Canonical KES Runtime

• canonical KES HTTP/runtime host: services/svc-kes
• canonical runtime entry: server.ts
• canonical KES persistence: repository.ts
• canonical gateway seam: kes-orchestrator.ts
• canonical gateway target in practice: KES_ORCHESTRATOR_SERVICE_URL=http://localhost:4025

Retired Host Status

• the old colocated KES HTTP host in svc-tenders is retired
• the former KES route mount in server.ts is gone
• the former registerKesRoutes.ts and kesRouteSupport.ts paths under services/svc-tenders/src/routes are gone

Removed Compatibility-Layer Status

• the former services/svc-tenders/src/kes/* compatibility package is gone
• KES delegation through repository.ts is gone
• svc-tenders no longer exposes a KES compatibility repository surface through TendersRepository

Shared Backbone Inventory

The following KES-related pieces still remain shared on purpose in svc-tenders:

• shared event backbone: kesOutboxRelay.ts
• shared event backbone: kesDomainEventConsumer.ts
• shared infra/runtime concern: kesEventConsumer.ts
• shared infra/runtime concern: kesDlqReplay.ts
• shared infra/runtime concern: kesOutboxPoisonReplay.ts
• shared infra/runtime concern: idempotencyStore.ts

What Remains Shared On Purpose

• gateway seam and route family in kes-orchestrator.ts
• shared auth ingress contract and upstream /auth/me resolution
• shared KYC/signature semantics, even though they are now consumed from the extracted runtime
• Kafka relay, projection pipeline, idempotency, and replay tooling
• API-side KES proxy event publication

These remain because the first KES extraction cut moved the HTTP/runtime host, not the whole event backbone.

What May Move Later

• KES outbox relay ownership if the team later wants KES-local durable publication
• domain-event projection ownership if the team later wants KES-local projection runtime
• replay tooling and idempotency ownership if the team later wants fuller operational independence
• deeper ownership of KYC/signature policy if the team later wants KES-local ingress policy rather than a shared shell contract

Notes

• Shared backbone retention is intentional, not a host-retirement bug.
• The extracted KES runtime is real and canonical even though the shared event backbone still lives in svc-tenders.
• Older KES prep docs that mention deleted services/svc-tenders/src/kes/* paths should now be read as historical unless they explicitly say otherwise.