Mountable, signed incoming-call and WebSocket routes. No listener is started.

voice/2 verifies a bounded form POST against :public_url and :auth_token, and checks :account_sid. Only then is :on_call invoked with the signed parameters. That host callback authorizes/admit the call and returns {:ok, wss_url} or {:error, reason}. Use an expiring, single-use path ticket to associate that stream URL with the authenticated call and application actor.

upgrade/2 verifies a GET against its explicit WSS :public_url, then calls the host's :authorize function with the connection. It must atomically admit the socket and return {:ok, socket_options} with the authorized call identity. The listener must also enforce connection/rate limits and finite timeouts. Arbitrary forwarded headers never determine the signing URL.

The generated TwiML explicitly places Hangup after Connect; this example policy ends a call after the stream closes. The channel itself makes no hangup claim.