diff --git a/crates/edgecookie/README.md b/crates/edgecookie/README.md
new file mode 100644
index 000000000..186b8c304
--- /dev/null
+++ b/crates/edgecookie/README.md
@@ -0,0 +1,9 @@
+# Edge Cookie providers
+
+Vendor Edge Cookie provider crates live here, one per vendor, for example
+`crates/edgecookie/<vendor>`. Each implements the `EdgeCookieProvider` trait
+from `trusted-server-core` and is wired in by an adapter.
+
+The built-in default provider (HMAC over the client IP) ships in
+`trusted-server-core` (`ec::provider`), so no crate is needed for it. This
+directory is a placeholder until a vendor provider is added.
diff --git a/crates/trusted-server-adapter-axum/src/middleware.rs b/crates/trusted-server-adapter-axum/src/middleware.rs
index 45cbedc2c..0009e1953 100644
--- a/crates/trusted-server-adapter-axum/src/middleware.rs
+++ b/crates/trusted-server-adapter-axum/src/middleware.rs
@@ -135,6 +135,9 @@ mod tests {
                 proxy_secret = "unit-test-proxy-secret"
 
                 [ec]
+                provider = "hmac"
+
+                [ec.providers.hmac]
                 passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )
diff --git a/crates/trusted-server-adapter-axum/tests/routes.rs b/crates/trusted-server-adapter-axum/tests/routes.rs
index 03caa3d11..78ad1cf82 100644
--- a/crates/trusted-server-adapter-axum/tests/routes.rs
+++ b/crates/trusted-server-adapter-axum/tests/routes.rs
@@ -33,6 +33,9 @@ fn test_router() -> edgezero_core::router::RouterService {
             proxy_secret = "integration-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
         "#,
     )
diff --git a/crates/trusted-server-adapter-cloudflare/src/middleware.rs b/crates/trusted-server-adapter-cloudflare/src/middleware.rs
index 5b605bcff..cb22e2126 100644
--- a/crates/trusted-server-adapter-cloudflare/src/middleware.rs
+++ b/crates/trusted-server-adapter-cloudflare/src/middleware.rs
@@ -151,6 +151,9 @@ mod tests {
                 proxy_secret = "unit-test-proxy-secret"
 
                 [ec]
+                provider = "hmac"
+
+                [ec.providers.hmac]
                 passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )
diff --git a/crates/trusted-server-adapter-cloudflare/tests/routes.rs b/crates/trusted-server-adapter-cloudflare/tests/routes.rs
index 09e3ed324..1d6a4bb61 100644
--- a/crates/trusted-server-adapter-cloudflare/tests/routes.rs
+++ b/crates/trusted-server-adapter-cloudflare/tests/routes.rs
@@ -36,6 +36,9 @@ fn test_router() -> RouterService {
             proxy_secret = "route-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
         "#,
     )
@@ -85,6 +88,9 @@ fn make_router() -> RouterService {
             proxy_secret = "integration-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
         "#,
     )
diff --git a/crates/trusted-server-adapter-fastly/src/app.rs b/crates/trusted-server-adapter-fastly/src/app.rs
index d6090c983..00757b5c1 100644
--- a/crates/trusted-server-adapter-fastly/src/app.rs
+++ b/crates/trusted-server-adapter-fastly/src/app.rs
@@ -1284,6 +1284,9 @@ mod tests {
                 allowed_domains = ["*.example", "*.example.com"]
 
                 [ec]
+                provider = "hmac"
+
+                [ec.providers.hmac]
                 passphrase = "test-passphrase-at-least-32-bytes!!"
 
                 [request_signing]
@@ -1353,6 +1356,9 @@ mod tests {
             allowed_domains = ["*.example", "*.example.com"]
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]
@@ -1717,6 +1723,9 @@ mod tests {
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )
@@ -2172,6 +2181,9 @@ mod tests {
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]
@@ -2297,6 +2309,9 @@ mod tests {
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]
diff --git a/crates/trusted-server-adapter-fastly/src/main.rs b/crates/trusted-server-adapter-fastly/src/main.rs
index 39d35b198..dd6897cc0 100644
--- a/crates/trusted-server-adapter-fastly/src/main.rs
+++ b/crates/trusted-server-adapter-fastly/src/main.rs
@@ -501,6 +501,9 @@ mod tests {
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]
diff --git a/crates/trusted-server-adapter-fastly/src/middleware.rs b/crates/trusted-server-adapter-fastly/src/middleware.rs
index 2c00ac2ff..e1ab28906 100644
--- a/crates/trusted-server-adapter-fastly/src/middleware.rs
+++ b/crates/trusted-server-adapter-fastly/src/middleware.rs
@@ -297,6 +297,9 @@ mod tests {
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]
diff --git a/crates/trusted-server-adapter-spin/src/middleware.rs b/crates/trusted-server-adapter-spin/src/middleware.rs
index 1bcede1fc..3cadf721d 100644
--- a/crates/trusted-server-adapter-spin/src/middleware.rs
+++ b/crates/trusted-server-adapter-spin/src/middleware.rs
@@ -178,6 +178,9 @@ mod tests {
                 proxy_secret = "unit-test-proxy-secret"
 
                 [ec]
+                provider = "hmac"
+
+                [ec.providers.hmac]
                 passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )
diff --git a/crates/trusted-server-adapter-spin/tests/routes.rs b/crates/trusted-server-adapter-spin/tests/routes.rs
index 2f7b1037e..58cbfc1b0 100644
--- a/crates/trusted-server-adapter-spin/tests/routes.rs
+++ b/crates/trusted-server-adapter-spin/tests/routes.rs
@@ -35,6 +35,9 @@ fn test_router() -> RouterService {
             proxy_secret = "route-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
         "#,
     )
diff --git a/crates/trusted-server-core/src/config.rs b/crates/trusted-server-core/src/config.rs
index e74ef4150..fc2f693d0 100644
--- a/crates/trusted-server-core/src/config.rs
+++ b/crates/trusted-server-core/src/config.rs
@@ -338,6 +338,9 @@ origin_url = "https://origin.example.com"
 proxy_secret = "change-me-proxy-secret"
 
 [ec]
+provider = "hmac"
+
+[ec.providers.hmac]
 passphrase = "production-secret-key-32-bytes-min"
 
 [[handlers]]
diff --git a/crates/trusted-server-core/src/config_payload.rs b/crates/trusted-server-core/src/config_payload.rs
index 6ede36e9c..2525a528d 100644
--- a/crates/trusted-server-core/src/config_payload.rs
+++ b/crates/trusted-server-core/src/config_payload.rs
@@ -154,7 +154,9 @@ mod tests {
     fn strings_that_look_like_json_scalars_round_trip_as_strings() {
         let mut original = test_settings();
         original.publisher.proxy_secret = Redacted::new("1234567890".to_string());
-        original.ec.passphrase = Redacted::new("12345678901234567890123456789012".to_string());
+        original.ec.providers.hmac = Some(crate::settings::HmacProviderConfig {
+            passphrase: Redacted::new("12345678901234567890123456789012".to_string()),
+        });
         original.handlers[0].password = Redacted::new("true".to_string());
 
         let reconstructed = settings_from_config_blob(&envelope_json(&original))
@@ -166,8 +168,22 @@ mod tests {
             "numeric-looking proxy secret should remain a string"
         );
         assert_eq!(
-            reconstructed.ec.passphrase.expose(),
-            original.ec.passphrase.expose(),
+            reconstructed
+                .ec
+                .providers
+                .hmac
+                .as_ref()
+                .expect("should reconstruct the hmac provider")
+                .passphrase
+                .expose(),
+            original
+                .ec
+                .providers
+                .hmac
+                .as_ref()
+                .expect("should keep the hmac provider")
+                .passphrase
+                .expose(),
             "numeric-looking passphrase should remain a string"
         );
         assert_eq!(
diff --git a/crates/trusted-server-core/src/ec/finalize.rs b/crates/trusted-server-core/src/ec/finalize.rs
index a553bb7a7..d09d8097a 100644
--- a/crates/trusted-server-core/src/ec/finalize.rs
+++ b/crates/trusted-server-core/src/ec/finalize.rs
@@ -8,12 +8,11 @@ use std::collections::HashSet;
 use edgezero_core::body::Body as EdgeBody;
 use http::Response;
 
-use super::consent::{ec_consent_granted, ec_consent_withdrawn};
 use crate::settings::Settings;
 
 use super::EcContext;
+use super::consent::ec_consent_withdrawn;
 use super::cookies::{expire_ec_cookie, set_ec_cookie};
-use super::generation::is_valid_ec_id;
 use super::kv::KvIdentityGraph;
 use super::log_id;
 use super::prebid_eids::ingest_eid_cookies;
@@ -29,12 +28,16 @@ const EC_RESPONSE_HEADERS: &[&str] = &[
 
 /// Finalizes EC response behavior for all routes.
 ///
-/// Applies withdrawal handling, last-seen updates, cookie reconciliation,
-/// Prebid EID ingestion, and cookie writes for new EC generation.
+/// Applies the resolved consent gate, last-seen updates, cookie
+/// reconciliation, Prebid EID ingestion, and cookie writes for new EC generation.
 ///
-/// On consent withdrawal, the browser response clears the EC cookie
-/// immediately and the EC identity-graph KV tombstone is the authoritative
-/// revocation marker. There is no separate consent KV store to clean up.
+/// When the request carries an explicit withdrawal signal (a storage opt-out or
+/// a TCF record refusing storage) and the client presented a cookie, the browser
+/// response clears the EC cookie immediately and the EC identity-graph KV
+/// tombstone is the authoritative revocation marker. A request that is merely
+/// not permitted (pre-consent or fail-closed) strips EC response headers but
+/// leaves an already-issued cookie intact. There is no separate consent KV
+/// store to clean up.
 ///
 /// `eids_cookie` should be the raw value of the `ts-eids` cookie extracted
 /// from the request *before* routing consumes it.
@@ -47,19 +50,27 @@ pub fn ec_finalize_response(
     sharedid_cookie: Option<&str>,
     response: &mut Response<EdgeBody>,
 ) {
-    let consent_allows_ec = ec_consent_granted(ec_context.consent());
-    let consent_withdrawn = ec_consent_withdrawn(ec_context.consent());
-
-    if !consent_allows_ec {
-        // Always strip EC-specific response headers when consent is not
-        // currently usable for this request. This covers both explicit
-        // revocation and fail-closed cases such as missing geo or undecodable
-        // consent input.
+    // Apply any response headers the active provider asked for during
+    // generation (for example to request more client evidence). This is empty
+    // unless a provider produced headers, so it is safe on every path.
+    for (name, value) in ec_context.response_headers() {
+        response.headers_mut().insert(name, value.clone());
+    }
+
+    let ec_permitted = ec_context.ec_allowed();
+
+    if !ec_permitted {
+        // Always strip EC-specific response headers when EC is not permitted for
+        // this request, covering both an explicit withdrawal and fail-closed
+        // cases such as missing geo or undecodable consent input.
         clear_ec_headers_on_response(response, Some(registry));
 
         // Only expire the browser cookie and tombstone the identity-graph row
-        // when the request carries an explicit withdrawal signal.
-        if consent_withdrawn && ec_context.cookie_was_present() {
+        // when the request carries an explicit withdrawal signal. A pre-consent
+        // or fail-closed state (consent is simply not granted) strips headers
+        // but must not destroy an already-issued identifier, or a returning user
+        // would be permanently withdrawn before they ever get to consent.
+        if ec_consent_withdrawn(ec_context.consent()) && ec_context.cookie_was_present() {
             expire_ec_cookie(settings, response);
 
             // Compute once for the authoritative identity-graph tombstones.
@@ -82,8 +93,8 @@ pub fn ec_finalize_response(
         return;
     }
 
-    // Returning user: consent is granted and EC came from request.
-    if ec_context.ec_was_present() && !ec_context.ec_generated() && consent_allows_ec {
+    // Returning user: EC is permitted and came from the request.
+    if ec_context.ec_was_present() && !ec_context.ec_generated() && ec_permitted {
         if let (Some(graph), Some(ec_id)) = (kv, ec_context.ec_value()) {
             ingest_eid_cookies(eids_cookie, sharedid_cookie, ec_id, graph, registry);
         }
@@ -156,13 +167,13 @@ fn withdrawal_ec_ids(ec_context: &EcContext) -> HashSet<String> {
     let mut hashes = HashSet::new();
 
     if let Some(cookie_ec_id) = ec_context.existing_cookie_ec_id()
-        && is_valid_ec_id(cookie_ec_id)
+        && ec_context.accepts_id(cookie_ec_id)
     {
         hashes.insert(cookie_ec_id.to_owned());
     }
 
     if let Some(active_ec_id) = ec_context.ec_value()
-        && is_valid_ec_id(active_ec_id)
+        && ec_context.accepts_id(active_ec_id)
     {
         hashes.insert(active_ec_id.to_owned());
     }
@@ -219,6 +230,7 @@ mod tests {
         ec_was_present: bool,
         ec_generated: bool,
         jurisdiction: Jurisdiction,
+        ec_allowed: bool,
     ) -> EcContext {
         let consent = ConsentContext {
             jurisdiction,
@@ -232,6 +244,7 @@ mod tests {
             ec_was_present,
             ec_generated,
             consent,
+            ec_allowed,
         )
     }
 
@@ -241,6 +254,7 @@ mod tests {
         ec_was_present: bool,
         ec_generated: bool,
         consent: ConsentContext,
+        ec_allowed: bool,
     ) -> EcContext {
         EcContext::new_for_test_with_cookie(
             ec_value.map(str::to_owned),
@@ -248,6 +262,7 @@ mod tests {
             ec_was_present,
             ec_generated,
             consent,
+            ec_allowed,
         )
     }
 
@@ -275,7 +290,14 @@ mod tests {
     #[test]
     fn withdrawal_ec_ids_returns_cookie_ec_only_when_active_missing() {
         let cookie_ec = sample_ec_id("cook1e");
-        let ec_context = make_context(None, Some(&cookie_ec), true, false, Jurisdiction::Unknown);
+        let ec_context = make_context(
+            None,
+            Some(&cookie_ec),
+            true,
+            false,
+            Jurisdiction::Unknown,
+            false,
+        );
 
         let ids = withdrawal_ec_ids(&ec_context);
 
