feat(workflow): Flowable up with registratie.bpmn external task (closes #4)

Add infra/flowable/docker-compose.yml (flowable-rest on Postgres, host :8090)
and workflows/registratie.bpmn — a minimal "Registratie ontvangen" process:
start -> external-worker task OpenZaakAanmaken -> end. A flowable-init
container deploys the model via the REST API on boot (idempotent: skips if
already deployed).

Add `make flowable-up/flowable-smoke/flowable-down`; flowable-smoke runs
infra/flowable/verify.py, which starts an instance and asserts it parks on
the OpenZaakAanmaken external task, then cleans up. Runbook included.

Verified clean-slate: down --volumes -> `make flowable-smoke` deploys on
boot, starts an instance, and confirms it waits at OpenZaakAanmaken.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -17,7 +17,7 @@ permissions:
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    runs-on: respellion-linux
     steps:
       - uses: https://github.com/actions/checkout@v4
       - uses: https://github.com/actions/setup-dotnet@v4
@@ -26,7 +26,7 @@ jobs:
       - run: make lint
 
   build:
-    runs-on: ubuntu-latest
+    runs-on: respellion-linux
     steps:
       - uses: https://github.com/actions/checkout@v4
       - uses: https://github.com/actions/setup-dotnet@v4
@@ -35,7 +35,7 @@ jobs:
       - run: make build
 
   unit:
-    runs-on: ubuntu-latest
+    runs-on: respellion-linux
     steps:
       - uses: https://github.com/actions/checkout@v4
       - uses: https://github.com/actions/setup-dotnet@v4
@@ -44,13 +44,7 @@ jobs:
       - run: make unit
 
   compose-smoke:
-    runs-on: ubuntu-latest
+    runs-on: respellion-linux
     steps:
       - uses: https://github.com/actions/checkout@v4
       - run: make smoke
-      - name: dump container logs on failure
-        if: failure()
-        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=80 oz-init openzaak nrc-init nrc-web flowable-init keycloak acl bff 2>&1 || true
-      - name: tear down on failure
-        if: failure()
-        run: docker compose -f infra/docker-compose.yml down --volumes 2>&1 || true

.gitignore

@@ -5,9 +5,6 @@ obj/
 [Rr]elease/
 *.user
 
-# Reqnroll-generated test code (regenerated from *.feature on build)
-*.feature.cs
-
 # Test results / coverage
 [Tt]est[Rr]esults/
 *.trx

Makefile

@@ -5,24 +5,9 @@
 # `make ci` locally runs exactly what the pipeline runs — no drift. Until a
 # self-hosted runner is registered, `make ci` is the gate (see docs/runbooks/ci.md).
 
-SLN        := register-referentie.slnx
+SLN        := services/bff/Bff.slnx
 COMPOSE    := infra/docker-compose.yml
-# Long-running services with a healthcheck — the smoke polls these for readiness
+HEALTH_URL := http://localhost:8080/health
-# (infra/wait-healthy.sh). One-shot init jobs (oz-init, nrc-init, flowable-init)
-# are not polled; they only need to have run. See docs/runbooks/gitea-actions-gotchas.md.
-WAIT_SVCS  := openzaak nrc-web acl bff
-# Config files (OpenZaak data.yaml, Keycloak realms, Flowable BPMN) are streamed
-# into external named volumes via `docker cp` (infra/seed-config.sh) instead of
-# bind-mounted, because bind mounts don't reach sibling containers on the
-# containerized CI runner. SEED populates them; run it before every `up`. The
-# volumes are `external`, so compose won't remove them — CFG_VOLS lists them for
-# explicit teardown. See docs/runbooks/gitea-actions-gotchas.md.
-SEED       := bash infra/seed-config.sh
-CFG_VOLS   := rr-oz-config rr-kc-realms rr-fl-bpmn
-# Local-only stack: same services but config is bind-mounted (no seed step), so a
-# plain `docker compose -f infra/docker-compose.local.yml up` works on any local
-# engine. This is the no-make / Windows-friendly path. See that file's header.
-LOCAL_COMPOSE := infra/docker-compose.local.yml
 OZ_COMPOSE  := infra/openzaak/docker-compose.yml
 OZ_BASE     := http://localhost:8000
 NRC_COMPOSE := infra/opennotificaties/docker-compose.yml
@@ -43,7 +28,7 @@ export DOCKER_HOST := unix://$(PODMAN_SOCK)
 endif
 endif
 
-.PHONY: ci lint build unit smoke up down local local-down changelog openzaak-up openzaak-smoke openzaak-seed openzaak-down stack-up stack-smoke stack-down keycloak-up keycloak-smoke keycloak-down flowable-up flowable-smoke flowable-down help
+.PHONY: ci lint build unit smoke down changelog openzaak-up openzaak-smoke openzaak-seed openzaak-down stack-up stack-smoke stack-down keycloak-up keycloak-smoke keycloak-down flowable-up flowable-smoke flowable-down help
 
 ## ci: run the full pipeline — lint, build, unit, smoke (mirrors Gitea Actions)
 ci: lint build unit smoke
@@ -60,38 +45,14 @@ build:
 unit:
 	dotnet test $(SLN) -c Release
 
-## smoke: seed config, bring the whole stack up, wait for health-checked services, tear down
+## smoke: compose up (wait for healthy), curl /health, then tear down
-# SEED populates the external config volumes first (upstream images used verbatim;
-# only our acl/bff are built). `up -d --build` starts EVERYTHING. Readiness is
-# checked by infra/wait-healthy.sh polling the durable, health-checked services
-# ($(WAIT_SVCS)) via `docker inspect` — portable across docker compose and
-# podman-compose, and needing no `--wait` flag or host port access. The one-shots
-# (oz-init, flowable-init) aren't polled; they just need to have run.
 smoke:
-	$(SEED) oz kc fl
+	docker compose -f $(COMPOSE) up -d --build --wait
-	docker compose -f $(COMPOSE) up -d --build
+	bash -c 'curl -fsS $(HEALTH_URL); rc=$$?; docker compose -f $(COMPOSE) down --volumes; exit $$rc'
-	bash -c 'WAIT_TIMEOUT=420 bash infra/wait-healthy.sh $(WAIT_SVCS); rc=$$?; docker compose -f $(COMPOSE) down --volumes; docker volume rm -f $(CFG_VOLS) >/dev/null 2>&1; exit $$rc'
 
-## up: seed config volumes and start the full stack (use instead of bare
+## down: stop and remove the local stack
-## `docker compose up`, which can't self-seed the external config volumes)
-up:
-	$(SEED) oz kc fl
-	docker compose -f $(COMPOSE) up -d --build
-
-## down: stop and remove the local stack (incl. the external config volumes)
 down:
 	docker compose -f $(COMPOSE) down --volumes
-	-docker volume rm -f $(CFG_VOLS)
-
-## local: bring up the bind-mount stack (no seed step) and wait for health
-## (Windows / no-make users: run `docker compose -f infra/docker-compose.local.yml up -d --build` directly)
-local:
-	docker compose -f $(LOCAL_COMPOSE) up -d --build
-	WAIT_TIMEOUT=420 bash infra/wait-healthy.sh $(WAIT_SVCS)
-
-## local-down: stop and remove the bind-mount stack
-local-down:
-	docker compose -f $(LOCAL_COMPOSE) down --volumes
 
 ## changelog: regenerate CHANGELOG.md from Conventional Commits (git-cliff)
 changelog:
@@ -99,11 +60,11 @@ changelog:
 
 ## openzaak-up: start the OpenZaak stack (migrations run on first start)
 openzaak-up:
-	$(SEED) oz
 	docker compose -f $(OZ_COMPOSE) up -d
 
 ## openzaak-smoke: start OpenZaak, then assert it is up with auth enforced
-openzaak-smoke: openzaak-up
+openzaak-smoke:
+	docker compose -f $(OZ_COMPOSE) up -d
 	@bash -c 'set -e; \
 	  echo "waiting for OpenZaak to respond..."; \
 	  for i in $$(seq 1 60); do \
@@ -127,11 +88,9 @@ openzaak-seed: openzaak-up
 ## openzaak-down: stop and remove the OpenZaak stack (wipes data)
 openzaak-down:
 	docker compose -f $(OZ_COMPOSE) down --volumes
-	-docker volume rm -f rr-oz-config
 
 ## stack-up: start OpenZaak + Open Notificaties together (shared network)
 stack-up:
-	$(SEED) oz
 	docker compose $(STACK_FILES) up -d
 
 ## stack-smoke: start both, assert OpenZaak (403/302/200) and NRC (302) are reachable
@@ -151,11 +110,9 @@ stack-smoke: stack-up
 ## stack-down: stop and remove both stacks (wipes data)
 stack-down:
 	docker compose $(STACK_FILES) down --volumes
-	-docker volume rm -f rr-oz-config
 
 ## keycloak-up: start Keycloak with the four imported realms
 keycloak-up:
-	$(SEED) kc
 	docker compose -f $(KC_COMPOSE) up -d
 
 ## keycloak-smoke: start Keycloak, then verify each realm logs in + returns its claim
@@ -168,11 +125,9 @@ keycloak-smoke: keycloak-up
 ## keycloak-down: stop and remove Keycloak
 keycloak-down:
 	docker compose -f $(KC_COMPOSE) down --volumes
-	-docker volume rm -f rr-kc-realms
 
 ## flowable-up: start Flowable (deploys registratie.bpmn on boot)
 flowable-up:
-	$(SEED) fl
 	docker compose -f $(FL_COMPOSE) up -d
 
 ## flowable-smoke: start Flowable, then verify a started instance waits on the external task
@@ -185,7 +140,6 @@ flowable-smoke: flowable-up
 ## flowable-down: stop and remove Flowable
 flowable-down:
 	docker compose -f $(FL_COMPOSE) down --volumes
-	-docker volume rm -f rr-fl-bpmn
 
