# K1 access
`kcode-k1-access` is the synchronous, Groups-aware facade for the logical KTO subsystem `k1-access-subsystem`.
## Public API
```rust
use std::{path::Path, sync::Arc};
use kcode_k1_access::{
AccessCheck, AccessContext, AccessId, AccessPolicy, AccessRevision, Authority,
FilteredAuthorities, GroupId, K1Access, ModelId, ProfileId, SentinelGroup, SubsystemId,
Target, TxId, UserId, ViewerSubject, ALL_MODELS, ALL_MODELS_MEMBER, ALL_USERS,
LOCAL_MODELS,
};
use kcode_k1_groups::K1Groups;
use kcode_k1_peering::K1Peering;
use kcode_k1_txn_ordering::K1TxnOrdering;
pub struct K1Access { /* opaque */ }
impl K1Access {
pub fn open(
root: &Path,
ordering: Arc<K1TxnOrdering>,
peering: Arc<K1Peering>,
groups: Arc<K1Groups>,
) -> Result<Self, String>;
pub fn create(
&self,
context: &AccessContext,
target: Target,
profile_id: ProfileId,
policy: AccessPolicy,
) -> Result<AccessRevision, String>;
pub fn profile_id(&self, access_id: AccessId) -> Result<Option<ProfileId>, String>;
pub fn replace_policy(
&self,
context: &AccessContext,
access_id: AccessId,
editors: Vec<Authority>,
viewers: Vec<ViewerSubject>,
) -> Result<AccessRevision, String>;
pub fn check(
&self,
context: &AccessContext,
access_id: AccessId,
expected_subsystem: SubsystemId,
) -> Result<AccessCheck, String>;
pub fn check_many(
&self,
context: &AccessContext,
access_ids: &[AccessId],
expected_subsystem: SubsystemId,
) -> Result<Vec<AccessCheck>, String>;
pub fn resolve_visible_targets(
&self,
context: &AccessContext,
targets: &[Target],
expected_subsystem: SubsystemId,
) -> Result<Vec<Option<AccessId>>, String>;
pub fn list_user(
&self,
context: &AccessContext,
expected_subsystem: SubsystemId,
) -> Result<Vec<AccessId>, String>;
pub fn list_group(
&self,
context: &AccessContext,
group: GroupId,
expected_subsystem: SubsystemId,
) -> Result<Vec<AccessId>, String>;
pub fn list_user_group_targets(
&self,
context: &AccessContext,
expected_subsystem: SubsystemId,
) -> Result<Vec<(AccessId, Target)>, String>;
}
```
The facade reexports the displayed Access values, including `ProfileId`, and Groups identity values and sentinels. Filters exist only in `AccessContext` and are never persisted.
## Profile link and wire contract
Every newly created access record has one required, non-null `ProfileId`. `create` submits that ID after the existing filtered-authority preflight, and the driver persists it as the record's immutable profile link. Replacement and authorization operations do not alter the link.
The 0.6.0 API and its selected Access 0.4.0 dependencies use the strict profile-linked wire format. There is no legacy fallback, nullable/default profile ID, compatibility decoder, or migration path in this facade. Callers must supply a valid `ProfileId` and coordinate any stored-data transition outside this package before adopting 0.6.0.
`profile_id` is a trusted internal/public-library primitive that forwards a raw lookup to the driver. It intentionally performs no authorization, context filtering, or unavailable-result concealment. It must not be exposed directly through an untrusted or user-facing interface; an owning service must authorize and conceal results before disclosure.
## Semantics
`create` rejects a policy whose authority is filtered by the context, then submits the target, immutable profile ID, and policy without requiring current authority membership.
`replace_policy` obtains one coherent Groups membership snapshot, requires current user edit authority through the driver's witness, and returns `access is unavailable` when no witness is visible. Editors and viewers are canonicalized before submission; sentinel editor groups and a direct `ALL_MODELS_MEMBER` viewer are rejected, and user or group viewers implied by editors are omitted. Current authority remains projection-owned and is not exposed by this facade. Model visibility is not an edit prerequisite.
`check` preserves context-aware discovery repair: a driver-reported missing record causes one discovery submission before one Groups membership snapshot and the authorization check. Unknown, wrong-subsystem, and filtered access is not repaired.
Empty `check_many` and `resolve_visible_targets` calls return an empty vector before Groups or driver work. Each nonempty call uses one coherent membership snapshot and one positional driver operation; neither repairs discovery.
`list_user` applies the complete context. `list_group` makes one current user-membership query and returns `access group is unavailable` unless the requested group is present. `list_user_group_targets` uses one coherent membership snapshot and its user groups. Listing never repairs discovery, and the driver applies context filters and subsystem selection.
Dependency errors are returned unchanged except for the two concealed outcomes stated above. The facade has no retry, cap, migration, worker, queue, timeout, or caller-coordination requirement.
## Performance
`open` is not yet benchmarked and synchronously performs driver opening and registration.
`create` is not yet benchmarked; facade-owned work is one filter lookup before one driver mutation.
`profile_id` is not yet benchmarked and adds no facade work beyond one driver query.
`replace_policy` is not yet benchmarked; facade-owned work scales with memberships and sorting the supplied editor and viewer lists before one driver mutation.
`check` is not yet benchmarked; it performs one discovery query, at most one discovery mutation, one membership query, and one driver check.
`check_many` and `resolve_visible_targets` are not yet benchmarked; facade-owned work is constant beyond one membership query and one driver call over the supplied positions.
`list_user` is not yet benchmarked and adds constant facade work to one driver query.
`list_group` is not yet benchmarked; facade-owned work scans the current user-group result once before one driver query.
`list_user_group_targets` is not yet benchmarked and performs one membership query followed by one driver query over its user groups.
The facade owns no lock or I/O beyond delegated operations. Dependency scheduling, persistence, callback, and query latency have no finite wall-clock bound.