KES Code Boundary Hardening
Historical Status Note
This document records the first hardening move that happened before the extracted svc-kes runtime and later compatibility-layer removal.
Resolving locale, route permissions, and workspace projection.
Current scope: Guest
Category: 10_normative | Version: v1.0.0
Owner: DOCUMENT_CUSTODIAN | Review cycle: 90 days
Approval authority: GOVERNANCE_ADMIN
Documentation portal is read-only. Editing and mutation endpoints are disabled.
Kvary platform is originally created in Georgian. Where a Georgian version exists, Georgian is authoritative for platform UI, documentation, and legal interpretation.
Translations into other languages are provided for convenience. Some records may originate in other languages and carry their own source or legal locale for a specific flow, but where a Georgian version is available, the Georgian version prevails for platform-level wording and interpretation.
Metadata incomplete: Document ID, Version, Status, Owner Role, Last Review Date, Next Review Date, Change Log
This document records the first hardening move that happened before the extracted svc-kes runtime and later compatibility-layer removal.
Current truth:
svc-tenders KES HTTP host: retiredservices/svc-tenders/src/kes/validation.ts and contracts.ts: removed as live pathsThe path references below are historical hardening evidence, not current runtime ownership.
Sprint 88 moved the clearly KES-owned schema block out of the mixed root validator and into:
Moved schemas:
createKesOrchestratorCaseSchemaapproveKesOrchestratorLandownerSchemapublishKesOrchestratorAuctionSchemaconfirmKesOrchestratorFundingSchemaassignKesOrchestratorTaskSchemasubmitKesOrchestratorInspectionSchemarequestKesOrchestratorPaymentSchemaapproveKesOrchestratorPaymentSchemasettleKesOrchestratorPaymentSchemacloseKesOrchestratorCaseSchemaupsertKesOrchestratorProcessMapSchemaRoute behavior stayed unchanged:
safeParse(...) usage pattern400 invalid_payload error shapeKES-owned route, repository-port, and domain-facing types were isolated into:
The new KES-owned contract file now owns:
This reduced direct dependency on mixed root layers in two places:
src/kes/contracts.ts and KES schemas from src/kes/validation.tsReduced:
validation.tsWhat the root repository became instead:
Still shared on purpose:
/auth/me principal resolution in server.ts