Canonical Target

• canonical extracted KES runtime target: http://localhost:4025

Rehearsal Host Notes

• old colocated KES host was verified in the isolated rehearsal stack through the internal legacy host on kesold93:4020
• new extracted host was verified on kesnew93:4025
• temporary API rehearsal host ran on api93:4002
• authenticated paths used the normal JWT plus /auth/me contract, but the /auth/me responder was a temporary auth stub because the full svc-auth container failed in this Docker environment on a native sharp runtime mismatch

Routes Checked

• GET /kes-orchestrator/cases?page=1&pageSize=1
• GET /kes-orchestrator/control-plane
• GET /kes-orchestrator/process-map
• GET /kes-orchestrator/suggestions
• PUT /kes-orchestrator/process-map without bearer token
• PUT /kes-orchestrator/process-map with bearer token
• POST /kes-orchestrator/cases with bearer token
• POST /kes-orchestrator/cases/:id/approve-landowner with bearer token
• POST /kes-orchestrator/cases/:id/payments/request with bearer token

Old Host Result

• list read: 200
• control-plane read: 200
• process-map read: 200
• suggestions without stakeholder filter: 400 stakeholder_id_required
• unauthenticated process-map write: 401 missing_bearer_token
• authenticated process-map write: 200
• authenticated case create: 201
• authenticated landowner approval: 200
• payment request in current signature-gate setup: 403 signature_verification_failed

New Host Result

• list read: 200
• control-plane read: 200
• process-map read: 200
• suggestions without stakeholder filter: 400 stakeholder_id_required
• unauthenticated process-map write: 401 missing_bearer_token
• authenticated process-map write: 200
• authenticated case create: 201
• authenticated landowner approval: 200
• payment request in current signature-gate setup: 403 signature_verification_failed

Parity Verdict

• parity confirmed for the first-cut KES HTTP/runtime surface
• parity confirmed for:
  • control-plane reads
  • process-map reads/writes
  • case creation
  • landowner approval
  • payment-sensitive signature-gate failure behavior
• no KES-specific route-shape drift found in the checked set

Mismatches Found

• no blocking mismatch found
• observed response differences were request-time or shared-DB noise only:
  • snapshotAt
  • updatedAt
  • generated caseId
  • contract IDs intentionally varied to avoid uniqueness conflicts during rehearsal

Shared Event-Backbone Boundary Notes

This parity result covers:

• KES HTTP/runtime surface
• KES route/support behavior
• KES persistence behavior

It does not claim that the following are now KES-local:

• Kafka relay
• broader projection pipeline
• idempotency store
• DLQ / replay tooling

Those remain shared Kvary event-backbone pieces outside the first-cut KES runtime.