What Does This Do

• Adds a new request_excluded tag to the appsec.waf.requests telemetry metric in WafMetricCollector
• Expands WAF_REQUEST_COMBINATIONS from 128 (2^7) to 256 (2^8) to accommodate the new boolean dimension
• Adds requestExcluded as the 8th parameter to wafRequest() and computeWafRequestIndex(), using bit 7 (1 << 7)
• Emits request_excluded:full when a request was excluded, request_excluded:none otherwise (always explicit per team guidance)
• Adds wafRequestExcluded field, setWafRequestExcluded(), and isWafRequestExcluded() to AppSecRequestContext, following the existing wafBlocked / wafTruncated pattern
• Wires ctx.isWafRequestExcluded() as the 8th argument in GatewayBridge when calling wafMetricCollector.wafRequest() at end-of-request
• Updates WafMetricPeriodicActionSpecification to pass the 8th argument and assert request_excluded:none in all expected tag lists

Implementation note

setWafRequestExcluded() is intentionally never called today: libddwaf 1.30.0 does not expose exclusion filter results in its output (ddwaf_result only carries events, actions, duration, timeout, attributes, keep). All requests therefore emit request_excluded:none as a baseline. The RFC itself acknowledges this: "At the time of writing, this information is not available, however the interface of libddwaf will be updated to propagate this information." The setter will be activated once libddwaf exposes that data.

Motivation

Implements the request_excluded tag defined in the In-App WAF Error Telemetry RFC for the appsec.waf.requests metric. The RFC changed this tag from a boolean to a string with values full (fully excluded) and partial (partially excluded). Per team guidance, tags must always be emitted explicitly rather than left implicit/undefined.

Jira ticket: APPSEC-62739

Additional Notes

Tag values defined by the RFC:

• full — request was fully excluded by an exclusion filter (not yet emitted, pending libddwaf update)
• partial — request was partially excluded (future use)
• none — request was not excluded (current baseline for all requests)

All 256 boolean combinations of the 8 WAF request flags are covered by the parameterized test in WafMetricCollectorTest.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors

Note: Once your PR is ready to merge, add it to the merge queue by commenting /merge. /merge -c cancels the queue request. /merge -f --reason "reason" skips all merge queue checks; please use this judiciously, as some checks do not run at the PR-level. For more information, see this doc.