Hank

Hank — Reactive Keystore

HANK/1 WebSocket + read-only HTTP fallback: scoped tokens, rotation, vault watch.

Hank — Reactive Keystore (v2026-08-02T101544Z-ab2bbdebf5) 2026-08-02 | "HANK/1 WebSocket + read-only HTTP fallback: scoped tokens, rotation, vault watch." 1 - AUTHENTICATION - Token authentication and authorization TokenStore.from_env() HANK_AUTH_TOKENS TokenStore.lookup() token lookup TokenInfo.allows() verb, key token string 2 - EVENT BUS - Subscription and notification handling EventBus.publish() event_bus.publish() HankRecord holons table EventBus._local_fanout() _local_fanout() HankEvent 3 - VAULT ACCESS - Secret retrieval and rotation HankVault.get_secret() get_secret() Obsidian vault ~/Documents/Noted-Vault/secrets/ SecretRotation.schedule() schedule rotation secret value 1. TokenStore.from_env… 2. TokenStore.lookup()… 3. TokenInfo.allows()… 4. EventBus.publish()… 5. HankRecord fetches… 6. EventBus._local_fan… 7. HankVault.get_secre… 8. SecretRotation.sche… TokenStore.from_env() payload <token_id>:<token>:<scope1>,<scope2>|<token_id>:<token>:<scope> EventBus.publish() payload {"kind": "set", "key": "secret_key", "version": 1} 2 of 5 identifiers appear only in design docs, not in code — this shows SPECIFIED behaviour, not verified implementation. TokenStore.from_env() uses environment variable HANK_AUTH_TOKENS to load tokens. Legend actor = initiates work · process = code path · store = state on disk · bus = durable queue · dashed = separate process cyan = request flow · pink = state read/write · dashed green = pull / return path · red = refusal

Provenance

This drawing is generated, not drawn. It is rebuilt from the source files below, so when they change the picture changes — a diagram here cannot quietly describe a system that no longer works this way.

Owner
Hank
Slug
hank-keystore
Rendered
2026-08-02T101544Z
From commit
ab2bbdebf5
Watches
4 paths
  • daemon/src/hank
  • daemon/src/hank_secrets.py
  • daemon/src/hank_subscriptions.py
  • daemon/config/hank-tokens.yaml