@@ -295,6 +317,7 @@ mod tests {
             true,
             false,
             Jurisdiction::Unknown,
+            false,
         );
 
         let ids = withdrawal_ec_ids(&ec_context);
@@ -313,6 +336,7 @@ mod tests {
             true,
             false,
             Jurisdiction::Unknown,
+            false,
         );
 
         let ids = withdrawal_ec_ids(&ec_context);
@@ -331,6 +355,7 @@ mod tests {
             true,
             false,
             Jurisdiction::Unknown,
+            false,
         );
 
         let ids = withdrawal_ec_ids(&ec_context);
@@ -402,7 +427,7 @@ mod tests {
             ..Default::default()
         };
         let ec_context =
-            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent);
+            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent, false);
         let mut response = empty_response();
         set_header(&mut response, "x-ts-ec", "stale");
         set_header(&mut response, "x-ts-eids", "[]");
@@ -459,6 +484,7 @@ mod tests {
             true,
             false,
             Jurisdiction::NonRegulated,
+            true,
         );
         let mut response = empty_response();
 
@@ -493,6 +519,7 @@ mod tests {
             true,
             false,
             Jurisdiction::NonRegulated,
+            true,
         );
         let mut response = empty_response();
 
@@ -527,6 +554,7 @@ mod tests {
             false,
             true,
             Jurisdiction::NonRegulated,
+            true,
         );
         let mut response = empty_response();
 
@@ -554,7 +582,7 @@ mod tests {
     #[test]
     fn finalize_denied_without_cookie_is_noop() {
         let settings = create_test_settings();
-        let ec_context = make_context(None, None, false, false, Jurisdiction::Unknown);
+        let ec_context = make_context(None, None, false, false, Jurisdiction::Unknown, false);
         let mut response = empty_response();
 
         let test_registry = PartnerRegistry::empty();
@@ -579,7 +607,12 @@ mod tests {
     }
 
     #[test]
-    fn finalize_unknown_jurisdiction_strips_headers_without_expiring_cookie() {
+    fn finalize_not_permitted_without_withdrawal_keeps_cookie() {
+        // When EC is not permitted (here a fail-closed unknown jurisdiction with
+        // no geo) but the request carries no explicit withdrawal signal, the
+        // response strips EC headers yet must leave an already-issued cookie
+        // intact. A pre-consent or transient fail-closed request must not
+        // permanently withdraw a returning user before they get to consent.
         let settings = create_test_settings();
         let ec_id = sample_ec_id("unk001");
         let ec_context = make_context(
@@ -588,6 +621,7 @@ mod tests {
             true,
             false,
             Jurisdiction::Unknown,
+            false,
         );
         let mut response = empty_response();
         set_header(&mut response, "x-ts-ec", &ec_id);
@@ -606,15 +640,78 @@ mod tests {
 
         assert!(
             get_header(&response, "x-ts-ec").is_none(),
-            "should strip EC header when consent cannot be verified"
+            "should strip EC header when EC is not permitted"
         );
         assert!(
             get_header(&response, "x-ts-eids").is_none(),
-            "should strip EID header when consent cannot be verified"
+            "should strip EID header when EC is not permitted"
+        );
+        assert!(
+            get_header(&response, "set-cookie").is_none(),
+            "a not-permitted request without a withdrawal signal should keep the cookie"
+        );
+    }
+
+    #[test]
+    fn set_ec_cookie_on_response_writes_the_ts_ec_cookie() {
+        // The positive case: when an EC value is present, the finalize path
+        // writes the ts-ec cookie to the browser, carrying the EC id.
+        let settings = create_test_settings();
+        let ec_id = sample_ec_id("setck1");
+        let ec_context = make_context(
+            Some(&ec_id),
+            None,
+            false,
+            true,
+            Jurisdiction::NonRegulated,
+            true,
+        );
+        let mut response = empty_response();
+
+        set_ec_cookie_on_response(&settings, &ec_context, &mut response);
+
+        let set_cookie =
+            get_header_str(&response, "set-cookie").expect("an EC value should write a Set-Cookie");
+        assert!(
+            set_cookie.contains("ts-ec=") && set_cookie.contains(&ec_id),
+            "should write the ts-ec cookie carrying the EC id, got: {set_cookie}"
         );
+    }
+
+    #[test]
+    fn closed_consent_gate_writes_no_ec_cookie() {
+        // The gate: with the consent gate closed (ec_allowed = false), no
+        // ts-ec cookie is written, even when an EC value and a generated flag are
+        // present. The consent gate is what suppresses the cookie.
+        let settings = create_test_settings();
+        let ec_id = sample_ec_id("gated1");
+        let ec_context = make_context(
+            Some(&ec_id),
+            None,
+            false,
+            true,
+            Jurisdiction::NonRegulated,
+            false,
+        );
+        let mut response = empty_response();
+
+        // Pass a KV graph so the missing-graph guard cannot be the reason the
+        // cookie is suppressed; the closed gate must be doing the work.
+        let kv = KvIdentityGraph::failing("test_store");
+        let test_registry = PartnerRegistry::empty();
+        ec_finalize_response(
+            &settings,
+            &ec_context,
+            Some(&kv),
+            &test_registry,
+            None,
+            None,
+            &mut response,
+        );
+
         assert!(
             get_header(&response, "set-cookie").is_none(),
-            "should not expire the cookie without an explicit withdrawal signal"
+            "a closed consent gate must not write a ts-ec cookie"
         );
     }
 }
diff --git a/crates/trusted-server-core/src/ec/generation.rs b/crates/trusted-server-core/src/ec/generation.rs
index 2924b7692..a3bfb1dd6 100644
--- a/crates/trusted-server-core/src/ec/generation.rs
+++ b/crates/trusted-server-core/src/ec/generation.rs
@@ -11,7 +11,6 @@ use rand::Rng;
 use sha2::Sha256;
 
 use crate::error::TrustedServerError;
-use crate::settings::Settings;
 
 type HmacSha256 = Hmac<Sha256>;
 
@@ -81,19 +80,39 @@ fn generate_random_suffix(length: usize) -> String {
 ///
 /// - [`TrustedServerError::EdgeCookie`] if HMAC generation fails
 pub fn generate_ec_id(
-    settings: &Settings,
+    passphrase: &str,
     client_ip: &str,
 ) -> Result<String, Report<TrustedServerError>> {
-    let mut mac = HmacSha256::new_from_slice(settings.ec.passphrase.expose().as_bytes())
-        .change_context(TrustedServerError::EdgeCookie {
+    generate_hmac_ec_id(passphrase, &[client_ip])
+}
+
+/// Mints an Edge Cookie identifier as HMAC-SHA256 over the given parts plus a
+/// random suffix, in the `{64hex}.{6alnum}` format.
+///
+/// The parts are joined with a unit separator (`\u{1f}`), which cannot appear in
+/// a client IP, User-Agent, JA4, or HTTP/2 fingerprint, so distinct part lists
+/// cannot collide. A provider that derives identity from several request signals
+/// (for example a Fastly provider over JA4, H2, IP, and UA) passes them as
+/// separate parts. Each part must be pre-normalized by the caller.
+///
+/// # Errors
+///
+/// - [`TrustedServerError::EdgeCookie`] if HMAC generation fails
+pub fn generate_hmac_ec_id(
+    passphrase: &str,
+    parts: &[&str],
+) -> Result<String, Report<TrustedServerError>> {
+    let mut mac = HmacSha256::new_from_slice(passphrase.as_bytes()).change_context(
+        TrustedServerError::EdgeCookie {
             message: "Failed to create HMAC instance".to_string(),
-        })?;
-    mac.update(client_ip.as_bytes());
+        },
+    )?;
+    // A unit separator cannot occur in any part, so distinct lists never collide.
+    mac.update(parts.join("\u{1f}").as_bytes());
     let hmac_hash = hex::encode(mac.finalize().into_bytes());
 
-    // Append random 6-character alphanumeric suffix for additional uniqueness.
-    let random_suffix = generate_random_suffix(6);
-    let ec_id = format!("{hmac_hash}.{random_suffix}");
+    // Append a random 6-character alphanumeric suffix for additional uniqueness.
+    let ec_id = format!("{hmac_hash}.{}", generate_random_suffix(6));
 
     log::trace!("Generated fresh EC ID: {}", super::log_id(&ec_id));
 
@@ -175,7 +194,39 @@ mod tests {
     use super::*;
     use std::net::{Ipv4Addr, Ipv6Addr};
 
-    use crate::test_support::tests::create_test_settings;
+    const TEST_PASSPHRASE: &str = "test-secret-key-32-bytes-minimum";
+
+    #[test]
+    fn generate_hmac_ec_id_is_stable_per_parts_and_collision_resistant() {
+        // The 64-char hex prefix is HMAC over the parts and is stable for the
+        // same parts; the random suffix varies, so compare prefixes only.
+        let prefix = |parts: &[&str]| {
+            generate_hmac_ec_id(TEST_PASSPHRASE, parts)
+                .expect("should generate")
+                .split('.')
+                .next()
+                .expect("should have a prefix")
+                .to_owned()
+        };
+
+        assert_eq!(
+            prefix(&["a", "b"]),
+            prefix(&["a", "b"]),
+            "the same parts should yield the same stable prefix"
+        );
+        assert_ne!(
+            prefix(&["a", "b"]),
+            prefix(&["a", "c"]),
+            "different parts should yield a different prefix"
+        );
+        // The unit separator prevents a join collision: ["a", "b"] must not hash
+        // the same as ["ab"].
+        assert_ne!(
+            prefix(&["a", "b"]),
+            prefix(&["ab"]),
+            "the separator should prevent ['a','b'] colliding with ['ab']"
+        );
+    }
 
     #[test]
     fn normalize_ipv4_unchanged() {
@@ -215,8 +266,7 @@ mod tests {
 
     #[test]
     fn generate_produces_valid_format() {
-        let settings = create_test_settings();
-        let ec_id = generate_ec_id(&settings, "192.168.1.1").expect("should generate EC ID");
+        let ec_id = generate_ec_id(TEST_PASSPHRASE, "192.168.1.1").expect("should generate EC ID");
         assert!(
             is_valid_ec_id(&ec_id),
             "should match EC ID format: {{64hex}}.{{6alnum}}, got: {ec_id}"
@@ -225,10 +275,10 @@ mod tests {
 
     #[test]
     fn generate_same_ip_produces_consistent_hash_prefix() {
-        let settings = create_test_settings();
-        let first = generate_ec_id(&settings, "192.168.1.1").expect("should generate first EC ID");
+        let first =
+            generate_ec_id(TEST_PASSPHRASE, "192.168.1.1").expect("should generate first EC ID");
         let second =
-            generate_ec_id(&settings, "192.168.1.1").expect("should generate second EC ID");
+            generate_ec_id(TEST_PASSPHRASE, "192.168.1.1").expect("should generate second EC ID");
 
         assert_eq!(
             ec_hash(&first),
diff --git a/crates/trusted-server-core/src/ec/identify.rs b/crates/trusted-server-core/src/ec/identify.rs
index 6ca251905..eeadaa290 100644
--- a/crates/trusted-server-core/src/ec/identify.rs
+++ b/crates/trusted-server-core/src/ec/identify.rs
@@ -10,7 +10,6 @@ use http::{Request, Response, StatusCode};
 use url::Url;
 
 use super::auth::authenticate_bearer;
-use super::consent::ec_consent_granted;
 use crate::error::TrustedServerError;
 use crate::openrtb::{Eid, Uid};
 use crate::settings::Settings;
@@ -62,7 +61,7 @@ pub fn handle_identify(
         );
     };
 
-    if !ec_consent_granted(ec_context.consent()) {
+    if !ec_context.ec_allowed() {
         return json_response_with_origin(
             StatusCode::FORBIDDEN,
             &serde_json::json!({ "consent": "denied" }),
@@ -332,7 +331,6 @@ fn apply_cors_headers(response: &mut Response<EdgeBody>, origin: &str) {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::consent::jurisdiction::Jurisdiction;
     use crate::consent::types::{ConsentContext, ConsentSource};
     use crate::ec::registry::PartnerRegistry;
     use crate::redacted::Redacted;
@@ -352,13 +350,12 @@ mod tests {
         );
     }
 
-    fn make_ec_context(jurisdiction: Jurisdiction, ec_value: Option<&str>) -> EcContext {
+    fn make_ec_context(ec_allowed: bool, ec_value: Option<&str>) -> EcContext {
         let consent = ConsentContext {
-            jurisdiction,
             source: ConsentSource::Cookie,
             ..ConsentContext::default()
         };
-        EcContext::new_for_test(ec_value.map(str::to_owned), consent)
+        EcContext::new_for_test_gated(ec_value.map(str::to_owned), consent, ec_allowed)
     }
 
     fn make_test_partner(source_domain: &str, api_token: &str) -> EcPartner {
@@ -472,7 +469,7 @@ mod tests {
             .uri("https://edge.test-publisher.com/identify")
             .body(EdgeBody::empty())
             .expect("should build test request");
-        let ec_context = make_ec_context(Jurisdiction::NonRegulated, None);
+        let ec_context = make_ec_context(true, None);
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct unauthorized response");
@@ -514,7 +511,7 @@ mod tests {
             .header("authorization", "Bearer wrong-token")
             .body(EdgeBody::empty())
             .expect("should build test request");
-        let ec_context = make_ec_context(Jurisdiction::NonRegulated, None);
+        let ec_context = make_ec_context(true, None);
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct unauthorized response");
@@ -539,7 +536,7 @@ mod tests {
             .header("authorization", format!("Bearer {VALID_API_TOKEN}"))
             .body(EdgeBody::empty())
             .expect("should build test request");
-        let ec_context = make_ec_context(Jurisdiction::Unknown, None);
+        let ec_context = make_ec_context(false, None);
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct denied response");
@@ -573,7 +570,7 @@ mod tests {
             .header("authorization", format!("Bearer {VALID_API_TOKEN}"))
             .body(EdgeBody::empty())
             .expect("should build test request");
-        let ec_context = make_ec_context(Jurisdiction::NonRegulated, None);
+        let ec_context = make_ec_context(true, None);
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct no-content response");
@@ -599,7 +596,7 @@ mod tests {
             .body(EdgeBody::empty())
             .expect("should build test request");
         let ec_id = format!("{}.ABC123", "a".repeat(64));
-        let ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
+        let ec_context = make_ec_context(true, Some(&ec_id));
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct degraded identify response");
@@ -652,7 +649,7 @@ mod tests {
             .header("origin", "https://evil.example")
             .body(EdgeBody::empty())
             .expect("should build test request");
-        let ec_context = make_ec_context(Jurisdiction::NonRegulated, None);
+        let ec_context = make_ec_context(true, None);
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct forbidden response");
@@ -678,7 +675,7 @@ mod tests {
             .header("origin", "https://www.test-publisher.com")
             .body(EdgeBody::empty())
             .expect("should build test request");
-        let ec_context = make_ec_context(Jurisdiction::NonRegulated, None);
+        let ec_context = make_ec_context(true, None);
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct no-content response with CORS headers");
diff --git a/crates/trusted-server-core/src/ec/mod.rs b/crates/trusted-server-core/src/ec/mod.rs
index d17fcd519..9e8d75f9d 100644
--- a/crates/trusted-server-core/src/ec/mod.rs
+++ b/crates/trusted-server-core/src/ec/mod.rs
@@ -44,6 +44,7 @@ pub mod kv_backend;
 pub mod kv_types;
 pub mod partner;
 pub mod prebid_eids;
+pub mod provider;
 pub mod pull_sync;
 pub mod rate_limiter;
 pub mod registry;
@@ -59,6 +60,8 @@ pub fn log_id(ec_id: &str) -> String {
     format!("{prefix}\u{2026}")
 }
 
