• before effective fallback mode: no KES_ORCHESTRATOR_SERVICE_URL override, or explicit fallback override to http://localhost:4020
• cutover target now present in repo env:
  • KES_ORCHESTRATOR_SERVICE_URL=http://localhost:4025

Canonical extracted KES runtime target remains:

• http://localhost:4025

Local Live Window Shape

Because the local Node/npm wrapper is still broken in this shell, the live window was executed against the real repo dist servers in a Docker-backed localhost stack:

• auth contract responder on :4100
• old colocated KES host on :4020
• extracted svc-kes host on :4025
• live API on :4001

The API route family stayed unchanged:

• /api/v1/kes/orchestrator/*

Cutover Start / Stop Steps

Pre-cutover fallback step

The live API was first started with the fallback override:

• KES_ORCHESTRATOR_SERVICE_URL=http://localhost:4020

This verified that the live stack still worked against the old colocated KES host before the cutover flip.

Cutover step

Only the API was restarted.

The restart used the repo env file with:

• KES_ORCHESTRATOR_SERVICE_URL=http://localhost:4025

No gateway route definitions changed. No auth middleware changed. Old colocated KES hosting remained up on :4020.

Smoke Checks Run

Pre-cutover fallback confirmation:

• GET /api/v1/health
• GET /api/v1/kes/orchestrator/cases?page=1&pageSize=1
• GET /api/v1/kes/orchestrator/control-plane
• GET /api/v1/kes/orchestrator/process-map
• GET /api/v1/kes/orchestrator/suggestions?stakeholderId=...&limit=1
• unauthenticated PUT /api/v1/kes/orchestrator/process-map
• authenticated PUT /api/v1/kes/orchestrator/process-map
• authenticated POST /api/v1/kes/orchestrator/cases

Post-cutover live checks:

• GET /api/v1/health
• GET /api/v1/kes/orchestrator/cases?page=1&pageSize=1
• GET /api/v1/kes/orchestrator/control-plane
• GET /api/v1/kes/orchestrator/process-map
• GET /api/v1/kes/orchestrator/suggestions?stakeholderId=...&limit=1
• unauthenticated PUT /api/v1/kes/orchestrator/process-map
• authenticated PUT /api/v1/kes/orchestrator/process-map
• authenticated POST /api/v1/kes/orchestrator/cases

Observations

Fallback mode worked.

Cutover mode worked after restarting only the API.

Observed post-cutover status set:

• cases read: 200
• control-plane read: 200
• process-map read: 200
• suggestions read with stakeholder filter: 200
• unauthenticated process-map write denial: 401 missing_bearer_token
• authenticated process-map write: 200
• authenticated case creation: 201

Whether The Cutover Remained In Place Or Was Rolled Back

The cutover remained in place.

No serious mismatch was found, so rollback was not needed during the window.

The old colocated KES host stayed available on :4020 throughout the window for immediate fallback if needed.