# kcode-codex-runtime Specification
## Purpose
The crate provides typed Rust access to a locally installed Codex CLI or
sandbox launcher. It contains no HTTP server, application routing, credential
storage, operation registry, search-mode policy, or persistence.
## Startup
Opening a runtime loads one process-shared catalog through `CatalogCache`,
removes hidden model instructions while preserving model limits, validates that
the launcher is logged in through ChatGPT, and probes the exact model-visible
prompt boundary. Successful boundary checks are cached by Codex/catalog
identity and complete generation configuration.
## Generation
Ordinary generation disables native web search and every unrelated Codex tool
or application feature. The exact caller prompt is written through standard
input. A valid UUID thread may be resumed. Successful JSONL output yields the
last completed agent message, thread identifier, and usage. Empty, malformed,
timed-out, authentication, quota, capacity, and oversized-input failures have
stable typed classifications.
## Web search
Web search is always fresh and ephemeral. It enables native web search while
keeping shell, filesystem mutation, application instructions, skills, agents,
and other tools disabled. Focused and thorough research depths produce bounded
evidence-oriented prompts. Every valid, credential-free HTTP(S) link in the
answer is returned after fragment removal and deduplication. No explicit source
count or model output-token limit is applied by the crate.
## Cancellation and data
The integrating runtime cancels by dropping an operation future. Every child
uses kill-on-drop, so cancellation does not orphan Codex. API-key environment
variables are removed. Prompts and results are passed in memory; the only
filesystem state is the disposable/versioned sanitized catalog and validation
cache.