The Bandit edge. Minimal work on the hot path, in the order that keeps an unauthenticated caller from costing anything: resolve the catch URL (Ankusa.RouteResolver, default POST /webhooks/:source_id) to a Ankusa.Route, refuse on a Content-Length over the limit, look the source up (Ankusa.Edge.Ingest.lookup/2), refuse a Content-Length over the tenant's own max_body_bytes (413), charge the pre-read limits (per client address, per node, per source bytes: 429, Ankusa.Edge.RateLimiter.pre_read/4), refuse header bytes no sink can carry (400 invalid_header), only then read the body (bounded in size by the tenant's cap, and in time by listener.request_deadline_ms: 408), and hand off to Ankusa.Edge.Ingest. A body with no declared length is charged to its source once it has been read. A request refused at any step before the read is answered without its body being read. No JSON parsing here.

The instance name is passed through init/1 (plug: {Ankusa.Edge.Router, instance: :default}) and is available as opts inside each route.