Current truth:

• live KES HTTP/runtime callers now go through services/svc-kes and services/api/src/routes/kes-orchestrator.ts
• the old svc-tenders KES HTTP host is retired
• the former services/svc-tenders/src/kes/* compatibility layer is removed

References below to deleted svc-tenders route/support or compatibility files are historical unless a line explicitly describes shared backbone code in services/svc-tenders/src/kafka.

Edge Inventory

| Dependency edge | Current source | Current target | Dependency type | Verdict | Notes | | --- | --- | --- | --- | --- | --- | | KES route module -> mixed repository slice | registerKesRoutes.ts | repository.ts | persistence / domain port | should move into KES later | Biggest code-boundary blocker; KES route is isolated but repository ownership is not | | KES route support -> shell auth/parsers | kesRouteSupport.ts | server.ts | shared support / parser / auth | must remain shared after extraction | requireServiceAuth, parse helpers, and query normalization are shell-level today | | Payment request -> KYC boundary helper | registerKesRoutes.ts | server.ts | ingress / KYC boundary | can be wrapped later | KES needs it, but it is still shell-owned ingress policy | | Payment request/approve/settle -> signature gate | registerKesRoutes.ts | server.ts | ingress / signature verification | can be wrapped later | Extraction will need a stable shared contract for this | | KES route module -> root validation file | registerKesRoutes.ts | validation.ts | validation / schema | should move into KES later | Cleanest near-term hardening target | | Live gateway -> KES runtime seam | kes-orchestrator.ts | KES_ORCHESTRATOR_SERVICE_URL ?? TENDERS_SERVICE_URL | API / service-target seam | should become API/service contract | Gateway shape is already appropriate for a future extracted runtime | | Gateway mutation proxy -> Kafka envelope producer | kes-orchestrator.ts | kesEventProducer.ts | kafka / operational eventing | should stay temporary for now | Useful operational stream, but not the canonical durable event boundary | | KES events consumer -> idempotency store | kesEventConsumer.ts | idempotencyStore.ts | kafka consumer infra | must remain shared after extraction | This behaves like event-backbone infrastructure, not KES-only product logic | | KES domain-event consumer -> projection tables | kesDomainEventConsumer.ts | KES projection tables from migration 0029 | projection / read-model | unresolved | Feels KES-centric, but still tied to shared outbox/event discipline | | KES outbox relay -> kes_outbox_events | kesOutboxRelay.ts | outbox tables from migration 0027 | shared event backbone | unresolved | Could stay shared longer even if KES route/runtime moves | | Web portal API -> gateway KES routes | apps/web/src/portal/api.ts | /api/v1/kes/orchestrator/* | web client / backend contract | should become API/service contract | Real backend consumer | | KES control-plane view -> portal API | KesControlPlaneView.tsx | apps/web/src/portal/api.ts | web client | can remain shared after extraction | No special blocker here if gateway contract stays stable | | KES workspace/editor page -> localStorage | page.tsx | browser storage | UI-local state | should stay temporary for now | This is not part of the backend extraction core |

Shared vs Must-Separate Summary

Must remain shared at first:

• gateway route family
• auth ingress and /auth/me principal resolution
• shell-owned parser helpers
• KYC boundary helper
• signature verification helper
• event-backbone infra such as idempotency

Should become KES-owned later:

• route-facing KES contracts
• KES validation
• KES repository/persistence slice
• KES case/projection/payment/hash-chain logic

Unresolved:

• whether outbox relay and domain-event consumer move with KES runtime or remain shared-Kvary event infrastructure longer
• whether KES payment-sensitive ingress helpers become KES-local wrappers or remain centrally shell-hosted