fix(infra): deploy diploma-eligibility DMN via dmn-api, not a process .bar (refs #14)

flowable-rest does not cascade a .dmn bundled inside a process .bar into the
DMN engine: the resource is stored but no decision is created, so the DMN
service task fails at runtime with FlowableObjectNotFoundException. Deploy the
DMN to the DMN engine via /dmn-api/dmn-repository/deployments and the BPMN to
the process engine separately; the service task resolves the decision across
deployments by key (verified live: Buitenlands->CBGV_ADVIES, Binnenlands->DIRECT).

Also move the DMN's doc comment inside <definitions>: Flowable's DMN XML
converter rejects a comment between the <?xml?> declaration and the root element
(XMLStreamReader not in START_DOCUMENT/START_ELEMENT state), unlike its BPMN one.

seed-config.sh now seeds both raw workflow files instead of building a .bar.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/docker-compose.yml

@@ -259,23 +259,30 @@ services:
   flowable-init:
     image: docker.io/curlimages/curl:latest
     restart: "no"
-    # registratie.bar (registratie.bpmn + diploma-eligibility.dmn) is streamed into this external
-    # volume by infra/seed-config.sh.
+    # registratie.bpmn + diploma-eligibility.dmn are streamed into this external volume by
+    # infra/seed-config.sh.
     volumes:
       - fl-bpmn:/work:ro
     command:
       - sh
       - -c
       - |
-        base=http://flowable-rest:8080/flowable-rest/service/repository/deployments
-        until curl -sf -u rest-admin:test "$$base" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
-        # Deploy the BPMN + its DMN as ONE .bar so the inline DMN service task resolves the decision by
-        # the process's own (shared) parent deployment id — flowable-rest does not expose the dmn-api app,
-        # and a standalone .dmn deployment is not visible to the process (S-13, ADR-0016).
-        if curl -s -u rest-admin:test "$$base?name=registratie" | grep -q '"name":"registratie"'; then
-          echo "registratie already deployed; skip"
+        svc=http://flowable-rest:8080/flowable-rest/service/repository/deployments
+        dmn=http://flowable-rest:8080/flowable-rest/dmn-api/dmn-repository/deployments
+        until curl -sf -u rest-admin:test "$$svc" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
+        # Deploy the DMN to the DMN engine and the BPMN to the process engine as SEPARATE deployments:
+        # flowable-rest does NOT cascade a .dmn bundled in a process .bar into the DMN engine, so the DMN
+        # must go via dmn-api. The process's DMN service task then resolves the decision across deployments
+        # by key (S-13, ADR-0016). Both steps are idempotent (skip if already deployed).
+        if curl -s -u rest-admin:test "$$dmn" | grep -q '"name":"diploma-eligibility.dmn"'; then
+          echo "diploma-eligibility DMN already deployed; skip"
         else
-          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bar;filename=registratie.bar' "$$base" >/dev/null && echo "deployed registratie (bpmn + dmn)"
+          curl -sf -u rest-admin:test -F 'file=@/work/diploma-eligibility.dmn;filename=diploma-eligibility.dmn' "$$dmn" >/dev/null && echo "deployed diploma-eligibility DMN"
+        fi
+        if curl -s -u rest-admin:test "$$svc?name=registratie" | grep -q '"name":"registratie"'; then
+          echo "registratie BPMN already deployed; skip"
+        else
+          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$svc" >/dev/null && echo "deployed registratie BPMN"
         fi
     depends_on:
       flowable-rest:

infra/flowable/docker-compose.yml

@@ -35,28 +35,35 @@ services:
         condition: service_healthy
     networks: [cg]
 
