AIKIDO-2026-39992

TL;DR

The Starlette and WebSocket request adapters return the full request path including any ASGI root_path or mount prefix. guard-core matches that value as an exact dict key against path-keyed controls such as exclude_paths and endpoint_rate_limits and passes it to custom request-check hooks, so under a mounted sub-application or a configured root_path those keys never match and the controls silently stop applying. Per-endpoint rate limits and path exclusions therefore provide no protection while the configuration reports them as active. The fix resolves the route-relative path with Starlette's get_route_path so the controls match the same path the router uses.