feat: add provider_init_rate to telemetry

On the first telemetry flush after provider initialization, include
a ProviderInitRate entry with labels describing the SDK configuration
(e.g. encryption: true/false). This lets the backend track which
customers have adopted encryption without tagging every metric.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: nicklasl

confidence-cloudflare-resolver/CLAUDE.md

@@ -62,7 +62,7 @@ RUSTFLAGS='--cfg getrandom_backend="wasm_js"' cargo build --target wasm32-unknow
 ## Compile-Time Data
 
 Two files are embedded at compile time from `../../data/`:
-- `resolver_state_current.pb` — Protobuf-encoded `SetResolverStateRequest` containing resolver state + account ID
+- `resolver_state_current.pb` — Protobuf-encoded `ClientResolverState` containing resolver state + account ID
 - `encryption_key` — Base64-encoded encryption key for resolve tokens
 
 ## Deployer

confidence-cloudflare-resolver/src/lib.rs

@@ -27,14 +27,12 @@ use confidence_resolver::proto::confidence::flags::resolver::v1::{
 use confidence_resolver::Client;
 use once_cell::sync::Lazy;
 
-/// SetResolverStateRequest message from the CDN.
-/// This matches the protobuf message format returned by the CDN.
 #[derive(Clone, PartialEq, Message)]
-pub struct SetResolverStateRequest {
+pub struct ClientResolverState {
     #[prost(bytes = "bytes", tag = "1")]
     pub state: Bytes,
     #[prost(string, tag = "2")]
-    pub account_id: String,
+    pub account: String,
 }
 
 /// The CDN response containing both the state and account_id
@@ -58,16 +56,16 @@ static FLAGS_LOGS_QUEUE: OnceLock<Queue> = OnceLock::new();
 static CONFIDENCE_CLIENT_SECRET: OnceLock<String> = OnceLock::new();
 
 /// Parsed CDN state request containing both state and account_id
-static CDN_STATE_REQUEST: Lazy<SetResolverStateRequest> = Lazy::new(|| {
-    SetResolverStateRequest::decode(Bytes::from_static(CDN_STATE_BYTES))
-        .expect("Failed to decode SetResolverStateRequest from CDN state")
+static CDN_STATE_REQUEST: Lazy<ClientResolverState> = Lazy::new(|| {
+    ClientResolverState::decode(Bytes::from_static(CDN_STATE_BYTES))
+        .expect("Failed to decode ClientResolverState from CDN state")
 });
 
 static RESOLVER_STATE: Lazy<ResolverState> = Lazy::new(|| {
     let cdn_request = &*CDN_STATE_REQUEST;
     ResolverState::from_proto(
         cdn_request.state.to_vec().try_into().unwrap(),
-        &cdn_request.account_id,
+        &cdn_request.account,
         None,
     )
     .unwrap()

confidence-resolver/protos/confidence/flags/resolver/v1/api.proto

@@ -182,4 +182,7 @@ message ResolvedFlag {
 
   // Determines whether the flag should be applied in the clients
  bool should_apply = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // The origin of the assignment, e.g. the rule name.
+  string assignment_origin = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
 }

confidence-resolver/protos/confidence/flags/resolver/v1/internal_api.proto

@@ -112,6 +112,8 @@ message WriteFlagAssignedResponse {
 // consumers everything needed to reconstruct bucket boundaries and resample
 // between different histogram configurations if needed.
 message TelemetryData {
+  reserved 1; // was: int64 dropped_events
+
   // Information about the SDK/provider
   Sdk sdk = 2 [
     (google.api.field_behavior) = OPTIONAL
@@ -128,6 +130,14 @@ message TelemetryData {
   // Set from the confidence-resolver crate version at build time.
   string resolver_version = 8;
 
+  repeated ProviderInitRate provider_init_rate = 9;
+
+  message ProviderInitRate {
+    uint32 count = 1;
+    reserved 2; // status — tbd
+    map<string, string> labels = 3;
+  }
+
   message ResolveLatency {
     // Delta sum of observed values since the last flush.
     uint32 sum = 1;

confidence-resolver/src/lib.rs

@@ -1707,6 +1707,7 @@ impl<'a> TryFrom<&ResolvedValue<'a>> for flags_resolver::ResolvedFlag {
             flag: value.flag.name.clone(),
             reason: value.inner.reason,
             should_apply: value.should_apply(),
+            assignment_origin: value.inner.rule.clone(),
             ..Default::default()
         };
 

confidence-resolver/src/resolver_spec_tests.rs

@@ -132,6 +132,7 @@ struct SpecResolvedFlag {
     value: Option<serde_json::Value>,
     should_apply: Option<bool>,
     assignment_id: Option<String>,
+    assignment_origin: Option<String>,
 }
 
 // ---------------------------------------------------------------------------
@@ -461,6 +462,15 @@ fn run_spec_test(state: &ResolverState, test_case: &SpecTestCase) {
             );
         }
 
