The signed chain (API doc §2): verify, parse, check, resolve, act.

Cheapest checks first — signature verification, both parsers and the expiry check are pure functions of the request (and, for expiry, the clock), and authorization is an existence-blind confinement resolution; the action's stat is the only source-metadata I/O and runs last. A halted conn short-circuits the rest of the chain, so a 401 never reaches option parsing, a 422 never touches the filesystem, and a 410 never learns whether the source it names exists.

The mounting contract is the assigns chain: VerifySignature assigns :rest_of_path, ParseOptions assigns :options and :source_string, CheckExpiry reads :options and assigns nothing, ResolveSource assigns :source, and each plug reads exactly what its predecessor assigns — a plug mounted without its upstream raises KeyError. Mount the five together, in this order.

Mounted by the router for GET /:sig/*rest; /health stays outside it, so an unsigned liveness check never touches signature verification.

The action is the seam, and there are two behind it: the streaming render and the info probe. Both endpoints in §2 are the same route and the same first three checks, so which one a request reached is a fact the chain discovers rather than the router — AudioProxy.Plugs.ParseOptions decides it and AudioProxy.Plugs.Action acts on it.