+use std::sync::Arc;
+
 use cookie::CookieJar;
 use edgezero_core::body::Body as EdgeBody;
 use error_stack::Report;
@@ -69,10 +72,12 @@ use crate::constants::COOKIE_TS_EC;
 use crate::cookies::handle_request_cookies;
 use crate::ec::cookies::ec_id_has_only_allowed_chars;
 use crate::error::TrustedServerError;
+use crate::evidence::BorrowedRequestInfo;
 use crate::geo::GeoInfo;
 use crate::platform::RuntimeServices;
 use crate::settings::Settings;
 use device::DeviceSignals;
+use provider::{EdgeCookieProvider, GeneratedEdgeCookie, IdentityInput, build_provider};
 
 use self::kv::KvIdentityGraph;
 use self::kv_types::KvEntry;
@@ -151,6 +156,10 @@ pub struct EcContext {
     ec_generated: bool,
     /// The consent context for this request.
     consent: ConsentContext,
+    /// Whether Edge Cookie creation is allowed for this request. Resolved once
+    /// at construction from the consent context and read via
+    /// [`ec_allowed`](Self::ec_allowed).
+    ec_allowed: bool,
     /// The normalized client IP, captured early before the request body
     /// is consumed. `None` when the platform cannot determine client IP.
     client_ip: Option<String>,
@@ -160,6 +169,27 @@ pub struct EcContext {
     /// Set via [`EcContext::set_device_signals`] before
     /// [`EcContext::generate_if_needed`] is called.
     device_signals: Option<DeviceSignals>,
+    /// The selected Edge Cookie provider (built-in or injected), built once at
+    /// construction. Core asks it whether an identifier is well formed
+    /// ([`accepts_id`](crate::ec::provider::EdgeCookieProvider::accepts_id)) so
+    /// an opaque vendor identifier round-trips through read-back and withdrawal
+    /// instead of being dropped by the built-in shape check. `None` when no
+    /// provider is configured.
+    selected_provider: Option<Arc<dyn crate::ec::provider::EdgeCookieProvider>>,
+    /// A snapshot of the request evidence a provider reads at generation time:
+    /// the request headers (so a provider can read cookies and client hints), and
+    /// the URL path and query string (so it can read request parameters).
+    /// Captured once at construction, and only when a provider is configured, so
+    /// a deployment with no Edge Cookie provider clones nothing. A provider reads
+    /// these through [`RequestInfo`](crate::evidence::RequestInfo) at generate
+    /// time.
+    request_headers: http::HeaderMap,
+    request_path: String,
+    request_query: String,
+    /// Response headers a provider asked to set, captured during
+    /// [`EcContext::generate_if_needed`] and applied to the response by EC
+    /// finalization. Empty for providers that set no headers.
+    response_headers: Vec<(http::HeaderName, http::HeaderValue)>,
 }
 
 impl EcContext {
@@ -199,13 +229,48 @@ impl EcContext {
     ) -> Result<Self, Report<TrustedServerError>> {
         let parsed = parse_ec_from_request(req)?;
 
-        let ec_value = parsed.cookie_ec.clone().filter(|v| is_valid_ec_id(v));
+        // Build the selected provider once. It is used here to decide whether
+        // the incoming cookie value is a usable identifier. Building it needs
+        // no request data, so nothing is cloned from the request.
+        let ec_provider = services.ec_provider();
+        let selected_provider: Option<Arc<dyn crate::ec::provider::EdgeCookieProvider>> =
+            build_provider(&settings.ec, ec_provider.clone())?.map(Arc::from);
+
+        // Read back an existing identifier only when the selected provider
+        // accepts its shape, so an opaque vendor identifier (for example a signed
+        // envelope) round-trips instead of being silently dropped by the built-in
+        // shape check. With no provider configured, Trusted Server is stateless:
+        // an existing identifier is treated as absent so it is never used or
+        // egressed, while the raw cookie value stays available to withdrawal
+        // handling below.
+        let ec_value = parsed.cookie_ec.clone().filter(|v| {
+            selected_provider
+                .as_ref()
+                .is_some_and(|selected| selected.accepts_id(v))
+        });
         let ec_was_present = ec_value.is_some();
 
         if let Some(ref id) = ec_value {
             log::trace!("Existing EC ID found: {}", log_id(id));
         }
 
+        // Snapshot the request evidence a provider reads at generation time (the
+        // headers, so it can read cookies and client hints, and the URL path and
+        // query, so it can read request parameters). Capture only when a provider
+        // is configured and no identifier already exists, so a no-provider
+        // deployment and a returning visitor clone nothing. Generation runs after
+        // the request body may be consumed, so the snapshot is owned.
+        let (request_headers, request_path, request_query) =
+            if selected_provider.is_some() && ec_value.is_none() {
+                (
+                    req.headers().clone(),
+                    req.uri().path().to_owned(),
+                    req.uri().query().unwrap_or_default().to_owned(),
+                )
+            } else {
+                (http::HeaderMap::new(), String::new(), String::new())
+            };
+
         // Capture the client IP from platform services (normalized).
         let client_ip = services
             .client_info()
@@ -222,11 +287,20 @@ impl EcContext {
             kv_store: None,
         });
 
+        // Gate Edge Cookie creation and use on the request's consent context
+        // (jurisdiction and consent signals). With no provider selected nothing
+        // may mint or use an identifier, so the gate is closed rather than open
+        // by default. Downstream consumers read the stored result via
+        // [`EcContext::ec_allowed`] rather than re-deriving it.
+        let ec_allowed = selected_provider
+            .as_ref()
+            .is_some_and(|_| consent::ec_consent_granted(&consent));
+
         log::info!(
-            "EC context: present={}, cookie_present={}, consent_allowed={}, jurisdiction={}",
+            "EC context: present={}, cookie_present={}, ec_allowed={}, jurisdiction={}",
             ec_was_present,
             parsed.cookie_ec.is_some(),
-            consent::ec_consent_granted(&consent),
+            ec_allowed,
             consent.jurisdiction,
         );
 
@@ -236,9 +310,15 @@ impl EcContext {
             ec_was_present,
             ec_generated: false,
             consent,
+            ec_allowed,
             client_ip,
             geo_info: geo_info.cloned(),
             device_signals: None,
+            selected_provider,
+            request_headers,
+            request_path,
+            request_query,
+            response_headers: Vec::new(),
         })
     }
 
@@ -264,22 +344,88 @@ impl EcContext {
             return Ok(());
         }
 
-        if !consent::ec_consent_granted(&self.consent) {
+        // A deployment with no provider selected is stateless: nothing to
+        // generate, and not an error. Reuse the provider built at read time
+        // rather than building it again.
+        let Some(ec_provider) = self.selected_provider.clone() else {
+            log::trace!("EC generation skipped: no Edge Cookie provider configured");
+            return Ok(());
+        };
+
+        if !self.ec_allowed {
             log::info!(
-                "EC generation skipped: consent not granted (jurisdiction={})",
+                "EC generation skipped: EC creation not permitted (jurisdiction={})",
                 self.consent.jurisdiction,
             );
             return Ok(());
         }
 
-        let client_ip = self.client_ip.as_deref().ok_or_else(|| {
-            Report::new(TrustedServerError::EdgeCookie {
+        // EC generation needs the client IP; checked after the cheap skip
+        // guards so a stateless deployment on a host with no client IP does not
+        // log spurious errors. The provider reads it borrowed at generate time
+        // (see [`generate_with_provider`]), so nothing is cloned here.
+        if self.client_ip.is_none() {
+            return Err(Report::new(TrustedServerError::EdgeCookie {
                 message: "Client IP required for EC generation but unavailable".to_owned(),
-            })
-        })?;
+            }));
+        }
+
+        self.generate_with_provider(ec_provider.as_ref(), settings, kv)
+    }
 
-        let ec_id = generation::generate_ec_id(settings, client_ip)?;
-        log::info!("Generated new EC ID: {}", log_id(&ec_id));
+    /// Derives and commits an EC identifier using a specific provider.
+    ///
+    /// Split out of [`generate_if_needed`](Self::generate_if_needed) so the
+    /// provider is supplied explicitly: the configured path builds it from
+    /// settings, and tests pass one in to observe the [`IdentityInput`] a
+    /// provider receives. The request evidence captured at read time (client
+    /// IP, headers, and the URL path and query) is passed borrowed through
+    /// [`RequestInfo`](crate::evidence::RequestInfo), so a provider can read
+    /// cookies and request parameters at generate time; the built-ins read
+    /// only the client IP. The skip guards (existing EC, consent gate)
+    /// stay in [`generate_if_needed`](Self::generate_if_needed).
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::EdgeCookie`] when the client IP is
+    /// unavailable, the provider fails to derive an identifier, or persisting a
+    /// generated identifier to the KV identity graph fails.
+    fn generate_with_provider(
+        &mut self,
+        ec_provider: &dyn EdgeCookieProvider,
+        settings: &Settings,
+        kv: Option<&KvIdentityGraph>,
+    ) -> Result<(), Report<TrustedServerError>> {
+        let input = IdentityInput {
+            consent: Some(&self.consent),
+        };
+        // Pass the request evidence captured at read time, borrowed: the client
+        // IP, the request headers (so a provider reads cookies and client hints),
+        // and the URL path and query (so it reads request parameters). A built-in
+        // provider reads only the client IP; a vendor provider reads what it
+        // needs through [`RequestInfo`].
+        let request_info = BorrowedRequestInfo::new(
+            self.client_ip.as_deref().unwrap_or_default(),
+            Some(&self.request_headers),
+        )
+        .with_request_target(&self.request_path, &self.request_query);
+        let generated: GeneratedEdgeCookie = ec_provider.generate(&request_info, &input)?;
+        // Capture any response headers the provider asked for, even when it
+        // produced no identifier (for example while it still needs more client
+        // evidence). EC finalization applies them to the response.
+        self.response_headers = generated.response_headers;
+        let Some(ec_id) = generated.id else {
+            log::info!(
+                "EC generation produced no identifier (provider={}); proceeding without an EC",
+                ec_provider.id(),
+            );
+            return Ok(());
+        };
+        log::info!(
+            "Generated new EC ID (provider={}): {}",
+            ec_provider.id(),
+            log_id(&ec_id),
+        );
         self.ec_value = Some(ec_id);
         self.ec_generated = true;
 
@@ -318,6 +464,21 @@ impl EcContext {
         self.ec_value.as_deref()
     }
 
+    /// Returns whether `value` is a well-formed identifier for the selected
+    /// provider.
+    ///
+    /// Lets core validate a cookie or active identifier (for example before
+    /// withdrawing it) through the provider that issued it, rather than assuming
+    /// the built-in shape. Falls back to the built-in shape when no provider is
+    /// configured.
+    #[must_use]
+    pub(crate) fn accepts_id(&self, value: &str) -> bool {
+        self.selected_provider.as_ref().map_or_else(
+            || is_valid_ec_id(value),
+            |provider| provider.accepts_id(value),
+        )
+    }
+
     /// Returns whether the `ts-ec` cookie was present on the incoming request.
     #[must_use]
     pub fn cookie_was_present(&self) -> bool {
@@ -347,7 +508,8 @@ impl EcContext {
     ///
     /// Allows handlers to apply query-param fallback consent for the current
     /// request only when pre-routing consent extraction produced an empty
-    /// context.
+    /// context. Mutations do not re-derive [`ec_allowed`](Self::ec_allowed),
+    /// which is resolved once at construction.
     pub fn consent_mut(&mut self) -> &mut ConsentContext {
         &mut self.consent
     }
@@ -364,6 +526,14 @@ impl EcContext {
         self.device_signals = Some(signals);
     }
 
+    /// Returns the response headers a provider asked to set during
+    /// [`generate_if_needed`](Self::generate_if_needed). Empty unless a provider
+    /// produced any.
+    #[must_use]
+    pub fn response_headers(&self) -> &[(http::HeaderName, http::HeaderValue)] {
+        &self.response_headers
+    }
+
     /// Returns the device signals, if set.
     #[must_use]
     pub fn device_signals(&self) -> Option<&DeviceSignals> {
@@ -382,10 +552,13 @@ impl EcContext {
         self.geo_info.as_ref()
     }
 
-    /// Returns whether EC creation is permitted by consent for this request.
+    /// Returns whether Edge Cookie creation is allowed for this request.
+    ///
+    /// Resolved once at construction from the consent context (see
+    /// [`consent::ec_consent_granted`]).
     #[must_use]
     pub fn ec_allowed(&self) -> bool {
-        consent::ec_consent_granted(&self.consent)
+        self.ec_allowed
     }
 
     /// Returns the existing EC cookie value for revocation handling.
@@ -399,12 +572,17 @@ impl EcContext {
     }
 
     /// Returns `true` when the request carried a cookie EC and the selected
-    /// active EC differs from that cookie value.
+    /// active EC denotes a different identity than the cookie value.
+    ///
+    /// The equality test is delegated to the [`EdgeCookieProvider`], because EC
+    /// identifiers are not assumed comparable by natural string equality: two
+    /// values may be different wrappers of the same payload, which only the
+    /// provider knows how to compare.
     #[must_use]
-    pub fn cookie_differs_from_active_ec(&self) -> bool {
+    pub fn cookie_differs_from_active_ec(&self, provider: &dyn EdgeCookieProvider) -> bool {
         matches!(
             (self.cookie_ec_value.as_deref(), self.ec_value.as_deref()),
-            (Some(cookie), Some(active)) if cookie != active
+            (Some(cookie), Some(active)) if !provider.keys_equal(cookie, active)
         )
     }
 
@@ -414,19 +592,45 @@ impl EcContext {
         self.ec_value.as_deref().map(generation::ec_hash)
     }
 
