# Process-Bearing Dependency Audit
Audit date: 2026-07-20 UTC.
This crate deliberately launches only the executable configured by its caller.
`tokio` supplies asynchronous process, filesystem, synchronization, and timeout
primitives. `serde_json` parses Codex-owned JSON catalogs and JSONL events;
`sha2` and `hex` derive cache identities; `url` normalizes returned source
links; `uuid` validates continuation identifiers; `anyhow` is retained in the
catalog compatibility surface. None receives a credential. Every child removes
`OPENAI_API_KEY` and `CODEX_API_KEY`, uses piped standard I/O, and is configured
for kill-on-drop.
The configured launcher and the Codex CLI are part of the host application's
trusted runtime boundary and must be independently installed and audited.
Dependency updates require normal source and license review before publication.