KES Dependency Edge Map

Historical Status Note

This dependency map records the pre-extraction and first-cut hardening state.

Current truth:

• live KES HTTP/runtime callers now go through services/svc-kes and services/api/src/routes/kes-orchestrator.ts
• the old svc-tenders KES HTTP host is retired
• the former services/svc-tenders/src/kes/* compatibility layer is removed

References below to deleted svc-tenders route/support or compatibility files are historical unless a line explicitly describes shared backbone code in services/svc-tenders/src/kafka.

Edge Inventory

| Dependency edge | Current source | Current target | Dependency type | Verdict | Notes | | --- | --- | --- | --- | --- | --- | | KES route module -> mixed repository slice | | | persistence / domain port | should move into KES later | Biggest code-boundary blocker; KES route is isolated but repository ownership is not | | KES route support -> shell auth/parsers | | | shared support / parser / auth | must remain shared after extraction | , parse helpers, and query normalization are shell-level today | | Payment request -> KYC boundary helper | | | ingress / KYC boundary | can be wrapped later | KES needs it, but it is still shell-owned ingress policy | | Payment request/approve/settle -> signature gate | | | ingress / signature verification | can be wrapped later | Extraction will need a stable shared contract for this | | KES route module -> root validation file | | | validation / schema | should move into KES later | Cleanest near-term hardening target | | Live gateway -> KES runtime seam | | | API / service-target seam | should become API/service contract | Gateway shape is already appropriate for a future extracted runtime | | Gateway mutation proxy -> Kafka envelope producer | | | kafka / operational eventing | should stay temporary for now | Useful operational stream, but not the canonical durable event boundary | | KES events consumer -> idempotency store | | | kafka consumer infra | must remain shared after extraction | This behaves like event-backbone infrastructure, not KES-only product logic | | KES domain-event consumer -> projection tables | | KES projection tables from migration | projection / read-model | unresolved | Feels KES-centric, but still tied to shared outbox/event discipline | | KES outbox relay -> kes_outbox_events | | outbox tables from migration | shared event backbone | unresolved | Could stay shared longer even if KES route/runtime moves | | Web portal API -> gateway KES routes | | | web client / backend contract | should become API/service contract | Real backend consumer | | KES control-plane view -> portal API | | | web client | can remain shared after extraction | No special blocker here if gateway contract stays stable | | KES workspace/editor page -> localStorage | | browser storage | UI-local state | should stay temporary for now | This is not part of the backend extraction core |