KES Env Cutover Rehearsal

Canonical Runtime Target

• canonical KES extracted target: http://localhost:4025

Rehearsal Environment Settings

• fallback old KES host inside the isolated stack: http://kesold93:4020
• extracted KES host inside the isolated stack: http://kesnew93:4025
• temporary API rehearsal host: http://api93:4002
• API seam under test:
  • fallback: KES_ORCHESTRATOR_SERVICE_URL=http://kesold93:4020
  • cutover: KES_ORCHESTRATOR_SERVICE_URL=http://kesnew93:4025

Additional isolated-stack note:

• KES_ORCHESTRATOR_KAFKA_ENABLED=false on the temporary API rehearsal container
  • this kept the rehearsal focused on first-cut KES HTTP/runtime parity
  • shared event-backbone ownership remains outside the first-cut KES runtime by design

Cutover Steps

1. started the isolated old host, new host, auth stub, and temporary API containers
2. verified fallback API mode against old host
3. restarted only the temporary API with:
   • KES_ORCHESTRATOR_SERVICE_URL=http://kesnew93:4025
4. reran the same gateway probe set through /api/v1/kes/orchestrator/*

Rollback Steps

1. stopped only the temporary API container
2. restarted it with:
   • KES_ORCHESTRATOR_SERVICE_URL=http://kesold93:4020
3. reran rollback confirmation probes

Smoke Checks Run

• GET /api/v1/kes/orchestrator/cases?page=1&pageSize=1
• GET /api/v1/kes/orchestrator/process-map
• GET /api/v1/kes/orchestrator/control-plane
• PUT /api/v1/kes/orchestrator/process-map without bearer token
• PUT /api/v1/kes/orchestrator/process-map with bearer token
• POST /api/v1/kes/orchestrator/cases with bearer token
• POST /api/v1/kes/orchestrator/cases/:id/payments/request with bearer token

Observations

• gateway fallback mode worked
• gateway cutover mode worked with only the env seam changed
• rollback back to old host worked
• route shape stayed unchanged under /api/v1/kes/orchestrator/*
• auth behavior stayed unchanged at the HTTP contract level:
  • unauthenticated write denial stayed 401
  • authenticated write paths succeeded where expected
  • payment-sensitive signature gate stayed 403 signature_verification_failed

Remaining Risks

• full svc-auth was not used in this isolated Docker rehearsal because its container hit a native sharp runtime mismatch; a small /auth/me stub was used instead
• temporary API rehearsal disabled API-side proxy Kafka publication to keep the rehearsal scoped to first-cut KES runtime parity
• broader shared event-backbone behavior remains outside first-cut KES ownership and outside the scope of this rehearsal