 ## help: list available targets
 help:

docs/architecture/adr-0003-default-fill.md

@@ -1,44 +0,0 @@
-# ADR-0003: ACL default-fill strategy
-
-- **Status:** Accepted
-- **Date:** 2026-06-04
-- **Deciders:** Respellion engineering
-- **Relates to:** S-04 (#5); builds on ADR-0001 (loose coupling)
-
-## Context
-
-The ACL is the only code that talks to ZGW APIs (ADR-0001 / CLAUDE.md §8.1). When the
-domain asks it to "open a zaak", the domain payload is intentionally free of ZGW
-specifics — it carries domain facts (e.g. the registrant's BSN), not OpenZaak fields. But
-OpenZaak's `POST /zaken` requires ZGW-mandatory fields: `bronorganisatie`,
-`verantwoordelijkeOrganisatie`, `startdatum`, `vertrouwelijkheidaanduiding`, and a
-`zaaktype` URL. Something has to supply those, and it must not leak into the domain.
-
-## Decision
-
-**The ACL default-fills the ZGW-mandatory zaak fields; the domain never sees them.**
-
-- `bronorganisatie`, `verantwoordelijkeOrganisatie`, `vertrouwelijkheidaanduiding`, and the
-  `zaaktype` URL come from **ACL configuration** (`AclDefaults` options) — not hardcoded,
-  not from the domain. This keeps them operationally manageable (the beheer portal will
-  edit them in S-15) and environment-specific (the seeded BIG zaaktype URL differs per env).
-- `startdatum` is derived from an injected **clock** (today's date), so it is
-  deterministic in tests.
-- The mapping from domain payload → ZGW `ZaakRequest` lives entirely inside the ACL
-  (`Application` builds the request from payload + defaults; `Infrastructure` serialises and
-  POSTs it). No other service constructs ZGW payloads or URLs.
-
-## Consequences
-
-- **Positive:** the domain stays ZGW-agnostic; ZGW knowledge is in one named place; defaults
-  are config (testable, env-specific, later editable via the beheer portal).
-- **Cost:** the ACL must be configured per environment (the seeded zaaktype URL, the
-  organisation RSINs). Missing/invalid config fails fast at the ACL boundary.
-- **Follow-ups:** mapping the BSN onto the zaak (eigenschap/rol), status transitions, and
-  documents are explicitly out of scope for S-04 and get their own slices.
-
-## Alternatives considered
-
-- **Defaults in the domain payload** — rejected: leaks ZGW concerns into the domain,
-  violating ADR-0001.
-- **Hardcoded defaults in code** — rejected: not env-specific, not operationally editable.

docs/architecture/adr-0004-bdd-framework.md

@@ -1,52 +0,0 @@
-# ADR-0004: Reqnroll as the BDD acceptance framework
-
-- **Status:** Accepted
-- **Date:** 2026-06-04
-- **Deciders:** Respellion engineering
-- **Relates to:** S-04 (#5); supports CLAUDE.md §3 (BDD at the use-case level) and §11 (tests pyramid)
-
-## Context
-
-CLAUDE.md §11 mandates that each user-visible flow is driven by a Gherkin acceptance
-scenario living in `tests/acceptance/`, and §3 names "BDD at the use-case level" as a core
-engineering principle. The foundational slices (S-00…S-03) added no acceptance layer; S-04
-is the first slice with real domain behaviour to drive, so it is where the BDD framework is
-introduced. We need a .NET tool that:
-
-- parses Gherkin `.feature` files and binds steps to C#,
-- integrates with the existing xUnit test runner (the repo standardises on xUnit), so
-  acceptance tests run under the same `dotnet test` / `make ci` gate as everything else,
-- is actively maintained on modern .NET (we target net10.0).
-
-## Decision
-
-**Use [Reqnroll](https://reqnroll.net/) (`Reqnroll.xUnit`) for acceptance tests.**
-
-- Reqnroll is the actively-maintained, open-source successor to SpecFlow (which is no longer
-  maintained). It keeps the same Gherkin + `[Binding]` model, so the knowledge transfers.
-- `Reqnroll.xUnit` generates one xUnit test per scenario, so acceptance tests are discovered
-  and run by the same runner as the unit tests — no second test framework, no extra CI step.
-- Acceptance projects live under `tests/acceptance/` per the PRD §9 layout. Generated
-  `*.feature.cs` files are build artefacts and are git-ignored.
-
-## Consequences
-
-- **Positive:** one assertion/runner stack (xUnit) across unit and acceptance tests; scenarios
-  are written in business language (Dutch domain terms inline) and reviewed as the slice's
-  contract; maintained tooling on net10.0.
-- **Cost:** a new dependency (`Reqnroll.xUnit`) and its xUnit v2 transitive graph. Reqnroll
-  pulls `xunit.core` but not the assertion library, so the `xunit` metapackage is referenced
-  explicitly to get `Assert`.
-- **Replaceable by:** hand-written xUnit "scenario" tests with a Given/When/Then helper, at
-  the cost of losing Gherkin as the shared, readable contract — which is the whole point of §3.
-- **Follow-ups:** the real-OpenZaak integration test (Testcontainers) and the Stryker mutation
-  baseline for S-04 are tracked as their own issues split off #5.
-
-## Alternatives considered
-
-- **SpecFlow** — rejected: unmaintained and without an official net10.0 story; Reqnroll is its
-  drop-in successor.
-- **Plain xUnit Given/When/Then helpers** — rejected for user-visible flows: loses the
-  business-readable Gherkin contract that §3/§11 require. Still fine for unit-level tests.
-- **Xunit.Gherkin.Quick** — rejected: lighter but less featureful (no hooks/scoped contexts,
-  smaller community) than Reqnroll.

docs/runbooks/ci.md

@@ -1,9 +1,11 @@
 # CI runbook — Gitea Actions
 
-> **Status: active.** The workflow `.gitea/workflows/ci.yaml` runs on Gitea's
+> **Status: no runner yet → run CI locally with `make ci`.** The workflow
-> hosted `ubuntu-latest` runner — no self-hosted runner required.
+> `.gitea/workflows/ci.yaml` is in place, but the pipeline cannot go green until a
-> **`make ci` is still the local gate** — it runs the exact same checks
+> self-hosted `respellion-linux` runner is registered against the Gitea instance.
-> (the workflow calls the same `make` targets).
+> Until then, **`make ci` is the gate** — it runs the exact same checks locally
+> (the workflow calls the same `make` targets). Issue **#30 (S-00-c)** stays open
+> until CI is verified green on a runner.
 
 ## The pipeline
 
@@ -16,40 +18,12 @@ and CI cannot drift:
 | `lint` | `make lint` → `dotnet format … --verify-no-changes` | .NET 10 SDK |
 | `build` | `make build` → `dotnet build … -c Release` | .NET 10 SDK |
 | `unit` | `make unit` → `dotnet test … -c Release` | .NET 10 SDK |
-| `compose-smoke` | `make smoke` → seed config volumes → `up -d` (full stack) → `up --wait` durable services → `down` | container engine + compose v2 |
+| `compose-smoke` | `make smoke` → compose up `--wait` → `curl /health` → `down` | container engine + compose v2 |
 
 All `uses:` references are absolute, tag-pinned URLs (`https://github.com/actions/checkout@v4`,
 `https://github.com/actions/setup-dotnet@v4`) per CLAUDE.md §8.7 and §15 — Gitea
 Actions resolves them from GitHub.
 
-> **`compose-smoke` runs on a containerized runner.** Workspace bind mounts do
-> **not** reach the sibling containers Compose starts, so config/assets are
-> streamed into external named volumes via `docker cp` (`infra/seed-config.sh`),
-> and the upstream images are used verbatim (no build). If you add a service that
-> needs a repo file at runtime, seed it the same way — don't bind-mount it. Note:
-> bare `docker compose up` no longer self-seeds; use `make up`. See
-> [gitea-actions-gotchas.md](gitea-actions-gotchas.md).
-
-## Running the stack locally without `make` (Windows / Docker Desktop)
-
-`make` and the bash helpers assume a Unix shell. To bring the whole stack up on a
-machine without them (e.g. Windows + Docker Desktop), use the **local compose
-file**, which bind-mounts the config instead of seeding volumes — so it needs no
-`make`, no seed step, and no bash:
-
-```bash
-docker compose -f infra/docker-compose.local.yml up -d --build          # any engine
-docker compose -f infra/docker-compose.local.yml up -d --build --wait    # Docker Desktop (Compose v2)
-docker compose -f infra/docker-compose.local.yml down --volumes
-```
-
-On Linux/macOS the same thing is wrapped as `make local` / `make local-down`.
-
-`infra/docker-compose.local.yml` mirrors the canonical `infra/docker-compose.yml`
-but swaps the external config volumes for bind mounts — valid locally because a
-local daemon can see the working directory (the seed/volume dance only exists for
-the containerized CI runner). Keep the two files in sync.
-
 ## Running CI locally (`make ci`)
 
 Until the runner exists, run the full pipeline yourself before pushing:
@@ -75,26 +49,56 @@ The Makefile auto-points `DOCKER_HOST` at `/run/user/$(id -u)/podman/podman.sock
 when that socket exists and `DOCKER_HOST` is unset, so `make smoke` "just works"
 locally while leaving real Docker hosts / CI runners untouched.
 
-## Runner: `ubuntu-latest`
+## Runner: `respellion-linux`
 
-All jobs run on Gitea's hosted **`ubuntu-latest`** runner — no self-hosted runner
+The single self-hosted runner label this repo targets is **`respellion-linux`**
-setup is required. The hosted runner ships with Docker and Docker Compose v2, so
+(declared here per §15). It is intended to run **co-located on the Gitea server**
-`make smoke` (`docker compose … up --wait`) works without extra configuration.
+(`git.labs.respellion.tech` / `46.224.220.37`) so CI is durable and independent of
+any developer machine.
 
-If Gitea's hosted runners are unavailable and a self-hosted fallback is needed,
+### Host prerequisites
-register an `act_runner` with the `ubuntu-latest` label:
+
+The runner executes jobs in **host mode** (see registration below), so the host
+must have, on `PATH`:
+
+- .NET 10 SDK (or let `setup-dotnet` install it into the runner tool cache)
+- A container engine with Compose v2 — Docker, or Podman with the Docker-compatible
+  socket and the `docker-compose` provider (as configured on the dev box)
+- `curl`
+
+### Install & register `act_runner` (on the Gitea server)
 
 ```bash
+# 1. Install the binary (pick the version matching the Gitea release line)
 VER=0.2.11
 curl -fsSL -o /usr/local/bin/act_runner \
   "https://dl.gitea.com/act_runner/${VER}/act_runner-${VER}-linux-amd64"
 chmod +x /usr/local/bin/act_runner
 
+# 2. Obtain a registration token from the Gitea UI:
+#    Site Administration → Actions → Runners → "Create new Runner"  (instance-level)
+#    (or Repo → Settings → Actions → Runners for a repo-scoped runner)
+
+# 3. Register with the respellion-linux label in HOST execution mode.
+#    The ":host" suffix means jobs run directly on the host shell, so
+#    `docker compose` in compose-smoke uses the host engine (no docker-in-docker).
 act_runner register --no-interactive \
   --instance https://git.labs.respellion.tech \
   --token <REGISTRATION_TOKEN> \
   --name respellion-ci-1 \
-  --labels "ubuntu-latest:docker://node:20-bookworm"
+  --labels "respellion-linux:host"
 
+# 4. Run it (foreground to verify, then install as a systemd service)
 act_runner daemon
 ```
+
+Verify in the Gitea UI (Actions → Runners) that `respellion-ci-1` shows **Idle**,
+then re-run the `CI` workflow; all four jobs should pass.
+
+## Security note
+
+A self-hosted runner in **host mode** executes workflow code directly on the Gitea
+server host. Anyone who can push a workflow can run code there. This is acceptable
+for a **private lab** instance with trusted contributors. For anything
+internet-facing, switch to container/VM isolation (`--labels "respellion-linux:docker://..."`)
+or a dedicated runner host, and gate workflow runs on approval for outside PRs.

