Detection pipeline

The proxy terminates the connection, applies header deception, checks IP reputation, and validates request shape.

Regex and AST rules from the signed bundle run next. Each rule is bounded; total deterministic budget per request is < 2ms.

If a request passes deterministic checks, the semantic analyzer is invoked for high-risk endpoints. Score is computed against block and log thresholds. See Proxy configuration for threshold tuning.

On pass, the request is forwarded to EKMIRE_UPSTREAM with original headers preserved. Response passes through without modification (unless scraper poisoning is enabled).