# K1 Access Groups conformance
This test-only library owns the Groups-dependent authorization and group-discovery scenarios for the K1 Access facade. It exercises ordinary groups, synthetic sentinels, group ownership, independent user/model viewer groups, immediate membership revocation, and monotonic group discovery through one real local Ordering, Peering, Groups, and Access stack.
## Public API
```rust
pub fn verify() -> Result<(), String>;
```
`verify` creates a fresh temporary root, opens each dependency once, performs the complete deterministic scenario, and returns the first labeled dependency or assertion failure. It proves that Access creation fans discovery to each named owner/viewer group; human membership controls `list_group`; later members see historical group IDs; revoked members receive `access denied`; authorization replacements only add discovery; model-only membership creates no human discovery path; and an ordinary user can list `ALL_USERS`. It uses only Access's public list APIs, compares opaque IDs in returned order, and performs no per-ID authorization checks while listing.
The fixture uses corrected strict Groups wire v2 through the public Groups facade. It creates only current-format state and has no migration or compatibility path. It performs local temporary filesystem and SQLite I/O plus dependency-owned entropy and synchronous callbacks. It starts no thread and performs no network, provider, HTTP, retry, timeout, polling, deployment, or background work.