that mines merged PRs and fix commits from this repo's own history to surface recurring defect patterns. We used it to seed a first batch of promptfoo test cases from real, historical dd-trace-java bugs. This is a temporary home for those cases — once the testing tool is decided, they'll move to wherever that tool expects them.
  CI is not wired up yet. There's no job today that automatically runs these tests when AGENTS.md or any file under .agents/dd-apm-sdk-review-overrides/ changes. That's a follow-
  up once the testing tool above is decided.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Once approved, use merge queue to merge the PR

Jira ticket: [PROJ-IDENT]

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.98 s	13.94 s	[-0.4%; +1.1%] (no difference)
startup:insecure-bank:tracing:Agent	12.98 s	12.95 s	[-0.6%; +1.1%] (no difference)
startup:petclinic:appsec:Agent	17.48 s	17.30 s	[+0.2%; +1.9%] (maybe worse)
startup:petclinic:iast:Agent	16.75 s	17.47 s	[-8.3%; +0.0%] (no difference)
startup:petclinic:profiling:Agent	16.92 s	17.18 s	[-5.9%; +2.9%] (no difference)
startup:petclinic:sca:Agent	16.95 s	17.36 s	[-6.7%; +1.9%] (no difference)
startup:petclinic:tracing:Agent	16.51 s	16.64 s	[-1.9%; +0.3%] (no difference)

Commit: 1604db5e · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.