# K1 HTTP people models
`kcode-k1-http-people-models` supplies authenticated routes intended to be nested by
`kcode-k1-http` below `/api`. It owns only a supplied local-model catalog and Group
model-membership UI mutations; authentication, Access semantics, listeners, model
discovery, persistence, and provider management remain outside this package.
## API
- `LocalModel::new(ModelId, String)` validates an exact display name: 1–128 UTF-8
bytes, no control characters, and at least one non-whitespace character. It does
not trim or normalize.
- `authenticated_routes(Arc<K1Groups>, Arc<[LocalModel]>)` rejects duplicate model
IDs and returns a `Router<()>`.
All routes require `Extension<Principal>`, return JSON, and set `Cache-Control:
no-store`:
- `GET /people/models` returns the supplied catalog in supplied order and the
canonical `ALL_MODELS` group.
- `PUT /people/groups/{group_id}/models/{model_id}` adds a catalogued model.
- `DELETE /people/groups/{group_id}/models/{model_id}` removes any canonical model,
allowing stale catalog entries to be removed.
IDs accept only canonical lowercase hexadecimal: 24 characters for groups and 64
for models. Group lookup and mutation run in Tokio blocking tasks. Only human Group
Owners may mutate ordinary groups. Group facade failures are reported as concise
`groups_unavailable` JSON errors with the dependency message nested below that
context.