-    /// Creates a test-only `EcContext` with explicit field values.
+    /// Creates a test-only `EcContext` whose creation gate is derived from the
+    /// consent context, matching the production construction path.
+    ///
+    /// Use [`new_for_test_gated`](Self::new_for_test_gated) when a test needs
+    /// an explicit gate.
     #[cfg(test)]
     #[must_use]
     pub fn new_for_test(ec_value: Option<String>, consent: ConsentContext) -> Self {
+        let ec_allowed = consent::ec_consent_granted(&consent);
+        Self::new_for_test_gated(ec_value, consent, ec_allowed)
+    }
+
+    /// Creates a test-only `EcContext` with an explicit creation gate.
+    ///
+    /// `ec_allowed` stands in for the gating decision the production path
+    /// resolves at construction, so a test can exercise the gate-open and
+    /// gate-closed branches directly.
+    #[cfg(test)]
+    #[must_use]
+    pub fn new_for_test_gated(
+        ec_value: Option<String>,
+        consent: ConsentContext,
+        ec_allowed: bool,
+    ) -> Self {
         Self {
             ec_was_present: ec_value.is_some(),
             cookie_ec_value: ec_value.clone(),
             ec_value,
             ec_generated: false,
             consent,
+            ec_allowed,
             client_ip: None,
             geo_info: None,
             device_signals: None,
+            selected_provider: None,
+            request_headers: http::HeaderMap::new(),
+            request_path: String::new(),
+            request_query: String::new(),
+            response_headers: Vec::new(),
         }
     }
 
@@ -438,15 +642,22 @@ impl EcContext {
         consent: ConsentContext,
         client_ip: Option<String>,
     ) -> Self {
+        let ec_allowed = consent::ec_consent_granted(&consent);
         Self {
             ec_was_present: ec_value.is_some(),
             cookie_ec_value: ec_value.clone(),
             ec_value,
             ec_generated: false,
             consent,
+            ec_allowed,
             client_ip,
             geo_info: None,
             device_signals: None,
+            selected_provider: None,
+            request_headers: http::HeaderMap::new(),
+            request_path: String::new(),
+            request_query: String::new(),
+            response_headers: Vec::new(),
         }
     }
 
@@ -460,6 +671,7 @@ impl EcContext {
         ec_was_present: bool,
         ec_generated: bool,
         consent: ConsentContext,
+        ec_allowed: bool,
     ) -> Self {
         Self {
             ec_value,
@@ -467,9 +679,15 @@ impl EcContext {
             ec_was_present,
             ec_generated,
             consent,
+            ec_allowed,
             client_ip: None,
             geo_info: None,
             device_signals: None,
+            selected_provider: None,
+            request_headers: http::HeaderMap::new(),
+            request_path: String::new(),
+            request_query: String::new(),
+            response_headers: Vec::new(),
         }
     }
 }
@@ -493,6 +711,7 @@ pub(crate) fn current_timestamp() -> u64 {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::evidence::{OwnedRequestInfo, RequestInfo};
     use crate::platform::test_support::noop_services;
     use crate::test_support::tests::create_test_settings;
 
@@ -511,6 +730,368 @@ mod tests {
         format!("{}.{suffix}", prefix_char.repeat(64))
     }
 
