feat(infra): Open Notificaties up + shared network with OpenZaak (closes #2 )

Add infra/opennotificaties/docker-compose.yml (PostGIS db, redis broker, migrate-init, API, celery worker) on a shared `cg` network with the OpenZaak stack (renamed oz->cg), published on host :8001. Add combined `make stack-up/stack-smoke/stack-down` targets and a runbook. Completes S-01's acceptance: OpenZaak + Open Notificaties + Postgres come up in compose and a health check confirms all reachable (OZ 403/302/200, NRC 302; cross-network DNS verified). Catalogus seed landed in S-01-b. OZ->NRC notification *delivery* wiring (NRC setup_configuration: Services + Authorization + JWT + Kanalen + Abonnementen; OZ NotificationConfig; re- enabling NOTIFICATIONS_DISABLED) is deferred to S-06 (Event Subscriber), the slice that consumes events. NRC data.yaml is migrate-only until then. Verified: `make stack-smoke` green (both platforms reachable). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
feat(infra): seed BIG catalogus + JWT client for OpenZaak (refs #2 ) (#41 )
2026-06-03 15:58:51 +02:00 · 2026-06-03 13:42:44 +00:00 · 2026-06-03 13:16:31 +00:00 · 2026-06-03 12:13:32 +00:00 · 2026-06-03 12:09:24 +00:00 · 2026-06-03 12:04:19 +00:00
39 changed files with 1382 additions and 509 deletions
--- a/.gitea/ISSUE_TEMPLATE/adr-proposal.md
+++ b/.gitea/ISSUE_TEMPLATE/adr-proposal.md
@@ -0,0 +1,24 @@
 ---
 name: ADR proposal
 about: Propose a decision that needs recording before coding (CLAUDE.md §14)
 title: "ADR: "
 labels:
  - type:adr-proposal
 ---
 **Decision to be made:**
 **Context / forces:** <!-- what makes this non-obvious; constraints, trade-offs -->
 **Options considered:**
 1.
 2.
 **Proposed option + why:**
 **Consequences:** <!-- what becomes easier/harder; what we commit to -->
 **Coupling rules touched (CLAUDE.md §8):** <!-- none, or which and why -->
 > On acceptance, the ADR file (`docs/architecture/adr-NNNN-title.md`, Nygard
 > template) lands in the PR that implements the decision.
--- a/.gitea/ISSUE_TEMPLATE/bug.md
+++ b/.gitea/ISSUE_TEMPLATE/bug.md
@@ -0,0 +1,21 @@
 ---
 name: Bug
 about: Something behaves incorrectly
 title: ""
 labels:
  - type:bug
 ---
 **What happened:**
 **What you expected:**
 **Steps to reproduce:**
 1.
 2.
 **Environment:** <!-- branch/commit, OS, container engine, anything relevant -->
 **Logs / evidence:**
 **Suspected area:** <!-- e.g. area:bff, area:acl — add the matching area label -->
--- a/.gitea/ISSUE_TEMPLATE/slice.md
+++ b/.gitea/ISSUE_TEMPLATE/slice.md
@@ -0,0 +1,31 @@
 ---
 name: Slice (user story)
 about: A backlog slice — independently demoable, encodes the Definition of Done
 title: "S-NN · "
 labels:
  - type:slice
 ---
 **Outcome:** <!-- one sentence; user-visible if possible -->
 **Acceptance:**
 <!-- Gherkin scenarios or testable assertions -->
 -
 **Touches:** <!-- services and folders -->
 **Out of scope:** <!-- explicit non-goals -->
 ## Definition of Done
 - [ ] This linked Gitea issue exists and is on the right milestone.
 - [ ] Failing test written and committed first (`test(scope): … (refs #NN)`).
 - [ ] Implementation makes the test pass (`feat(scope): … (refs #NN)`).
 - [ ] Refactor commit follows if structure improved.
 - [ ] Conventional Commit messages referencing this issue.
 - [ ] All Gitea Actions CI jobs green (or `make ci` green while no runner exists).
 - [ ] `docker compose up` from a fresh clone reaches green health checks within 3 minutes.