-  # Deploys registratie.bar (registratie.bpmn + diploma-eligibility.dmn) via the REST API once
-  # flowable-rest is up. Idempotent: skips if a deployment named "registratie" already exists.
+  # Deploys registratie.bpmn (process engine) and diploma-eligibility.dmn (DMN engine) via the REST
+  # API once flowable-rest is up. Idempotent: skips each if already deployed.
   flowable-init:
     image: docker.io/curlimages/curl:latest
     restart: "no"
-    # registratie.bar (registratie.bpmn + diploma-eligibility.dmn) is streamed into this external
-    # volume by infra/seed-config.sh.
+    # registratie.bpmn + diploma-eligibility.dmn are streamed into this external volume by
+    # infra/seed-config.sh.
     volumes:
       - fl-bpmn:/work:ro
     command:
       - sh
       - -c
       - |
-        base=http://flowable-rest:8080/flowable-rest/service/repository/deployments
-        until curl -sf -u rest-admin:test "$$base" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
-        # Deploy the BPMN + its DMN as ONE .bar so the inline DMN service task resolves the decision by
-        # the process's own (shared) parent deployment id — flowable-rest does not expose the dmn-api app,
-        # and a standalone .dmn deployment is not visible to the process (S-13, ADR-0016).
-        if curl -s -u rest-admin:test "$$base?name=registratie" | grep -q '"name":"registratie"'; then
-          echo "registratie already deployed; skip"
+        svc=http://flowable-rest:8080/flowable-rest/service/repository/deployments
+        dmn=http://flowable-rest:8080/flowable-rest/dmn-api/dmn-repository/deployments
+        until curl -sf -u rest-admin:test "$$svc" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
+        # Deploy the DMN to the DMN engine and the BPMN to the process engine as SEPARATE deployments:
+        # flowable-rest does NOT cascade a .dmn bundled in a process .bar into the DMN engine, so the DMN
+        # must go via dmn-api. The process's DMN service task then resolves the decision across deployments
+        # by key (S-13, ADR-0016). Both steps are idempotent (skip if already deployed).
+        if curl -s -u rest-admin:test "$$dmn" | grep -q '"name":"diploma-eligibility.dmn"'; then
+          echo "diploma-eligibility DMN already deployed; skip"
         else
-          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bar;filename=registratie.bar' "$$base" >/dev/null && echo "deployed registratie (bpmn + dmn)"
+          curl -sf -u rest-admin:test -F 'file=@/work/diploma-eligibility.dmn;filename=diploma-eligibility.dmn' "$$dmn" >/dev/null && echo "deployed diploma-eligibility DMN"
+        fi
+        if curl -s -u rest-admin:test "$$svc?name=registratie" | grep -q '"name":"registratie"'; then
+          echo "registratie BPMN already deployed; skip"
+        else
+          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$svc" >/dev/null && echo "deployed registratie BPMN"
         fi
     depends_on:
       flowable-rest:

infra/seed-config.sh

@@ -35,18 +35,13 @@ populate() {  # volume  source(file or dir/.)
 
 [ "$#" -gt 0 ] || { echo "usage: seed-config.sh <oz|nrc|kc|fl> ..." >&2; exit 2; }
 
-# The registratie process and its diploma-eligibility DMN must land in ONE Flowable deployment, so the
-# process's inline DMN service task resolves the decision by its (shared) parent deployment id (S-13,
-# ADR-0016). We bundle both into a single .bar (zip) and deploy that one artefact.
-build_flowable_bar() {
-  local out="$1"
-  python3 - "$here/../workflows/registratie.bpmn" "$here/../workflows/diploma-eligibility.dmn" "$out" <<'PY'
-import sys, zipfile
-bpmn, dmn, out = sys.argv[1:4]
-with zipfile.ZipFile(out, "w", zipfile.ZIP_DEFLATED) as z:
-    z.write(bpmn, "registratie.bpmn")
-    z.write(dmn, "diploma-eligibility.dmn")
-PY
+# The registratie process (BPMN) and its diploma-eligibility DMN are deployed as SEPARATE Flowable
+# deployments — the process engine and the DMN engine each own theirs (S-13, ADR-0016). flowable-rest
+# does not cascade a .dmn bundled in a process .bar into the DMN engine, so we seed both raw files and
+# let flowable-init deploy each via its own REST app. We stage them in a temp dir and copy its contents.
+stage_flowable_workflows() {
+  local dir="$1"
+  cp "$here/../workflows/registratie.bpmn" "$here/../workflows/diploma-eligibility.dmn" "$dir/"
 }
 
 for key in "$@"; do
@@ -54,7 +49,7 @@ for key in "$@"; do
     oz) populate rr-oz-config "$here/openzaak/setup_configuration/." ;;
     nrc) populate rr-nrc-config "$here/opennotificaties/setup_configuration/." ;;
     kc) populate rr-kc-realms "$here/keycloak/realms/." ;;
-    fl) bar="$(mktemp -d)/registratie.bar"; build_flowable_bar "$bar"; populate rr-fl-bpmn "$bar" ;;
+    fl) d="$(mktemp -d)"; stage_flowable_workflows "$d"; populate rr-fl-bpmn "$d/." ;;
     *)  echo "unknown seed key: $key" >&2; exit 2 ;;
   esac
 done