+    /// A test provider that compares identifiers by the payload after a `:`,
+    /// modeling an envelope whose wrapper can differ for the same identity.
+    #[derive(Debug)]
+    struct WrapperInsensitiveProvider;
+
+    impl EdgeCookieProvider for WrapperInsensitiveProvider {
+        fn id(&self) -> &'static str {
+            "wrapper-insensitive"
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie::default())
+        }
+
+        fn keys_equal(&self, left: &str, right: &str) -> bool {
+            fn payload(value: &str) -> &str {
+                value.split_once(':').map_or(value, |(_, payload)| payload)
+            }
+            payload(left) == payload(right)
+        }
+    }
+
+    /// A test provider that does not override `keys_equal`, so it uses the
+    /// default natural string equality.
+    #[derive(Debug)]
+    struct NaturalProvider;
+
+    impl EdgeCookieProvider for NaturalProvider {
+        fn id(&self) -> &'static str {
+            "natural"
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie::default())
+        }
+    }
+
+    #[test]
+    fn cookie_differs_from_active_ec_delegates_to_the_provider() {
+        // The cookie and the active EC are different wrappers of one payload.
+        let context = EcContext::new_for_test_with_cookie(
+            Some("wrapper-active:shared-payload".to_owned()),
+            Some("wrapper-cookie:shared-payload".to_owned()),
+            true,
+            false,
+            ConsentContext::default(),
+            true,
+        );
+
+        assert!(
+            !context.cookie_differs_from_active_ec(&WrapperInsensitiveProvider),
+            "a payload-aware provider should treat different wrappers as the same identity"
+        );
+        assert!(
+            context.cookie_differs_from_active_ec(&NaturalProvider),
+            "natural equality should treat different wrappers as different"
+        );
+    }
+
+    /// A provider that records the `Cookie` header from the request info passed
+    /// to `generate`, so a test can prove request cookies reach a provider (a
+    /// client that stores values in cookies relies on this).
+    #[derive(Debug)]
+    struct CookieCapturingProvider {
+        seen_cookie: std::sync::Mutex<Option<String>>,
+    }
+
+    impl EdgeCookieProvider for CookieCapturingProvider {
+        fn id(&self) -> &'static str {
+            "cookie-capturing"
+        }
+
+        fn generate(
+            &self,
+            request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            let cookie = request_info.header("cookie").map(ToOwned::to_owned);
+            *self.seen_cookie.lock().expect("should lock seen cookie") = cookie;
+            Ok(GeneratedEdgeCookie::default())
+        }
+    }
+
+    #[test]
+    fn a_provider_reads_request_cookies_from_the_request_info() {
+        // RequestInfo contract: a provider given request info that carries
+        // headers can read request cookies through it (a client that stores
+        // values in cookies relies on this). The organic generate path passes
+        // no header snapshot; a caller that has headers supplies them.
+        let mut headers = http::HeaderMap::new();
+        headers.insert(
+            "cookie",
+            "client-id=abc123; ts-ec=xyz"
+                .parse()
+                .expect("should build a valid cookie header"),
+        );
+        let request_info = OwnedRequestInfo::new("203.0.113.7".to_owned(), headers);
+        let provider = CookieCapturingProvider {
+            seen_cookie: std::sync::Mutex::new(None),
+        };
+
+        provider
+            .generate(&request_info, &IdentityInput::default())
+            .expect("generation should succeed");
+
+        assert_eq!(
+            provider
+                .seen_cookie
+                .lock()
+                .expect("should lock seen cookie")
+                .as_deref(),
+            Some("client-id=abc123; ts-ec=xyz"),
+            "the provider should read the request cookies from the request info"
+        );
+    }
+
+    /// A provider whose identifiers are opaque and deliberately not the
+    /// built-in HMAC shape (no dot, mixed case), modeling a vendor identifier
+    /// such as a signed envelope. It accepts any of its own non-empty
+    /// identifiers.
+    #[derive(Debug)]
+    struct OpaqueIdProvider;
+
+    impl EdgeCookieProvider for OpaqueIdProvider {
+        fn id(&self) -> &'static str {
+            "opaque"
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie::default())
+        }
+
+        fn accepts_id(&self, value: &str) -> bool {
+            !value.is_empty()
+        }
+    }
+
+    /// A geo that resolves to the non-regulated jurisdiction (US, no region),
+    /// so the consent gate is open and generation runs in provider tests.
+    fn non_regulated_geo() -> GeoInfo {
+        GeoInfo {
+            city: String::new(),
+            country: "US".to_owned(),
+            continent: "NorthAmerica".to_owned(),
+            latitude: 0.0,
+            longitude: 0.0,
+            metro_code: 0,
+            region: None,
+            asn: None,
+        }
+    }
+
+    #[test]
+    fn read_from_request_round_trips_an_opaque_provider_identifier() {
+        use crate::platform::test_support::noop_services_with_ec_provider;
+
+        // A vendor identifier that is deliberately not the built-in HMAC shape
+        // (no dot, mixed case) — the exact value the built-in check would drop.
+        const OPAQUE_ID: &str = "AbC123opaqueEnvelopeValueXYZ";
+
+        let mut settings = create_test_settings();
+        settings.ec.provider = Some("opaque".to_owned());
+        let cookie = format!("ts-ec={OPAQUE_ID}");
+        let req = create_test_request(&[("cookie", &cookie)]);
+
+        // With the opaque provider injected, its `accepts_id` governs read-back,
+        // so the identifier survives verbatim.
+        let services = noop_services_with_ec_provider(Arc::new(OpaqueIdProvider));
+        let ec = EcContext::read_from_request(&settings, &req, &services)
+            .expect("should read EC context");
+        assert_eq!(
+            ec.ec_value(),
+            Some(OPAQUE_ID),
+            "an opaque provider identifier should round-trip through read-back verbatim"
+        );
+
+        // Control: with the provider selected but not injected by the adapter,
+        // the request fails loudly instead of silently running stateless with
+        // the identifier dropped.
+        let err = EcContext::read_from_request(&settings, &req, &noop_services())
+            .expect_err("a selected but uninjected provider should fail the request");
+        assert!(
+            err.to_string().contains("opaque"),
+            "the error should name the selected provider, got: {err}"
+        );
+
+        // Control: with no provider selected at all, the identifier is treated
+        // as absent, so a stateless deployment never uses or egresses it.
+        let mut stateless = create_test_settings();
+        stateless.ec.provider = None;
+        stateless.ec.providers.hmac = None;
+        let ec_without = EcContext::read_from_request(&stateless, &req, &noop_services())
+            .expect("should read EC context");
+        assert_eq!(
+            ec_without.ec_value(),
+            None,
+            "with no provider selected, an existing identifier is treated as absent"
+        );
+        assert!(
+            !ec_without.ec_allowed(),
+            "with no provider selected, the gate stays closed"
+        );
+    }
+
+    /// A provider that records the request query parameter `id` and the `Cookie`
+    /// header it is given at generate time, proving request evidence (parameters
+    /// and cookies) reaches a provider through the organic generate path.
+    #[derive(Debug, Default)]
+    struct EvidenceCapturingProvider {
+        seen: std::sync::Mutex<Option<(String, String)>>,
+    }
+
+    impl EdgeCookieProvider for EvidenceCapturingProvider {
+        fn id(&self) -> &'static str {
+            "evidence"
+        }
+
+        fn generate(
+            &self,
+            request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            let query_id = request_info.query_param("id").unwrap_or_default();
+            let cookie = request_info.header("cookie").unwrap_or_default().to_owned();
+            *self.seen.lock().expect("should lock seen evidence") = Some((query_id, cookie));
+            Ok(GeneratedEdgeCookie {
+                id: Some("evidence-ec".to_owned()),
+                response_headers: Vec::new(),
+            })
+        }
+
+        fn accepts_id(&self, value: &str) -> bool {
+            !value.is_empty()
+        }
+    }
+
+    #[test]
+    fn generate_passes_request_parameters_and_cookies_to_the_provider() {
+        use crate::platform::test_support::noop_services_with_ec_provider;
+
+        let provider = Arc::new(EvidenceCapturingProvider::default());
+        let mut settings = create_test_settings();
+        settings.ec.provider = Some("evidence".to_owned());
+
+        // A request carrying a query parameter and a (non-EC) cookie, with no
+        // existing `ts-ec` cookie so the generate path runs.
+        let req = Request::builder()
+            .method("GET")
+            .uri("http://example.com/page?id=abc123&debug=1")
+            .header("cookie", "client-id=xyz789")
+            .body(EdgeBody::empty())
+            .expect("should build request");
+
+        let services = noop_services_with_ec_provider(provider.clone());
+        let geo = non_regulated_geo();
+        let mut ec = EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+            .expect("should read EC context");
+        ec.generate_if_needed(&settings, None)
+            .expect("should run generation");
+
+        let seen = provider
+            .seen
+            .lock()
+            .expect("should lock seen evidence")
+            .clone();
+        assert_eq!(
+            seen,
+            Some(("abc123".to_owned(), "client-id=xyz789".to_owned())),
+            "the provider should read the request query parameter and cookies at generate time"
+        );
+        assert_eq!(
+            ec.ec_value(),
+            Some("evidence-ec"),
+            "the identifier the provider minted should be committed"
+        );
+    }
+
+    /// A provider that mints an opaque, mixed-case, non-HMAC identifier at the
+    /// edge, so a test can prove such an identifier persists to the KV identity
+    /// graph under its own value as the key.
+    #[derive(Debug)]
+    struct ServerOpaqueProvider;
+
+    impl EdgeCookieProvider for ServerOpaqueProvider {
+        fn id(&self) -> &'static str {
+            "server-opaque"
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie {
+                id: Some("Opaque_EC_Value_MixedCase_123".to_owned()),
+                response_headers: Vec::new(),
+            })
+        }
+
+        fn accepts_id(&self, value: &str) -> bool {
+            !value.is_empty()
+        }
+
+        fn normalize_id_for_kv(&self, value: &str) -> String {
+            value.to_owned()
+        }
+    }
+
+    #[test]
+    fn generate_persists_an_opaque_identifier_to_kv_under_its_own_key() {
+        use crate::platform::test_support::noop_services_with_ec_provider;
+
+        const OPAQUE: &str = "Opaque_EC_Value_MixedCase_123";
+
+        let mut settings = create_test_settings();
+        settings.ec.provider = Some("server-opaque".to_owned());
+        let services = noop_services_with_ec_provider(Arc::new(ServerOpaqueProvider));
+        let graph = KvIdentityGraph::in_memory("test-ec-store");
+
+        // No existing cookie, so the edge mints and persists.
+        let req = create_test_request(&[]);
+        let geo = non_regulated_geo();
+        let mut ec = EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+            .expect("should read EC context");
+        ec.generate_if_needed(&settings, Some(&graph))
+            .expect("should generate and persist");
+
+        assert_eq!(
+            ec.ec_value(),
+            Some(OPAQUE),
+            "the opaque identifier should be minted"
+        );
+
+        // The entry is stored under the full identifier verbatim.
+        assert!(
+            graph.get(OPAQUE).expect("kv get should succeed").is_some(),
+            "the entry should exist under the opaque identifier key"
+        );
+
+        // A lowercased key must miss, proving the key preserves case rather than
+        // being lowercased like the built-in HMAC form (the clash this guards).
+        assert!(
+            graph
+                .get(&OPAQUE.to_lowercase())
+                .expect("kv get should succeed")
+                .is_none(),
+            "the KV key must be case-sensitive and verbatim, not lowercased"
+        );
+    }
+
     #[test]
     fn read_from_request_ignores_header_ec() {
         let settings = create_test_settings();
diff --git a/crates/trusted-server-core/src/ec/provider.rs b/crates/trusted-server-core/src/ec/provider.rs
new file mode 100644
index 000000000..42a133e47
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/provider.rs
@@ -0,0 +1,404 @@
+//! Edge Cookie identity providers.
+//!
+//! An [`EdgeCookieProvider`] derives an Edge Cookie identifier. Providers are
+//! wired by dependency injection: a provider's constructor takes the services it
+//! needs (for example [`RequestInfo`] for the client IP)
+//! (the adapter, through [`build_provider`]) supplies instances per request. A
+//! provider that needs a service the host does not supply cannot be built, so
+//! the request stops rather than silently degrading.
+//!
+//! The provider is selected by configuration, with no default. [`HmacProvider`]
+//! is the built-in server-side implementation that derives the identifier from
+//! the client IP using HMAC, the behavior Trusted Server has always shipped.
+
+use std::sync::Arc;
+
+use error_stack::Report;
+
+use crate::consent::ConsentContext;
+use crate::error::TrustedServerError;
+use crate::evidence::RequestInfo;
+use crate::redacted::Redacted;
+use crate::settings::Ec;
+
+use super::generation;
+
+/// The request-scoped gating context passed to [`EdgeCookieProvider::generate`].
+///
+/// Request data (client IP, User-Agent, headers, host signals) reaches a
+/// provider through the services injected into its constructor, not through this
+/// struct. This carries only the per-request gating context a provider may read
+/// for behavior beyond gating. The gate has already confirmed Edge Cookie
+/// storage is allowed before `generate` is called.
+#[derive(Default)]
+pub struct IdentityInput<'a> {
+    /// The request's consent context, when available, for provider-specific
+    /// logic. The core gates generation before calling the provider, so a
+    /// provider reads this only to forward or record consent. [`HmacProvider`]
+    /// ignores it.
+    pub consent: Option<&'a ConsentContext>,
+}
+
+/// The outcome of [`EdgeCookieProvider::generate`].
+///
+/// Carries the derived identifier, if any, and any response headers the provider
+/// needs set on the outbound response.
+#[derive(Debug, Default)]
+pub struct GeneratedEdgeCookie {
+    /// The derived Edge Cookie identifier, or `None` when the provider produced
+    /// none for this request.
+    pub id: Option<String>,
+
+    /// Response headers the provider needs set on the outbound response, for
+    /// example to request additional client evidence on later requests. Empty
+    /// for providers that set no headers, such as [`HmacProvider`].
+    pub response_headers: Vec<(http::HeaderName, http::HeaderValue)>,
+}
+
+/// A strategy for deriving an Edge Cookie identifier.
+///
+/// Implementations are selected by configuration. A provider derives the
+/// identifier at the edge in [`generate`](Self::generate), and the page
+/// response sets the `ts-ec` cookie.
+///
+/// A provider returns `Ok(None)` from [`generate`](Self::generate) when it
+/// cannot derive an identifier at the edge, so the request proceeds without an
+/// Edge Cookie rather than failing.
+pub trait EdgeCookieProvider: Send + Sync + core::fmt::Debug {
+    /// Returns the stable identifier for this provider, used in configuration
+    /// and logs.
+    fn id(&self) -> &'static str;
+
+    /// Derives an Edge Cookie identifier from the provider's injected services
+    /// and the request's gating context.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::EdgeCookie`] when derivation fails.
+    fn generate(
+        &self,
+        request_info: &dyn RequestInfo,
+        input: &IdentityInput<'_>,
+    ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>>;
+
+    /// Returns whether two identifiers produced by this provider denote the same
+    /// identity.
+    ///
+    /// Edge Cookie identifiers must not be assumed comparable by natural string
+    /// equality. A provider whose identifiers can carry the same payload in
+    /// different wrappers (for example a signed envelope that is re-issued with a
+    /// new timestamp or signature) overrides this to compare by payload, so the
+    /// system asks the provider rather than comparing the raw strings.
+    ///
+    /// The default compares the values for byte equality, which is correct for
+    /// providers whose identifiers are canonical, such as [`HmacProvider`].
+    fn keys_equal(&self, left: &str, right: &str) -> bool {
+        left == right
+    }
+
+    /// Returns whether `value` is a well-formed identifier this provider issues.
+    ///
+    /// Core calls this to decide whether an incoming `ts-ec` cookie value is a
+    /// usable Edge Cookie identifier before reading it back, keying the KV
+    /// identity graph, or withdrawing it. This keeps the identifier opaque to
+    /// core: a provider whose identifiers are not the built-in shape (for
+    /// example an opaque signed envelope) accepts its own format here, so its
+    /// identifier round-trips instead of being silently dropped on read-back.
+    ///
+    /// The default accepts the built-in HMAC identifier shape
+    /// (`<64 hex>.<6 alphanumeric>`), which is correct for [`HmacProvider`] and
+    /// the other core providers.
+    fn accepts_id(&self, value: &str) -> bool {
+        generation::is_valid_ec_id(value)
+    }
+
+    /// Returns the KV-key form of `value` for this provider's identifiers.
+    ///
+    /// Core keys the identity graph by the returned string, so a provider whose
+    /// identifiers are case-sensitive or carry no separable segments returns the
+    /// value unchanged to avoid collapsing distinct identifiers into one key.
+    ///
+    /// The default lowercases the leading HMAC hash segment and preserves the
+    /// suffix, matching the built-in identifier shape.
+    fn normalize_id_for_kv(&self, value: &str) -> String {
+        generation::normalize_ec_id_for_kv(value)
+    }
+}
+
+/// The built-in HMAC Edge Cookie provider.
+///
+/// Derives the identifier from the client IP (read from the [`RequestInfo`]
+/// passed at call time) and the configured passphrase via
+/// [`generation::generate_ec_id`].
+#[derive(Debug, Clone)]
+pub struct HmacProvider {
+    passphrase: Redacted<String>,
+}
+
+impl HmacProvider {
+    /// Creates an HMAC provider with the given passphrase.
+    #[must_use]
+    pub fn new(passphrase: Redacted<String>) -> Self {
+        Self { passphrase }
+    }
+}
+
+impl EdgeCookieProvider for HmacProvider {
+    fn id(&self) -> &'static str {
+        "hmac"
+    }
+
+    fn generate(
+        &self,
+        request_info: &dyn RequestInfo,
+        _input: &IdentityInput<'_>,
+    ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+        let id = generation::generate_ec_id(self.passphrase.expose(), request_info.client_ip())?;
+        Ok(GeneratedEdgeCookie {
+            id: Some(id),
+            response_headers: Vec::new(),
+        })
+    }
+}
+
+/// Builds the Edge Cookie provider named by the `[ec] provider` selector,
+/// injecting the services it needs.
+///
+/// This is the composition root for the built-in providers. The per-request
+/// [`RequestInfo`] is passed borrowed to
+/// [`generate`](EdgeCookieProvider::generate) at call time rather than stored, so
+/// no request snapshot is cloned here. Returns `Ok(None)` when no provider is
+/// selected, so the caller stays stateless.
+///
+/// # Errors
+///
+/// None of the built-in constructions fail today. The `Result` is the seam for
+/// a provider whose construction can fail (for example one requiring a host
+/// service the deployment does not supply), so such a misconfiguration fails
+/// loudly rather than minting a degraded identifier.
+pub fn build_provider(
+    ec: &Ec,
+    injected: Option<Arc<dyn EdgeCookieProvider>>,
+) -> Result<Option<Box<dyn EdgeCookieProvider>>, Report<TrustedServerError>> {
+    let Some(key) = ec.provider.as_deref() else {
+        return Ok(None);
+    };
+    let provider: Option<Box<dyn EdgeCookieProvider>> = match key {
+        "hmac" => ec
+            .providers
+            .hmac
+            .as_ref()
+            .map(|config| Box::new(HmacProvider::new(config.passphrase.clone())) as _),
+        // Any other key names a vendor or host provider the adapter injects
+        // through [`RuntimeServices`](crate::platform::RuntimeServices), the same
+        // seam the device and geo providers use, so core never names a vendor.
+        // The injected provider is used when its own id matches the selected key,
+        // and its `[ec.providers.<key>]` block is read by the adapter that built
+        // it. A selected key with no matching injected provider is a deployment
+        // error: fail loudly rather than silently running stateless.
+        other => {
+            let provider = injected
+                .filter(|provider| provider.id() == other)
+                .map(|provider| Box::new(SharedProvider(provider)) as _);
+            if provider.is_none() {
+                return Err(Report::new(TrustedServerError::EdgeCookie {
+                    message: format!(
+                        "Edge Cookie provider `{other}` is selected but this deployment's \
+                         adapter does not provide it"
+                    ),
+                }));
+            }
+            provider
+        }
+    };
+    Ok(provider)
+}
+
+/// Adapts an injected, shared [`EdgeCookieProvider`] to the owned `Box` that
+/// [`build_provider`] returns.
+///
+/// A vendor or host provider is injected as an `Arc` so it can live in
+/// [`RuntimeServices`](crate::platform::RuntimeServices) and be cloned per
+/// request. Every method delegates to the inner provider, so its behavior is
+/// unchanged.
+#[derive(Debug)]
+struct SharedProvider(Arc<dyn EdgeCookieProvider>);
+
+impl EdgeCookieProvider for SharedProvider {
+    fn id(&self) -> &'static str {
+        self.0.id()
+    }
+
+    fn generate(
+        &self,
+        request_info: &dyn RequestInfo,
+        input: &IdentityInput<'_>,
+    ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+        self.0.generate(request_info, input)
+    }
+
+    fn keys_equal(&self, left: &str, right: &str) -> bool {
+        self.0.keys_equal(left, right)
+    }
+
+    fn accepts_id(&self, value: &str) -> bool {
+        self.0.accepts_id(value)
+    }
+
+    fn normalize_id_for_kv(&self, value: &str) -> String {
+        self.0.normalize_id_for_kv(value)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::redacted::Redacted;
+
+    fn test_passphrase() -> Redacted<String> {
+        Redacted::from("a-test-passphrase-32-bytes-minimum".to_owned())
+    }
+
+    /// A provider whose identifiers wrap a payload after a `:` separator, so two
+    /// different wrappers of the same payload denote the same identity. Stands in
+    /// for an envelope-based vendor identifier.
+    #[derive(Debug)]
+    struct WrappedPayloadProvider;
+
+    impl EdgeCookieProvider for WrappedPayloadProvider {
+        fn id(&self) -> &'static str {
+            "wrapped"
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie::default())
+        }
+
+        fn keys_equal(&self, left: &str, right: &str) -> bool {
+            fn payload(value: &str) -> &str {
+                value.split_once(':').map_or(value, |(_, payload)| payload)
+            }
+            payload(left) == payload(right)
+        }
+    }
+
+    #[test]
+    fn default_id_semantics_match_the_builtin_shape() {
+        let provider = HmacProvider::new(test_passphrase());
+
+        // The default `accepts_id` accepts the built-in HMAC shape and rejects
+        // anything else, so a built-in provider's identifiers round-trip while an
+        // opaque value is left to a provider that overrides the check.
+        let valid = format!("{}.{}", "a".repeat(64), "abc123");
+        assert!(provider.accepts_id(&valid), "should accept the HMAC shape");
+        assert!(
+            !provider.accepts_id("not-hmac-shaped"),
+            "should reject a non-HMAC identifier by default"
+        );
+
+        // The default `normalize_id_for_kv` lowercases the hash segment. This is
+        // exactly the transform that would corrupt an opaque case-sensitive
+        // identifier, which is why such a provider overrides it.
+        let mixed = format!("{}.{}", "A".repeat(64), "abc123");
+        assert_eq!(
+            provider.normalize_id_for_kv(&mixed),
+            format!("{}.{}", "a".repeat(64), "abc123"),
+            "the default should lowercase the hash segment"
+        );
+    }
+
+    #[test]
+    fn shared_provider_delegates_id_semantics_to_the_inner_provider() {
+        // `SharedProvider` wraps an adapter-injected provider. It must forward
+        // every trait method to the inner provider, including `accepts_id` and
+        // `normalize_id_for_kv`; a wrapper that silently used the defaults would
+        // drop an opaque vendor identifier on read-back. This guards that
+        // delegation directly.
+        #[derive(Debug)]
+        struct Inner;
+
+        impl EdgeCookieProvider for Inner {
+            fn id(&self) -> &'static str {
+                "inner"
+            }
+
+            fn generate(
+                &self,
+                _request_info: &dyn RequestInfo,
+                _input: &IdentityInput<'_>,
+            ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+                Ok(GeneratedEdgeCookie::default())
+            }
+
+            fn accepts_id(&self, value: &str) -> bool {
+                value == "opaque-ok"
+            }
+
+            fn normalize_id_for_kv(&self, value: &str) -> String {
+                format!("kv:{value}")
+            }
+        }
+
+        let shared = SharedProvider(Arc::new(Inner));
+
+        assert_eq!(shared.id(), "inner", "should delegate id");
+        assert!(
+            shared.accepts_id("opaque-ok"),
+            "should delegate accepts_id acceptance to the inner provider"
+        );
+        assert!(
+            !shared.accepts_id("something-else"),
+            "should delegate accepts_id rejection to the inner provider"
+        );
+        assert_eq!(
+            shared.normalize_id_for_kv("x"),
+            "kv:x",
+            "should delegate normalize_id_for_kv to the inner provider"
+        );
+    }
+
+    #[test]
+    fn hmac_keys_equal_uses_natural_equality() {
+        let provider = HmacProvider::new(test_passphrase());
+        assert!(
+            provider.keys_equal("abcd.efghij", "abcd.efghij"),
+            "identical HMAC keys should be equal"
+        );
+        assert!(
+            !provider.keys_equal("abcd.efghij", "abcd.klmnop"),
+            "different HMAC keys should not be equal"
+        );
+    }
+
+    #[test]
+    fn keys_equal_can_compare_by_payload_ignoring_the_wrapper() {
+        let provider = WrappedPayloadProvider;
+        assert!(
+            provider.keys_equal("wrapper-1:same-payload", "wrapper-2:same-payload"),
+            "different wrappers of the same payload should be equal"
+        );
+        assert!(
+            !provider.keys_equal("wrapper-1:payload-a", "wrapper-1:payload-b"),
+            "different payloads should not be equal"
+        );
+    }
+
+    #[test]
+    fn a_selected_but_uninjected_vendor_provider_fails_loudly() {
+        let ec = Ec {
+            provider: Some("acme".to_owned()),
+            ..Ec::default()
+        };
+
+        let err = build_provider(&ec, None)
+            .expect_err("selecting a provider the adapter does not inject should error");
+        assert!(
+            err.to_string().contains("acme"),
+            "the error should name the selected provider, got: {err}"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/edge_cookie.rs b/crates/trusted-server-core/src/edge_cookie.rs
index a4cdb4730..cb82eca3e 100644
--- a/crates/trusted-server-core/src/edge_cookie.rs
+++ b/crates/trusted-server-core/src/edge_cookie.rs
@@ -11,24 +11,29 @@ use crate::constants::{COOKIE_TS_EC, HEADER_X_TS_EC};
 use crate::cookies::handle_request_cookies;
 use crate::ec::cookies::ec_id_has_only_allowed_chars;
 #[cfg(test)]
-use crate::ec::generation::{generate_ec_id as generate_canonical_ec_id, normalize_ip};
+use crate::ec::generation::normalize_ip;
+#[cfg(test)]
+use crate::ec::provider::{IdentityInput, build_provider};
 use crate::error::TrustedServerError;
 #[cfg(test)]
+use crate::evidence::BorrowedRequestInfo;
+#[cfg(test)]
 use crate::platform::RuntimeServices;
 #[cfg(test)]
 use crate::settings::Settings;
 
