# kcode-kennedy-app
`kcode-kennedy-app` is Kennedy's security-sensitive top-level application
library. It owns command-line policy, maintenance commands, credential-vault
unlocking and secret policy, filesystem preparation,
construction of every in-process capability, root selection, runtime model
selection, listener binding, readiness ordering, and lifetime supervision.
Mechanical argument parsing and stable path defaults are delegated to
`kcode-kennedy-cli`.
Task state defaults to `./data/kennedy-task-board.sqlite3`; the separate credit
balance capability defaults to `./data/kennedy-credits.sqlite3`. Startup opens
credits first, passes that handle into the task board, and shares the resulting
handles with the read-only HTTP presentation and Kennedy session services.
The executable crate is intentionally only a one-line-equivalent delegation to
this library. Application behavior belongs here or in a focused lower-level
library, never in the executable wrapper.
The app depends exactly on libraries entrusted with reusable credentials or
security-critical application composition. Telegram session workflow is kept in
`kcode-kennedy-telegram-runtime`; raw bot transport remains in
`kcode-tg-kennedy-bot`; general session control, prompt composition, and non-transport scheduling
remain in `kcode-kennedy-orchestration`; exact static prompt text is bundled by
`kcode-kennedy-prompts`; system and identity-directory roots remain in
`kcode-kennedy-roots`. The app has no prompt-directory configuration or runtime
prompt-file dependency.
## Public API
### `main`
`main` is the complete Kennedy process entry point. It installs tracing and the
Rustls crypto provider, parses command-line arguments, runs offline secret or
Kweb-size maintenance when requested, or starts the server application.
Normal startup leaves fixed connections summarized unless `--fixed` selects
the legacy compatibility projection in which they also load as full nodes. The
retired pre-library AudioIngress database option and migration are absent;
existing legacy data remains offline and untouched.
Server startup binds the public listener before opening persistent state,
unlocks the credential vault, opens Kweb and its canonical roots, constructs
the durable administrator command lane, identity, history, intelligence, agent,
Telegram, audio, developer-tool, HTTP, session-control, root-reconciliation,
general orchestration, and Telegram session capabilities, then supervises all
long-running runtimes together.
The session stack records normalized provider submissions for exact Context
View/Structured Material inspection. Primary Codex generation retains durable
native thread affinity only for append-only Chatend changes and submits the
journal delta after a successful synchronization point. If earlier
provider-visible context is rewritten, the session abandons that continuation,
clears affinity, and starts a fresh outer round from the complete current
projection; logs identify the thread action and explicit reset reason.
The function returns an error if startup validation fails or any supervised
runtime exits unexpectedly. Optional credentials disable only their documented
features; the crates.io publication credential and Kweb signing configuration
remain required for normal server startup.
## Operational boundaries
Offline maintenance first acquires the public listener address as a process
guard, so it cannot mutate secrets or inspect persistent Kweb state while the
server is running. The public listener is also acquired before server state is
opened so an already-running process cannot permit a second writer to open the
same persistence roots.
One shared async mutex serializes application Kweb writers across general
orchestration, Telegram root reconciliation, Telegram wakeups, self-time, and
history ingress. Independent transport and read-only work remains concurrent.
Administrator mutations are durably admitted to their SQLite command lane
before its supervised runtime waits for Kweb's global writer ordering.