# K1 access driver
`kcode-k1-access-driver` owns the synchronous KTO, Peering, callback-correlation, and Access-projection lifecycle for `k1-access-subsystem`. A Groups-aware facade obtains membership evidence and calls this driver; the driver neither opens Groups nor evaluates membership.
## Public API
```rust
use std::{path::Path, sync::Arc};
use kcode_k1_access_driver::{
AccessCheck, AccessId, AccessRevision, Authorizations, GroupId, K1AccessDriver,
OwnerWitness, RequestPrincipal, SubsystemId, Target, TxId, UserId,
};
use kcode_k1_peering::K1Peering;
use kcode_k1_txn_ordering::K1TxnOrdering;
impl K1AccessDriver {
pub fn open(root: &Path, ordering: Arc<K1TxnOrdering>, peering: Arc<K1Peering>) -> Result<Self, String>;
pub fn create(&self, target: Target, authorizations: Authorizations) -> Result<AccessRevision, String>;
pub fn replace(&self, access_id: AccessId, actor: UserId, groups_revision: Option<TxId>, witness: OwnerWitness, authorizations: Authorizations) -> Result<AccessRevision, String>;
pub fn ensure_discovery(&self, access_id: AccessId) -> Result<AccessRevision, String>;
pub fn discovery_missing(&self, access_id: AccessId, expected_subsystem: SubsystemId) -> Result<bool, String>;
pub fn discovered_for_user(&self, user: UserId, expected_subsystem: SubsystemId) -> Result<Vec<AccessId>, String>;
pub fn discovered_for_group(&self, group: GroupId, expected_subsystem: SubsystemId) -> Result<Vec<AccessId>, String>;
pub fn owner_witness(&self, access_id: AccessId, user: UserId, user_groups: &[GroupId]) -> Result<Option<OwnerWitness>, String>;
pub fn check(&self, principal: RequestPrincipal, access_id: AccessId, expected_subsystem: SubsystemId, user_groups: &[GroupId], model_groups: &[GroupId], groups_revision: Option<TxId>) -> Result<AccessCheck, String>;
}
```
`replace` accepts the actor, Groups revision, witness, and normalized authorization evidence already established by its caller. `check` accepts one already-obtained user/model group snapshot and its revision. `ensure_discovery` submits exactly `AccessAction::EnsureDiscovery { access_id }`.
## Correlation and failure contract
Open first materializes the projection and then registers its callback after the durable cursor. Every mutation creates a fresh random operation ID, encodes once, submits once, and requires callback evidence for the exact synchronous Peering transaction ID. A recorded callback outcome wins over a Peering error. A Peering success without exact callback evidence faults the driver.
Malformed callbacks, projection failures, missing, duplicate, or contradictory callback evidence, and a callback/submission transaction mismatch fault the driver. Reorganization faults it, discards pending evidence, and clears projection state; projection query errors also fault it. Recovery requires a fresh open.
The driver holds no state lock across randomness, encoding, Peering, projection, or caller work. It has no retry, timeout, worker, queue, polling, Groups lookup, authentication, network surface, or background recovery. Projection and Peering scheduling have no finite wall-clock bound.