# K1 daemon library
`kcode-k1-daemon-lib` remains the library-only composition root exposing `run(PathBuf) -> ExitCode`. Startup creates the multithreaded runtime, prompts once for the protected Vault passphrase, opens the established state beneath `<k1_root>/state`, preserves readiness, slow-start, invite-stock, safe-error, and graceful-shutdown behavior, then binds `127.0.0.1:4450`.
K1Http still owns signing, authentication, replay protection, CORS, `nosniff`, body collection, and authenticated `/api` nesting. Version 0.9.2 selects Audio Classification 0.5.6 and Access Full Audio 0.7.4 and mounts `kcode-k1-http-audio-artifacts` 0.1.0, adding authenticated `GET /api/audio/{access_id}/fragments/{fragment_id}/artifacts` with parent authorization, membership checks, and non-cacheable responses.
Version 0.9.3 preserves all routes and runtime behavior while reporting the safe failing startup stage. Codex Adapter and Chat failures retain their existing safe display text; opaque stages expose only their fixed stage names. Raw diagnostics, Vault contents, credentials, and provider secrets are never rendered.
Provider composition remains Gemini 3.1 Pro plus one isolated Codex app-server with Audio on GPT-5.6 Terra and Chat on GPT-5.6 Sol. Existing paths, origins, models, providers, People, Persons, Accounts, Terms, Chat, Audio routes, and executable behavior are unchanged. Checks start no listener or provider; this release adds no state, migration, provider mechanism, retry, limit, UI, restart, deployment, or live effect.