[dhruv8sh]

Summary

• Design spec for a native ID5 identity provider on the server-side identity providers framework (Add design spec for server-side identity providers #1428, revision 12). ID5 needs no browser input, so a visitor whose browser blocks Prebid.js or ID5's hosts can still get an ID5 ID from the edge.
• Maps ID5's server-side gs/v2 fetch (the endpoint ID5's Prebid Server module calls) onto the trait: ClientIp and UserAgent needed, the signature as private state, id5-sync.com plus an opt-in EUID source, ext.linkType, a 2-hour refresh hint and also_invalidate.
• Recommends after_send, sets out the three ownership choices against Lockr capture for id5-sync.com with migration, and proposes four additive framework changes for revision 13.

Changes

File	Change
docs/superpowers/specs/2026-10-23-id5-provider-design.md	New spec.

Closes

Part of #353. Related: #90, #1246.

Spec

Spec: docs/superpowers/specs/2026-10-23-id5-provider-design.md. This PR is the spec. It has had no agent review rounds yet.

Assumed vendor facts (section 12 of the spec)

ID5's web server-side fetch page needs a login. Facts verified from the Prebid.js 10.26.0 module, ID5's published Prebid Server module sources (id5-user-id 3.43-rc.1), ID5's public in-app and CTV guides and the IAB GVL are cited. These are assumed:

1. ID5 permits TS, not only Prebid Server, to call gs/v2 for a publisher's Partner Number, and the provider and origin values to send.
2. gs/v2 reads IPv4 as ipv4 (as the PBS module sends it), not ip (as the in-app guide names it).
3. gs/v2 takes and returns signature, its size fits the framework's 1,024-byte state cap, and an older signature is accepted.
4. A UID of "0" on gs/v2 means no consent or an opt-out, never a transient state.
5. The 30-day server-side deletion window applies to web traffic on gs/v2.
6. The EUID source string and EUID token lifetime.
7. What pba is, its size, and whether bidders need it.
8. Rate limits and edge latency (none published).
9. Which TCF purposes gs/v2 requires.

Verified: GVL ID 131 (ID5 Technology SAS, GVL version 182; consent Purposes 1, 3, 5, 10; no legitimate-interest purposes).

Decisions to confirm (section 15 of the spec)

ID	Proposed
D1	Endpoint gs/v2, pending ID5's approval
D2	after_send; hold only once edge p95 is at or below 80 ms for a week
D3	PageUrl not declared; gs/v2 has no page URL field
D4	id5-sync.com always; EUID opt-in through config; no TrueLink in v1
D5	UID "0" is a sticky opt-out that keeps the signature (needs F1)
D6	A 2-hour refresh hint, ID5's web guidance
D7	30-day expiry
D8	strict() plus vendor 131; not Purposes 3 and 5 unless ID5 requires them
D9	EID-level inserter from config; no matcher or mm
D10	Lockr sites keep Lockr capture; other sites use native ID5; Lockr narrowed only after measurement
D11	Trim an oversized ext to {linkType}
D12	Send ipv4 or ipv6, as the PBS module does
D13	Framework changes F1 to F4
D14	#777: identity takes modules, a list

Proposed framework changes (section 11 of the spec)

• F1. Resolution::opted_out_keeping_state(): an opt-out that keeps the vendor's state, because ID5 reads its opt-out from the signature.
• F2. A record whose writer no longer claims its source after sources narrowing is not served and counts as absent.
• F3. A provider's sticky opt-out is kept for retired_opt_out_sec after the provider is removed from config.
• F4. Doc fixes: section 10.1's ID5 example to after_send, section 12.4's ID5 sketch, and [ec.identity] under Pluggable, competition-neutral modules with a technical permission model #777's [<type>.<name>] rule.

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format (prettier --check passes on the new file)
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: every file:line reference checked against c84a73da7, the pinned Prebid.js module, or the published PBS module sources

Checklist

• Feature PRs: spec linked above, ending in a review log of two or more agent review rounds
• Changes follow AGENTS.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses tracing macros (not println!)
• New code has tests
• No secrets or credentials committed