docs/runbooks/gitea-actions-gotchas.md

@@ -1,100 +0,0 @@
-# Gitea Actions gotchas
-
-How our CI (Gitea Actions on the hosted **`ubuntu-latest`** runner) differs from a
-local run, and the workarounds in this repo. Referenced by `CLAUDE.md` §8.7/§15.
-
-**One root cause sits under most of this:** the runner executes the job **inside a
-container**, so when a step runs `docker compose up`, Compose starts the stack as
-**sibling containers** on the host's daemon. Anything that assumes the job and
-those containers share a filesystem — or a `localhost` — breaks.
-
-| Gotcha | Fix | Lives in |
-|---|---|---|
-| Bind-mounted config arrives empty | `docker cp` config into external volumes | `infra/seed-config.sh` |
-| `docker compose up --wait` is unsupported / flaky | poll health with `docker inspect` | `infra/wait-healthy.sh` |
-| `pg_isready` passes before PostGIS is ready | add a `PostGIS_Version()` probe | the db healthchecks |
-
----
-
-## 1. Bind mounts don't reach the containers
-
-**Symptom** — green locally, but `compose-smoke` fails with:
-
-```
-oz-init-1 | CommandError: Yaml file `/app/setup_configuration/data.yaml` does not exist.
-```
-
-Migrations run fine; only the step that reads a *mounted* file fails. The same
-trap hits `nrc-init`, `flowable-init`, and `keycloak`.
-
-**Why** — a relative bind mount like `./openzaak/setup_configuration:/app/...` is
-resolved by Compose to a path *inside the job container*
-(`/workspace/.../setup_configuration`). The daemon then looks for that path on
-*its own host*, doesn't find it, and mounts an **empty directory**. (It works on a
-runner that executes jobs on the host — which is why moving to `ubuntu-latest`
-exposed it.)
-
-**Fix** — use the upstream images verbatim (no build) and stream config into
-**external named volumes** with `docker cp`, which copies over the Docker API and
-so works wherever the daemon runs. `infra/seed-config.sh` creates each volume,
-mounts it in a throwaway helper, and copies the files in:
-
-| Asset | Volume | Mounted at |
-|---|---|---|
-| OpenZaak `data.yaml` | `rr-oz-config` | `oz-init:/app/setup_configuration` |
-| Keycloak realms | `rr-kc-realms` | `keycloak:/opt/keycloak/data/import` |
-| `registratie.bpmn` | `rr-fl-bpmn` | `flowable-init:/work` |
-
-The volumes are `external: true` with fixed names, so they resolve identically
-under docker compose and podman-compose. `make` seeds before every `up`; `make
-down` removes them. (Open Notificaties needs nothing — `nrc-init` migrates only.)
-
-**Consequence — bare `docker compose up` can't self-seed external volumes:**
-
-- **CI / Linux / macOS:** `make up` or `make smoke` (seed, then start).
-- **No-make / Windows:** `infra/docker-compose.local.yml` — a twin stack that
-  **bind-mounts** the config instead. Bind mounts are fine *locally* because a
-  local daemon can see your working directory, so
-  `docker compose -f infra/docker-compose.local.yml up -d` just works.
-
-**Why not the obvious alternatives**
-
-- *Bake config into an image* (incl. an inline Dockerfile) — `docker compose up`
-  would then work unaided, but it's a build; we wanted the upstream images as-is.
-- *Compose `configs:` with inline `content`* — Compose writes a client-side temp
-  file and bind-mounts it, hitting the exact same problem.
-- *A host-executing runner* — bind mounts would work with zero seeding, but it
-  reintroduces a self-hosted runner and undoes the move to `ubuntu-latest`.
-
----
-
-## 2. Readiness: poll health, don't use `--wait`
-
-`docker compose up --wait` looks ideal but fails us three ways:
-
-- **podman-compose doesn't implement it** (`unrecognized arguments: --wait`) — so
-  it would break local dev.
-- A project-wide `--wait` **treats a one-shot exiting `0` as a failure** unless
-  something `depends_on` it with `service_completed_successfully`. `flowable-init`
-  deploys the BPMN and exits with no dependant, so `--wait` fails the moment it
-  does — last line `container infra-flowable-init-1 exited (0)`.
-- The containerized runner **can't reach published host ports**, so an external
-  `curl localhost:8080/health` can't work either.
-
-**Fix** — `infra/wait-healthy.sh` polls each durable service (`openzaak nrc-web
-acl bff`, listed as `WAIT_SVCS` in the `Makefile`) with `docker ps` + `docker
-inspect '{{.State.Health.Status}}'` until it reports `healthy`. It uses only
-primitives both runtimes support, reads the **in-container** healthcheck (no host
-port needed), and ignores the one-shots (they only need to have run).
-`WAIT_TIMEOUT` defaults to 420 s — enough for the cold OpenZaak migrate (~90 s)
-plus app start.
-
----
-
-## 3. `pg_isready` passes before PostGIS is ready
-
-`pg_isready` succeeds as soon as the TCP port is open — *before* the
-`postgis/postgis` image has finished running `CREATE EXTENSION postgis`. An init
-container that starts migrating in that window can fail on a missing PostGIS. So
-the db healthchecks add a `SELECT PostGIS_Version()` probe, making dependents wait
-for the extension, not just the port.

docs/runbooks/openzaak.md

@@ -71,12 +71,5 @@ The Makefile auto-points `DOCKER_HOST` at the Podman socket when it exists, so t
   but OZ→NRC delivery wiring + re-enabling lands with **S-06**.
 - **Zaaktype is a concept**, not published (publishing needs roltypen/statustypen/
   resultaattypen — beyond the lean seed). List with `?status=alles`.
-- **Image tag.** Pinned to `openzaak/open-zaak:1.28.2` via `${OPENZAAK_TAG}` (bump
+- **Image tag.** Currently `openzaak/open-zaak:latest` via `${OPENZAAK_TAG}`; pin to
-  deliberately, not via `:latest`).
+  a known-good tag (ADR-0002 follow-up).
-- **Config arrives via a volume, not a bind mount.** `setup_configuration/data.yaml`
-  is streamed into the external `rr-oz-config` volume by `infra/seed-config.sh`
-  (`docker cp`) and mounted at `/app/setup_configuration`, so the init container
-  finds it on Gitea's containerized CI runner too (bind mounts don't reach sibling
-  containers there). The image is the upstream `openzaak/open-zaak` verbatim — no
-  build. Run via `make openzaak-up` (seeds first). See
-  [gitea-actions-gotchas.md](gitea-actions-gotchas.md).

