# K1 daemon library
`kcode-k1-daemon-lib` is the library-only composition root for one private K1 loopback daemon.
## Public API
`run(PathBuf) -> ExitCode` is the sole public operation. Call it once from a small local binary. It owns the Tokio runtime, hidden no-echo Vault passphrase prompt, startup/readiness output, SIGINT/SIGTERM shutdown, and fixed secret-free failure output.
## State and HTTP
The trusted root maps only to `<root>/state/`. Existing ordering, peering, invites, accounts, groups, access profiles, replay, Persons, and daemon-file state retain their ownership and formats. The encrypted Vault opens at `<root>/state/vault`; startup retrieves only its `gemini-api-key` value. Gemini uses that key, while Terra uses the local Codex login and never retrieves an OpenAI key.
Audio is always composed during startup, before listener bind: classification state is `<root>/state/audio-classification` and Access state is `<root>/state/access`. The subsystem has the fixed Gemini `gemini-3.1-pro-preview` and local Terra `gpt-5.6-terra` model IDs. The audio adapter contributes these eight signed authenticated routes: submit, user and group discovery, status, fragment audio, labels, retry, and discard.
The daemon binds only `127.0.0.1:4450`; its public/signing origin and only Host authority are `http://localhost:4450` and `localhost:4450`. It serves `/config.json`, Terms, registration, `/me`, exact-ID People, Groups, Access Profiles, and authenticated audio through existing K1 HTTP leaves. Existing signing, replay, CORS, envelopes, fallback, Vault, and readiness behavior remain unchanged.
Fresh stock links retain `http://localhost:4321/lib/kcode-k1-ui/*/account.html?invite=<code>`. This library defines no binary target, CLI, static serving, audio host abstraction, UI/browser work, migration, retry, polling, package-owned request limits, generic Access/Profile changes, proxy, or deployment behavior.