-/// Generates a fresh EC ID based on client IP address.
+/// Generates a fresh EC ID using the configured Edge Cookie provider.
 ///
-/// Delegates to the canonical generator in [`crate::ec::generation`] so a
-/// single normalization + HMAC path produces EC IDs. The canonical
-/// `normalize_ip` format is a stable contract — EC hashes stored in KV
-/// depend on it, and a divergent normalization would mint non-correlating
-/// identities for the same client.
+/// Routes through the pluggable provider model: the active `[ec] provider`
+/// selection decides the outcome. Returns `Ok(None)` when no provider is
+/// configured, so Trusted Server runs statelessly and mints no Edge Cookie.
+/// `request_headers` lets a provider that derives identity from request
+/// evidence read it; the built-in HMAC provider ignores it and uses only the
+/// normalized client IP.
 ///
 /// # Errors
 ///
-/// - [`TrustedServerError::EdgeCookie`] if HMAC generation fails
+/// - [`TrustedServerError::EdgeCookie`] if provider generation fails
 ///
 /// Currently exercised only by tests: the production EC lifecycle generates IDs
 /// through [`crate::ec`]/`EcContext` rather than this edge-cookie helper.
@@ -36,18 +41,33 @@ use crate::settings::Settings;
 pub fn generate_ec_id(
     settings: &Settings,
     services: &RuntimeServices,
-) -> Result<String, Report<TrustedServerError>> {
-    // Fallback to "unknown" when client IP is unavailable (e.g., local testing).
-    // All such requests share the same HMAC base; the random suffix provides uniqueness.
+    request_headers: Option<&http::HeaderMap>,
+) -> Result<Option<String>, Report<TrustedServerError>> {
+    // Fall back to "unknown" when the client IP is unavailable (for example in
+    // local testing). All such requests share the same HMAC base; the random
+    // suffix provides uniqueness.
     let client_ip = services
-        .client_info
+        .client_info()
         .client_ip
         .map(normalize_ip)
         .unwrap_or_else(|| "unknown".to_string());
 
     log::trace!("Generating fresh EC ID from normalized client context");
 
-    generate_canonical_ec_id(settings, &client_ip)
+    let Some(provider) = build_provider(&settings.ec, services.ec_provider())? else {
+        log::info!("No Edge Cookie provider configured; running statelessly");
+        return Ok(None);
+    };
+
+    // The provider reads request data (for example the client IP) borrowed at
+    // call time, so nothing is cloned.
+    let request_info = BorrowedRequestInfo::new(&client_ip, request_headers);
+    // The publisher path gates creation on the request's consent context at
+    // the call site, and the built-in provider reads neither that result nor
+    // the consent context, so
+    // they are not threaded here.
+    let generated = provider.generate(&request_info, &IdentityInput::default())?;
+    Ok(generated.id)
 }
 
 /// Gets an existing EC ID from the request.
@@ -99,7 +119,10 @@ pub fn get_ec_id(req: &Request<EdgeBody>) -> Result<Option<String>, Report<Trust
 /// 1. The `x-ts-ec` header
 /// 2. The `ts-ec` cookie
 ///
-/// If neither exists, generates a new EC ID.
+/// If neither exists, generates a new EC ID via the configured provider.
+///
+/// Returns `Ok(None)` when no existing EC ID is present and no Edge Cookie
+/// provider is configured, so the caller proceeds statelessly.
 ///
 /// # Errors
 ///
@@ -109,14 +132,16 @@ pub(crate) fn get_or_generate_ec_id_from_http_request(
     settings: &Settings,
     services: &RuntimeServices,
     req: &Request<EdgeBody>,
-) -> Result<String, Report<TrustedServerError>> {
+) -> Result<Option<String>, Report<TrustedServerError>> {
     if let Some(id) = get_ec_id(req)? {
-        return Ok(id);
+        return Ok(Some(id));
     }
 
-    // If no existing EC ID found, generate a fresh one
-    let ec_id = generate_ec_id(settings, services)?;
-    log::trace!("No existing EC ID found; generated a fresh EC ID");
+    // If no existing EC ID found, generate a fresh one through the provider.
+    let ec_id = generate_ec_id(settings, services, Some(req.headers()))?;
+    if ec_id.is_some() {
+        log::trace!("No existing EC ID found; generated a fresh EC ID");
+    }
     Ok(ec_id)
 }
 
@@ -130,7 +155,7 @@ pub fn get_or_generate_ec_id(
     settings: &Settings,
     services: &RuntimeServices,
     req: &Request<EdgeBody>,
-) -> Result<String, Report<TrustedServerError>> {
+) -> Result<Option<String>, Report<TrustedServerError>> {
     get_or_generate_ec_id_from_http_request(settings, services, req)
 }
 
@@ -141,6 +166,7 @@ mod tests {
     use http::{HeaderName, header};
     use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
 
+    use crate::ec::generation::generate_ec_id as generate_canonical_ec_id;
     use crate::platform::test_support::{noop_services, noop_services_with_client_ip};
     use crate::test_support::tests::create_test_settings;
 
@@ -155,9 +181,17 @@ mod tests {
             0x2001, 0x0db8, 0x85a3, 0x0000, 0x8a2e, 0x0370, 0x7334, 0x1234,
         ));
 
-        let id_here = generate_ec_id(&settings, &noop_services_with_client_ip(ip))
-            .expect("should generate EC ID via edge_cookie");
-        let id_canonical = generate_canonical_ec_id(&settings, &normalize_ip(ip))
+        let id_here = generate_ec_id(&settings, &noop_services_with_client_ip(ip), None)
+            .expect("should generate EC ID via edge_cookie")
+            .expect("should configure the hmac provider in test settings");
+        let passphrase = settings
+            .ec
+            .providers
+            .hmac
+            .as_ref()
+            .map(|hmac| hmac.passphrase.expose().as_str())
+            .unwrap_or("");
+        let id_canonical = generate_canonical_ec_id(passphrase, &normalize_ip(ip))
             .expect("should generate EC ID via canonical generator");
 
         assert_eq!(
@@ -206,7 +240,9 @@ mod tests {
     fn test_generate_ec_id() {
         let settings: Settings = create_test_settings();
 
-        let ec_id = generate_ec_id(&settings, &noop_services()).expect("should generate EC ID");
+        let ec_id = generate_ec_id(&settings, &noop_services(), None)
+            .expect("should generate EC ID")
+            .expect("should configure the hmac provider in test settings");
         log::debug!("Generated EC ID: {}", ec_id);
         assert!(
             is_ec_id_format(&ec_id),
@@ -214,15 +250,31 @@ mod tests {
         );
     }
 
+    #[test]
+    fn generate_ec_id_returns_none_when_no_provider_is_configured() {
+        let mut settings = create_test_settings();
+        // No provider selected: Trusted Server runs statelessly.
+        settings.ec.provider = None;
+
+        let id = generate_ec_id(&settings, &noop_services(), None)
+            .expect("generation should not error when no provider is configured");
+        assert!(
+            id.is_none(),
+            "no Edge Cookie provider should mean no Edge Cookie is minted"
+        );
+    }
+
     #[test]
     fn test_generate_ec_id_uses_client_ip() {
         let settings = create_test_settings();
         let ip = IpAddr::V4(Ipv4Addr::new(203, 0, 113, 1));
 
-        let id_with_ip = generate_ec_id(&settings, &noop_services_with_client_ip(ip))
-            .expect("should generate EC ID with client IP");
-        let id_without_ip = generate_ec_id(&settings, &noop_services())
-            .expect("should generate EC ID without client IP");
+        let id_with_ip = generate_ec_id(&settings, &noop_services_with_client_ip(ip), None)
+            .expect("should generate EC ID with client IP")
+            .expect("should configure the hmac provider in test settings");
+        let id_without_ip = generate_ec_id(&settings, &noop_services(), None)
+            .expect("should generate EC ID without client IP")
+            .expect("should configure the hmac provider in test settings");
 
         let hmac_with_ip = id_with_ip.split_once('.').expect("should contain dot").0;
         let hmac_without_ip = id_without_ip.split_once('.').expect("should contain dot").0;
@@ -278,7 +330,8 @@ mod tests {
         assert_eq!(ec_id, Some("existing_ec_id".to_string()));
 
         let ec_id = get_or_generate_ec_id(&settings, &noop_services(), &req)
-            .expect("should reuse header EC ID");
+            .expect("should reuse header EC ID")
+            .expect("an existing EC should be present");
         assert_eq!(ec_id, "existing_ec_id");
     }
 
@@ -294,7 +347,8 @@ mod tests {
         assert_eq!(ec_id, Some("existing_cookie_id".to_string()));
 
         let ec_id = get_or_generate_ec_id(&settings, &noop_services(), &req)
-            .expect("should reuse cookie EC ID");
+            .expect("should reuse cookie EC ID")
+            .expect("an existing EC should be present");
         assert_eq!(ec_id, "existing_cookie_id");
     }
 
@@ -326,7 +380,8 @@ mod tests {
             .expect("should build test request");
 
         let ec_id = get_or_generate_ec_id_from_http_request(&settings, &noop_services(), &req)
-            .expect("should reuse cookie EC ID from http request");
+            .expect("should reuse cookie EC ID from http request")
+            .expect("an existing EC should be present");
 
         assert_eq!(ec_id, "existing_http_cookie_id");
     }
@@ -344,7 +399,8 @@ mod tests {
         let req = create_test_request(&[]);
 
         let ec_id = get_or_generate_ec_id(&settings, &noop_services(), &req)
-            .expect("should get or generate EC ID");
+            .expect("should get or generate EC ID")
+            .expect("should configure the hmac provider in test settings");
         assert!(!ec_id.is_empty());
     }
 
@@ -369,7 +425,8 @@ mod tests {
         let req = create_test_request(&[(HEADER_X_TS_EC, "evil;injected")]);
 
