# Dependency Audit
Audited for version 0.1.2.
- `kcode-session-log`: the only durable transcript implementation. Session
History owns its store and session handles and does not expose them across
the public boundary.
- `anyhow`: detailed internal validation, replay, filesystem, and
serialization context for the mutable `Session` integration API.
- `chrono`: RFC 3339 lifecycle timestamp validation, current timestamps, and
fixed ingress-retry scheduling.
- `serde` and `serde_json`: typed public records, application-owned state,
checksummed control records, reconstructed Chatend events, and completion
receipts.
- `sha2`: SHA-256 integrity checks for control-journal records.
- `uuid`: library-assigned session and command identities plus validation of
caller-supplied UUID identities.
- `tracing`: bounded operational storage diagnostics without transcript,
object-byte, or application-state logging.
- `tokio` is a development dependency used only by asynchronous unit tests.
The crate has no HTTP server, Axum, multipart, network client, database,
credential, Kweb, process-execution, or production asynchronous-runtime
dependency. It contains no unsafe Rust.