fix(infra): deploy BPMN + DMN as one .bar so the inline decision resolves (S-13, refs #14)

The DMN service task resolves its decision scoped to the process's own deployment,
so a standalone .dmn deployment was invisible (FlowableObjectNotFoundException: No
decision found for key: diploma-eligibility). Bundle registratie.bpmn +
diploma-eligibility.dmn into a single registratie.bar and deploy it as one
deployment, giving the decision the process's parent deployment id. flowable-rest
does not expose the dmn-api app, so co-deployment is the way in.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/architecture/adr-0016-diploma-eligibility-dmn.md

@@ -36,9 +36,12 @@ only new job is to carry the diploma origin and pass it into the process as a st
   `DiplomaOrigin` (Binnenlands/Buitenlands); `SubmitRegistration` passes it to
   `StartRegistrationProcessAsync`, which sets it as the `diplomaOrigin` start variable. The domain
   never evaluates the DMN and never learns the route — that is the process's concern.
-- **Deployed like the BPMN.** The DMN is version-controlled in `workflows/` and deployed to the DMN
-  engine by the same `flowable-init` step (via `dmn-api/dmn-repository/deployments`), staged into the
-  `fl-bpmn` volume alongside the BPMN.
+- **Deployed in one `.bar` with the BPMN.** The DMN is version-controlled in `workflows/` and bundled
+  with `registratie.bpmn` into a single `registratie.bar` (by `seed-config.sh`) that `flowable-init`
+  deploys as one deployment. This is required, not cosmetic: `flowable-rest` does not expose the
+  `dmn-api` app, and Flowable resolves an inline DMN scoped to the process's own deployment — so a
+  standalone `.dmn` deployment is invisible to the process (`FlowableObjectNotFoundException: No
+  decision found for key`). Co-deploying gives the decision the process's parent deployment id.
 
 ## Consequences
 

infra/docker-compose.yml

@@ -259,7 +259,8 @@ services:
   flowable-init:
     image: docker.io/curlimages/curl:latest
     restart: "no"
-    # registratie.bpmn + diploma-eligibility.dmn are streamed into this external volume by infra/seed-config.sh.
+    # registratie.bar (registratie.bpmn + diploma-eligibility.dmn) is streamed into this external
+    # volume by infra/seed-config.sh.
     volumes:
       - fl-bpmn:/work:ro
     command:
@@ -268,19 +269,13 @@ services:
       - |
         base=http://flowable-rest:8080/flowable-rest/service/repository/deployments
         until curl -sf -u rest-admin:test "$$base" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
-        # Deploy the diploma-eligibility DMN via the process repository: the flowable-rest image embeds
-        # the DMN engine but does not expose the dmn-api app, so the process deployment cross-deploys the
-        # .dmn resource to the DMN engine, where the registratie DMN service task resolves it by key
-        # (S-13, ADR-0016).
-        if curl -s -u rest-admin:test "$$base?name=diploma-eligibility" | grep -q '"name":"diploma-eligibility"'; then
-          echo "diploma-eligibility already deployed; skip"
-        else
-          curl -sf -u rest-admin:test -F 'file=@/work/diploma-eligibility.dmn;filename=diploma-eligibility.dmn' "$$base" >/dev/null && echo "deployed diploma-eligibility"
-        fi
+        # Deploy the BPMN + its DMN as ONE .bar so the inline DMN service task resolves the decision by
+        # the process's own (shared) parent deployment id — flowable-rest does not expose the dmn-api app,
+        # and a standalone .dmn deployment is not visible to the process (S-13, ADR-0016).
         if curl -s -u rest-admin:test "$$base?name=registratie" | grep -q '"name":"registratie"'; then
           echo "registratie already deployed; skip"
         else
-          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$base" >/dev/null && echo "deployed registratie"
+          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bar;filename=registratie.bar' "$$base" >/dev/null && echo "deployed registratie (bpmn + dmn)"
         fi
     depends_on:
       flowable-rest:

infra/flowable/docker-compose.yml

@@ -35,12 +35,13 @@ services:
         condition: service_healthy
     networks: [cg]
 
