Add Postgres remote query COPY executor with optional intake upload

[nubtron]

What does this PR do?

Adds a proof-of-concept Postgres remote query executor for the remote queries research path, with two result modes:

• without resultDelivery, COPY bytes stream inline as COPY events through the existing Agent result path;
• with resultDelivery, the integration uploads bounded COPY bytes directly to its-agent-intake over HTTP using a multipart contract, then returns a receipt.

The executor includes:

• an explicit check registry abstraction with exact {host, port, dbname} matching and fail-closed target selection;
• credential-shaped field rejection in request payloads and a strict proof-query policy;
• binary-safe COPY streaming with configurable chunk/row/byte limits and timeout;
• direct multipart intake upload with a server-owned part size, COPY-chunk aggregation into parts, finalize/abort, idempotent part retries, and receipt mapping;
• a 10 GiB total upload cap and a 5-minute HTTP timeout;
• unit tests and a targeted Docker-backed integration test.

Verified locally in this worktree with ddev --no-interactive test -s postgres (lint passed), ddev validate config -s postgres and ddev validate models -s postgres (valid / in sync), and ddev --no-interactive test postgres -- tests/test_remote_query.py (149 unit tests passed). The live integration test could not run here because a shared long-running proof container already holds host port 5432; the consolidated tree is byte-identical to the hosted #24926 tip, which already ran the integration test in its own CI.

Motivation

This consolidates the former draft stack into a single review surface:

• postgres: stream Remote Queries COPY output to the Agent relay #24925 postgres: stream Remote Queries COPY output to the Agent relay
• postgres: add deterministic Remote Queries COPY relay proofs #24926 postgres: add deterministic Remote Queries COPY relay proofs

Both child drafts are closed in favor of this PR; their branches remain available. The stack is linear, so this PR advances nubtron/remote-queries-poc to the hosted #24926 tree by fast-forward, preserving the existing signed commits without rewriting history. No intermediate relay or chunk-upload variants are reintroduced; the final tree keeps inline COPY streaming when resultDelivery is absent and direct multipart intake upload when it is present.

This is intentionally a proof executor, not a production remote-query implementation. It proves the Agent-local Python execution seam once an explicit registry supplies the matching check, plus the optional direct intake upload path.

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Add qa/required if this PR needs QA validation, or qa/skip-qa if it does not. Exactly one of the two is required.
• If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

[datadog-prod-us1-6]

 

✅ All CI checks and tests passed. Datadog automation helped this PR pass.

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🔄 Datadog retried 1 test - 1 passed on retry

🎯 Code Coverage (details)
• Patch Coverage: 95.72%
• Overall Coverage: 94.38% (+5.78%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 3c202f6 | Docs | View more details | Give us feedback!}

[codecov]

Codecov Report

❌ Patch coverage is 90.33333% with 29 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.35%. Comparing base (18c80aa) to head (92ac25c).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cit-pr-commenter-54b7da]

evalya-impact-summary

evalya impact analysis

Impact analysis: 0 selected, 0 skipped (of 0 test tasks)
Publish tasks:   1 (always emitted)
Diff (6 files):
  postgres/changelog.d/23499.added
  postgres/changelog.d/23499.added.1
  postgres/changelog.d/23499.fixed
  postgres/datadog_checks/postgres/remote_query.py
  postgres/tests/test_remote_query.py
  postgres/tests/test_remote_query_integration.py

Debug a specific task: evalya plan impact --path <path> --task <task>

Learn more about CI impact filtering

[dd-octo-sts]

Validation Report

All 21 validations passed.

Show details

Validation	Description	Status
agent-reqs	Verify check versions match the Agent requirements file	✅
ci	Validate CI configuration and code coverage settings	✅
codeowners	Validate every integration has a CODEOWNERS entry	✅
config	Validate default configuration files against spec.yaml	✅
dep	Verify dependency pins are consistent and Agent-compatible	✅
http	Validate integrations use the HTTP wrapper correctly	✅
imports	Validate check imports do not use deprecated modules	✅
integration-style	Validate check code style conventions	✅
jmx-metrics	Validate JMX metrics definition files and config	✅
labeler	Validate PR labeler config matches integration directories	✅
legacy-signature	Validate no integration uses the legacy Agent check signature	✅
license-headers	Validate Python files have proper license headers	✅
licenses	Validate third-party license attribution list	✅
metadata	Validate metadata.csv metric definitions	✅
models	Validate configuration data models match spec.yaml	✅
openmetrics	Validate OpenMetrics integrations disable the metric limit	✅
package	Validate Python package metadata and naming	✅
qa-label	Validate the pull request declares whether it needs QA for the next Agent release	✅
readmes	Validate README files have required sections	✅
saved-views	Validate saved view JSON file structure and fields	✅
version	Validate version consistency between package and changelog	✅

View full run