KES Code Boundary Hardening

Historical Status Note

This document records the first hardening move that happened before the extracted svc-kes runtime and later compatibility-layer removal.

Current truth:

• canonical KES runtime: services/svc-kes
• old svc-tenders KES HTTP host: retired
• former services/svc-tenders/src/kes/validation.ts and contracts.ts: removed as live paths

The path references below are historical hardening evidence, not current runtime ownership.

What validation moved

Sprint 88 moved the clearly KES-owned schema block out of the mixed root validator and into:

• validation.ts

Moved schemas:

• createKesOrchestratorCaseSchema
• approveKesOrchestratorLandownerSchema
• publishKesOrchestratorAuctionSchema
• confirmKesOrchestratorFundingSchema
• assignKesOrchestratorTaskSchema
• submitKesOrchestratorInspectionSchema
• requestKesOrchestratorPaymentSchema
• approveKesOrchestratorPaymentSchema
• settleKesOrchestratorPaymentSchema
• closeKesOrchestratorCaseSchema
• upsertKesOrchestratorProcessMapSchema

Route behavior stayed unchanged:

• same route paths
• same safeParse(...) usage pattern
• same 400 invalid_payload error shape

What contracts/types were hardened

KES-owned route, repository-port, and domain-facing types were isolated into:

• contracts.ts

The new KES-owned contract file now owns:

• KES route support shape
• KES repository port shape
• KES case/task/inspection/payment/process-map types
• KES projection and lifecycle-gate types
• KES command/input shapes
• KES signature-audit type

This reduced direct dependency on mixed root layers in two places:

• registerKesRoutes.ts now imports KES types from src/kes/contracts.ts and KES schemas from src/kes/validation.ts
• kesRouteSupport.ts now depends on the KES-owned support contract instead of importing its type surface from the KES route module

What mixed dependencies were reduced

Reduced:

• KES route module -> root validation.ts
• KES route module -> root repository-owned route/support type surface
• KES support builder -> route-module-owned support type surface

What the root repository became instead:

• repository.ts now acts as a compatibility import/export site for the KES type surface rather than the primary owner of those KES contracts

What still remains shared

Still shared on purpose:

• auth ingress and /auth/me principal resolution in server.ts
• KYC boundary helper in server.ts
• signature verification helper in server.ts
• gateway seam in kes-orchestrator.ts
• Kafka/outbox/projection runtime pieces under services/svc-tenders/src/kafka

What still blocks runtime/bootstrap prep

• KES persistence methods still live in the mixed root repository.ts
• payment-note encryption and event hash-chain logic still live there too
• ingress/security is still shell-owned, not wrapped behind a smaller dedicated contract yet
• Kafka/outbox/projection ownership is still shared/backbone-heavy rather than clearly KES-local

Notes

• This sprint intentionally did not force event-backbone logic into fake KES ownership.
• The hardening gain is real, but KES is still not runtime-first ready.