# kcode-kennedy-app
`kcode-kennedy-app` is Kennedy's security-sensitive top-level application
library. It owns command-line parsing, maintenance commands, credential-vault
unlocking and secret policy, filesystem preparation and legacy audio migration,
construction of every in-process capability, root selection, runtime model
selection, listener binding, readiness ordering, and lifetime supervision.
The executable crate is intentionally only a one-line-equivalent delegation to
this library. Application behavior belongs here or in a focused lower-level
library, never in the executable wrapper.
The app depends exactly on libraries entrusted with reusable credentials or
security-critical application composition. Telegram session workflow is kept in
`kcode-kennedy-telegram-runtime`; raw bot transport remains in
`kcode-tg-kennedy-bot`; general session control and non-transport scheduling
remain in `kcode-kennedy-orchestration`; system and identity-directory roots
remain in `kcode-kennedy-roots`.
## Public API
### `main`
`main` is the complete Kennedy process entry point. It installs tracing and the
Rustls crypto provider, parses command-line arguments, runs offline secret or
Kweb-size maintenance when requested, or starts the server application.
Server startup binds the public listener before opening persistent state,
unlocks the credential vault, opens Kweb and its canonical roots, constructs
identity, history, intelligence, agent, Telegram, audio, developer-tool, HTTP,
session-control, root-reconciliation, general orchestration, and Telegram
session capabilities, then supervises all long-running runtimes together.
The function returns an error if startup validation fails or any supervised
runtime exits unexpectedly. Optional credentials disable only their documented
features; the crates.io publication credential and Kweb signing configuration
remain required for normal server startup.
## Operational boundaries
Offline maintenance first acquires the public listener address as a process
guard, so it cannot mutate secrets or inspect persistent Kweb state while the
server is running. The public listener is also acquired before server state is
opened so an already-running process cannot permit a second writer to open the
same persistence roots.
One shared async mutex serializes application Kweb writers across general
orchestration, Telegram root reconciliation, Telegram wakeups, self-time, and
history ingress. Independent transport and read-only work remains concurrent.