HOOX · Gateway (hoox-worker)

Public ingress for the mesh — validates TradingView webhooks, enforces WAF/IP allowlists and rate limits, locks idempotency via Durable Objects, and dispatches privately over Service Bindings.

Part of the HOOX edge-trading mesh — a production-grade algorithmic trading framework on Cloudflare Workers.
Site: hoox.sh · Docs: docs.hoox.sh · Paper: hoox-arxiv-paper-core.pdf

---

The hoox-worker (Cloudflare service name: hoox) is the only public signal entrypoint besides the dashboard. It is the WAF edge of the HOOX mesh:

1. Authenticate inbound webhooks (API key / shared secret headers).
2. Authorize source IPs when TradingView allowlisting is enabled.
3. Rate-limit noisy or abusive senders (atomic Durable Object when bound; else KV / memory).
4. Idempotency — Durable Objects store request fingerprints so duplicate alerts never double-fill.
5. Kill switch — when agent-worker (or operators) flip the global breaker, the gateway drops new signals until reset.
6. Dispatch — successful signals go to trade-worker via Service Binding and/or the trade-execution queue; telemetry fans into analytics-worker; optional operator alerts go to telegram-worker.

Role in the Mesh

TradingView / webhooks
        │
        ▼
┌──────────────────┐
│  hoox-worker     │  ← PUBLIC gateway
│  (auth · WAF ·   │
│   rate · DO id.) │
└───┬──────┬───┬───┘
    │      │   │
    ▼      ▼   ▼
 trade  tele analytics
 worker worker worker

Entry Points

Method	Path / surface	Auth	Description
POST	/webhook or /	Body apiKey (timing-safe) + optional IP allowlist	Primary signal ingress
GET	/health	None	Liveness probe (binding presence only)
GET	/v1/health, /v1/workers, SSE streams	Bearer OPERATOR_API_KEY	Operator management plane
GET	/v1/trades/stream, /v1/logs/stream	Bearer OPERATOR_API_KEY	Long-lived SSE; polls trade-worker /api/signals & /api/system-logs
DO	IdempotencyStore	Internal	Deduplicate trade traces
DO	RateLimiterStore	Internal	Atomic per-session trade rate limits

Ingress controls (webhook): kill switch (trade:kill_switch | global:kill_switch → 503), TradingView IP allowlist, 64 KiB body cap, session rate limit (10/min via RATE_LIMITER DO or KV fallback), DO idempotency (body/Idempotency-Key or auto fingerprint).

CLI

hoox deploy worker hoox          # deploy gateway
hoox monitor status              # gateway health / recent activity
hoox check health                # mesh health including gateway

Development

bun test workers/hoox-worker

Deploy notes (post-hardening)

# From workers/hoox-worker (or monorepo root with --config)
# wrangler deploy applies DO migrations (v1 IdempotencyStore, v2 RateLimiterStore).
wrangler deploy

# Notify allowlist (fail-closed when unset). Comma-separated numeric chat IDs.
wrangler secret put TELEGRAM_ALLOWED_CHAT_IDS
# Optional alias (same shape as telegram-worker):
# wrangler secret put AUTHORIZED_CHAT_IDS

Binding / secret	Required	Notes
RATE_LIMITER → RateLimiterStore	Yes (prod)	Atomic multi-isolate rate limits for the trade path. Without the binding, gateway falls back to CONFIG_KV / in-memory (best-effort). Declared in wrangler.jsonc + migration tag v2.
IDEMPOTENCY_STORE → IdempotencyStore	Yes	Migration tag v1.
TELEGRAM_ALLOWED_CHAT_IDS	Yes for notify	Public webhook notify payloads; also CONFIG_KV key telegram:allowed_chat_ids (JSON array). Alias: AUTHORIZED_CHAT_IDS.

Full post-hardening checklist: DEPLOY.md.

Mesh interconnect

Direction	Peers
Called by	External clients (TradingView, custom webhooks) — this is a public isolate.
This worker calls	See list below

• trade-worker — TRADE_SERVICE / trade-execution queue — validated signal execution
• telegram-worker — TELEGRAM_SERVICE — ingress / rejection alerts
• analytics-worker — ANALYTICS_SERVICE — signal + API telemetry

Full mesh (all isolates live as git submodules under hoox-sh/hoox workers/):

Isolate	Role	Repository
hoox-worker	Public webhook gateway (WAF, idempotency, dispatch)	monorepo workers/hoox-worker
trade-worker	Multi-exchange order execution (Binance / Bybit / MEXC)	monorepo workers/trade-worker
agent-worker	AI risk manager (configurable cron 1–1440 min, kill switch)	monorepo workers/agent-worker
d1-worker	D1 SQL proxy + settings / balances / positions	monorepo workers/d1-worker
telegram-worker	Alerts, bot commands, RAG copilot	monorepo workers/telegram-worker
email-worker	Mailgun / email signal parsing → trade	monorepo workers/email-worker
analytics-worker	Analytics Engine write + query path	monorepo workers/analytics-worker
report-worker	PDF reports via Browser Rendering → R2	monorepo workers/report-worker
web3-wallet-worker	On-chain wallet identity (ethers.js)	monorepo workers/web3-wallet-worker
dashboard	Next.js ops console (OpenNext, public)	monorepo workers/dashboard

Docs & monorepo

Resource	Link
Isolate profile (operators)	https://docs.hoox.sh/docs/devops/workers/hoox
Parent monorepo	github.com/hoox-sh/hoox
This repository	github.com/hoox-sh/hoox-worker
Workers index	docs.hoox.sh → Workers
CLI	@hoox-sh/hoox-cli · hoox deploy worker hoox

License

CC BY 4.0 — part of the HOOX open-core mesh.