# K1 access
`kcode-k1-access` is the synchronous, Groups-aware facade for the logical KTO subsystem `k1-access-subsystem`.
## Public API
```rust
use std::{path::Path, sync::Arc};
use kcode_k1_access::{
AccessCheck, AccessContext, AccessId, AccessPolicy, AccessRevision, Authority,
FilteredAuthorities, GroupId, K1Access, ModelId, SentinelGroup, SubsystemId, Target, TxId,
UserId, ViewerSubject, ALL_MODELS, ALL_MODELS_MEMBER, ALL_USERS, LOCAL_MODELS,
};
use kcode_k1_groups::K1Groups;
use kcode_k1_peering::K1Peering;
use kcode_k1_txn_ordering::K1TxnOrdering;
pub struct K1Access { /* opaque */ }
impl K1Access {
pub fn open(
root: &Path,
ordering: Arc<K1TxnOrdering>,
peering: Arc<K1Peering>,
groups: Arc<K1Groups>,
) -> Result<Self, String>;
pub fn create(
&self,
context: &AccessContext,
target: Target,
policy: AccessPolicy,
) -> Result<AccessRevision, String>;
pub fn replace_policy(
&self,
context: &AccessContext,
access_id: AccessId,
editors: Vec<Authority>,
viewers: Vec<ViewerSubject>,
) -> Result<AccessRevision, String>;
pub fn check(
&self,
context: &AccessContext,
access_id: AccessId,
expected_subsystem: SubsystemId,
) -> Result<AccessCheck, String>;
pub fn check_many(
&self,
context: &AccessContext,
access_ids: &[AccessId],
expected_subsystem: SubsystemId,
) -> Result<Vec<AccessCheck>, String>;
pub fn resolve_visible_targets(
&self,
context: &AccessContext,
targets: &[Target],
expected_subsystem: SubsystemId,
) -> Result<Vec<Option<AccessId>>, String>;
pub fn list_user(
&self,
context: &AccessContext,
expected_subsystem: SubsystemId,
) -> Result<Vec<AccessId>, String>;
pub fn list_group(
&self,
context: &AccessContext,
group: GroupId,
expected_subsystem: SubsystemId,
) -> Result<Vec<AccessId>, String>;
pub fn list_user_group_targets(
&self,
context: &AccessContext,
expected_subsystem: SubsystemId,
) -> Result<Vec<(AccessId, Target)>, String>;
}
```
The facade reexports the displayed Access values, Groups identity values and sentinels. Filters exist only in `AccessContext` and are never persisted.
## Semantics
`create` rejects a policy whose authority is filtered by the context, then submits the policy without requiring current authority membership.
`replace_policy` obtains one coherent Groups membership snapshot, requires current user edit authority through the driver's witness, and returns `access is unavailable` when no witness is visible. Editors and viewers are canonicalized before submission; sentinel editor groups and a direct `ALL_MODELS_MEMBER` viewer are rejected, and user or group viewers implied by editors are omitted. Current authority remains projection-owned and is not exposed by this facade. Model visibility is not an edit prerequisite.
`check` preserves context-aware discovery repair: a driver-reported missing record causes one discovery submission before one Groups membership snapshot and the authorization check. Unknown, wrong-subsystem, and filtered access is not repaired.
Empty `check_many` and `resolve_visible_targets` calls return an empty vector before Groups or driver work. Each nonempty call uses one coherent membership snapshot and one positional driver operation; neither repairs discovery.
`list_user` applies the complete context. `list_group` makes one current user-membership query and returns `access group is unavailable` unless the requested group is present. `list_user_group_targets` uses one coherent membership snapshot and its user groups. Listing never repairs discovery, and the driver applies context filters and subsystem selection.
Dependency errors are returned unchanged except for the two concealed outcomes stated above. The facade has no retry, cap, migration, worker, queue, timeout, or caller-coordination requirement.
## Performance
`open` is not yet benchmarked and synchronously performs driver opening and registration.
`create` is not yet benchmarked; facade-owned work is one filter lookup before one driver mutation.
`replace_policy` is not yet benchmarked; facade-owned work scales with memberships and sorting the supplied editor and viewer lists before one driver mutation.
`check` is not yet benchmarked; it performs one discovery query, at most one discovery mutation, one membership query, and one driver check.
`check_many` and `resolve_visible_targets` are not yet benchmarked; facade-owned work is constant beyond one membership query and one driver call over the supplied positions.
`list_user` is not yet benchmarked and adds constant facade work to one driver query.
`list_group` is not yet benchmarked; facade-owned work scans the current user-group result once before one driver query.
`list_user_group_targets` is not yet benchmarked and performs one membership query followed by one driver query over its user groups.
The facade owns no lock or I/O beyond delegated operations. Dependency scheduling, persistence, callback, and query latency have no finite wall-clock bound.