 - [ ] Docs touched if behaviour, contracts, or operations changed.
 - [ ] ADR added in `docs/architecture/` if a non-obvious decision was made.
 - [ ] Demo note appended to `docs/demo-script.md` if the slice is user-visible.
 - [ ] This issue closed by the merging PR (`closes #NN`).
--- a/.gitea/PULL_REQUEST_TEMPLATE.md
+++ b/.gitea/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,23 @@
 <!-- Title: Conventional Commit style, e.g. feat(bff): … (closes #NN) -->
 ## What & why
 <!-- Summary of the change and the slice/bug it addresses. -->
 Closes #
 ## Definition of Done
 - [ ] Linked Gitea issue (above).
 - [ ] Failing test committed before the implementation.
 - [ ] Implementation makes the test pass; refactor commit if structure improved.
 - [ ] Conventional Commits referencing the issue (`refs #NN`).
 - [ ] CI green — all Gitea Actions jobs (or `make ci` green while no runner exists).
 - [ ] `docker compose up` from a fresh clone reaches green health checks within 3 minutes.
 - [ ] Docs updated if behaviour, contracts, or operations changed.
 - [ ] ADR added in `docs/architecture/` if a non-obvious decision was made.
 - [ ] Demo note in `docs/demo-script.md` if user-visible.
 ## Notes for reviewers
 <!-- Anything that helps review: trade-offs, follow-ups, known gaps. -->
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -0,0 +1,50 @@
 name: CI
 on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
 permissions:
  contents: read
 # Self-hosted runner — see docs/runbooks/ci.md for the runner setup.
 # `uses:` are absolute, tag-pinned URLs (CLAUDE.md §8.7 / §15).
 # Each job calls a `make` target — the same one developers run locally
 # (`make ci`). The Makefile is the single source of truth; see docs/runbooks/ci.md.
 jobs:
  lint:
    runs-on: respellion-linux
    steps:
      - uses: https://github.com/actions/checkout@v4
      - uses: https://github.com/actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'
      - run: make lint
  build:
    runs-on: respellion-linux
    steps:
      - uses: https://github.com/actions/checkout@v4
      - uses: https://github.com/actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'
      - run: make build
  unit:
    runs-on: respellion-linux
    steps:
      - uses: https://github.com/actions/checkout@v4
      - uses: https://github.com/actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'
      - run: make unit
  compose-smoke:
    runs-on: respellion-linux
    steps:
      - uses: https://github.com/actions/checkout@v4
      - run: make smoke
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1,31 @@
 # .NET build output
 bin/
 obj/
 [Dd]ebug/
 [Rr]elease/
 *.user
 # Test results / coverage
 [Tt]est[Rr]esults/
 *.trx
 coverage*.json
 coverage*.xml
 *.coverage
 # Rider / VS / VS Code
 .idea/
 .vs/
 .vscode/
 # Node / Angular (added as the frontend lands)
 node_modules/
 dist/
 .angular/
 # Python / MkDocs
 .venv/
 site/
 # OS
 .DS_Store
 Thumbs.db
--- a/BACKLOG.md
+++ b/BACKLOG.md
@@ -12,22 +12,41 @@ Each slice is **independently demoable** and meets the Definition of Done in `CL
 ## Iteration 0 — Foundations *(milestone: `Iteration 0 — Foundations`)*
-### S-00 · Repository skeleton, Gitea Actions CI, contributor workflow
+> **S-00 was split** (CLAUDE.md §13) into the sub-slices below. The original
 > outcome — a fresh clone + `docker compose up` reaching a green BFF health
 > endpoint, with CI green and the contributor scaffolding in place — is the sum
 > of S-00-a…e. The Gitea milestones, labels, and slice issues already exist —
 > they are managed directly with the `tea` CLI.
-**Outcome:** A fresh `git clone` from the Respellion Gitea remote, followed by `docker compose up`, produces a green "hello world" health endpoint from a placeholder BFF. Gitea Actions runs lint, build, unit tests, and the compose-up smoke test, all green. Issue templates, PR template, milestones, labels, and the first project board exist in Gitea.
