KES Live Cutover Observations

Route Checks Performed

Correct gateway route family used throughout:

• /api/v1/kes/orchestrator/*

Checked routes:

• GET /api/v1/kes/orchestrator/cases?page=1&pageSize=1
• GET /api/v1/kes/orchestrator/control-plane
• GET /api/v1/kes/orchestrator/process-map
• GET /api/v1/kes/orchestrator/suggestions?stakeholderId=11111111-1111-4111-8111-111111111111&limit=1
• unauthenticated PUT /api/v1/kes/orchestrator/process-map
• authenticated PUT /api/v1/kes/orchestrator/process-map
• authenticated POST /api/v1/kes/orchestrator/cases

Auth Observations

Auth behavior stayed consistent with the verified parity path:

• missing bearer token still returned 401 missing_bearer_token
• valid bearer token still passed gateway auth and KES service auth
• authenticated mutation happy-paths still succeeded after cutover

This window used the same proven auth contract shape as Sprint 94.

Environment caveat:

• full svc-auth still could not be used in this local Docker-backed execution because of the pre-existing native sharp runtime mismatch
• /auth/me was provided by a contract-compatible auth responder so the KES/gateway auth path could be exercised without changing auth semantics

Response / Status Observations

Post-cutover responses matched the expected first-cut KES runtime behavior:

• cases list returned 200
• control-plane snapshot returned 200
• process-map read returned 200
• suggestions returned 200 with an empty set for the chosen stakeholder fixture
• authenticated process-map mutation returned 200
• authenticated case creation returned 201

No gateway-specific route-shape issue appeared. No auth-path regression appeared. No KES-runtime mismatch appeared in the checked set.

Shared Event-Backbone Caveat

This cutover validates first-cut KES extracted-runtime parity only.

It does not prove that these pieces have become KES-local:

• Kafka relay
• broader projection pipeline
• idempotency store
• DLQ / replay tooling

Those remain shared backbone concerns outside the first-cut KES ownership boundary.

Anomalies

No blocking anomaly was found.

Observed differences remained expected runtime noise only:

• snapshotAt
• updatedAt
• generated caseId

Rollback Notes

Rollback was not needed.

Rollback path remained simple during the window:

• keep old colocated KES host alive on :4020
• restart only the API with KES_ORCHESTRATOR_SERVICE_URL unset or pointed back to http://localhost:4020

That rollback method was preserved even though the window stayed on svc-kes.