Hank

Hank — Reactive Keystore

HANK/1 WebSocket + read-only HTTP fallback: scoped tokens, rotation, vault watch.

Hank — Reactive Keystore (v2026-08-28T093439Z-747172b178) 2026-08-28 | HANK/1 WebSocket + read-only HTTP fallback: scoped tokens, rotation, vault watch. 1 - AUTHENTICATION - Token authentication and authorization TokenStore.from_env HANK_AUTH_TOKENS TokenStore.from_env daemon/src/hank/auth.py TokenStore.lookup TokenStore.lookup daemon/src/hank/auth.py TokenInfo.allows TokenInfo.allows daemon/src/hank/auth.py token string TokenInfo 2 - EVENT BUS - Subscription and event handling EventBus.publish EventBus.publish daemon/src/hank/bus.py EventBus._local_fanout EventBus._local_fanout daemon/src/hank/bus.py Subscription.deliver Subscription.deliver daemon/src/hank/bus.py HankEvent matching subsc… 3 - SUBSCRIPTIONS - Vault document change notifications HankSubscriber.watch HankSubscriber.watch daemon/src/hank_subscriptions.py HankSubscriber._emit HankSubscriber._emit daemon/src/hank_subscriptions.py HankSubscriber.subscribe HankSubscriber.subscribe daemon/src/hank_subscriptions.py file change matching callb… 1. TokenStore.from_… 2. TokenStore.looku… 3. TokenInfo.allows… 4. EventBus.publish… 5. EventBus._local_… 6. Subscription.del… 7. HankSubscriber.w… 8. HankSubscriber._… 9. HankSubscriber.s… HankEvent payload {"kind": "set", "key": "reg:example", "version": 1} TokenStore.from_env config kv-admin:s3cret:admin:*|guest:r34d:read:user:* TokenStore.from_env reads from HANK_AUTH_TOKENS env var. EventBus uses LISTEN/NOTIFY for multi-process support. HankSubscriber watches for .md file changes in the vault. Legend actor = initiates work · process = code path · store = state on disk · bus = durable queue · dashed = separate process cyan = request flow · pink = state read/write · dashed green = pull / return path · red = refusal As of 2026-08-28 11:16 UTC, from commit 68470f5

Provenance

This drawing is generated, not drawn. It is rebuilt from the source files below, so when they change the picture changes — a diagram here cannot quietly describe a system that no longer works this way.

Owner
Hank
Slug
hank-keystore
Rendered
2026-08-28T093439Z
From commit
747172b178
Updated
28 Aug 2026, 11:16 UTC
Sources at
68470f5
Watches
4 paths
  • daemon/src/hank
  • daemon/src/hank_subscriptions.py
  • daemon/config/hank-tokens.yaml
  • daemon/SECRETS.md