+### S-00-a · Placeholder BFF + health endpoint
-**Acceptance:**
+**Outcome:** A minimal .NET BFF exposing `GET /health` returning green; runnable with `dotnet run`. TDD anchor for the slice.
- New developer follows `README.md` and reaches a green local environment in under 10 minutes.
+**Touches:** `services/bff/`, tests. **Out of scope:** Docker, CI, OIDC.
 - Gitea Actions pipeline green on `main`.
 - `git-cliff` produces an empty `CHANGELOG.md`.
 - `docs/PRD.md`, `CLAUDE.md`, `BACKLOG.md`, `docs/architecture/adr-0001-loose-coupling.md`, `docs/gitea-workflow.md` all in repo.
 - `.gitea/workflows/ci.yaml`, `.gitea/ISSUE_TEMPLATE/{slice,bug,adr-proposal}.md`, `.gitea/PULL_REQUEST_TEMPLATE.md` all in repo.
 - Gitea milestone `Iteration 1 — Walking Skeleton` exists, populated with issues S-01 through S-09.
-**Touches:** repo layout, Gitea Actions workflows, Dockerfile for placeholder BFF, `docker-compose.yml` skeleton, MkDocs scaffold, Gitea issue/PR templates.
+### S-00-b · Dockerfile + compose skeleton + compose-up smoke
-**Out of scope:** any business logic, frontend, OpenZaak.
+**Outcome:** BFF containerized; `infra/docker-compose.yml` brings it up; health green within 3 minutes from a fresh clone.
 **Touches:** `services/bff/Dockerfile`, `infra/docker-compose.yml`, smoke script. **Out of scope:** other services, CI.
 ### S-00-c · Gitea Actions CI (lint, build, unit, compose-up smoke)
 **Outcome:** `.gitea/workflows/ci.yaml` green on PRs and `main`: lint, build, unit, compose-up smoke. Actions pinned by absolute URL (§8.7/§15).
 **Touches:** `.gitea/workflows/ci.yaml`, `docs/runbooks/ci.md`. **Out of scope:** mutation, e2e, container push.
 ### S-00-d · Contributor workflow: issue/PR templates, git-cliff, CHANGELOG
 **Outcome:** Issue templates (`slice`/`bug`/`adr-proposal`), PR template, `git-cliff` → empty `CHANGELOG.md`, `docs/gitea-workflow.md`.
 **Touches:** `.gitea/ISSUE_TEMPLATE/`, `.gitea/PULL_REQUEST_TEMPLATE.md`, `cliff.toml`, `CHANGELOG.md`, `docs/gitea-workflow.md`. **Out of scope:** app code.
 ### S-00-e · Docs scaffold: MkDocs + ADR-0001 + README quickstart
 **Outcome:** MkDocs builds the `docs/` site; `docs/architecture/adr-0001-loose-coupling.md` exists; README has a sub-10-minute quickstart.
 **Touches:** `mkdocs.yml`, `docs/` nav, `docs/architecture/adr-0001-loose-coupling.md`, `README.md`. **Out of scope:** Gitea Pages publish.
 ---
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -0,0 +1,20 @@
 # Changelog
 All notable changes to this project. Generated from Conventional Commits by git-cliff.
 ## Unreleased
 ### CI
 - Gitea Actions pipeline + runner runbook (refs #30) (#37)
 ### Chores
 - Add idempotent Gitea backlog seeder
 - Remove bootstrap scripts from main (#35)
 ### Documentation
 - Split S-00 into sub-slices (refs #1) (#33)
 ### Features
 - Placeholder BFF + /health endpoint (closes #28) (#34)
 - Containerize BFF + compose-up smoke (closes #29) (#36)
