S-19a · ACL writes the RegisterRecord to Objecten on approval (closes #149) (#151)

Closes #149.

**Outcome:** approving a registration now writes the canonical register record to the **Objecten** API as a `RegisterRecord` object, alongside the ZGW eindstatus. OpenZaak holds the process, Objecten holds the register (ADR-0028). The write goes through the ACL (§8.1) and is idempotent on the zaak id, so a replayed approval updates the existing object rather than creating a second one.

S-19 (#20) was split first (CLAUDE.md §13) — it bundled this with re-sourcing the read projection, which is now #150.

### What landed

- `IRegisterRecordGateway` + `RegisterRecord` in `Acl.Application`; `ObjectenGateway` in `Acl.Infrastructure` (static Token auth, CRS headers, objecttype resolved by name to its highest **published** version).
- `AclService.ApproveZaakAsync` writes the record after the eindstatus, keyed on the zaak UUID with the zaak's identificatie as reference.
- Compose wiring for both stacks; `ADR-0028`; demo note; PRD §15 out-of-scope line retired.

### Three things only a live stack found

Running the gateway against a real Objecten + Objecttypen pair while writing this turned up blockers CI would have hit after the fact:

1. **Objecten rejects an objecttype it has not been configured with**, by UUID — assigned at seed time by a one-shot that runs *after* Objecten's static setup_configuration. The UUID is now pinned on both sides.
2. **Objecten 500s on every write when its Notificaties config is absent** (`notifications_api_common` raises rather than skipping). Objecten → NRC has no broker, worker, kanaal or abonnement, so notifications are **disabled** rather than wired to drop every message; #150 turns them on for real.
3. **Objecttypen echoes the request Host into the objecttype `url`**, and Objecten only accepts the one matching its configured `api_root` — so the ACL must read Objecttypen at `http://objecttypen:8000`. This is why the new integration test only passes inside the compose network.

All three are recorded in ADR-0028.

### Verification

- `ObjectenGatewayIntegrationTests` (verify-acl, in-network): two writes for one id leave exactly one object with the second write's status. **Passing locally against live Objecten.**
- The **Playwright happy path** asserts, after the behandelaar approves, that Objecten holds exactly one `RegisterRecord` for *that* reference — missing, duplicated, or non-public-safe all fail.
- ACL mutation score **92.23%** (baseline 91.37%, break 90).
- `make lint` / `make unit` green locally; full-stack `make verify` runs in CI.

## Definition of Done

- [x] A linked Gitea issue exists (#149).
- [x] Failing test written and committed first.
- [x] Implementation makes the test pass.
- [x] Refactor commit follows if structure improved.
- [x] Conventional Commit messages referencing the issue (`refs #149`).
- [x] All Gitea Actions CI jobs green (run 684).
- [x] `docker compose up` from a fresh clone reaches green health checks within 3 minutes (verify-stack step 1).
- [x] Docs touched — ADR-0028, demo note, PRD §15, BACKLOG.
- [x] ADR added: `docs/architecture/adr-0028-objecten-holds-the-register.md`.
- [x] Demo note appended to `docs/demo-script.md`.
- [x] Closed by the merging PR (`closes #149`).

🤖 Generated with [Claude Code](https://claude.com/claude-code)Reviewed-on: #151

infra/docker-compose.local.yml

@@ -338,6 +338,14 @@ services:
       Acl__Defaults__Vertrouwelijkheidaanduiding: openbaar
       Acl__Defaults__ZaaktypeIdentificatie: BIG-REGISTRATIE
       Acl__Defaults__InformatieobjecttypeOmschrijving: Diploma
+      # Objecten holds the register, OpenZaak holds the process (S-19a, ADR-0028). Both APIs take a
+      # static token, not a ZGW JWT. The objecttype URL is assigned at seed time, so the ACL resolves
+      # it by name — lazily, on the first approval, so no depends_on is needed here.
+      Acl__Objecten__BaseUrl: http://objecten:8000/
+      Acl__Objecten__Token: ${OBJECTEN_TOKEN:-1234567890abcdef1234567890abcdef12345678}
+      Acl__Objecten__ObjecttypenBaseUrl: http://objecttypen:8000/
+      Acl__Objecten__ObjecttypenToken: ${OBJECTTYPEN_TOKEN:-0123456789abcdef0123456789abcdef01234567}
+      Acl__Objecten__ObjecttypeName: RegisterRecord
     ports:
       - "8100:8080"
     volumes:
@@ -683,6 +691,12 @@ services:
       CACHE_AXES: objecten-redis:6379/0
       DISABLE_2FA: "true"
       OTEL_SDK_DISABLED: "true"
+      # S-19a: Objecten refuses every write while its Notificaties config is absent
+      # (notifications_api_common raises rather than skipping, so POST /objects 500s). Objecten →
+      # NRC is not wired yet — there is no broker, worker, kanaal or abonnement for it — so turn
+      # notifications off rather than fake a delivery path that silently drops every message.
+      # S-19b (#150) sources the projection from Objecten and turns this back on for real.
+      NOTIFICATIONS_DISABLED: "true"
       RUN_SETUP_CONFIG: "true"
     command: /setup_configuration.sh
     volumes:

infra/docker-compose.yml

@@ -323,6 +323,14 @@ services:
       # so verify-domain still points the ACL at OpenZaak's container IP.
       Acl__Defaults__ZaaktypeIdentificatie: BIG-REGISTRATIE
       Acl__Defaults__InformatieobjecttypeOmschrijving: Diploma
+      # Objecten holds the register, OpenZaak holds the process (S-19a, ADR-0028). Both APIs take a
+      # static token, not a ZGW JWT. The objecttype URL is assigned at seed time, so the ACL resolves
+      # it by name — lazily, on the first approval, so no depends_on is needed here.
+      Acl__Objecten__BaseUrl: http://objecten:8000/
+      Acl__Objecten__Token: ${OBJECTEN_TOKEN:-1234567890abcdef1234567890abcdef12345678}
+      Acl__Objecten__ObjecttypenBaseUrl: http://objecttypen:8000/
+      Acl__Objecten__ObjecttypenToken: ${OBJECTTYPEN_TOKEN:-0123456789abcdef0123456789abcdef01234567}
+      Acl__Objecten__ObjecttypeName: RegisterRecord
     ports:
       - "8100:8080"
     healthcheck:
@@ -709,6 +717,12 @@ services:
       CACHE_AXES: objecten-redis:6379/0
       DISABLE_2FA: "true"
       OTEL_SDK_DISABLED: "true"
+      # S-19a: Objecten refuses every write while its Notificaties config is absent
+      # (notifications_api_common raises rather than skipping, so POST /objects 500s). Objecten →
+      # NRC is not wired yet — there is no broker, worker, kanaal or abonnement for it — so turn
+      # notifications off rather than fake a delivery path that silently drops every message.
+      # S-19b (#150) sources the projection from Objecten and turns this back on for real.
+      NOTIFICATIONS_DISABLED: "true"
       RUN_SETUP_CONFIG: "true"
     command: /setup_configuration.sh
     # data.yaml is streamed into this external volume by infra/seed-config.sh before start.

infra/objecten/setup_configuration/data.yaml

@@ -19,7 +19,18 @@ zgw_consumers:
       header_key: Authorization
       header_value: Token 0123456789abcdef0123456789abcdef01234567
 
-# (2) Static API token peers use to write/read objects.
+# (2) Permit the RegisterRecord objecttype (S-19a). Objecten refuses to store an object whose
+# objecttype it has not been configured with ("ObjectType with url=… is not configured"), and it
+# identifies one by uuid — which is why infra/objecttypen-registerrecord/register.py pins that uuid
+# instead of letting Objecttypen assign one. Keep the two in step.
+objecttypes_config_enable: true
+objecttypes:
+  items:
+    - uuid: 1f4b4e26-8b1f-4e2f-9d6c-6a1b7a2f0e01
+      name: RegisterRecord
+      service_identifier: objecttypen
+
+# (3) Static API token peers use to write/read objects.
 tokenauth_config_enable: true
 tokenauth:
   items:

infra/objecttypen-registerrecord/register.py

@@ -17,6 +17,11 @@ BASE = os.environ.get("OBJECTTYPEN", "http://objecttypen:8000").rstrip("/")
 TOKEN = os.environ["OBJECTTYPEN_TOKEN"]
 SCHEMA_PATH = os.environ.get("SCHEMA", "/config/registerrecord.schema.json")
 NAME = "RegisterRecord"
+# Pinned rather than server-assigned (S-19a): the Objecten API will only accept objects whose
+# objecttype it has been configured with *by uuid*, and its own setup_configuration is a static
+# file applied before this one-shot runs. A fixed uuid lets both sides be declared up front instead
+# of threading a seed-time value between two containers. See infra/objecten/setup_configuration.
+UUID = "1f4b4e26-8b1f-4e2f-9d6c-6a1b7a2f0e01"
 
 
 def api(method, path, body=None):
@@ -53,6 +58,7 @@ def main():
         return 0
 
     ot = existing or api("POST", "/api/v2/objecttypes", {
+        "uuid": UUID,
         "name": NAME,
         "namePlural": "RegisterRecords",
         "description": schema.get("description", ""),

infra/run-domain-check.sh

@@ -142,6 +142,7 @@ still="$(printf '%s' "$resp" | task_for_reg "$reg_id")"
 [ -z "$still" ] || { echo "FAIL — Beoordelen task $still still active after completion" >&2; exit 1; }
 echo "OK — behandelaar claimed and completed the Beoordelen task; the registratie process finished"
 
+
 # ── S-11: withdrawal. A second registration parks at Beoordelen; the citizen withdraws it via the
 # domain, which delivers the RegistratieIngetrokken message to the task's execution, tripping the
 # BPMN boundary event so the process ends and the Beoordelen task disappears (ADR-0014). ────────────