kcode-k1-access 0.1.0

K1 access transaction facade and authorization integration
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

# K1 access

`kcode-k1-access` is the synchronous transaction facade for the logical KTO subsystem `k1-access-subsystem`. It submits owned access mutations through Peering, materializes canonical callbacks through the access projection, and uses one coherent Groups membership snapshot for authorization checks and ownership evidence.

## Public API

```rust
use std::{path::Path, sync::Arc};
use kcode_k1_access::{
    AccessCheck, AccessId, AccessRevision, Authorizations, GroupId, K1Access, ModelId,
    OwnerSubject, RequestPrincipal, SubsystemId, Target, TxId, UserId, ViewerSubject,
};
use kcode_k1_groups::K1Groups;
use kcode_k1_peering::K1Peering;
use kcode_k1_txn_ordering::K1TxnOrdering;

impl K1Access {
    pub fn open(
        root: &Path,
        ordering: Arc<K1TxnOrdering>,
        peering: Arc<K1Peering>,
        groups: Arc<K1Groups>,
    ) -> Result<Self, String>;
    pub fn create(
        &self,
        target: Target,
        authorizations: Authorizations,
    ) -> Result<AccessRevision, String>;
    pub fn set_authorizations(
        &self,
        principal: RequestPrincipal,
        access_id: AccessId,
        authorizations: Authorizations,
    ) -> Result<AccessRevision, String>;
    pub fn check(
        &self,
        principal: RequestPrincipal,
        access_id: AccessId,
        expected_subsystem: SubsystemId,
    ) -> Result<AccessCheck, String>;
}
```

The facade reexports the complete consumer type contract from `kcode-k1-access-types`. Create uses exactly the supplied target and normalized authorizations and adds no grants or defaults. Set obtains memberships once, uses only the user's direct or group ownership to select a witness, and embeds the actor, Groups revision, witness, and requested authorizations. A principal with no owner witness is rejected before submission. The model does not contribute management authority. Check obtains memberships once and evaluates both user and model visibility against one Groups revision.

## Ordering and failure semantics

Open materializes the projection first and registers the callback strictly after its durable cursor. Callbacks strictly decode one format payload and apply it once. Applied and Unchanged outcomes return their exact access revision; Rejected returns its exact reason. Every local mutation uses a fresh random operation ID, submits once, and requires matching synchronous callback evidence. A recorded callback wins over a Peering error; a Peering success without an exact callback transaction match makes the facade unavailable.

Malformed callbacks, projection errors, duplicate or contradictory correlation evidence, and callback or submission mismatches make the facade unavailable. A reorganization first invalidates the facade and pending evidence, then clears projection-owned state. Recovery requires a fresh open. Groups errors are returned without faulting Access; projection query errors fault Access.

The facade holds no state lock across entropy, encoding, Groups, Peering, projection, or KTO work. It has no retry, timeout, worker, thread, queue, polling, default authorization, authentication, HTTP surface, deployment behavior, or background recovery.