--- a/112
+++ b/112
@@ -0,0 +1,112 @@
 # Developer + CI entrypoints.
 #
 # These targets are the single source of truth for the checks. The Gitea
 # Actions workflow (.gitea/workflows/ci.yaml) invokes the SAME targets, so
 # `make ci` locally runs exactly what the pipeline runs — no drift. Until a
 # self-hosted runner is registered, `make ci` is the gate (see docs/runbooks/ci.md).
 SLN        := services/bff/Bff.slnx
 COMPOSE    := infra/docker-compose.yml
 HEALTH_URL := http://localhost:8080/health
 OZ_COMPOSE  := infra/openzaak/docker-compose.yml
 OZ_BASE     := http://localhost:8000
 NRC_COMPOSE := infra/opennotificaties/docker-compose.yml
 NRC_BASE    := http://localhost:8001
 STACK_FILES := -f $(OZ_COMPOSE) -f $(NRC_COMPOSE)
 # On a rootless Podman dev box, point Docker CLI/Compose at the Podman socket —
 # but only if that socket exists and DOCKER_HOST isn't already set, so real
 # Docker hosts and CI runners are left untouched.
 PODMAN_SOCK := /run/user/$(shell id -u)/podman/podman.sock
 ifeq ($(wildcard $(PODMAN_SOCK)),$(PODMAN_SOCK))
 ifeq ($(origin DOCKER_HOST),undefined)
 export DOCKER_HOST := unix://$(PODMAN_SOCK)
 endif
 endif
 .PHONY: ci lint build unit smoke down changelog openzaak-up openzaak-smoke openzaak-seed openzaak-down stack-up stack-smoke stack-down help
 ## ci: run the full pipeline — lint, build, unit, smoke (mirrors Gitea Actions)
 ci: lint build unit smoke
 ## lint: verify formatting (no changes)
 lint:
 	dotnet format $(SLN) --verify-no-changes
 ## build: release build
 build:
 	dotnet build $(SLN) -c Release
 ## unit: run unit tests
 unit:
 	dotnet test $(SLN) -c Release
 ## smoke: compose up (wait for healthy), curl /health, then tear down
 smoke:
 	docker compose -f $(COMPOSE) up -d --build --wait
 	bash -c 'curl -fsS $(HEALTH_URL); rc=$$?; docker compose -f $(COMPOSE) down --volumes; exit $$rc'
 ## down: stop and remove the local stack
 down:
 	docker compose -f $(COMPOSE) down --volumes
 ## changelog: regenerate CHANGELOG.md from Conventional Commits (git-cliff)
 changelog:
 	git-cliff --output CHANGELOG.md
 ## openzaak-up: start the OpenZaak stack (migrations run on first start)
 openzaak-up:
 	docker compose -f $(OZ_COMPOSE) up -d
 ## openzaak-smoke: start OpenZaak, then assert it is up with auth enforced
 openzaak-smoke:
 	docker compose -f $(OZ_COMPOSE) up -d
 	@bash -c 'set -e; \
 	  echo "waiting for OpenZaak to respond..."; \
 	  for i in $$(seq 1 60); do \
 	    code=$$(curl -s -o /dev/null -w "%{http_code}" $(OZ_BASE)/zaken/api/v1/zaken || true); \
 	    [ -n "$$code" ] && [ "$$code" != "000" ] && break; sleep 3; \
 	  done; \
 	  echo "GET /zaken/api/v1/zaken (unauth) -> $$code (expect 403, auth enforced)"; test "$$code" = "403"; \
 	  admin=$$(curl -s -o /dev/null -w "%{http_code}" $(OZ_BASE)/admin/); \
 	  echo "GET /admin/             -> $$admin (expect 302)"; test "$$admin" = "302"; \
 	  root=$$(curl -s -o /dev/null -w "%{http_code}" $(OZ_BASE)/zaken/api/v1/); \
 	  echo "GET /zaken/api/v1/      -> $$root (expect 200)"; test "$$root" = "200"; \
 	  echo "OpenZaak smoke OK"'
 ## openzaak-seed: bring OpenZaak up and seed the BIG catalogus (idempotent)
 openzaak-seed: openzaak-up
 	@bash -c 'for i in $$(seq 1 50); do \
 	    c=$$(curl -s -o /dev/null -w "%{http_code}" $(OZ_BASE)/catalogi/api/v1/ || true); \
 	    [ "$$c" = "200" ] && break; sleep 3; done; echo "OpenZaak ready ($$c)"'
 	python3 infra/openzaak/seed_catalogus.py
 ## openzaak-down: stop and remove the OpenZaak stack (wipes data)
 openzaak-down:
 	docker compose -f $(OZ_COMPOSE) down --volumes
 ## stack-up: start OpenZaak + Open Notificaties together (shared network)
 stack-up:
 	docker compose $(STACK_FILES) up -d
 ## stack-smoke: start both, assert OpenZaak (403/302/200) and NRC (302) are reachable
 stack-smoke: stack-up
 	@bash -c 'set -e; \
 	  echo "waiting for OpenZaak + Open Notificaties..."; \
 	  for i in $$(seq 1 60); do \
 	    oz=$$(curl -s -o /dev/null -w "%{http_code}" $(OZ_BASE)/admin/ || true); \
 	    nrc=$$(curl -s -o /dev/null -w "%{http_code}" $(NRC_BASE)/admin/ || true); \
 	    [ "$$oz" = "302" ] && [ "$$nrc" = "302" ] && break; sleep 3; done; \
 	  z=$$(curl -s -o /dev/null -w "%{http_code}" $(OZ_BASE)/zaken/api/v1/zaken); \
 	  echo "OpenZaak /zaken (unauth) -> $$z (expect 403)"; test "$$z" = "403"; \
 	  echo "OpenZaak /admin/         -> $$oz (expect 302)"; test "$$oz" = "302"; \
 	  echo "Open Notificaties /admin/-> $$nrc (expect 302)"; test "$$nrc" = "302"; \
 	  echo "stack smoke OK"'
 ## stack-down: stop and remove both stacks (wipes data)
 stack-down:
 	docker compose $(STACK_FILES) down --volumes
 ## help: list available targets
 help:
 	@grep -E '^## ' $(MAKEFILE_LIST) | sed 's/^## //'
--- a/README.md
+++ b/README.md
@@ -41,22 +41,32 @@ For the architecture rationale, see [docs/PRD.md §3](docs/PRD.md) and [docs/arc
 **Prerequisites**
- Docker Engine (or Docker Desktop) with Compose v2
+- .NET 10 SDK (for `make lint/build/unit`)
- ~8 GB free RAM, ~10 GB free disk
+- A container engine with Compose v2 — Docker, or rootless Podman (see [docs/runbooks/ci.md](docs/runbooks/ci.md) for the Podman + Compose-provider setup)
- Bash or PowerShell
+- `make`, `curl`, `git`
 - ~4 GB free RAM, ~5 GB free disk (grows as services land)
-**Bring the stack up**
+**Clone**
 ```bash
-git clone https://gitea.respellion.local/respellion/register-reference.git
+git clone git@git.labs.respellion.tech:eho/register-referentie.git
-cd register-reference
+cd register-referentie
 cp .env.example .env          # edit if you change ports
 docker compose -f infra/docker-compose.yml up -d
 ```
-Health checks should be green within ~3 minutes on a developer machine. If something fails, see [docs/runbooks/local-startup.md](docs/runbooks/local-startup.md).
+**Wired today (Iteration 0):** only the placeholder BFF exists so far. Get to green in under 10 minutes — run the full check gate, or just the running service:
-**Default URLs**
+```bash
 make ci          # lint + build + unit + container smoke — the CI gate
 ```
 ```bash
 docker compose -f infra/docker-compose.yml up -d --build --wait
 curl http://localhost:8080/health     # -> Healthy
 ```
 `--wait` exits non-zero unless the container reports healthy, so it doubles as the compose-up smoke test. The remaining services and the URLs below land in later slices.
 **Target service URLs** *(most land in later slices)*
 | Service | URL |
 |---|---|
@@ -64,7 +74,7 @@ Health checks should be green within ~3 minutes on a developer machine. If somet
 | Openbaar register | http://localhost:4201 |
 | Behandel-portal | http://localhost:4202 |
 | Beheer-portal | http://localhost:4203 |
-| BFF | http://localhost:5000 |
+| BFF | http://localhost:8080 |
 | OpenZaak | http://localhost:8000 |
 | Open Notificaties | http://localhost:8001 |
 | Flowable | http://localhost:8080 |
@@ -73,10 +83,12 @@ Health checks should be green within ~3 minutes on a developer machine. If somet
 Test credentials, BSNs, and personas: see [docs/synthetic-data.md](docs/synthetic-data.md).