         let ec_id = get_or_generate_ec_id(&settings, &noop_services(), &req)
-            .expect("should generate fresh ID on invalid header");
+            .expect("should generate fresh ID on invalid header")
+            .expect("should configure the hmac provider in test settings");
         assert_ne!(
             ec_id, "evil;injected",
             "should not use tampered header value"
diff --git a/crates/trusted-server-core/src/evidence.rs b/crates/trusted-server-core/src/evidence.rs
new file mode 100644
index 000000000..78e0d21ca
--- /dev/null
+++ b/crates/trusted-server-core/src/evidence.rs
@@ -0,0 +1,293 @@
+//! Service interfaces injected into providers.
+//!
+//! Trusted Server wires providers by dependency injection. A provider's
+//! constructor takes the services it needs as `Arc<dyn Trait>`, and the adapter
+//! (the composition root) supplies instances per request. A provider that needs
+//! a service the host does not supply cannot be built, so the request stops
+//! rather than silently degrading.
+//!
+//! These traits are the service interfaces. Request-scoped data outlives the
+//! live request only when snapshotted, so an implementation owns its data where
+//! needed ([`OwnedRequestInfo`] is the built-in owned snapshot).
+
+use http::HeaderMap;
+
+/// Read-only access to the current request's basic information.
+///
+/// The request data any host can supply: the normalized client IP, the
+/// User-Agent, and request headers. A provider receives it by reference at call
+/// time (`generate`/`detect`), reads what it needs, and does not retain it.
+pub trait RequestInfo: Send + Sync + core::fmt::Debug {
+    /// The normalized client IP, or `""` when the host cannot determine it.
+    fn client_ip(&self) -> &str;
+
+    /// The `User-Agent` header value, or `""` when absent.
+    fn user_agent(&self) -> &str;
+
+    /// An arbitrary request header by name (case-insensitive), or `None`.
+    ///
+    /// Request cookies are read through this, from the `Cookie` header (a
+    /// provider that stores values in cookies parses them from it).
+    fn header(&self, name: &str) -> Option<&str>;
+
+    /// The names of all request headers present, for a provider that enumerates
+    /// evidence (for example to forward client hints). The default is empty.
+    fn header_names(&self) -> Vec<&str> {
+        Vec::new()
+    }
+
+    /// The request path (the URL path, without the query string), or `""` when
+    /// request info was built without a URL.
+    ///
+    /// A provider reads the request target through this together with
+    /// [`query`](Self::query); `RequestInfo` is the evidence abstraction, so more
+    /// request accessors can be added here (as defaulted methods) without
+    /// breaking existing implementations.
+    fn path(&self) -> &str {
+        ""
+    }
+
+    /// The raw request query string (the part after `?`, without the leading
+    /// `?`), or `""` when the request carried none.
+    ///
+    /// A provider reads request parameters through this, or the
+    /// [`query_param`](Self::query_param) convenience. The default is empty, for
+    /// request info built without a URL.
+    fn query(&self) -> &str {
+        ""
+    }
+
+    /// The first value of query parameter `name`, percent-decoded, or `None`
+    /// when the parameter is absent.
+    ///
+    /// Parses [`query`](Self::query) with `application/x-www-form-urlencoded`
+    /// rules, matching how the browser encodes query parameters.
+    fn query_param(&self, name: &str) -> Option<String> {
+        url::form_urlencoded::parse(self.query().as_bytes())
+            .find_map(|(key, value)| (&*key == name).then(|| value.into_owned()))
+    }
+}
+
+/// An owned [`RequestInfo`] built from a request snapshot.
+///
+/// Owns the client IP and a header snapshot, for a context that cannot borrow
+/// the live request for the duration of the call. The request path uses
+/// [`BorrowedRequestInfo`]; this owned variant serves tests and any future
+/// host whose request data cannot be borrowed.
+#[derive(Debug, Default, Clone)]
+pub struct OwnedRequestInfo {
+    client_ip: String,
+    headers: HeaderMap,
+    path: String,
+    query: String,
+}
+
+impl OwnedRequestInfo {
+    /// Builds owned request info from the client IP and a header snapshot.
+    ///
+    /// The request target ([`path`](RequestInfo::path) and
+    /// [`query`](RequestInfo::query)) is empty; attach it with
+    /// [`with_request_target`](Self::with_request_target) when the caller has the
+    /// URL.
+    #[must_use]
+    pub fn new(client_ip: String, headers: HeaderMap) -> Self {
+        Self {
+            client_ip,
+            headers,
+            path: String::new(),
+            query: String::new(),
+        }
+    }
+
+    /// Attaches the request target (URL path and query string) to this snapshot,
+    /// so a provider can read request parameters through
+    /// [`query_param`](RequestInfo::query_param).
+    #[must_use]
+    pub fn with_request_target(mut self, path: String, query: String) -> Self {
+        self.path = path;
+        self.query = query;
+        self
+    }
+}
+
+impl RequestInfo for OwnedRequestInfo {
+    fn client_ip(&self) -> &str {
+        &self.client_ip
+    }
+
+    fn user_agent(&self) -> &str {
+        self.headers
+            .get(http::header::USER_AGENT)
+            .and_then(|value| value.to_str().ok())
+            .unwrap_or_default()
+    }
+
+    fn header(&self, name: &str) -> Option<&str> {
+        self.headers.get(name).and_then(|value| value.to_str().ok())
+    }
+
+    fn header_names(&self) -> Vec<&str> {
+        self.headers.keys().map(http::HeaderName::as_str).collect()
+    }
+
+    fn path(&self) -> &str {
+        &self.path
+    }
+
+    fn query(&self) -> &str {
+        &self.query
+    }
+}
+
+/// A borrowed [`RequestInfo`] over the live request, with no allocation.
+///
+/// The composition root builds one per request from the normalized client IP and
+/// an optional borrow of the request headers, then passes it to a provider by
+/// shared reference at call time (`generate`/`detect`). It borrows rather than
+/// owns, so it must not outlive the request. A provider reads it during the call
+/// and does not retain it, so no per-request `HeaderMap` clone is needed.
+#[derive(Debug)]
+pub struct BorrowedRequestInfo<'a> {
+    client_ip: &'a str,
+    headers: Option<&'a HeaderMap>,
+    path: &'a str,
+    query: &'a str,
+}
+
+impl<'a> BorrowedRequestInfo<'a> {
+    /// Borrows request info from the client IP and optional request headers.
+    ///
+    /// Pass `None` for headers on a path that only needs the client IP. The
+    /// request target ([`path`](RequestInfo::path) and
+    /// [`query`](RequestInfo::query)) is empty; attach it with
+    /// [`with_request_target`](Self::with_request_target) when the caller has the
+    /// URL.
+    #[must_use]
+    pub fn new(client_ip: &'a str, headers: Option<&'a HeaderMap>) -> Self {
+        Self {
+            client_ip,
+            headers,
+            path: "",
+            query: "",
+        }
+    }
+
+    /// Attaches the borrowed request target (URL path and query string), so a
+    /// provider can read request parameters through
+    /// [`query_param`](RequestInfo::query_param).
+    #[must_use]
+    pub fn with_request_target(mut self, path: &'a str, query: &'a str) -> Self {
+        self.path = path;
+        self.query = query;
+        self
+    }
+}
+
+impl RequestInfo for BorrowedRequestInfo<'_> {
+    fn client_ip(&self) -> &str {
+        self.client_ip
+    }
+
+    fn user_agent(&self) -> &str {
+        self.headers
+            .and_then(|headers| headers.get(http::header::USER_AGENT))
+            .and_then(|value| value.to_str().ok())
+            .unwrap_or_default()
+    }
+
+    fn header(&self, name: &str) -> Option<&str> {
+        self.headers
+            .and_then(|headers| headers.get(name))
+            .and_then(|value| value.to_str().ok())
+    }
+
+    fn header_names(&self) -> Vec<&str> {
+        self.headers
+            .map(|headers| headers.keys().map(http::HeaderName::as_str).collect())
+            .unwrap_or_default()
+    }
+
+    fn path(&self) -> &str {
+        self.path
+    }
+
+    fn query(&self) -> &str {
+        self.query
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn headers_with_cookie() -> HeaderMap {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            "cookie",
+            "client-id=abc123; ts-ec=xyz"
+                .parse()
+                .expect("should parse cookie header"),
+        );
+        headers
+    }
+
+    #[test]
+    fn query_param_decodes_and_selects_the_first_value() {
+        let info = OwnedRequestInfo::new(String::new(), HeaderMap::new())
+            .with_request_target("/page".to_owned(), "id=a%20b&id=second&flag=1".to_owned());
+
+        assert_eq!(
+            info.query_param("id").as_deref(),
+            Some("a b"),
+            "should percent-decode and return the first value for a repeated key"
+        );
+        assert_eq!(info.query_param("flag").as_deref(), Some("1"));
+        assert_eq!(
+            info.query_param("missing"),
+            None,
+            "an absent parameter should be None"
+        );
+    }
+
+    #[test]
+    fn path_and_query_accessors_return_the_request_target() {
+        let info = OwnedRequestInfo::new(String::new(), HeaderMap::new())
+            .with_request_target("/a/b".to_owned(), "x=1".to_owned());
+        assert_eq!(info.path(), "/a/b");
+        assert_eq!(info.query(), "x=1");
+    }
+
+    #[test]
+    fn request_info_defaults_to_an_empty_target() {
+        let info = OwnedRequestInfo::new("203.0.113.5".to_owned(), HeaderMap::new());
+        assert_eq!(info.path(), "", "path should default to empty");
+        assert_eq!(info.query(), "", "query should default to empty");
+        assert_eq!(
+            info.query_param("id"),
+            None,
+            "query_param over an empty query should be None"
+        );
+    }
+
+    #[test]
+    fn a_provider_reads_cookies_from_the_header() {
+        let info = OwnedRequestInfo::new("203.0.113.5".to_owned(), headers_with_cookie());
+        assert_eq!(
+            info.header("cookie"),
+            Some("client-id=abc123; ts-ec=xyz"),
+            "cookies are read through the Cookie header"
+        );
+    }
+
+    #[test]
+    fn borrowed_request_info_exposes_the_same_target() {
+        let headers = headers_with_cookie();
+        let info = BorrowedRequestInfo::new("203.0.113.5", Some(&headers))
+            .with_request_target("/page", "id=abc123");
+
+        assert_eq!(info.path(), "/page");
+        assert_eq!(info.query(), "id=abc123");
+        assert_eq!(info.query_param("id").as_deref(), Some("abc123"));
+        assert_eq!(info.header("cookie"), Some("client-id=abc123; ts-ec=xyz"));
+    }
+}
diff --git a/crates/trusted-server-core/src/integrations/google_tag_manager.rs b/crates/trusted-server-core/src/integrations/google_tag_manager.rs
index 0dfb5906f..8eaa82a75 100644
--- a/crates/trusted-server-core/src/integrations/google_tag_manager.rs
+++ b/crates/trusted-server-core/src/integrations/google_tag_manager.rs
@@ -1537,6 +1537,9 @@ origin_url = "https://origin.test-publisher.com"
 proxy_secret = "test-secret"
 
 [ec]
+provider = "hmac"
+
+[ec.providers.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 
 [integrations.google_tag_manager]
@@ -1570,6 +1573,9 @@ origin_url = "https://origin.test-publisher.com"
 proxy_secret = "test-secret"
 
 [ec]
+provider = "hmac"
+
+[ec.providers.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 
 [integrations.google_tag_manager]
diff --git a/crates/trusted-server-core/src/integrations/prebid.rs b/crates/trusted-server-core/src/integrations/prebid.rs
index 4cc10f8da..c35299bab 100644
--- a/crates/trusted-server-core/src/integrations/prebid.rs
+++ b/crates/trusted-server-core/src/integrations/prebid.rs
@@ -3021,6 +3021,9 @@ origin_url = "https://origin.test-publisher.com"
 proxy_secret = "test-secret"
 
 [ec]
+provider = "hmac"
+
+[ec.providers.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 "#;
 
diff --git a/crates/trusted-server-core/src/lib.rs b/crates/trusted-server-core/src/lib.rs
index 70a4d6cfd..ba1d585d1 100644
--- a/crates/trusted-server-core/src/lib.rs
+++ b/crates/trusted-server-core/src/lib.rs
@@ -46,6 +46,7 @@ pub mod creative_opportunities;
 pub mod ec;
 pub(crate) mod edge_cookie;
 pub mod error;
+pub mod evidence;
 pub mod geo;
 pub mod host_header;
 pub(crate) mod host_rewrite;
diff --git a/crates/trusted-server-core/src/platform/test_support.rs b/crates/trusted-server-core/src/platform/test_support.rs
index 917f1bf50..cecb902fa 100644
--- a/crates/trusted-server-core/src/platform/test_support.rs
+++ b/crates/trusted-server-core/src/platform/test_support.rs
@@ -688,6 +688,28 @@ pub(crate) fn noop_services() -> RuntimeServices {
     build_services_with_config(NoopConfigStore)
 }
 
+/// Build a [`RuntimeServices`] with an injected Edge Cookie provider, so a test
+/// can exercise the adapter-injection path an opaque-identifier vendor provider
+/// reaches core through.
+pub(crate) fn noop_services_with_ec_provider(
+    ec_provider: Arc<dyn crate::ec::provider::EdgeCookieProvider>,
+) -> RuntimeServices {
+    RuntimeServices::builder()
+        .config_store(Arc::new(NoopConfigStore))
+        .secret_store(Arc::new(NoopSecretStore))
+        .kv_store(Arc::new(edgezero_core::key_value_store::NoopKvStore))
+        .backend(Arc::new(NoopBackend))
+        .http_client(Arc::new(NoopHttpClient))
+        .geo(Arc::new(NoopGeo))
+        // A fixed client IP so the generate path (which requires one) can run.
+        .client_info(ClientInfo {
+            client_ip: Some("203.0.113.10".parse().expect("should parse test client IP")),
+            ..ClientInfo::default()
+        })
+        .ec_provider(ec_provider)
+        .build()
+}
+
 /// Build a [`RuntimeServices`] whose auction telemetry sink is the supplied
 /// recording (or otherwise custom) sink, so tests can assert which terminal
 /// auction events were emitted.
diff --git a/crates/trusted-server-core/src/platform/types.rs b/crates/trusted-server-core/src/platform/types.rs
index a39a26430..b68a78184 100644
--- a/crates/trusted-server-core/src/platform/types.rs
+++ b/crates/trusted-server-core/src/platform/types.rs
@@ -9,6 +9,7 @@ use super::{
     PlatformBackend, PlatformConfigStore, PlatformGeo, PlatformHttpClient, PlatformKvStore,
     PlatformSecretStore,
 };
+use crate::ec::provider::EdgeCookieProvider;
 
 /// Geographic information extracted from a request.
 ///
@@ -18,7 +19,7 @@ use super::{
 pub struct GeoInfo {
     /// City name.
     pub city: String,
-    /// Two-letter country code.
+    /// ISO 3166-1 alpha-2 country code, for example `US` or `GB`.
     pub country: String,
     /// Continent name.
     pub continent: String,
@@ -28,7 +29,8 @@ pub struct GeoInfo {
     pub longitude: f64,
     /// DMA (Designated Market Area) / metro code.
     pub metro_code: i64,
-    /// Region code.
+    /// ISO 3166-2 subdivision code without the country prefix, for example `CA`
+    /// for California, or `None` when no region resolves.
     pub region: Option<String>,
     /// Autonomous System Number (e.g. `7922` = Comcast).
     /// Used to distinguish home ISP vs. corporate VPN.
@@ -178,6 +180,12 @@ pub struct RuntimeServices {
     pub(crate) auction_telemetry_sink: Arc<dyn AuctionTelemetrySink>,
     /// Per-request client metadata extracted at the entry point.
     pub(crate) client_info: ClientInfo,
+    /// A vendor or host Edge Cookie provider the adapter injects, selected when
+    /// `[ec] provider` names it. `None` when only the built-in providers are in
+    /// use. This is the seam that lets a vendor Edge Cookie provider live in its
+    /// own crate and be injected, so core never names a vendor (the same
+    /// pattern as [`geo`](Self::geo)).
+    pub(crate) ec_provider: Option<Arc<dyn EdgeCookieProvider>>,
 }
 
 impl RuntimeServices {
@@ -253,6 +261,17 @@ impl RuntimeServices {
         &self.client_info
     }
 
+    /// Returns the adapter-injected Edge Cookie provider, when one is wired.
+    ///
+    /// `None` when the deployment uses only the built-in providers (which core
+    /// builds itself). A vendor or host provider is injected here by the
+    /// adapter, so [`build_provider`](crate::ec::provider::build_provider) can
+    /// return it without core naming the vendor.
+    #[must_use]
+    pub fn ec_provider(&self) -> Option<Arc<dyn EdgeCookieProvider>> {
+        self.ec_provider.clone()
+    }
+
     /// Wrap the KV store in a [`super::KvHandle`] for ergonomic access to
     /// JSON helpers, pagination, and validation.
     #[must_use]
@@ -295,6 +314,7 @@ pub struct RuntimeServicesBuilder {
     geo: Option<Arc<dyn PlatformGeo>>,
     auction_telemetry_sink: Option<Arc<dyn AuctionTelemetrySink>>,
     client_info: Option<ClientInfo>,
+    ec_provider: Option<Arc<dyn EdgeCookieProvider>>,
 }
 
 impl RuntimeServicesBuilder {
@@ -308,6 +328,7 @@ impl RuntimeServicesBuilder {
             geo: None,
             auction_telemetry_sink: None,
             client_info: None,
+            ec_provider: None,
         }
     }
 
@@ -370,6 +391,18 @@ impl RuntimeServicesBuilder {
         self
     }
 
+    /// Set the adapter-injected Edge Cookie provider.
+    ///
+    /// Optional: leave it unset for a deployment that uses only the built-in
+    /// providers. Set it to inject a vendor or host provider selected by
+    /// `[ec] provider`, so the provider lives in its own crate and core never
+    /// names it.
+    #[must_use]
+    pub fn ec_provider(mut self, ec_provider: Arc<dyn EdgeCookieProvider>) -> Self {
+        self.ec_provider = Some(ec_provider);
+        self
+    }
+
     /// Construct [`RuntimeServices`] from the accumulated configuration.
     ///
     /// # Panics
@@ -402,6 +435,7 @@ impl RuntimeServicesBuilder {
             client_info: self
                 .client_info
                 .expect("should set client_info before building RuntimeServices"),
+            ec_provider: self.ec_provider,
         }
     }
 }
diff --git a/crates/trusted-server-core/src/response_privacy.rs b/crates/trusted-server-core/src/response_privacy.rs
index 21ba9f20b..df91e86a5 100644
--- a/crates/trusted-server-core/src/response_privacy.rs
+++ b/crates/trusted-server-core/src/response_privacy.rs
@@ -157,6 +157,9 @@ mod tests {
                 proxy_secret = "unit-test-proxy-secret"
 