+        // assignmentOrigin assertion
+        if let Some(expected_origin) = &expected_flag.assignment_origin {
+            assert_eq!(
+                &actual.assignment_origin, expected_origin,
+                "[{}] assignmentOrigin mismatch for flag '{}'",
+                test_case.name, expected_flag.flag,
+            );
+        }
+
         // assignmentId assertion (from resolve token)
         if let Some(expected_assignment_id) = &expected_flag.assignment_id {
             let token = resolver

confidence-resolver/src/telemetry.rs

@@ -498,6 +498,7 @@ impl Telemetry {
             state_age,
             memory_bytes: (self.memory_provider)(),
             resolver_version: crate::version::VERSION.to_string(),
+            provider_init_rate: Vec::new(),
         }
     }
 }

confidence-resolver/test-payloads/resolver-spec/tests.json

@@ -4114,5 +4114,28 @@
         "expectError": null
       }
     }
+  },
+  {
+    "name": "assignment_origin_is_matched_rule_name",
+    "resolveRequest": {
+      "flags": ["flags/simple-flag"],
+      "evaluationContext": { "targeting_key": "user1", "country": "SE" },
+      "clientSecret": "test-secret"
+    },
+    "expectedResult": {
+      "general": {
+        "resolvedFlags": [
+          {
+            "flag": "flags/simple-flag",
+            "reason": "RESOLVE_REASON_MATCH",
+            "variant": "on",
+            "value": { "enabled": true },
+            "shouldApply": true,
+            "assignmentOrigin": "flags/simple-flag/rules/rule1"
+          }
+        ],
+        "expectError": null
+      }
+    }
   }
 ]

openfeature-provider/INTEGRATION_GUIDE.md

@@ -13,9 +13,10 @@ For language-specific installation and quick start instructions, see your provid
 ## Table of Contents
 
 1. [Getting Your Credentials](#getting-your-credentials)
-2. [Error Handling](#error-handling)
-3. [Sticky Assignments](#sticky-assignments)
-4. [Deferred Apply and Resolve Token Security](#deferred-apply-and-resolve-token-security)
+2. [Encryption](#encryption)
+3. [Error Handling](#error-handling)
+4. [Sticky Assignments](#sticky-assignments)
+5. [Deferred Apply and Resolve Token Security](#deferred-apply-and-resolve-token-security)
 
 ---
 
@@ -29,6 +30,38 @@ Before integrating any Confidence provider, you'll need a **client secret** from
 
 ---
 
+## Encryption
+
+The flag state downloaded by local-resolve providers contains your flag rules and targeting segments. To protect this data at rest and in transit, Confidence supports **encrypting the flag state**. The state is decrypted only when it is loaded into the resolver component inside the provider — it is never stored or transmitted in plaintext.
+
+### Getting Your Encryption Key
+
+The encryption key is available in the [Confidence Admin view](https://app.confidence.spotify.com/admin/clients), next to the client credentials for your integration.
+
+### Migration
+
+Encryption support was introduced in the following provider versions:
+
+| Provider | Version | Package |
+|----------|---------|---------|
+| JavaScript | `0.16.0` | `@spotify-confidence/openfeature-server-provider-local` |
+| Java | `0.16.0` | `com.spotify.confidence:openfeature-provider-local` |
+| Go | `0.19.0` | `github.com/spotify/confidence-resolver/openfeature-provider/go` |
+| Python | `0.9.0` | `confidence-openfeature-provider` |
+| Rust | `0.7.0` | `spotify-confidence-openfeature-provider-local` |
+
+We strongly recommend enabling encryption now by passing the encryption key when creating your provider. See your provider's README for the exact configuration:
+
+- [JavaScript](js/README.md#encryption)
+- [Java](java/README.md#encryption)
+- [Go](go/README.md#encryption)
+- [Python](python/README.md#encryption)
+- [Rust](rust/README.md#encryption)
+
+> **⚠️ Upcoming change:** Encryption will be made **mandatory** in a future SDK release. We will communicate a timeline and migration path before legacy (unencrypted) provider versions are affected. Adopting encryption now ensures a smooth transition when that happens.
+
+---
+
 ## Error Handling
 
 All Confidence providers use a **default value fallback** pattern to ensure your application continues to function even when flag evaluation fails.

openfeature-provider/go/README.md

@@ -35,6 +35,25 @@ You'll need a **client secret** from Confidence to use this provider.
 - Creating a test flag for verification
 - Best practices for credential storage
 
+## Encryption
+
+The provider supports encrypting the flag state to protect your flag rules and targeting segments at rest and in transit. The state is decrypted only when loaded into the resolver.
+
+**📖 See the [Integration Guide: Encryption](../INTEGRATION_GUIDE.md#encryption)** for background and migration details.
+
+Pass the encryption key in `ProviderConfig`:
+
+```go
+provider, err := confidence.NewProvider(ctx, confidence.ProviderConfig{
+    ClientSecret:  "your-client-secret",
+    EncryptionKey: "your-encryption-key", // Get from Confidence Admin view
+})
+```
+
+The encryption key is available in the [Confidence Admin view](https://app.confidence.spotify.com/admin/clients), next to your client credentials.
+
+> **⚠️ Upcoming change:** Encryption will be made **mandatory** in a future SDK release. We will communicate a timeline and migration path before legacy provider versions are affected. We strongly recommend enabling it now.
+
 ## Quick Start
 
 ```go
@@ -158,6 +177,7 @@ The `ProviderConfig` struct contains all configuration options for the provider:
 #### Required Fields
 
 - `ClientSecret` (string): The client secret used for authentication and flag evaluation
+- `EncryptionKey` (string): Encryption key for decrypting the flag state. Found in the [Confidence Admin view](https://app.confidence.spotify.com/admin/clients). Will be required in a future release.
 
 #### Optional Fields