Process-Map Checks

• GET /kes-orchestrator/process-map
• PUT /kes-orchestrator/process-map with authenticated operator fixture
• denial path for unauthenticated PUT /kes-orchestrator/process-map

Case / Task / Inspection Action Checks

• POST /kes-orchestrator/cases
• POST /kes-orchestrator/cases/:id/approve-landowner
• POST /kes-orchestrator/cases/:id/publish-auction
• POST /kes-orchestrator/cases/:id/confirm-funding
• POST /kes-orchestrator/cases/:id/tasks
• POST /kes-orchestrator/cases/:id/inspections
• POST /kes-orchestrator/cases/:id/close

Payment-Sensitive Ingress Checks

• POST /kes-orchestrator/cases/:id/payments/request
  • verify KYC boundary behavior
  • verify signature gate behavior
• POST /kes-orchestrator/payments/:id/approve
  • verify signature gate behavior
• POST /kes-orchestrator/payments/:id/settle
  • verify signature gate behavior

Auth-Protected Denial Checks

• unauthenticated POST /kes-orchestrator/cases
• unauthenticated PUT /kes-orchestrator/process-map
• unauthenticated payment mutation path

Env-Cutover Checks

• fallback mode with KES_ORCHESTRATOR_SERVICE_URL unset or pointing to http://localhost:4020
• extracted cutover mode with KES_ORCHESTRATOR_SERVICE_URL=http://localhost:4025
• verify route shape remains identical on gateway
• verify auth behavior remains identical on gateway

Rollback Checks

• revert KES_ORCHESTRATOR_SERVICE_URL back to http://localhost:4020 or unset it
• restart API only
• confirm fallback path works again immediately

Event-Backbone Note

Parity for the first cut should be interpreted as:

• KES HTTP/runtime parity
• KES route/support parity
• KES persistence parity

It is not a claim that the extracted KES runtime already owns:

• Kafka relay
• broader projection pipeline
• idempotency store
• DLQ / replay tooling

Those remain shared outside first-cut KES ownership by design.