# Dependency Audit
Audited for version 0.1.4.
- `kcode-session-log`: the only durable transcript implementation. Session
History owns its store and session handles and does not expose them across
the public boundary.
- `kcode-session-control-journal` 0.1.0: the private `.session-control` raw-file
implementation. It owns record encoding, SHA-256 integrity, complete-record
validation, incomplete-final-tail repair, synchronized append, and atomic
replacement. Session History retains ownership of lifecycle, command, and
stop projections plus domain compaction selection and ordering.
- `anyhow`: detailed internal validation, replay, filesystem, and
serialization context for the mutable `Session` integration API.
- `chrono`: RFC 3339 lifecycle timestamp validation, current timestamps, and
fixed ingress-retry scheduling.
- `serde` and `serde_json`: typed public records, application-owned state,
control-record values, reconstructed Chatend events, and completion receipts.
- `uuid`: library-assigned session and command identities plus validation of
caller-supplied UUID identities.
- `tracing`: bounded operational storage diagnostics without transcript,
object-byte, or application-state logging.
- `tokio`: only its synchronization feature, used to wake the orchestration
owner when a durable stop request targets live same-process work. The crate
does not create or own a runtime.
The crate has no HTTP server, Axum, multipart, network client, database,
credential, Kweb, process-execution, or production asynchronous-runtime
dependency. It contains no unsafe Rust.