# Principal-limited service discovery (K1396–K1400)

The service process privately owns the `Registry` and a bounded `Visibility`
policy. A trusted startup policy grants a principal access to a tuple of
namespace and service name. The process boundary supplies the authenticated
principal identity; request bytes do not appoint their own principal. Direct
`Registry::lookup` stays inside the service process.

`Visibility::query` returns a binding only when the principal, namespace, and
name all match a visibility grant and the name is currently bound. A hidden
bound name and an unknown name both return `NotFound`, so a client cannot
distinguish their existence through this API. A public grant does not expose
the same name through the management namespace. Queries have no mutable
access to grants, bindings, or resource counts. Duplicate visibility grants
are rejected before policy publication.

K1398 checks two allowed public queries and the full unchanged registry
state. K1399 checks a management-name query, a nonexistent management name,
cross-namespace queries, unchanged policy and registry state, and a healthy
public query after denial. A mutation test disables the visibility guard and
must make the negative test fail. K1400 still requires real EL0 principal
identity and six-profile guest evidence; local tests alone do not prove
product integration. The model has no `unsafe` operation.