hank-sec-egress

hank-sec-egress owns SEC HTTP identity, URL containment, retry/redirect policy, and pacing. Its explicit backends serve different deployment contracts:

• hank_sec_egress.portable.get() is for independently installed public clients. It admits at most one request start per second per process, including every retry and redirect. It needs no private host configuration, fcntl, or ~/.sec_budget. SEC_USER_AGENT overrides the public EDGAR client identity; caller-supplied User-Agent headers cannot override this owner.
• hank_sec_egress.get() / async_get() are for managed Unix services. They coordinate the version-1 machine limiter at ~/.sec_budget/machine_limiter.state, including socket-write admission. They require SEC_BUDGET_SITE (prod or dev), SEC_USER_AGENT, and, starting with 0.2.0, SEC_EXPECTED_MACHINE_IDENTITY. The latter is deployment-owned configuration compared against socket.getfqdn(); it does not override the actual machine identity. No private hostnames ship in the package.

Both APIs require a nonempty product-owned caller_label. Both accept only sec.gov URLs, replace caller User-Agent headers, and apply the same compression, retry, and redirect bounds. Managed consumers may call effective_headers() for request-time identity projection. Limiter implementation classes and mutable host configuration are not package-root exports.

Public EDGAR MCP submissions metadata deliberately calls SEC directly through portable.get(). Scratch document extraction remains an HTTP call to the hosted EDGAR API. Managed deployments remain pinned to their existing package versions until their deployment configuration and dependency locks are updated together.