Resolving locale, route permissions, and workspace projection.
Current scope: Guest
Category: 10_normative | Version: v1.0.0
Owner: DOCUMENT_CUSTODIAN | Review cycle: 90 days
Approval authority: GOVERNANCE_ADMIN
Documentation portal is read-only. Editing and mutation endpoints are disabled.
Kvary platform is originally created in Georgian. Where a Georgian version exists, Georgian is authoritative for platform UI, documentation, and legal interpretation.
Translations into other languages are provided for convenience. Some records may originate in other languages and carry their own source or legal locale for a specific flow, but where a Georgian version is available, the Georgian version prevails for platform-level wording and interpretation.
Metadata incomplete: Document ID, Version, Status, Owner Role, Last Review Date, Next Review Date, Change Log
KES now owns its core route, contract, validation, support, and persistence surface in code, but its event-driven surroundings are still split across three layers:
KES-owned domain and persistenceshared Kvary event backboneshared runtime / operational infrastructureThat split is real and should stay explicit during extraction prep.
VERIFIED KES-owned: extracted KES HTTP/runtime surface under services/svc-kes
Notes: svc-kes is now the canonical KES HTTP/runtime host after retirement of the old colocated svc-tenders host.
VERIFIED KES-owned: services/svc-kes/src/kes/repository.ts
Notes: Contains the KES SQL, row mapping, payment-note handling, integrity hash-chain logic, and kes_orchestrator_events append/read behavior in the canonical extracted runtime.
VERIFIED KES-owned: KES route-triggered domain mutations through services/svc-kes/src/routes/registerKesRoutes.ts
Notes: Case creation, task assignment, inspection submission, payment request/approve/settle, and case closure all land in KES-owned persistence through the extracted runtime.
VERIFIED KES-owned: Control-plane and projection-oriented reads served by KES routes, backed by services/svc-kes/src/kes/repository.ts
Notes: These are still KES-facing reads even when some of their freshness assumptions depend on shared projection flow later.
VERIFIED shared-backbone-owned: services/svc-tenders/src/kafka/kesOutboxRelay.ts
Notes: Reads kes_outbox_events, publishes to Kafka, tracks attempts, lag, poison rows, and monitoring. This is a durable delivery bridge, not KES-local request logic.
VERIFIED shared-backbone-owned: services/svc-tenders/src/kafka/kesDomainEventConsumer.ts
Notes: Consumes domain-event envelopes, applies projection writes, and manages domain-event DLQ behavior. This is broader event backbone / projection infrastructure, not just KES route hosting.
VERIFIED shared-backbone-owned: domain-event topics and projection pipeline described in docs/EVENT_DRIVEN_ARCHITECTURE.md
Notes: kes.orchestrator.domain-events and its projection tables are the meaningful downstream event-processing path today.
INFERRED shared-backbone-owned: projection rebuild and control-plane freshness assumptions
Notes: Current KES reads are still compatible with shared projection ownership. Full projection autonomy is later cleanup, not first-cut extraction truth.
VERIFIED shared-infra-owned: services/svc-tenders/src/kafka/idempotencyStore.ts
Notes: Generic Kafka consumer idempotency table and claim logic. Not KES-specific.
VERIFIED shared-infra-owned: services/svc-tenders/src/kafka/kesDlqReplay.ts
Notes: Operational replay tooling for the KES proxy-event DLQ.
VERIFIED shared-infra-owned: services/svc-tenders/src/kafka/kesOutboxPoisonReplay.ts
Notes: Operational recovery tooling for poison outbox rows.
VERIFIED shared-infra-owned: API-side proxy event publishing in services/api/src/routes/kes-orchestrator.ts
Notes: Publishes transport/operational events after mutation proxying. Useful, but not the canonical durable event path because it is not transactionally tied to KES persistence.
VERIFIED shared-infra-owned: services/svc-tenders/src/kafka/kesEventConsumer.ts
Notes: Handles API-side proxy events with idempotency, retry, and DLQ support. Current default usage is transport/ops-oriented rather than the primary business mutation engine.
/auth/me identity resolutionsvc-tenders has now been removed