eho/atomic-design-poc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(openzaak): bounded retry + flagged write divergence (WP-60)

Browse Source 
Local aanvraag/document writes and their paired ZGW writes aren't
transactional; a ZGW failure after the local write succeeds used to
diverge silently. ZgwHttpClient now retries transport-shaped failures
(not 500, which can follow a partial commit on the non-idempotent
statussen/rollen POSTs), and a ZGW failure that survives retry sets
Aanvraag.ZgwError plus a zgw:divergence audit row instead of failing
or diverging quietly. No outbox/reconcile job: three request-triggered
write paths don't justify a persisted queue that would also need to
carry citizen PII for the JWT audit claims.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
eho
2026-07-30 18:11:55 +02:00
co-authored by Claude Sonnet 5
parent 67abc58052
commit 3ff80c124f
18 changed files with 855 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/architecture/0005-openzaak-behind-bff.md
+10 -2
View File
@@ -67,5 +67,13 @@ up front — the migration stance ADR-0001 already prescribes.
- **Also shipped (WP-50):** `IZaakSource.CreateZaak` — the first write. Submitting an aanvraag
now also creates a Zaak + Status + Rol in OpenZaak when `Zgw:Enabled=true`, routed through the
existing submit endpoint with zero DTO change (same seam, same anti-corruption boundary).
- **Deferred:** real inbound OIDC/JWT auth (still header-stubbed), Documenten/DRC upload + link
(WP-51), Notificaties/NRC webhooks (WP-52), adding OpenZaak to docker-compose.
- **Also shipped (WP-51):** `IDocumentSource` (`LocalDocumentSource`/`OpenZaakDocumentSource`,
same config-gated seam shape) — an upload registers a Documenten/DRC enkelvoudiginformatieobject
and, once a zaak exists, a submit links it in with a zaakinformatieobject.
- **Also shipped (WP-60):** bounded retry in `ZgwHttpClient` for transport-shaped ZGW failures,
plus a flagged (not silent) divergence — `Aanvraag.ZgwError` + a `zgw:divergence` audit row —
when a ZGW write still fails after retry. No outbox/background worker (see WP-60 for the
ladder check that ruled it out for this POC's write volume).
- **Deferred:** real inbound OIDC/JWT auth (still header-stubbed), Notificaties/NRC webhooks
(WP-52, shipped instead as a direct-to-BFF delivery in WP-58), adding OpenZaak to
docker-compose, an automated reconciliation/repair job for a flagged divergence (WP-60).