infra/docker-compose.local.yml

@@ -1,296 +0,0 @@
-# LOCAL development stack — runs with a plain `docker compose up`, no make / no
-# seed step / no bash. Use this on a local engine (Docker Desktop on Windows or
-# macOS, or rootless Podman on Linux).
-#
-#   docker compose -f infra/docker-compose.local.yml up -d --build         # podman
-#   docker compose -f infra/docker-compose.local.yml up -d --build --wait  # Docker Desktop
-#   docker compose -f infra/docker-compose.local.yml down --volumes
-#
-# It is identical to infra/docker-compose.yml EXCEPT that the three config inputs
-# (OpenZaak data.yaml, Keycloak realms, Flowable BPMN) are **bind-mounted** from
-# the repo instead of being streamed into external volumes by infra/seed-config.sh.
-# Bind mounts work here because a local daemon can see your working directory —
-# the seed dance only exists for the containerized CI runner, where it can't. See
-# docs/runbooks/gitea-actions-gotchas.md.
-#
-# `infra/docker-compose.yml` remains the CI-canonical stack; keep the two in sync.
-#
-# Port map (host):
-#   8000 OpenZaak · 8001 Open Notificaties · 8080 BFF · 8090 Flowable REST
-#   8100 ACL · 8180 Keycloak   (all admin: admin / admin — dev only)
-
-services:
-
-  # ── OpenZaak (S-01) ──────────────────────────────────────────────────────
-  oz-db:
-    image: docker.io/postgis/postgis:17-3.5
-    environment:
-      POSTGRES_USER: openzaak
-      POSTGRES_PASSWORD: openzaak
-      POSTGRES_DB: openzaak
-    command: postgres -c max_connections=300
-    volumes:
-      - oz-db:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U openzaak -d openzaak && psql -U openzaak -d openzaak -c 'SELECT PostGIS_Version();' -q 2>/dev/null"]
-      interval: 5s
-      timeout: 5s
-      retries: 30
-      start_period: 15s
-    networks: [cg]
-
-  oz-redis:
-    image: docker.io/library/redis:7
-    networks: [cg]
-
-  oz-init:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
-    environment: &oz-env
-      DJANGO_SETTINGS_MODULE: openzaak.conf.docker
-      SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production}
-      DB_HOST: oz-db
-      DB_NAME: openzaak
-      DB_USER: openzaak
-      DB_PASSWORD: openzaak
-      IS_HTTPS: "no"
-      ALLOWED_HOSTS: "*"
-      CACHE_DEFAULT: oz-redis:6379/0
-      CACHE_AXES: oz-redis:6379/0
-      CELERY_BROKER_URL: redis://oz-redis:6379/1
-      CELERY_RESULT_BACKEND: redis://oz-redis:6379/1
-      DISABLE_2FA: "true"
-      NOTIFICATIONS_DISABLED: "true"
-      OPENZAAK_SUPERUSER_USERNAME: admin
-      DJANGO_SUPERUSER_PASSWORD: admin
-      OPENZAAK_SUPERUSER_EMAIL: admin@localhost
-      RUN_SETUP_CONFIG: "true"
-    command: /setup_configuration.sh
-    # Bind mount (`:z` relabels for SELinux on Linux; a no-op on Docker Desktop).
-    volumes:
-      - ./openzaak/setup_configuration:/app/setup_configuration:ro,z
-    depends_on:
-      oz-db:
-        condition: service_healthy
-      oz-redis:
-        condition: service_started
-    networks: [cg]
-
-  openzaak:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
-    environment: *oz-env
-    healthcheck:
-      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
-      start_period: 30s
-    ports:
-      - "8000:8000"
-    depends_on:
-      oz-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  oz-celery:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
-    environment: *oz-env
-    command: /celery_worker.sh
-    depends_on:
-      oz-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  # ── Open Notificaties / NRC (S-01-c) ─────────────────────────────────────
-  nrc-db:
-    image: docker.io/postgis/postgis:17-3.5
-    environment:
-      POSTGRES_USER: opennotificaties
-      POSTGRES_PASSWORD: opennotificaties
-      POSTGRES_DB: opennotificaties
-    command: postgres -c max_connections=300
-    volumes:
-      - nrc-db:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U opennotificaties -d opennotificaties"]
-      interval: 5s
-      timeout: 3s
-      retries: 10
-    networks: [cg]
-
-  nrc-redis:
-    image: docker.io/library/redis:7
-    networks: [cg]
-
-  nrc-init:
-    # Migrations only (see the canonical compose / ADR-0002); no config needed.
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
-    environment: &nrc-env
-      DJANGO_SETTINGS_MODULE: nrc.conf.docker
-      SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production}
-      DB_HOST: nrc-db
-      DB_NAME: opennotificaties
-      DB_USER: opennotificaties
-      DB_PASSWORD: opennotificaties
-      IS_HTTPS: "no"
-      ALLOWED_HOSTS: "*"
-      CACHE_DEFAULT: nrc-redis:6379/0
-      CACHE_AXES: nrc-redis:6379/0
-      CELERY_BROKER_URL: redis://nrc-redis:6379/1
-      CELERY_RESULT_BACKEND: redis://nrc-redis:6379/1
-      DISABLE_2FA: "true"
-      OPENNOTIFICATIES_SUPERUSER_USERNAME: admin
-      DJANGO_SUPERUSER_PASSWORD: admin
-      OPENNOTIFICATIES_SUPERUSER_EMAIL: admin@localhost
-    command: ["sh", "-c", "/wait_for_db.sh && OTEL_SDK_DISABLED=True python src/manage.py migrate"]
-    depends_on:
-      nrc-db:
-        condition: service_healthy
-      nrc-redis:
-        condition: service_started
-      openzaak:
-        condition: service_healthy
-    networks: [cg]
-
-  nrc-web:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
-    environment: *nrc-env
-    healthcheck:
-      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
-      start_period: 30s
-    ports:
-      - "8001:8000"
-    depends_on:
-      nrc-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  nrc-celery:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
-    environment: *nrc-env
-    command: /celery_worker.sh
-    depends_on:
-      nrc-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  # ── Keycloak (S-02) ──────────────────────────────────────────────────────
-  keycloak:
-    image: quay.io/keycloak/keycloak:26.1
-    command: ["start-dev", "--import-realm"]
-    environment:
-      KC_BOOTSTRAP_ADMIN_USERNAME: admin
-      KC_BOOTSTRAP_ADMIN_PASSWORD: admin
-      KEYCLOAK_ADMIN: admin
-      KEYCLOAK_ADMIN_PASSWORD: admin
-      KC_HEALTH_ENABLED: "true"
-      KC_HTTP_ENABLED: "true"
-    ports:
-      - "8180:8080"
-    volumes:
-      - ./keycloak/realms:/opt/keycloak/data/import:ro,z
-    networks: [cg]
-
-  # ── Flowable (S-03) ──────────────────────────────────────────────────────
-  flowable-db:
-    image: docker.io/library/postgres:16
-    environment:
-      POSTGRES_USER: flowable
-      POSTGRES_PASSWORD: flowable
-      POSTGRES_DB: flowable
-    volumes:
-      - flowable-db:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U flowable -d flowable"]
-      interval: 5s
-      timeout: 3s
-      retries: 10
-    networks: [cg]
-
-  flowable-rest:
-    image: docker.io/flowable/flowable-rest:latest
-    environment:
-      SPRING_DATASOURCE_DRIVER-CLASS-NAME: org.postgresql.Driver
-      SPRING_DATASOURCE_URL: jdbc:postgresql://flowable-db:5432/flowable
-      SPRING_DATASOURCE_USERNAME: flowable
-      SPRING_DATASOURCE_PASSWORD: flowable
-    ports:
-      - "8090:8080"
-    depends_on:
-      flowable-db:
-        condition: service_healthy
-    networks: [cg]
-
-  flowable-init:
-    image: docker.io/curlimages/curl:latest
-    restart: "no"
-    volumes:
-      - ../workflows/registratie.bpmn:/work/registratie.bpmn:ro,z
-    command:
-      - sh
-      - -c
-      - |
-        base=http://flowable-rest:8080/flowable-rest/service/repository/deployments
-        until curl -sf -u rest-admin:test "$$base" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
-        if curl -s -u rest-admin:test "$$base?name=registratie" | grep -q '"name":"registratie"'; then
-          echo "registratie already deployed; skip"
-        else
-          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$base" >/dev/null && echo "deployed registratie"
-        fi
-    depends_on:
-      flowable-rest:
-        condition: service_started
-    networks: [cg]
-
-  # ── ACL ──────────────────────────────────────────────────────────────────
-  acl:
-    build:
-      context: ../services/acl
-      dockerfile: Dockerfile
-    image: register-referentie/acl:dev
-    environment:
-      Acl__OpenZaak__BaseUrl: http://openzaak:8000/
-      Acl__OpenZaak__ClientId: big-reference-seed
-      Acl__OpenZaak__Secret: insecure-dev-secret-change-me
-      Acl__Defaults__Bronorganisatie: "517439943"
-      Acl__Defaults__VerantwoordelijkeOrganisatie: "517439943"
-      Acl__Defaults__Vertrouwelijkheidaanduiding: openbaar
-      Acl__Defaults__ZaaktypeUrl: ${ACL_ZAAKTYPE_URL:-http://openzaak:8000/catalogi/api/v1/zaaktypen/00000000-0000-0000-0000-000000000000}
-    ports:
-      - "8100:8080"
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s
-    depends_on:
-      openzaak:
-        condition: service_healthy
-    networks: [cg]
-
-  # ── BFF ──────────────────────────────────────────────────────────────────
-  bff:
-    build:
-      context: ../services/bff
-      dockerfile: Dockerfile
-    image: register-referentie/bff:dev
-    ports:
-      - "8080:8080"
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s
-    networks: [cg]
-
-volumes:
-  oz-db:
-  nrc-db:
-  flowable-db:
-
-networks:
-  cg:

infra/docker-compose.yml

@@ -1,289 +1,9 @@
-# Development stack — boots all infra services plus the ACL and BFF.
+# Local development stack. Grows service-by-service with each slice.
-#
+# S-00-b: the placeholder BFF with a /health check.
-# Consolidates infra/openzaak/, infra/opennotificaties/, infra/keycloak/,
-# and infra/flowable/ and adds the ACL and BFF services.
-#
-# Port map (host):
-#   8000  OpenZaak ZGW API  (admin: admin / admin)
-#   8001  Open Notificaties (admin: admin / admin)
-#   8080  BFF               GET /health → Healthy
-#   8090  Flowable REST     http://localhost:8090/flowable-rest/service/
-#   8100  ACL               GET /health → Healthy  POST /zaken
-#   8180  Keycloak          (admin: admin / admin)
 #
 #   docker compose -f infra/docker-compose.yml up -d --build --wait
-#
+#   curl http://localhost:8080/health   # -> Healthy
-# After first boot, seed the BIG catalogus and note the zaaktype URL:
-#   python infra/openzaak/seed_catalogus.py
-# Then set ACL_ZAAKTYPE_URL in a .env file or your shell and re-up the acl
-# service:
-#   export ACL_ZAAKTYPE_URL=http://openzaak:8000/catalogi/api/v1/zaaktypen/<uuid>
-#   docker compose -f infra/docker-compose.yml up -d acl
-
 services:
-
-  # ── OpenZaak (S-01) ──────────────────────────────────────────────────────
-  oz-db:
-    image: docker.io/postgis/postgis:17-3.5
-    environment:
-      POSTGRES_USER: openzaak
-      POSTGRES_PASSWORD: openzaak
-      POSTGRES_DB: openzaak
-    command: postgres -c max_connections=300
-    volumes:
-      - oz-db:/var/lib/postgresql/data
-    healthcheck:
-      # pg_isready only checks TCP; the second clause verifies PostGIS is installed
-      # so oz-init migrations can safely start (avoids race on cold container start).
-      test: ["CMD-SHELL", "pg_isready -U openzaak -d openzaak && psql -U openzaak -d openzaak -c 'SELECT PostGIS_Version();' -q 2>/dev/null"]
-      interval: 5s
-      timeout: 5s
-      retries: 30
-      start_period: 15s
-    networks: [cg]
-
-  oz-redis:
-    image: docker.io/library/redis:7
-    networks: [cg]
-
-  oz-init:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
-    environment: &oz-env
-      DJANGO_SETTINGS_MODULE: openzaak.conf.docker
-      SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production}
-      DB_HOST: oz-db
-      DB_NAME: openzaak
-      DB_USER: openzaak
-      DB_PASSWORD: openzaak
-      IS_HTTPS: "no"
-      ALLOWED_HOSTS: "*"
-      CACHE_DEFAULT: oz-redis:6379/0
-      CACHE_AXES: oz-redis:6379/0
-      CELERY_BROKER_URL: redis://oz-redis:6379/1
-      CELERY_RESULT_BACKEND: redis://oz-redis:6379/1
-      DISABLE_2FA: "true"
-      NOTIFICATIONS_DISABLED: "true"
-      OPENZAAK_SUPERUSER_USERNAME: admin
-      DJANGO_SUPERUSER_PASSWORD: admin
-      OPENZAAK_SUPERUSER_EMAIL: admin@localhost
-      RUN_SETUP_CONFIG: "true"
-    command: /setup_configuration.sh
-    # data.yaml is streamed into this external volume by infra/seed-config.sh
-    # before start (bind mounts don't reach sibling containers on the CI runner).
-    volumes:
-      - oz-config:/app/setup_configuration:ro
-    depends_on:
-      oz-db:
-        condition: service_healthy
-      oz-redis:
-        condition: service_started
-    networks: [cg]
-
-  openzaak:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
-    environment: *oz-env
-    healthcheck:
-      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
-      start_period: 30s
-    ports:
-      - "8000:8000"
-    depends_on:
-      oz-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  oz-celery:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
-    environment: *oz-env
-    command: /celery_worker.sh
-    depends_on:
-      oz-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  # ── Open Notificaties / NRC (S-01-c) ─────────────────────────────────────
-  nrc-db:
-    image: docker.io/postgis/postgis:17-3.5
-    environment:
-      POSTGRES_USER: opennotificaties
-      POSTGRES_PASSWORD: opennotificaties
-      POSTGRES_DB: opennotificaties
-    command: postgres -c max_connections=300
-    volumes:
-      - nrc-db:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U opennotificaties -d opennotificaties"]
-      interval: 5s
-      timeout: 3s
-      retries: 10
-    networks: [cg]
-
-  nrc-redis:
-    image: docker.io/library/redis:7
-    networks: [cg]
-
-  nrc-init:
-    # Plain base image — nrc-init runs migrations only (see command below), so it
-    # needs no baked config.
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
-    environment: &nrc-env
-      DJANGO_SETTINGS_MODULE: nrc.conf.docker
-      SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production}
-      DB_HOST: nrc-db
-      DB_NAME: opennotificaties
-      DB_USER: opennotificaties
-      DB_PASSWORD: opennotificaties
-      IS_HTTPS: "no"
-      ALLOWED_HOSTS: "*"
-      CACHE_DEFAULT: nrc-redis:6379/0
-      CACHE_AXES: nrc-redis:6379/0
-      CELERY_BROKER_URL: redis://nrc-redis:6379/1
-      CELERY_RESULT_BACKEND: redis://nrc-redis:6379/1
-      DISABLE_2FA: "true"
-      OPENNOTIFICATIES_SUPERUSER_USERNAME: admin
-      DJANGO_SUPERUSER_PASSWORD: admin
-      OPENNOTIFICATIES_SUPERUSER_EMAIL: admin@localhost
-    # Migrations only for now. No setup_configuration steps are enabled yet (the
-    # OZ<->NRC notification wiring lands in S-06), and NRC's `setup_configuration`
-    # aborts with "No steps enabled" on the empty data.yaml — so we run `migrate`
-    # directly instead of /setup_configuration.sh. See data.yaml and ADR-0002.
-    command: ["sh", "-c", "/wait_for_db.sh && OTEL_SDK_DISABLED=True python src/manage.py migrate"]
-    depends_on:
-      nrc-db:
-        condition: service_healthy
-      nrc-redis:
-        condition: service_started
-      openzaak:
-        condition: service_healthy
-    networks: [cg]
-
-  nrc-web:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
-    environment: *nrc-env
-    healthcheck:
-      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
-      start_period: 30s
-    ports:
-      - "8001:8000"
-    depends_on:
-      nrc-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  nrc-celery:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
-    environment: *nrc-env
-    command: /celery_worker.sh
-    depends_on:
-      nrc-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  # ── Keycloak (S-02) ──────────────────────────────────────────────────────
-  keycloak:
-    image: quay.io/keycloak/keycloak:26.1
-    command: ["start-dev", "--import-realm"]
-    environment:
-      KC_BOOTSTRAP_ADMIN_USERNAME: admin
-      KC_BOOTSTRAP_ADMIN_PASSWORD: admin
-      KEYCLOAK_ADMIN: admin
-      KEYCLOAK_ADMIN_PASSWORD: admin
-      KC_HEALTH_ENABLED: "true"
-      KC_HTTP_ENABLED: "true"
-    ports:
-      - "8180:8080"
-    # realm exports are streamed into this external volume by infra/seed-config.sh.
-    volumes:
-      - kc-realms:/opt/keycloak/data/import:ro
-    networks: [cg]
-
-  # ── Flowable (S-03) ──────────────────────────────────────────────────────
-  flowable-db:
-    image: docker.io/library/postgres:16
-    environment:
-      POSTGRES_USER: flowable
-      POSTGRES_PASSWORD: flowable
-      POSTGRES_DB: flowable
-    volumes:
-      - flowable-db:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U flowable -d flowable"]
-      interval: 5s
-      timeout: 3s
-      retries: 10
-    networks: [cg]
-
-  flowable-rest:
-    image: docker.io/flowable/flowable-rest:latest
-    environment:
-      SPRING_DATASOURCE_DRIVER-CLASS-NAME: org.postgresql.Driver
-      SPRING_DATASOURCE_URL: jdbc:postgresql://flowable-db:5432/flowable
-      SPRING_DATASOURCE_USERNAME: flowable
-      SPRING_DATASOURCE_PASSWORD: flowable
-    ports:
-      - "8090:8080"
-    depends_on:
-      flowable-db:
-        condition: service_healthy
-    networks: [cg]
-
-  flowable-init:
-    image: docker.io/curlimages/curl:latest
-    restart: "no"
-    # registratie.bpmn is streamed into this external volume by infra/seed-config.sh.
-    volumes:
-      - fl-bpmn:/work:ro
-    command:
-      - sh
-      - -c
-      - |
-        base=http://flowable-rest:8080/flowable-rest/service/repository/deployments
-        until curl -sf -u rest-admin:test "$$base" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
-        if curl -s -u rest-admin:test "$$base?name=registratie" | grep -q '"name":"registratie"'; then
-          echo "registratie already deployed; skip"
-        else
-          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$base" >/dev/null && echo "deployed registratie"
-        fi
-    depends_on:
-      flowable-rest:
-        condition: service_started
-    networks: [cg]
-
-  # ── ACL ──────────────────────────────────────────────────────────────────
-  acl:
-    build:
-      context: ../services/acl
-      dockerfile: Dockerfile
-    image: register-referentie/acl:dev
-    environment:
-      Acl__OpenZaak__BaseUrl: http://openzaak:8000/
-      Acl__OpenZaak__ClientId: big-reference-seed
-      Acl__OpenZaak__Secret: insecure-dev-secret-change-me
-      Acl__Defaults__Bronorganisatie: "517439943"
-      Acl__Defaults__VerantwoordelijkeOrganisatie: "517439943"
-      Acl__Defaults__Vertrouwelijkheidaanduiding: openbaar
-      # Override with the real zaaktype URL after running seed_catalogus.py.
-      Acl__Defaults__ZaaktypeUrl: ${ACL_ZAAKTYPE_URL:-http://openzaak:8000/catalogi/api/v1/zaaktypen/00000000-0000-0000-0000-000000000000}
-    ports:
-      - "8100:8080"
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s
-    depends_on:
-      openzaak:
-        condition: service_healthy
-    networks: [cg]
-
-  # ── BFF ──────────────────────────────────────────────────────────────────
   bff:
     build:
       context: ../services/bff
@@ -297,24 +17,3 @@ services:
       timeout: 3s
       retries: 5
       start_period: 10s
-    networks: [cg]
-
-volumes:
-  oz-db:
-  nrc-db:
-  flowable-db:
-  # Config volumes — created and populated out-of-band by infra/seed-config.sh
-  # (docker cp), because bind mounts don't reach sibling containers on the CI
-  # runner. `external` keeps the names deterministic; the seed step manages them.
-  oz-config:
-    external: true
-    name: rr-oz-config
-  kc-realms:
-    external: true
-    name: rr-kc-realms
-  fl-bpmn:
-    external: true
-    name: rr-fl-bpmn
-
-networks:
-  cg:

infra/flowable/docker-compose.yml

@@ -40,9 +40,8 @@ services:
   flowable-init:
     image: docker.io/curlimages/curl:latest
     restart: "no"
-    # registratie.bpmn is streamed into this external volume by infra/seed-config.sh.
     volumes:
-      - fl-bpmn:/work:ro
+      - ../../workflows/registratie.bpmn:/work/registratie.bpmn:ro,z
     command:
       - sh
       - -c
@@ -61,10 +60,6 @@ services:
 
 volumes:
   flowable-db:
-  # populated out-of-band by infra/seed-config.sh (docker cp) — see that script.
-  fl-bpmn:
-    external: true
-    name: rr-fl-bpmn
 
 networks:
   cg:

infra/keycloak/docker-compose.yml

@@ -21,15 +21,9 @@ services:
       KC_HTTP_ENABLED: "true"
     ports:
       - "8180:8080"
-    # realm exports are streamed into this external volume by infra/seed-config.sh.
     volumes:
-      - kc-realms:/opt/keycloak/data/import:ro
+      - ./realms:/opt/keycloak/data/import:ro,z
     networks: [cg]
 
-volumes:
-  kc-realms:
-    external: true
-    name: rr-kc-realms
-
 networks:
   cg:

infra/opennotificaties/docker-compose.yml

@@ -19,13 +19,10 @@ services:
     volumes:
       - nrc-db:/var/lib/postgresql/data
     healthcheck:
-      # pg_isready only checks TCP; the second clause verifies PostGIS is installed
+      test: ["CMD-SHELL", "pg_isready -U opennotificaties -d opennotificaties"]
-      # so nrc-init migrations can safely start (avoids race on cold container start).
-      test: ["CMD-SHELL", "pg_isready -U opennotificaties -d opennotificaties && psql -U opennotificaties -d opennotificaties -c 'SELECT PostGIS_Version();' -q 2>/dev/null"]
       interval: 5s
-      timeout: 5s
+      timeout: 3s
-      retries: 30
+      retries: 10
-      start_period: 15s
     networks: [cg]
 
   nrc-redis:
@@ -33,8 +30,7 @@ services:
     networks: [cg]
 
   nrc-init:
-    # Plain base image — nrc-init runs migrations only (see command below).
+    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-latest}
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
     environment: &nrc-env
       DJANGO_SETTINGS_MODULE: nrc.conf.docker
       SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production}
@@ -52,11 +48,10 @@ services:
       OPENNOTIFICATIES_SUPERUSER_USERNAME: admin
       DJANGO_SUPERUSER_PASSWORD: admin
       OPENNOTIFICATIES_SUPERUSER_EMAIL: admin@localhost
-    # Migrations only for now. No setup_configuration steps are enabled yet (the
+      RUN_SETUP_CONFIG: "true"
-    # OZ<->NRC notification wiring lands in S-06), and NRC's `setup_configuration`
+    command: /setup_configuration.sh
-    # aborts with "No steps enabled" on the empty data.yaml — so we run `migrate`
+    volumes:
-    # directly instead of /setup_configuration.sh. See data.yaml and ADR-0002.
+      - ./setup_configuration:/app/setup_configuration:ro,z
-    command: ["sh", "-c", "/wait_for_db.sh && OTEL_SDK_DISABLED=True python src/manage.py migrate"]
     depends_on:
       nrc-db:
         condition: service_healthy
@@ -65,7 +60,7 @@ services:
     networks: [cg]
 
   nrc-web:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
+    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-latest}
     environment: *nrc-env
     healthcheck:
       test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
@@ -81,7 +76,7 @@ services:
     networks: [cg]
 
   nrc-celery:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
+    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-latest}
     environment: *nrc-env
     command: /celery_worker.sh
     depends_on:

infra/openzaak/docker-compose.yml

@@ -18,13 +18,10 @@ services:
     volumes:
       - oz-db:/var/lib/postgresql/data
     healthcheck:
-      # pg_isready only checks TCP; the second clause verifies PostGIS is installed
+      test: ["CMD-SHELL", "pg_isready -U openzaak -d openzaak"]
-      # so oz-init migrations can safely start (avoids race on cold container start).
-      test: ["CMD-SHELL", "pg_isready -U openzaak -d openzaak && psql -U openzaak -d openzaak -c 'SELECT PostGIS_Version();' -q 2>/dev/null"]
       interval: 5s
-      timeout: 5s
+      timeout: 3s
-      retries: 30
+      retries: 10
-      start_period: 15s
     networks: [cg]
 
   oz-redis:
@@ -32,7 +29,7 @@ services:
     networks: [cg]
 
   oz-init:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
+    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
     environment: &oz-env
       DJANGO_SETTINGS_MODULE: openzaak.conf.docker
       SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production}
@@ -55,9 +52,10 @@ services:
       OPENZAAK_SUPERUSER_EMAIL: admin@localhost
       RUN_SETUP_CONFIG: "true"
     command: /setup_configuration.sh
-    # data.yaml is streamed into this external volume by infra/seed-config.sh.
     volumes:
-      - oz-config:/app/setup_configuration:ro
+      # :z relabels for SELinux; the dir/file must be world-readable for the
+      # container user (rootless Podman uid mapping). See docs/runbooks/openzaak.md.
+      - ./setup_configuration:/app/setup_configuration:ro,z
     depends_on:
       oz-db:
         condition: service_healthy
@@ -66,7 +64,7 @@ services:
     networks: [cg]
 
   openzaak:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
+    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
     environment: *oz-env
     healthcheck:
       test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
@@ -82,7 +80,7 @@ services:
     networks: [cg]
 
   oz-celery:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
+    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
     environment: *oz-env
     command: /celery_worker.sh
     depends_on:
@@ -92,10 +90,6 @@ services:
 
 volumes:
   oz-db:
-  # populated out-of-band by infra/seed-config.sh (docker cp) — see that script.
-  oz-config:
-    external: true
-    name: rr-oz-config
 
 networks:
   cg:

infra/seed-config.sh

@@ -1,45 +0,0 @@
-#!/usr/bin/env bash
-#
-# Populate the external named *config* volumes that the upstream services mount,
-# by `docker cp`-ing files into a throwaway helper container that mounts each one.
-#
-# Why: the compose stack uses the upstream images verbatim (no build). On Gitea's
-# containerized runner, `docker compose` starts the stack as SIBLING containers
-# via the host daemon, so a workspace bind mount resolves to a path the daemon
-# can't see and is mounted empty. `docker cp` instead streams bytes over the
-# Docker API, so the files reach the volume regardless of where the daemon runs.
-# We use plain docker primitives (volume create / run / cp / rm) rather than
-# `docker compose create`, because podman-compose (local dev) lacks that
-# subcommand. Fixed-name `external` volumes keep the names deterministic across
-# both runtimes. See docs/runbooks/gitea-actions-gotchas.md.
-#
-# Usage: seed-config.sh <key> [<key> ...]   where key ∈ { oz, kc, fl }
-set -euo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-HELPER="${SEED_HELPER_IMAGE:-docker.io/library/busybox:stable}"
-
-populate() {  # volume  source(file or dir/.)
-  local vol="$1" src="$2" cid
-  docker volume rm -f "$vol" >/dev/null 2>&1 || true
-  docker volume create "$vol" >/dev/null
-  # A *created* (never started) helper is enough: the volume is attached at create
-  # time, `docker cp` writes through to it, and `docker rm` is instant (nothing to
-  # stop). `docker create` is a container subcommand both docker and podman have —
-  # unlike `docker compose create`, which podman-compose lacks.
-  cid="$(docker create -v "$vol:/dest" "$HELPER" true)"
-  docker cp "$src" "$cid:/dest/"
-  docker rm "$cid" >/dev/null
-  echo "  seeded $vol"
-}
-
-[ "$#" -gt 0 ] || { echo "usage: seed-config.sh <oz|kc|fl> ..." >&2; exit 2; }
-
-for key in "$@"; do
-  case "$key" in
-    oz) populate rr-oz-config "$here/openzaak/setup_configuration/." ;;
-    kc) populate rr-kc-realms "$here/keycloak/realms/." ;;
-    fl) populate rr-fl-bpmn  "$here/../workflows/registratie.bpmn" ;;
-    *)  echo "unknown seed key: $key" >&2; exit 2 ;;
-  esac
-done

infra/wait-healthy.sh

@@ -1,36 +0,0 @@
-#!/usr/bin/env bash
-#
-# Wait until the named compose services report a healthy healthcheck.
-#
-# Portable across `docker compose` (CI) and `podman-compose` (local dev): it uses
-# plain `docker ps` + `docker inspect`, so it needs neither `docker compose
-# up --wait` (podman-compose doesn't implement that flag) nor host port access
-# (the containerized CI runner can't reach published ports). It also sidesteps the
-# `--wait`-fails-when-a-one-shot-exits issue, since we only poll long-running
-# services that declare a healthcheck. See docs/runbooks/gitea-actions-gotchas.md.
-#
-# Usage: WAIT_TIMEOUT=420 wait-healthy.sh <service> [<service> ...]
-set -euo pipefail
-
-timeout="${WAIT_TIMEOUT:-420}"
-deadline=$(( $(date +%s) + timeout ))
-
-# compose service name -> container id. The name filter matches both docker
-# compose ("infra-openzaak-1") and podman-compose ("infra_openzaak_1") naming.
-cid_for() { docker ps -aq --filter "name=$1" | head -1; }
-
-for svc in "$@"; do
-  echo "waiting for '$svc' to be healthy (timeout ${timeout}s)..."
-  while :; do
-    cid="$(cid_for "$svc")"
-    status=""
-    [ -n "$cid" ] && status="$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}' "$cid" 2>/dev/null || true)"
-    [ "$status" = "healthy" ] && { echo "  '$svc' is healthy"; break; }
-    if [ "$(date +%s)" -ge "$deadline" ]; then
-      echo "TIMEOUT: '$svc' not healthy (status=${status:-no-container})" >&2
-      docker ps -a --filter "name=$svc" >&2 || true
-      exit 1
-    fi
-    sleep 3
-  done
-done

mkdocs.yml

@@ -23,9 +23,6 @@ nav:
   - Product Requirements: PRD.md
   - Architecture:
       - "ADR-0001: Loose coupling": architecture/adr-0001-loose-coupling.md
-      - "ADR-0002: Catalogus design": architecture/adr-0002-catalogus-design.md
-      - "ADR-0003: ACL default-fill": architecture/adr-0003-default-fill.md
-      - "ADR-0004: BDD framework": architecture/adr-0004-bdd-framework.md
   - Working in Gitea: gitea-workflow.md
   - Runbooks:
       - CI: runbooks/ci.md

register-referentie.slnx

@@ -1,16 +0,0 @@
-<Solution>
-  <Folder Name="/services/" />
-  <Folder Name="/services/acl/">
-    <Project Path="services/acl/Acl.Api/Acl.Api.csproj" />
-    <Project Path="services/acl/Acl.Application/Acl.Application.csproj" />
-    <Project Path="services/acl/Acl.Infrastructure/Acl.Infrastructure.csproj" />
-    <Project Path="services/acl/Acl.Tests/Acl.Tests.csproj" />
-  </Folder>
-  <Folder Name="/services/bff/">
-    <Project Path="services/bff/Bff.Api/Bff.Api.csproj" />
-    <Project Path="services/bff/Bff.Tests/Bff.Tests.csproj" />
-  </Folder>
-  <Folder Name="/tests/">
-    <Project Path="tests/acceptance/Acceptance.csproj" />
-  </Folder>
-</Solution>

services/acl/.dockerignore

@@ -1,3 +0,0 @@
-**/bin
-**/obj
-**/*.user

services/acl/Acl.Api/Acl.Api.csproj

@@ -1,14 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk.Web">
-
-  <ItemGroup>
-    <ProjectReference Include="..\Acl.Application\Acl.Application.csproj" />
-    <ProjectReference Include="..\Acl.Infrastructure\Acl.Infrastructure.csproj" />
-  </ItemGroup>
-
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <Nullable>enable</Nullable>
-    <ImplicitUsings>enable</ImplicitUsings>
-  </PropertyGroup>
-
-</Project>

services/acl/Acl.Api/Program.cs

@@ -1,31 +0,0 @@
-using Acl.Application;
-using Acl.Infrastructure;
-
-var builder = WebApplication.CreateBuilder(args);
-
-builder.Services.AddSingleton<IClock, SystemClock>();
-builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
-    .GetSection("Acl:Defaults").Get<AclDefaults>()
-    ?? throw new InvalidOperationException("Missing configuration section 'Acl:Defaults'"));
-builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
-    .GetSection("Acl:OpenZaak").Get<OpenZaakOptions>()
-    ?? throw new InvalidOperationException("Missing configuration section 'Acl:OpenZaak'"));
-builder.Services.AddHttpClient<IZaakGateway, OpenZaakGateway>();
-builder.Services.AddScoped<AclService>();
-
-var app = builder.Build();
-
-app.MapGet("/health", () => "Healthy");
-
-// The ACL's single operation, exposed as a service endpoint.
-app.MapPost("/zaken", async (OpenZaakRequest body, AclService acl, CancellationToken ct) =>
-{
-    var zaakUrl = await acl.OpenZaakAsync(new DomainRegistration(body.Bsn), ct);
-    return Results.Ok(new { zaakUrl = zaakUrl.ToString() });
-});
-
-app.Run();
-
-public sealed record OpenZaakRequest(string Bsn);
-
-public partial class Program;

services/acl/Acl.Api/Properties/launchSettings.json

@@ -1,23 +0,0 @@
-{
-  "$schema": "https://json.schemastore.org/launchsettings.json",
-  "profiles": {
-    "http": {
-      "commandName": "Project",
-      "dotnetRunMessages": true,
-      "launchBrowser": true,
-      "applicationUrl": "http://localhost:5041",
-      "environmentVariables": {
-        "ASPNETCORE_ENVIRONMENT": "Development"
-      }
-    },
-    "https": {
-      "commandName": "Project",
-      "dotnetRunMessages": true,
-      "launchBrowser": true,
-      "applicationUrl": "https://localhost:7260;http://localhost:5041",
-      "environmentVariables": {
-        "ASPNETCORE_ENVIRONMENT": "Development"
-      }
-    }
-  }
-}

services/acl/Acl.Api/appsettings.Development.json

@@ -1,8 +0,0 @@
-{
-  "Logging": {
-    "LogLevel": {
-      "Default": "Information",
-      "Microsoft.AspNetCore": "Warning"
-    }
-  }
-}