-  # Deploys workflows/registratie.bpmn + diploma-eligibility.dmn via the REST API once flowable-rest is up.
-  # Idempotent: skips each if a deployment of that name already exists.
+  # Deploys registratie.bar (registratie.bpmn + diploma-eligibility.dmn) via the REST API once
+  # flowable-rest is up. Idempotent: skips if a deployment named "registratie" already exists.
   flowable-init:
     image: docker.io/curlimages/curl:latest
     restart: "no"
-    # registratie.bpmn + diploma-eligibility.dmn are streamed into this external volume by infra/seed-config.sh.
+    # registratie.bar (registratie.bpmn + diploma-eligibility.dmn) is streamed into this external
+    # volume by infra/seed-config.sh.
     volumes:
       - fl-bpmn:/work:ro
     command:
@@ -49,19 +50,13 @@ services:
       - |
         base=http://flowable-rest:8080/flowable-rest/service/repository/deployments
         until curl -sf -u rest-admin:test "$$base" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
-        # Deploy the diploma-eligibility DMN via the process repository: the flowable-rest image embeds
-        # the DMN engine but does not expose the dmn-api app, so the process deployment cross-deploys the
-        # .dmn resource to the DMN engine, where the registratie DMN service task resolves it by key
-        # (S-13, ADR-0016).
-        if curl -s -u rest-admin:test "$$base?name=diploma-eligibility" | grep -q '"name":"diploma-eligibility"'; then
-          echo "diploma-eligibility already deployed; skip"
-        else
-          curl -sf -u rest-admin:test -F 'file=@/work/diploma-eligibility.dmn;filename=diploma-eligibility.dmn' "$$base" >/dev/null && echo "deployed diploma-eligibility"
-        fi
+        # Deploy the BPMN + its DMN as ONE .bar so the inline DMN service task resolves the decision by
+        # the process's own (shared) parent deployment id — flowable-rest does not expose the dmn-api app,
+        # and a standalone .dmn deployment is not visible to the process (S-13, ADR-0016).
         if curl -s -u rest-admin:test "$$base?name=registratie" | grep -q '"name":"registratie"'; then
           echo "registratie already deployed; skip"
         else
-          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$base" >/dev/null && echo "deployed registratie"
+          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bar;filename=registratie.bar' "$$base" >/dev/null && echo "deployed registratie (bpmn + dmn)"
         fi
     depends_on:
       flowable-rest:

infra/seed-config.sh

@@ -35,12 +35,26 @@ populate() {  # volume  source(file or dir/.)
 
 [ "$#" -gt 0 ] || { echo "usage: seed-config.sh <oz|nrc|kc|fl> ..." >&2; exit 2; }
 
+# The registratie process and its diploma-eligibility DMN must land in ONE Flowable deployment, so the
+# process's inline DMN service task resolves the decision by its (shared) parent deployment id (S-13,
+# ADR-0016). We bundle both into a single .bar (zip) and deploy that one artefact.
+build_flowable_bar() {
+  local out="$1"
+  python3 - "$here/../workflows/registratie.bpmn" "$here/../workflows/diploma-eligibility.dmn" "$out" <<'PY'
+import sys, zipfile
+bpmn, dmn, out = sys.argv[1:4]
+with zipfile.ZipFile(out, "w", zipfile.ZIP_DEFLATED) as z:
+    z.write(bpmn, "registratie.bpmn")
+    z.write(dmn, "diploma-eligibility.dmn")
+PY
+}
+
 for key in "$@"; do
   case "$key" in
     oz) populate rr-oz-config "$here/openzaak/setup_configuration/." ;;
     nrc) populate rr-nrc-config "$here/opennotificaties/setup_configuration/." ;;
     kc) populate rr-kc-realms "$here/keycloak/realms/." ;;
-    fl) populate rr-fl-bpmn  "$here/../workflows/." ;;  # registratie.bpmn + diploma-eligibility.dmn
+    fl) bar="$(mktemp -d)/registratie.bar"; build_flowable_bar "$bar"; populate rr-fl-bpmn "$bar" ;;
     *)  echo "unknown seed key: $key" >&2; exit 2 ;;
   esac
 done