# Dependency Audit
Audited for version 0.1.1.
- `kcode-gemini-api`: configured Gemini multimodal client supplied by caller.
- `kcode-codex-runtime`: configured Codex generation runtime supplied by
caller.
- `hound`: in-memory WAV parsing and interval decoding.
- `ruopus`: in-memory Ogg Opus encoding.
- `futures`: bounded concurrent piece transcription.
- `rusqlite`: durable recording, progress, retry, and completed-transcript
state, including attempt-scoped structured piece transcripts. The bundled
SQLite feature makes the published library self-contained.
- `tokio`: asynchronous retained-original writes, the automatic background
worker, transcription tasks, bounded concurrency, and retry timing.
- `chrono`: caller-supplied recording times and durable timestamps.
- `sha2`: content identity for exact retained audio bytes.
- `serde` and `serde_json`: typed public status serialization and durable
dependency progress snapshots.
- `uuid`: stable recording and temporary-upload identifiers.
- `tracing`: bounded operational diagnostics without exposing audio or
transcript contents.
- `anyhow`: private persistence and worker error context.
The crate has no HTTP-server, multipart, application-framework, Kmap, Chatend,
credential-vault, or downstream memory-ingress dependency. Provider
credentials remain encapsulated in caller-created clients.