services/acl/Acl.Api/appsettings.json

@@ -1,9 +0,0 @@
-{
-  "Logging": {
-    "LogLevel": {
-      "Default": "Information",
-      "Microsoft.AspNetCore": "Warning"
-    }
-  },
-  "AllowedHosts": "*"
-}

services/acl/Acl.Application/Acl.Application.csproj

@@ -1,9 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <Nullable>enable</Nullable>
-  </PropertyGroup>
-
-</Project>

services/acl/Acl.Application/AclDefaults.cs

@@ -1,10 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>Configured ZGW defaults the ACL fills in (ADR-0003).</summary>
-public sealed class AclDefaults
-{
-    public required string Bronorganisatie { get; init; }
-    public required string VerantwoordelijkeOrganisatie { get; init; }
-    public required string Vertrouwelijkheidaanduiding { get; init; }
-    public required Uri ZaaktypeUrl { get; init; }
-}

services/acl/Acl.Application/AclService.cs

@@ -1,20 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>The ACL's single operation: open a zaak from a domain payload,
-/// default-filling the ZGW-mandatory fields (ADR-0003).</summary>
-public sealed class AclService(IZaakGateway gateway, AclDefaults defaults, IClock clock)
-{
-    public Task<Uri> OpenZaakAsync(DomainRegistration registration, CancellationToken ct = default)
-    {
-        ArgumentNullException.ThrowIfNull(registration);
-
-        var request = new ZaakRequest(
-            defaults.Bronorganisatie,
-            defaults.VerantwoordelijkeOrganisatie,
-            defaults.Vertrouwelijkheidaanduiding,
-            defaults.ZaaktypeUrl,
-            clock.Today);
-
-        return gateway.OpenZaakAsync(request, ct);
-    }
-}

services/acl/Acl.Application/DomainRegistration.cs

@@ -1,4 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>Domain-language payload handed to the ACL. No ZGW concepts here.</summary>
-public sealed record DomainRegistration(string Bsn);

services/acl/Acl.Application/IClock.cs

@@ -1,7 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>Abstracts "today" so startdatum default-fill is deterministic in tests.</summary>
-public interface IClock
-{
-    DateOnly Today { get; }
-}

services/acl/Acl.Application/IZaakGateway.cs

@@ -1,8 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>Port to the ZGW Zaken API. Implemented in Infrastructure — the only
-/// code that talks to OpenZaak (ADR-0001).</summary>
-public interface IZaakGateway
-{
-    Task<Uri> OpenZaakAsync(ZaakRequest request, CancellationToken ct = default);
-}

services/acl/Acl.Application/ZaakRequest.cs

@@ -1,9 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>The fully default-filled zaak the gateway will create in OpenZaak.</summary>
-public sealed record ZaakRequest(
-    string Bronorganisatie,
-    string VerantwoordelijkeOrganisatie,
-    string Vertrouwelijkheidaanduiding,
-    Uri Zaaktype,
-    DateOnly Startdatum);

services/acl/Acl.Infrastructure/Acl.Infrastructure.csproj

@@ -1,13 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <ItemGroup>
-    <ProjectReference Include="..\Acl.Application\Acl.Application.csproj" />
-  </ItemGroup>
-
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <Nullable>enable</Nullable>
-  </PropertyGroup>
-
-</Project>

services/acl/Acl.Infrastructure/OpenZaakGateway.cs

@@ -1,48 +0,0 @@
-using System.Net.Http.Headers;
-using System.Net.Http.Json;
-using System.Text.Json.Serialization;
-using Acl.Application;
-
-namespace Acl.Infrastructure;
-
-/// <summary>The only code that talks to OpenZaak's Zaken API (ADR-0001).</summary>
-public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) : IZaakGateway
-{
-    public async Task<Uri> OpenZaakAsync(ZaakRequest request, CancellationToken ct = default)
-    {
-        ArgumentNullException.ThrowIfNull(request);
-
-        using var message = new HttpRequestMessage(
-            HttpMethod.Post, new Uri(options.BaseUrl, "/zaken/api/v1/zaken"))
-        {
-            Content = JsonContent.Create(new ZaakDto(
-                request.Bronorganisatie,
-                request.Zaaktype.ToString(),
-                request.VerantwoordelijkeOrganisatie,
-                request.Startdatum.ToString("yyyy-MM-dd"),
-                request.Vertrouwelijkheidaanduiding)),
-        };
-        message.Headers.Authorization =
-            new AuthenticationHeaderValue("Bearer", ZgwToken.Mint(options.ClientId, options.Secret));
-        // ZRC is a geo API; it requires the CRS headers.
-        message.Headers.Add("Accept-Crs", "EPSG:4326");
-        message.Content.Headers.Add("Content-Crs", "EPSG:4326");
-
-        using var response = await http.SendAsync(message, ct);
-        response.EnsureSuccessStatusCode();
-
-        var created = await response.Content.ReadFromJsonAsync<ZaakCreatedDto>(ct)
-            ?? throw new InvalidOperationException("OpenZaak returned an empty zaak response");
-        return new Uri(created.Url);
-    }
-
-    private sealed record ZaakDto(
-        [property: JsonPropertyName("bronorganisatie")] string Bronorganisatie,
-        [property: JsonPropertyName("zaaktype")] string Zaaktype,
-        [property: JsonPropertyName("verantwoordelijkeOrganisatie")] string VerantwoordelijkeOrganisatie,
-        [property: JsonPropertyName("startdatum")] string Startdatum,
-        [property: JsonPropertyName("vertrouwelijkheidaanduiding")] string Vertrouwelijkheidaanduiding);
-
-    private sealed record ZaakCreatedDto(
-        [property: JsonPropertyName("url")] string Url);
-}

services/acl/Acl.Infrastructure/OpenZaakOptions.cs

@@ -1,9 +0,0 @@
-namespace Acl.Infrastructure;
-
-/// <summary>Connection + credential config for OpenZaak's ZGW APIs.</summary>
-public sealed class OpenZaakOptions
-{
-    public required Uri BaseUrl { get; init; }
-    public required string ClientId { get; init; }
-    public required string Secret { get; init; }
-}

services/acl/Acl.Infrastructure/SystemClock.cs

@@ -1,8 +0,0 @@
-using Acl.Application;
-
-namespace Acl.Infrastructure;
-
-public sealed class SystemClock : IClock
-{
-    public DateOnly Today => DateOnly.FromDateTime(DateTime.UtcNow);
-}

services/acl/Acl.Infrastructure/ZgwToken.cs

@@ -1,29 +0,0 @@
-using System.Security.Cryptography;
-using System.Text;
-using System.Text.Json;
-
-namespace Acl.Infrastructure;
-
-/// <summary>Mints a ZGW (vng-api-common) JWT: HS256 over the standard claims.</summary>
-internal static class ZgwToken
-{
-    public static string Mint(string clientId, string secret)
-    {
-        var header = B64Url(JsonSerializer.SerializeToUtf8Bytes(new { alg = "HS256", typ = "JWT" }));
-        var payload = B64Url(JsonSerializer.SerializeToUtf8Bytes(new
-        {
-            iss = clientId,
-            iat = DateTimeOffset.UtcNow.ToUnixTimeSeconds(),
-            client_id = clientId,
-            user_id = "acl",
-            user_representation = "acl",
-        }));
-        var signingInput = $"{header}.{payload}";
-        using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
-        var signature = B64Url(hmac.ComputeHash(Encoding.UTF8.GetBytes(signingInput)));
-        return $"{signingInput}.{signature}";
-    }
-
-    private static string B64Url(byte[] bytes) =>
-        Convert.ToBase64String(bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_');
-}

services/acl/Acl.Tests/Acl.Tests.csproj

@@ -1,26 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <Nullable>enable</Nullable>
-    <IsPackable>false</IsPackable>
-  </PropertyGroup>
-
-  <ItemGroup>
-    <PackageReference Include="coverlet.collector" Version="6.0.4" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
-    <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <Using Include="Xunit" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <ProjectReference Include="..\Acl.Application\Acl.Application.csproj" />
-    <ProjectReference Include="..\Acl.Infrastructure\Acl.Infrastructure.csproj" />
-  </ItemGroup>
-
-</Project>

services/acl/Acl.Tests/AclServiceTests.cs

@@ -1,47 +0,0 @@
-using Acl.Application;
-
-namespace Acl.Tests;
-
-public class AclServiceTests
-{
-    private sealed class FakeGateway : IZaakGateway
-    {
-        public ZaakRequest? Captured;
-        public Uri Result { get; } = new("http://openzaak/zaken/api/v1/zaken/abc");
-
-        public Task<Uri> OpenZaakAsync(ZaakRequest request, CancellationToken ct = default)
-        {
-            Captured = request;
-            return Task.FromResult(Result);
-        }
-    }
-
-    private sealed class FixedClock(DateOnly today) : IClock
-    {
-        public DateOnly Today { get; } = today;
-    }
-
-    [Fact]
-    public async Task Opening_a_zaak_default_fills_zgw_fields_and_returns_the_zaak_url()
-    {
-        var gateway = new FakeGateway();
-        var defaults = new AclDefaults
-        {
-            Bronorganisatie = "517439943",
-            VerantwoordelijkeOrganisatie = "517439943",
-            Vertrouwelijkheidaanduiding = "openbaar",
-            ZaaktypeUrl = new("http://openzaak/catalogi/api/v1/zaaktypen/big"),
-        };
-        var service = new AclService(gateway, defaults, new FixedClock(new DateOnly(2026, 6, 4)));
-
-        var url = await service.OpenZaakAsync(new DomainRegistration("123456782"));
-
-        Assert.Equal(gateway.Result, url);
-        var req = Assert.IsType<ZaakRequest>(gateway.Captured);
-        Assert.Equal("517439943", req.Bronorganisatie);
-        Assert.Equal("517439943", req.VerantwoordelijkeOrganisatie);
-        Assert.Equal("openbaar", req.Vertrouwelijkheidaanduiding);
-        Assert.Equal(defaults.ZaaktypeUrl, req.Zaaktype);
-        Assert.Equal(new DateOnly(2026, 6, 4), req.Startdatum);
-    }
-}

