# K1 daemon library
`kcode-k1-daemon-lib` is the library-only composition root for one private K1 loopback daemon.
## Public API
`run(PathBuf) -> ExitCode` is the sole public operation. Call it once from a small local binary. It owns the Tokio runtime, hidden no-echo Vault passphrase prompt, startup/readiness output, SIGINT/SIGTERM shutdown, and fixed secret-free failure output.
## State and HTTP
The trusted root maps only to `<root>/state/`. Existing ordering, peering, invites, accounts, groups, access profiles, replay, Persons, and daemon-file state retain their ownership and formats. The encrypted Vault opens at `<root>/state/vault`; startup retrieves only its `gemini-api-key` value. Gemini uses that key, while Terra uses the local Codex login and never retrieves an OpenAI key.
Audio is always composed during startup, before listener bind: classification state is `<root>/state/audio-classification` and Access state is `<root>/state/access`. The subsystem has the fixed Gemini `gemini-3.1-pro-preview` and local Terra `gpt-5.6-terra` model IDs. The audio adapter contributes these eight signed authenticated routes: submit, user and group discovery, status, fragment audio, labels, retry, and discard.
The Persons access wrapper is stateless and reuses the existing Persons, Access, and Access Profile instances. The daemon exposes its signed create, universal read, authorized rename, and directly discovered manageable-Person list routes, with no directory/group expansion or request-supplied model.
The daemon binds only `127.0.0.1:4450`; its public/signing origin and only Host authority are `http://localhost:4450` and `localhost:4450`. It serves `/config.json`, Terms, registration, `/me`, exact-ID People, Groups, Access Profiles, authenticated Persons access, and authenticated audio through existing K1 HTTP leaves. Existing signing, replay, CORS, envelopes, fallback, Vault, and readiness behavior remain unchanged.
Fresh stock links retain `http://localhost:4321/lib/kcode-k1-ui/*/account.html?invite=<code>`. This library defines no binary target, CLI, static serving, audio host abstraction, UI/browser work, migration, retry, polling, package-owned request limits, generic Access/Profile changes, proxy, or deployment behavior.