Expand description
§K1 daemon library
kcode-k1-daemon-lib is the library-only composition root for one private K1 loopback daemon.
§Public API
run(PathBuf) -> ExitCode is the sole public operation. Call it once from a small local binary. It owns the Tokio runtime, hidden no-echo Vault passphrase prompt, startup/readiness output, SIGINT/SIGTERM shutdown, and fixed secret-free failure output.
§State and HTTP
The trusted root maps only to <root>/state/. Existing ordering, peering, invites, accounts, groups, access profiles, replay, Persons, and daemon-file state retain their ownership and formats. The encrypted Vault opens at <root>/state/vault; startup retrieves only its gemini-api-key value. Gemini uses that key, while Terra uses the local Codex login and never retrieves an OpenAI key.
Audio is always composed during startup, before listener bind: classification state is <root>/state/audio-classification and Access state is <root>/state/access. The subsystem has the fixed Gemini gemini-3.1-pro-preview and local Terra gpt-5.6-terra model IDs. The audio adapter contributes these eight signed authenticated routes: submit, user and group discovery, status, fragment audio, labels, retry, and discard.
The daemon binds only 127.0.0.1:4450; its public/signing origin and only Host authority are http://localhost:4450 and localhost:4450. It serves /config.json, Terms, registration, /me, exact-ID People, Groups, Access Profiles, and authenticated audio through existing K1 HTTP leaves. Existing signing, replay, CORS, envelopes, fallback, Vault, and readiness behavior remain unchanged.
Fresh stock links retain http://localhost:4321/lib/kcode-k1-ui/*/account.html?invite=<code>. This library defines no binary target, CLI, static serving, audio host abstraction, UI/browser work, migration, retry, polling, package-owned request limits, generic Access/Profile changes, proxy, or deployment behavior.