# kcode-kennedy-app
`kcode-kennedy-app` is Kennedy's security-sensitive top-level application
library. It owns command-line parsing, maintenance commands, credential-vault
unlocking and secret policy, filesystem preparation and legacy audio migration,
construction of every in-process capability, root selection, runtime model
selection, listener binding, readiness ordering, and lifetime supervision.
The executable crate is intentionally only a one-line-equivalent delegation to
this library. Application behavior belongs here or in a focused lower-level
library, never in the executable wrapper.
The app depends exactly on libraries entrusted with reusable credentials or
security-critical application composition. Telegram session workflow is kept in
`kcode-kennedy-telegram-runtime`; raw bot transport remains in
`kcode-tg-kennedy-bot`; general session control, prompt composition, and non-transport scheduling
remain in `kcode-kennedy-orchestration`; exact static prompt text is bundled by
`kcode-kennedy-prompts`; system and identity-directory roots remain in
`kcode-kennedy-roots`. The app has no prompt-directory configuration or runtime
prompt-file dependency.
## Public API
### `main`
`main` is the complete Kennedy process entry point. It installs tracing and the
Rustls crypto provider, parses command-line arguments, runs offline secret or
Kweb-size maintenance when requested, or starts the server application.
Server startup binds the public listener before opening persistent state,
unlocks the credential vault, opens Kweb and its canonical roots, constructs
the durable administrator command lane, identity, history, intelligence, agent,
Telegram, audio, developer-tool, HTTP, session-control, root-reconciliation,
general orchestration, and Telegram session capabilities, then supervises all
long-running runtimes together.
The function returns an error if startup validation fails or any supervised
runtime exits unexpectedly. Optional credentials disable only their documented
features; the crates.io publication credential and Kweb signing configuration
remain required for normal server startup.
## Operational boundaries
Offline maintenance first acquires the public listener address as a process
guard, so it cannot mutate secrets or inspect persistent Kweb state while the
server is running. The public listener is also acquired before server state is
opened so an already-running process cannot permit a second writer to open the
same persistence roots.
One shared async mutex serializes application Kweb writers across general
orchestration, Telegram root reconciliation, Telegram wakeups, self-time, and
history ingress. Independent transport and read-only work remains concurrent.
Administrator mutations are durably admitted to their SQLite command lane
before its supervised runtime waits for Kweb's global writer ordering.