Module anomaly 

Lightweight statistical anomaly scoring (DW-090).

A first-line traffic filter that scores requests against configurable request-shape signals (header entropy, header count/bytes, path length/depth, query count, body size, unusual method). Each signal produces a normalized [0, 1] sub-score; the overall score is the average of the configured signals’ scores. A score at or above the policy’s threshold is blocked (403 anomaly_blocked) unless dry_run is set (scored and logged, request proceeds).

Request-path position

The anomaly check runs AFTER the WAF-lite filter and BEFORE the route limits (DW-027): it is an inspection phase like the WAF, rejecting abusive request shapes before any resource is spent on auth or rate limiting. It inspects the ORIGINAL request (before path rewrite / transforms).

Design constraints

• No ML, no heavy computation on the hot path: every signal is O(1) or O(n) in the header count/size (already bounded by the parser hardening knobs).
• No new dependencies: the Shannon entropy and normalization math is in-house (a byte-frequency histogram over a stack array).
• The scorer is compiled once per config generation (like the WAF and rate-limit engines) and reused across requests.

Structs

AnomalyResult

The result of scoring one request: the overall score, whether it triggered (>= threshold), and the per-signal sub-scores for observability/logging.

AnomalyScorer

A compiled anomaly-scoring generation: the configured signals, the block threshold, the body inspection cap, and the dry-run flag. Built once per config generation from AnomalyPolicy and reused across requests.