# K1 daemon library
`kcode-k1-daemon-lib` is the library-only composition root exposing `run(PathBuf) -> ExitCode`. Startup creates the multithreaded runtime, prompts once for the protected Vault passphrase, opens established state beneath `<k1_root>/state`, preserves readiness, slow-start, invite-stock, safe-error, and graceful-shutdown behavior, then binds `127.0.0.1:4450`.
K1Http owns signing, authentication, replay protection, CORS, `nosniff`, body collection, and authenticated `/api` nesting. Version 0.9.2 selects Audio Classification 0.5.6 and Access Full Audio 0.7.4 and mounts `kcode-k1-http-audio-artifacts` 0.1.0, adding authenticated `GET /api/audio/{access_id}/fragments/{fragment_id}/artifacts` with parent authorization, membership checks, and non-cacheable responses.
Version 0.9.3 reports the safe failing startup stage. Version 0.9.4 additionally renders the complete safe Audio Classification child error so projection/replay incompatibilities can be diagnosed. Codex Adapter and Chat retain their existing safe display text; other opaque stages expose only fixed names. Raw diagnostics, Vault contents, credentials, and provider secrets are never rendered.
Provider composition remains Gemini 3.1 Pro plus one isolated Codex app-server with Audio on GPT-5.6 Terra and Chat on GPT-5.6 Sol. Existing paths, origins, models, providers, People, Persons, Accounts, Terms, Chat, Audio routes, and executable behavior are unchanged. Checks start no listener or provider; these releases add no state, migration, provider mechanism, retry, limit, UI, restart, deployment, or live effect.