# Public API
```rust
use std::{path::Path, sync::Arc};
use kcode_k1_transaction_id::TxId;
use kcode_k1_txn_ordering::{K1TxnOrdering, SubsystemId};
pub struct K1Peering;
impl K1Peering {
pub fn open(root: &Path, ordering: Arc<K1TxnOrdering>) -> Result<Self, String>;
pub fn submit_txn(&self, subsystem: SubsystemId, payload: &[u8]) -> Result<TxId, String>;
}
```
# Identity
`open` retains the supplied live ordering instance and uses `root/identity.key` for the local Ed25519 identity; it does not open or own the ordering root. A missing peering root is created. The root and identity must be real directories and files, not symbolic links.
A new identity is created only when ordering has no canonical tip. The file contains the 32-byte private seed followed by its corresponding 32-byte public key and is installed exclusively, synchronized, and owner-only on Unix. Existing identity material must be a regular 64-byte file with matching keys and, on Unix, no group or other permissions. A missing identity with nonempty history, malformed identity, interrupted installation, or failed installation is rejected without automatic repair or replacement. Errors do not disclose key bytes.
Performance: Not yet benchmarked; `open` performs fixed work over one 64-byte local file plus OS entropy and synchronized file creation for a new identity, with no timeout or retry.
# Submission
`submit_txn` reads the current Unix timestamp in seconds and asks ordering to construct and sign a local transaction using the persisted public key, requested subsystem, payload, one Ed25519 signature, and successful no-op propagation. The target subsystem must already be active in ordering, otherwise the call fails before mutation. On success it returns ordering's exact `TxId` after the target callback completes.
An error identifying a transaction as committed records a committed transaction and must not be retried as a precommit rejection. Subsystems submit through peering and update durable materialization only through canonical ordering callbacks. Concurrent calls are independent at this layer and follow ordering's serialization and callback guarantees.
Performance: Not yet benchmarked; for payload length `B`, `submit_txn` performs `O(B)` signing work with no transaction-sized peering allocation, then waits for ordering persistence and callback completion without timeout or retry.