services/acl/Acl.Tests/OpenZaakGatewayTests.cs

@@ -1,51 +0,0 @@
-using System.Net;
-using System.Net.Http.Json;
-using Acl.Application;
-using Acl.Infrastructure;
-
-namespace Acl.Tests;
-
-public class OpenZaakGatewayTests
-{
-    private sealed class StubHandler(Func<HttpRequestMessage, Task<HttpResponseMessage>> onSend)
-        : HttpMessageHandler
-    {
-        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken ct)
-            => onSend(request);
-    }
-
-    [Fact]
-    public async Task Posts_zaak_to_openzaak_with_bearer_and_default_fields_and_returns_url()
-    {
-        HttpRequestMessage? seen = null;
-        string? body = null;
-        var handler = new StubHandler(async req =>
-        {
-            seen = req;
-            body = await req.Content!.ReadAsStringAsync();
-            return new HttpResponseMessage(HttpStatusCode.Created)
-            {
-                Content = JsonContent.Create(new { url = "http://openzaak/zaken/api/v1/zaken/xyz" }),
-            };
-        });
-        var gateway = new OpenZaakGateway(
-            new HttpClient(handler),
-            new OpenZaakOptions { BaseUrl = new("http://openzaak"), ClientId = "cid", Secret = "sec" });
-        var request = new ZaakRequest(
-            "517439943", "517439943", "openbaar",
-            new("http://openzaak/catalogi/api/v1/zaaktypen/big"), new DateOnly(2026, 6, 4));
-
-        var url = await gateway.OpenZaakAsync(request);
-
-        Assert.Equal("http://openzaak/zaken/api/v1/zaken/xyz", url.ToString());
-        Assert.Equal(HttpMethod.Post, seen!.Method);
-        Assert.Equal("http://openzaak/zaken/api/v1/zaken", seen.RequestUri!.ToString());
-        Assert.Equal("Bearer", seen.Headers.Authorization!.Scheme);
-        Assert.False(string.IsNullOrWhiteSpace(seen.Headers.Authorization.Parameter));
-        Assert.Contains("\"bronorganisatie\":\"517439943\"", body);
-        Assert.Contains("\"verantwoordelijkeOrganisatie\":\"517439943\"", body);
-        Assert.Contains("\"vertrouwelijkheidaanduiding\":\"openbaar\"", body);
-        Assert.Contains("\"startdatum\":\"2026-06-04\"", body);
-        Assert.Contains("\"zaaktype\":\"http://openzaak/catalogi/api/v1/zaaktypen/big\"", body);
-    }
-}

services/acl/Acl.slnx

@@ -1,6 +0,0 @@
-<Solution>
-  <Project Path="Acl.Api/Acl.Api.csproj" />
-  <Project Path="Acl.Application/Acl.Application.csproj" />
-  <Project Path="Acl.Infrastructure/Acl.Infrastructure.csproj" />
-  <Project Path="Acl.Tests/Acl.Tests.csproj" />
-</Solution>

services/acl/Dockerfile

@@ -1,32 +0,0 @@
-# Multi-stage build for the ACL service (.NET 10).
-# Build context is services/acl (see infra/docker-compose.yml).
-FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
-WORKDIR /src
-
-# Restore first (cached unless .csproj files change).
-COPY Acl.Api/Acl.Api.csproj Acl.Api/
-COPY Acl.Application/Acl.Application.csproj Acl.Application/
-COPY Acl.Infrastructure/Acl.Infrastructure.csproj Acl.Infrastructure/
-RUN dotnet restore Acl.Api/Acl.Api.csproj
-
-COPY Acl.Api/ Acl.Api/
-COPY Acl.Application/ Acl.Application/
-COPY Acl.Infrastructure/ Acl.Infrastructure/
-RUN dotnet publish Acl.Api/Acl.Api.csproj -c Release -o /app/publish /p:UseAppHost=false
-
-FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtime
-WORKDIR /app
-
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends curl \
-    && rm -rf /var/lib/apt/lists/*
-
-COPY --from=build /app/publish .
-
-ENV ASPNETCORE_URLS=http://+:8080
-EXPOSE 8080
-
-HEALTHCHECK --interval=5s --timeout=3s --start-period=10s --retries=5 \
-    CMD curl -fsS http://localhost:8080/health || exit 1
-
-ENTRYPOINT ["dotnet", "Acl.Api.dll"]

tests/acceptance/Acceptance.csproj

@@ -1,23 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <Nullable>enable</Nullable>
-    <IsPackable>false</IsPackable>
-  </PropertyGroup>
-
-  <ItemGroup>
-    <PackageReference Include="coverlet.collector" Version="6.0.4" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
-    <PackageReference Include="Reqnroll.xUnit" Version="3.3.4" />
-    <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <ProjectReference Include="..\..\services\acl\Acl.Application\Acl.Application.csproj" />
-    <ProjectReference Include="..\..\services\acl\Acl.Infrastructure\Acl.Infrastructure.csproj" />
-  </ItemGroup>
-
-</Project>

tests/acceptance/Features/EenZaakOpenen.feature

@@ -1,27 +0,0 @@
-# language: en
-# Drives S-04 (#5). The ACL is the only code that talks to ZGW (ADR-0001); it
-# default-fills the ZGW-mandatory zaak fields the domain never sees (ADR-0003).
-# Real-OpenZaak verification is a separate slice — this scenario exercises the
-# use case against an in-memory stand-in for the Zaken API.
-Feature: Een zaak openen vanuit een registratie
-  Als domein wil ik de ACL vragen een zaak te openen
-  zodat de ZGW-verplichte velden worden ingevuld zonder dat het domein ze kent.
-
-  Scenario: De ACL vult de ZGW-verplichte velden default in
-    Given a domain registration for BSN "123456782"
-    And the ACL is configured with these defaults:
-      | field                        | value                                         |
-      | bronorganisatie              | 517439943                                     |
-      | verantwoordelijkeOrganisatie | 517439943                                     |
-      | vertrouwelijkheidaanduiding  | openbaar                                      |
-      | zaaktype                     | http://openzaak/catalogi/api/v1/zaaktypen/big |
-    And today is "2026-06-04"
-    When the domain asks the ACL to open a zaak
-    Then a zaak is created with these default-filled fields
-      | field                        | value                                         |
-      | bronorganisatie              | 517439943                                     |
-      | verantwoordelijkeOrganisatie | 517439943                                     |
-      | vertrouwelijkheidaanduiding  | openbaar                                      |
-      | zaaktype                     | http://openzaak/catalogi/api/v1/zaaktypen/big |
-      | startdatum                   | 2026-06-04                                    |
-    And the ACL returns the URL of the created zaak

tests/acceptance/Steps/EenZaakOpenenSteps.cs

@@ -1,65 +0,0 @@
-using Acceptance.Support;
-using Acl.Application;
-using Reqnroll;
-using Xunit;
-
-namespace Acceptance.Steps;
-
-/// <summary>Bindings for <c>EenZaakOpenen.feature</c>. Reqnroll creates one
-/// instance per scenario, so instance fields hold scenario-scoped state.</summary>
-[Binding]
-public sealed class EenZaakOpenenSteps
-{
-    private readonly InMemoryZaakGateway _gateway = new();
-    private DomainRegistration? _registration;
-    private AclDefaults? _defaults;
-    private DateOnly _today;
-    private Uri? _returnedUrl;
-
-    [Given("a domain registration for BSN \"(.*)\"")]
-    public void GivenADomainRegistrationForBsn(string bsn)
-        => _registration = new DomainRegistration(bsn);
-
-    [Given("the ACL is configured with these defaults:")]
-    public void GivenTheAclIsConfiguredWithTheseDefaults(DataTable defaults)
-    {
-        var values = ToFieldMap(defaults);
-        _defaults = new AclDefaults
-        {
-            Bronorganisatie = values["bronorganisatie"],
-            VerantwoordelijkeOrganisatie = values["verantwoordelijkeOrganisatie"],
-            Vertrouwelijkheidaanduiding = values["vertrouwelijkheidaanduiding"],
-            ZaaktypeUrl = new Uri(values["zaaktype"]),
-        };
-    }
-
-    [Given("today is \"(.*)\"")]
-    public void GivenTodayIs(string date)
-        => _today = DateOnly.Parse(date);
-
-    [When("the domain asks the ACL to open a zaak")]
-    public async Task WhenTheDomainAsksTheAclToOpenAZaak()
-    {
-        var service = new AclService(_gateway, _defaults!, new FixedClock(_today));
-        _returnedUrl = await service.OpenZaakAsync(_registration!);
-    }
-
-    [Then("a zaak is created with these default-filled fields")]
-    public void ThenAZaakIsCreatedWithTheseDefaultFilledFields(DataTable expected)
-    {
-        var request = Assert.IsType<ZaakRequest>(_gateway.Captured);
-        var fields = ToFieldMap(expected);
-        Assert.Equal(fields["bronorganisatie"], request.Bronorganisatie);
-        Assert.Equal(fields["verantwoordelijkeOrganisatie"], request.VerantwoordelijkeOrganisatie);
-        Assert.Equal(fields["vertrouwelijkheidaanduiding"], request.Vertrouwelijkheidaanduiding);
-        Assert.Equal(fields["zaaktype"], request.Zaaktype.ToString());
-        Assert.Equal(fields["startdatum"], request.Startdatum.ToString("yyyy-MM-dd"));
-    }
-
-    [Then("the ACL returns the URL of the created zaak")]
-    public void ThenTheAclReturnsTheUrlOfTheCreatedZaak()
-        => Assert.Equal(InMemoryZaakGateway.CreatedZaakUrl, _returnedUrl);
-
-    private static Dictionary<string, string> ToFieldMap(DataTable table)
-        => table.Rows.ToDictionary(r => r["field"], r => r["value"]);
-}

tests/acceptance/Support/FixedClock.cs

@@ -1,10 +0,0 @@
-using Acl.Application;
-
-namespace Acceptance.Support;
-
-/// <summary>A clock pinned to a known date so <c>startdatum</c> is deterministic
-/// in scenarios (ADR-0003).</summary>
-public sealed class FixedClock(DateOnly today) : IClock
-{
-    public DateOnly Today { get; } = today;
-}

tests/acceptance/Support/InMemoryZaakGateway.cs

@@ -1,20 +0,0 @@
-using Acl.Application;
-
-namespace Acceptance.Support;
-
-/// <summary>An in-memory stand-in for the OpenZaak Zaken API. It captures the
-/// fully default-filled <see cref="ZaakRequest"/> the ACL builds and returns a
-/// fixed zaak URL, so the acceptance scenario can verify the use case without a
-/// running OpenZaak (real-OpenZaak verification is a separate slice).</summary>
-public sealed class InMemoryZaakGateway : IZaakGateway
-{
-    public static readonly Uri CreatedZaakUrl = new("http://openzaak/zaken/api/v1/zaken/created-123");
-
-    public ZaakRequest? Captured { get; private set; }
-
-    public Task<Uri> OpenZaakAsync(ZaakRequest request, CancellationToken ct = default)
-    {
-        Captured = request;
-        return Task.FromResult(CreatedZaakUrl);
-    }
-}