# K1 daemon library
`kcode-k1-daemon-lib` is the library-only composition root for one private K1 loopback daemon.
## Public API
```rust,no_run
use std::{path::PathBuf, process::ExitCode};
fn main() -> ExitCode {
kcode_k1_daemon_lib::run(PathBuf::from("/srv/k1"))
}
```
`run(PathBuf) -> ExitCode` is the sole public operation. Call it exactly once from a small local binary. It owns a process-lifetime Tokio runtime, startup, readiness output, SIGINT/SIGTERM shutdown, and fixed safe failure output. After building the runtime it obtains exactly one hidden, no-echo passphrase from the controlling terminal with the prompt `Unlock K1 vault: `; prompt latency is excluded from the startup slow-warning timer.
## State and HTTP
The supplied trusted root maps only to `<root>/state/`. Existing ordering, peering, invites, accounts, groups, access profiles, replay, invite stock, and daemon-file state retain their ownership and formats. Person state is stored under `<root>/state/persons/`; missing storage is initialized under the Persons contract, while malformed or incompatible state fails startup without migration or reset.
The encrypted Vault projection opens at `<root>/state/vault` after daemon files, transaction ordering, and Peering, before Persons and all later subsystems, and remains alive until server shutdown. Empty input, terminal prompt failure, or Vault failure produces only the generic secret-free startup failure; Vault failure precedes listener creation and readiness output. Peering identity remains in its current plaintext storage.
Registration creates each new user's permanent Person anchor. User reads resolve that anchor to the current canonical Person, while HTTP authentication and Groups/Access authorization continue to use `UserId`.
The daemon binds only `127.0.0.1:4450`; its backend public/signing origin and accepted single Host authority are exactly `http://localhost:4450` and `localhost:4450`. It serves `/config.json`, Terms, registration, `/me`, exact-ID People, Groups, and Access Profiles through the existing K1 HTTP leaves. Those leaves retain signing, replay, CORS, envelopes, and route semantics. Unknown non-API paths use Axum's ordinary 404.
Fresh stock links retain the form `http://localhost:4321/lib/kcode-k1-ui/*/account.html?invite=<code>`. This library defines no binary target, CLI, static Web serving, model or audio host integration, reverse Person lookup, Person listing, migration, reset, proxy, or deployment behavior.
The daemon deliberately has no provider-secret consumer and does not eagerly enumerate or retrieve OpenAI, Gemini, or other values. It exposes no Vault handle or admin API and provides no Vault migration, recovery, environment-password, CLI-password, or stdin-forwarding path; future consumers must request only their fixed value.
## Output and performance
On readiness, stdout receives one flushed JSON line with `event`, `public_origin`, and the reconciled unused invite count. Startup over 100 ms emits the existing structured stderr warning. Startup failure emits only `kcode-k1-daemon: startup failed` and returns exit code 1; listener failure emits its fixed concise line and returns 1. SIGINT or SIGTERM returns success.
Startup work is linear in retained dependency state and invite reconciliation; request performance follows the selected HTTP leaf and its state owners.