Runtime Location

• new runtime: services/svc-kes
• bootstrap entry: server.ts
• canonical intended dev port: http://localhost:4025

Bootstrap Shape

The first copy-first KES runtime now exists with:

• package.json
• tsconfig.json
• config.ts
• db.ts
• auth.ts
• server.ts
• migrate.ts

Files Copied Into The First-Cut Runtime

• KES contracts: contracts.ts
• KES validation: validation.ts
• KES repository/persistence: repository.ts
• KES route registration: registerKesRoutes.ts
• KES route support: kesRouteSupport.ts
• KES auth/runtime request types: authTypes.ts
• KES-local security helpers needed by persistence and payment ingress: security.ts
• KES-owned migrations for first-cut tables:
  • 0024_kes_orchestrator.sql
  • 0025_kes_orchestrator_process_map.sql

What Remains Shared On Purpose

• gateway seam in kes-orchestrator.ts
• KES_ORCHESTRATOR_SERVICE_URL ?? TENDERS_SERVICE_URL
• shared auth ingress behavior and /auth/me principal resolution
• KYC/signature enforcement semantics
• Kafka relay and outbox runtime
• broader projection pipeline
• Kafka idempotency store
• DLQ and replay tooling

What Stayed Old-Host-Only

• active colocated KES hosting in server.ts
• shared Kafka/outbox/projection tooling under src/kafka
• fallback rollback target still available on http://localhost:4020

This section describes the bootstrap-time coexistence state. The old KES HTTP host was later retired in Sprint 97.

Dev / Coexistence Wiring

Root helpers exist for the extracted runtime, and normal repo startup now has enough KES-aware port coverage to treat svc-kes as the active primary runtime:

• package.json
  • predev:kes
  • dev:kes
  • dev:api:kes-extracted
• dev-bootstrap.js
  • 4025 port cleanup awareness

Post-cutover status note:

• the live API seam now targets svc-kes
• the old svc-tenders KES host has since been retired

Coexistence / Rollback Notes

• svc-kes is now the active primary KES runtime
• rollback remained simple at bootstrap time because no live seam was changed in that sprint

Current status after Sprint 97:

• the old svc-tenders KES HTTP host is no longer present
• shared backbone/runtime pieces still remain outside first-cut KES ownership

Event-Backbone Boundary Note

This runtime owns the KES HTTP surface, route/support layer, contracts/validation, and KES persistence.

It does not claim first-cut ownership of:

• Kafka relay
• outbox publication runtime
• domain-event projection pipeline
• Kafka idempotency store
• DLQ / replay tooling

Those remain shared Kvary backbone pieces during the first extraction cut.