                 [ec]
+                provider = "hmac"
+
+                [ec.providers.hmac]
                 passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )
diff --git a/crates/trusted-server-core/src/settings.rs b/crates/trusted-server-core/src/settings.rs
index 598c00056..40939a36c 100644
--- a/crates/trusted-server-core/src/settings.rs
+++ b/crates/trusted-server-core/src/settings.rs
@@ -420,9 +420,26 @@ impl EcPartner {
 #[derive(Debug, Default, Clone, Deserialize, Serialize, Validate)]
 #[serde(deny_unknown_fields)]
 pub struct Ec {
-    /// Publisher passphrase used as HMAC key for EC generation.
-    #[validate(custom(function = Ec::validate_passphrase))]
-    pub passphrase: Redacted<String>,
+    /// The key of the Edge Cookie identity provider to activate.
+    ///
+    /// Names one of the blocks under [`providers`](Self::providers), for
+    /// example `"hmac"`. Set it in the `[ec]` TOML section or override it with
+    /// the `TRUSTED_SERVER__ec__provider` environment variable so the same
+    /// compiled WebAssembly can switch providers at deployment. When absent, no
+    /// Edge Cookie is generated and Trusted Server runs statelessly. Selecting a
+    /// provider whose block is missing is rejected at startup by
+    /// [`validate_provider_selection`](Self::validate_provider_selection).
+    #[serde(default)]
+    pub provider: Option<String>,
+
+    /// Configuration blocks for the available Edge Cookie identity providers.
+    ///
+    /// Each provider has its own optional `[ec.providers.<key>]` block. The
+    /// [`provider`](Self::provider) selector names which one is active, so a
+    /// block can be configured (or kept) without being the one in use.
+    #[serde(default)]
+    #[validate(nested)]
+    pub providers: EcProviders,
 
     /// Fastly KV store name for the EC identity graph.
     #[serde(default)]
@@ -510,6 +527,116 @@ impl Ec {
         }
         Ok(())
     }
+
+    /// Validates that the selected provider names a configured block.
+    ///
+    /// When [`provider`](Self::provider) is set, the matching block under
+    /// [`providers`](Self::providers) must be present, so a deployment that
+    /// selects a provider (in TOML or via the environment override) but has not
+    /// configured it fails fast at startup rather than silently running
+    /// stateless. When no provider is selected, Trusted Server runs statelessly
+    /// and this check passes.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::Configuration`] when the selected provider
+    /// key is unknown or its `[ec.providers.<key>]` block is absent.
+    pub fn validate_provider_selection(&self) -> Result<(), Report<TrustedServerError>> {
+        let Some(key) = self.provider.as_deref() else {
+            if !self.providers.is_empty() {
+                return Err(Report::new(TrustedServerError::Configuration {
+                    message: "[ec.providers.*] blocks are configured but no [ec] provider is \
+                              selected. Set [ec] provider = \"<key>\" to activate one, or \
+                              remove the blocks to run statelessly"
+                        .to_owned(),
+                }));
+            }
+            return Ok(());
+        };
+
+        let configured = match key {
+            "hmac" => self.providers.hmac.is_some(),
+            // A vendor or host provider the adapter injects is configured when
+            // its `[ec.providers.<key>]` block is present. The adapter validates
+            // the block's own contents when it builds the provider.
+            other => self.providers.has_vendor(other),
+        };
+
+        if configured {
+            Ok(())
+        } else {
+            Err(Report::new(TrustedServerError::Configuration {
+                message: format!(
+                    "Edge Cookie provider `{key}` is selected but has no `[ec.providers.{key}]` configuration"
+                ),
+            }))
+        }
+    }
+}
+
+/// Configuration blocks for the available Edge Cookie identity providers.
+///
+/// Each provider is configured in its own `[ec.providers.<key>]` block, for
+/// example:
+///
+/// ```toml
+/// [ec.providers.hmac]
+/// passphrase = "replace-with-32-plus-byte-random-secret"
+/// ```
+///
+/// The active provider is chosen by the [`Ec::provider`] selector, so a block
+/// can be present without being in use.
+#[derive(Debug, Default, Clone, Deserialize, Serialize, Validate)]
+pub struct EcProviders {
+    /// The built-in HMAC-over-client-IP provider, keyed `hmac`.
+    #[serde(default)]
+    #[validate(nested)]
+    pub hmac: Option<HmacProviderConfig>,
+
+    /// Configuration blocks for vendor or host providers that live in their own
+    /// crates and are injected by the adapter. Any `[ec.providers.<key>]` block
+    /// whose key is not a built-in is captured here as raw values, and the
+    /// adapter that constructs the provider deserializes its own block into the
+    /// vendor crate's config type. Core never names a vendor, so a new provider
+    /// adds nothing here.
+    #[serde(flatten)]
+    vendor: HashMap<String, JsonValue>,
+}
+
+impl EcProviders {
+    /// Returns the raw configuration block for a vendor provider `key`, or
+    /// `None` when no `[ec.providers.<key>]` block is present. The adapter that
+    /// builds the provider deserializes this into its own config type.
+    #[must_use]
+    pub fn vendor_config(&self, key: &str) -> Option<&JsonValue> {
+        self.vendor.get(key)
+    }
+
+    /// Whether a vendor provider configuration block is present for `key`.
+    #[must_use]
+    pub fn has_vendor(&self, key: &str) -> bool {
+        self.vendor.contains_key(key)
+    }
+
+    /// Whether any provider configuration block is present.
+    ///
+    /// Used by [`Ec::validate_provider_selection`] to reject a half-migrated
+    /// configuration that carries provider blocks with no selector, which
+    /// would otherwise silently run stateless.
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.hmac.is_none() && self.vendor.is_empty()
+    }
+}
+
+/// Configuration for the built-in HMAC Edge Cookie provider.
+///
+/// Mapped from the `[ec.providers.hmac]` TOML block.
+#[derive(Debug, Default, Clone, Deserialize, Serialize, Validate)]
+pub struct HmacProviderConfig {
+    /// Publisher passphrase used as the HMAC key for EC generation.
+    #[validate(custom(function = Ec::validate_passphrase))]
+    pub passphrase: Redacted<String>,
 }
 
 #[derive(Debug, Default, Clone, Deserialize, Serialize, Validate)]
@@ -2031,6 +2158,7 @@ impl Settings {
             })
         })?;
 
+        settings.ec.validate_provider_selection()?;
         settings.validate_admin_coverage()?;
         settings.validate_admin_handler_passwords()?;
 
@@ -2115,8 +2243,10 @@ impl Settings {
     pub fn reject_placeholder_secrets(&self) -> Result<(), Report<TrustedServerError>> {
         let mut insecure_fields: Vec<String> = Vec::new();
 
-        if Ec::is_placeholder_passphrase(self.ec.passphrase.expose()) {
-            insecure_fields.push("ec.passphrase".to_owned());
+        if let Some(hmac) = &self.ec.providers.hmac
+            && Ec::is_placeholder_passphrase(hmac.passphrase.expose())
+        {
+            insecure_fields.push("ec.providers.hmac.passphrase".to_owned());
         }
         if Publisher::is_placeholder_proxy_secret(self.publisher.proxy_secret.expose()) {
             insecure_fields.push("publisher.proxy_secret".to_owned());
@@ -2703,9 +2833,14 @@ mod tests {
         );
         assert_eq!(settings.publisher.origin_host_header_override, None);
         assert_eq!(
-            settings.ec.passphrase.expose(),
-            "test-secret-key-32-bytes-minimum"
+            settings.ec.provider.as_deref(),
+            Some("hmac"),
+            "test settings should select the hmac EC provider"
         );
+        let Some(hmac) = &settings.ec.providers.hmac else {
+            panic!("test settings should configure the hmac EC provider");
+        };
+        assert_eq!(hmac.passphrase.expose(), "test-secret-key-32-bytes-minimum");
 
         settings.validate().expect("Failed to validate settings");
     }
@@ -2729,6 +2864,53 @@ mod tests {
         );
     }
 
+    #[test]
+    fn provider_selection_allows_no_provider_for_stateless_operation() {
+        let ec = Ec::default();
+        assert!(ec.provider.is_none(), "default Ec selects no provider");
+        ec.validate_provider_selection()
+            .expect("should allow no provider selected and run statelessly");
+    }
+
+    #[test]
+    fn provider_selection_rejects_a_selector_without_a_configured_block() {
+        // Point the selector at a provider whose `[ec.providers.<key>]` block is
+        // absent, mirroring a deployment that sets the env override to a
+        // provider it never configured.
+        let toml_str =
+            crate_test_settings_str().replace(r#"provider = "hmac""#, r#"provider = "acme""#);
+
+        let err = Settings::from_toml(&toml_str)
+            .expect_err("selecting an unconfigured provider should fail at startup");
+        assert!(
+            matches!(
+                err.current_context(),
+                TrustedServerError::Configuration { .. }
+            ),
+            "unconfigured provider selection should be a configuration error, got: {:?}",
+            err.current_context()
+        );
+    }
+
+    #[test]
+    fn provider_blocks_without_a_selector_are_rejected() {
+        // A half-migrated configuration that carries an [ec.providers.hmac]
+        // block but never selects it would silently run stateless; reject it
+        // at startup instead.
+        let toml_str = crate_test_settings_str().replace("provider = \"hmac\"\n", "");
+
+        let err = Settings::from_toml(&toml_str)
+            .expect_err("a provider block with no selector should fail at startup");
+        assert!(
+            matches!(
+                err.current_context(),
+                TrustedServerError::Configuration { .. }
+            ),
+            "should be a configuration error, got: {:?}",
+            err.current_context()
+        );
+    }
+
     #[test]
     fn validate_rejects_trailing_slash_in_origin_url() {
         let toml_str = crate_test_settings_str().replace(
@@ -3050,7 +3232,9 @@ origin_host_header_overide = "www.example.com""#,
         let mut settings =
             Settings::from_toml(&crate_test_settings_str()).expect("should parse test settings");
         settings.publisher.proxy_secret = Redacted::new("unit-test-proxy-secret".to_owned());
-        settings.ec.passphrase = Redacted::new("test-secret-key-32-bytes-minimum".to_owned());
+        settings.ec.providers.hmac = Some(HmacProviderConfig {
+            passphrase: Redacted::new("test-secret-key-32-bytes-minimum".to_owned()),
+        });
         settings.handlers[0].password =
             Redacted::new("replace-with-admin-password-32-bytes".to_owned());
 
@@ -3669,6 +3853,9 @@ origin_host_header_overide = "www.example.com""#,
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )
@@ -3700,6 +3887,9 @@ origin_host_header_overide = "www.example.com""#,
             max_buffered_body_bytes = 0
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         );
@@ -4854,6 +5044,9 @@ origin_host_header_overide = "www.example.com""#,
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]
@@ -4997,6 +5190,9 @@ origin_url = "https://origin.example.com"
 proxy_secret = "secret"
 
 [ec]
+provider = "hmac"
+
+[ec.providers.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 
 [creative_opportunities]
@@ -5038,6 +5234,9 @@ origin_url = "https://origin.example.com"
 proxy_secret = "secret"
 
 [ec]
+provider = "hmac"
+
+[ec.providers.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 
 [creative_opportunities]
@@ -5074,6 +5273,9 @@ origin_url = "https://origin.example.com"
 proxy_secret = "secret"
 
 [ec]
+provider = "hmac"
+
+[ec.providers.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 
 [creative_opportunities]
@@ -5116,6 +5318,9 @@ origin_url = "https://origin.example.com"
 proxy_secret = "secret"
 
 [ec]
+provider = "hmac"
+
+[ec.providers.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 
 [creative_opportunities]
diff --git a/crates/trusted-server-core/src/test_support.rs b/crates/trusted-server-core/src/test_support.rs
index 5f094c0d2..f755a0bcd 100644
--- a/crates/trusted-server-core/src/test_support.rs
+++ b/crates/trusted-server-core/src/test_support.rs
@@ -31,7 +31,11 @@ pub mod tests {
             rewrite_attributes = ["href", "link", "url"]
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
+
             [request_signing]
             config_store_id = "test-config-store-id"
             secret_store_id = "test-secret-store-id"
diff --git a/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml b/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
index 17d7c2713..1a1e71e81 100644
--- a/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
+++ b/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
@@ -10,10 +10,13 @@ origin_url = "http://127.0.0.1:8888"
 proxy_secret = "integration-test-proxy-secret"
 
 [ec]
-passphrase = "integration-test-ec-secret-padded-32"
+provider = "hmac"
 ec_store = "ec_identity_store"
 pull_sync_concurrency = 3
 
+[ec.providers.hmac]
+passphrase = "integration-test-ec-secret-padded-32"
+
 [[ec.partners]]
 name = "Integration Test Partner"
 source_domain = "inttest.example.com"
diff --git a/crates/trusted-server-integration-tests/tests/parity.rs b/crates/trusted-server-integration-tests/tests/parity.rs
index acf7f5f4b..853a48ee9 100644
--- a/crates/trusted-server-integration-tests/tests/parity.rs
+++ b/crates/trusted-server-integration-tests/tests/parity.rs
@@ -43,6 +43,9 @@ fn test_settings() -> Settings {
             proxy_secret = "parity-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
         "#,
     )
diff --git a/trusted-server.example.toml b/trusted-server.example.toml
index 19ecda4a5..9cb08839f 100644
--- a/trusted-server.example.toml
+++ b/trusted-server.example.toml
@@ -12,12 +12,21 @@ origin_url = "https://origin.example.com"
 proxy_secret = "change-me-proxy-secret"
 
 [ec]
-passphrase = "trusted-server-placeholder-secret"
+# Edge Cookie identity is OFF by default: with no provider selected, Trusted
+# Server runs statelessly and generates no Edge Cookie. Activate one by
+# uncommenting the selector AND its [ec.providers.<key>] block together (a
+# block with no selector is rejected at startup), or set the selector with the
+# TRUSTED_SERVER__ec__provider environment variable. The built-in hmac provider
+# is host-neutral; a vendor provider needs its own cargo feature.
+# provider = "hmac"
 ec_store = "ec_identity_store"
 pull_sync_concurrency = 3
 # cluster_trust_threshold = 10
 # cluster_recheck_secs = 3600
 
+# [ec.providers.hmac]
+# passphrase = "replace-with-32-plus-byte-random-secret"
+
 # Example partner configuration. Replace the token before validating/pushing.
 # [[ec.partners]]
 # name = "Example Partner"