fix(infra): deploy BPMN + DMN as one .bar so the inline decision resolves (S-13, refs #14)

The DMN service task resolves its decision scoped to the process's own deployment,
so a standalone .dmn deployment was invisible (FlowableObjectNotFoundException: No
decision found for key: diploma-eligibility). Bundle registratie.bpmn +
diploma-eligibility.dmn into a single registratie.bar and deploy it as one
deployment, giving the decision the process's parent deployment id. flowable-rest
does not expose the dmn-api app, so co-deployment is the way in.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/docker-compose.yml

@@ -259,7 +259,8 @@ services:
   flowable-init:
     image: docker.io/curlimages/curl:latest
     restart: "no"
-    # registratie.bpmn + diploma-eligibility.dmn are streamed into this external volume by infra/seed-config.sh.
+    # registratie.bar (registratie.bpmn + diploma-eligibility.dmn) is streamed into this external
+    # volume by infra/seed-config.sh.
     volumes:
       - fl-bpmn:/work:ro
     command:
@@ -268,19 +269,13 @@ services:
       - |
         base=http://flowable-rest:8080/flowable-rest/service/repository/deployments
         until curl -sf -u rest-admin:test "$$base" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
-        # Deploy the diploma-eligibility DMN via the process repository: the flowable-rest image embeds
-        # the DMN engine but does not expose the dmn-api app, so the process deployment cross-deploys the
-        # .dmn resource to the DMN engine, where the registratie DMN service task resolves it by key
-        # (S-13, ADR-0016).
-        if curl -s -u rest-admin:test "$$base?name=diploma-eligibility" | grep -q '"name":"diploma-eligibility"'; then
-          echo "diploma-eligibility already deployed; skip"
-        else
-          curl -sf -u rest-admin:test -F 'file=@/work/diploma-eligibility.dmn;filename=diploma-eligibility.dmn' "$$base" >/dev/null && echo "deployed diploma-eligibility"
-        fi
+        # Deploy the BPMN + its DMN as ONE .bar so the inline DMN service task resolves the decision by
+        # the process's own (shared) parent deployment id — flowable-rest does not expose the dmn-api app,
+        # and a standalone .dmn deployment is not visible to the process (S-13, ADR-0016).
         if curl -s -u rest-admin:test "$$base?name=registratie" | grep -q '"name":"registratie"'; then
           echo "registratie already deployed; skip"
         else
-          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$base" >/dev/null && echo "deployed registratie"
+          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bar;filename=registratie.bar' "$$base" >/dev/null && echo "deployed registratie (bpmn + dmn)"
         fi
     depends_on:
       flowable-rest:

infra/flowable/docker-compose.yml

@@ -35,12 +35,13 @@ services:
         condition: service_healthy
     networks: [cg]
 
-  # Deploys workflows/registratie.bpmn + diploma-eligibility.dmn via the REST API once flowable-rest is up.
-  # Idempotent: skips each if a deployment of that name already exists.
+  # Deploys registratie.bar (registratie.bpmn + diploma-eligibility.dmn) via the REST API once
+  # flowable-rest is up. Idempotent: skips if a deployment named "registratie" already exists.
   flowable-init:
     image: docker.io/curlimages/curl:latest
     restart: "no"
-    # registratie.bpmn + diploma-eligibility.dmn are streamed into this external volume by infra/seed-config.sh.
+    # registratie.bar (registratie.bpmn + diploma-eligibility.dmn) is streamed into this external
+    # volume by infra/seed-config.sh.
     volumes:
       - fl-bpmn:/work:ro
     command:
@@ -49,19 +50,13 @@ services:
       - |
         base=http://flowable-rest:8080/flowable-rest/service/repository/deployments
         until curl -sf -u rest-admin:test "$$base" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
-        # Deploy the diploma-eligibility DMN via the process repository: the flowable-rest image embeds
-        # the DMN engine but does not expose the dmn-api app, so the process deployment cross-deploys the
-        # .dmn resource to the DMN engine, where the registratie DMN service task resolves it by key
-        # (S-13, ADR-0016).
-        if curl -s -u rest-admin:test "$$base?name=diploma-eligibility" | grep -q '"name":"diploma-eligibility"'; then
-          echo "diploma-eligibility already deployed; skip"
-        else
-          curl -sf -u rest-admin:test -F 'file=@/work/diploma-eligibility.dmn;filename=diploma-eligibility.dmn' "$$base" >/dev/null && echo "deployed diploma-eligibility"
-        fi
+        # Deploy the BPMN + its DMN as ONE .bar so the inline DMN service task resolves the decision by
+        # the process's own (shared) parent deployment id — flowable-rest does not expose the dmn-api app,
+        # and a standalone .dmn deployment is not visible to the process (S-13, ADR-0016).
         if curl -s -u rest-admin:test "$$base?name=registratie" | grep -q '"name":"registratie"'; then
           echo "registratie already deployed; skip"
         else
-          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$base" >/dev/null && echo "deployed registratie"
+          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bar;filename=registratie.bar' "$$base" >/dev/null && echo "deployed registratie (bpmn + dmn)"
         fi
     depends_on:
       flowable-rest:

infra/seed-config.sh

@@ -35,12 +35,26 @@ populate() {  # volume  source(file or dir/.)
 
 [ "$#" -gt 0 ] || { echo "usage: seed-config.sh <oz|nrc|kc|fl> ..." >&2; exit 2; }
 
+# The registratie process and its diploma-eligibility DMN must land in ONE Flowable deployment, so the
+# process's inline DMN service task resolves the decision by its (shared) parent deployment id (S-13,
+# ADR-0016). We bundle both into a single .bar (zip) and deploy that one artefact.
+build_flowable_bar() {
+  local out="$1"
+  python3 - "$here/../workflows/registratie.bpmn" "$here/../workflows/diploma-eligibility.dmn" "$out" <<'PY'
+import sys, zipfile
+bpmn, dmn, out = sys.argv[1:4]
+with zipfile.ZipFile(out, "w", zipfile.ZIP_DEFLATED) as z:
+    z.write(bpmn, "registratie.bpmn")
+    z.write(dmn, "diploma-eligibility.dmn")
+PY
+}
+
 for key in "$@"; do
   case "$key" in
     oz) populate rr-oz-config "$here/openzaak/setup_configuration/." ;;
     nrc) populate rr-nrc-config "$here/opennotificaties/setup_configuration/." ;;
     kc) populate rr-kc-realms "$here/keycloak/realms/." ;;
-    fl) populate rr-fl-bpmn  "$here/../workflows/." ;;  # registratie.bpmn + diploma-eligibility.dmn
+    fl) bar="$(mktemp -d)/registratie.bar"; build_flowable_bar "$bar"; populate rr-fl-bpmn "$bar" ;;
     *)  echo "unknown seed key: $key" >&2; exit 2 ;;
   esac
 done