-**Re-seed synthetic data**
+**Build the docs site**
 ```bash
-./tools/seed.sh               # or pwsh ./tools/seed.ps1
+python3 -m venv .venv && .venv/bin/pip install mkdocs-material
 .venv/bin/mkdocs serve         # live preview at http://localhost:8000
 .venv/bin/mkdocs build         # static site in ./site
 ```
 ---
--- a/cliff.toml
+++ b/cliff.toml
@@ -0,0 +1,45 @@
 # git-cliff configuration — generates CHANGELOG.md from Conventional Commits.
 # Run via `make changelog`. See https://git-cliff.org.
 [changelog]
 header = """
 # Changelog
 All notable changes to this project. Generated from Conventional Commits by git-cliff.\n
 """
 body = """
 {% if version %}\
 ## {{ version }} — {{ timestamp | date(format="%Y-%m-%d") }}
 {% else %}\
 ## Unreleased
 {% endif %}\
 {% for group, commits in commits | group_by(attribute="group") %}
 ### {{ group | upper_first }}
 {% for commit in commits %}\
 - {{ commit.message | upper_first }}{% if commit.breaking %} **[BREAKING]**{% endif %}
 {% endfor %}\
 {% endfor %}\n
 """
 trim = true
 [git]
 conventional_commits = true
 filter_unconventional = true
 split_commits = false
 protect_breaking_commits = true
 tag_pattern = "v[0-9]*"
 # CalVer tags: YYYY.MM.PATCH
 filter_commits = false
 commit_parsers = [
  { message = "^feat", group = "Features" },
  { message = "^fix", group = "Bug Fixes" },
  { message = "^perf", group = "Performance" },
  { message = "^refactor", group = "Refactor" },
  { message = "^docs", group = "Documentation" },
  { message = "^test", group = "Tests" },
  { message = "^ci", group = "CI" },
  { message = "^build", group = "Build" },
  { message = "^arch", group = "Architecture" },
  { message = "^chore", group = "Chores" },
  { message = ".*", group = "Other" },
 ]
--- a/docs/PRD.md
+++ b/docs/PRD.md
@@ -85,7 +85,7 @@ The five flows form the BDD acceptance backbone (Gherkin scenarios in `tests/acc
 - **Source control & collaboration:** **Gitea** (Respellion self-hosted) — repository, issues, milestones, labels, projects, releases, container registry, wiki, packages.
 - **CI/CD:** **Gitea Actions** running on Respellion-hosted `act_runner` instances. Workflow files live in `.gitea/workflows/`. Marketplace actions are referenced via absolute URLs (`uses: https://github.com/actions/checkout@v4` or Gitea-hosted equivalents where available) for reproducibility.
- **Backend:** .NET 9 (LTS at iteration time), C#, minimal APIs for BFF, MediatR for in-process messaging within Domain Service, EF Core for the projection store and domain DB.
+- **Backend:** .NET 10 (LTS at iteration time), C#, minimal APIs for BFF, MediatR for in-process messaging within Domain Service, EF Core for the projection store and domain DB.
 - **Frontend:** Angular (latest LTS) + TypeScript, standalone components + signals, Nx monorepo, NL Design System component library, Angular Testing Library + Playwright.
 - **Workflow:** Flowable (BPMN + DMN) via Docker image; Postgres for engine store.
 - **Identity:** Keycloak with pre-seeded realms.
--- a/docs/architecture/adr-0001-loose-coupling.md
+++ b/docs/architecture/adr-0001-loose-coupling.md
@@ -0,0 +1,58 @@
 # ADR-0001: Loose coupling to upstream Common Ground modules
 - **Status:** Accepted
 - **Date:** 2026-06-03
 - **Deciders:** Respellion engineering
 - **Template note:** This is the first ADR and doubles as the worked example of
  the Nygard template. Copy its shape for new ADRs (`adr-NNNN-title.md`).
 ## Context
 This reference application orchestrates several upstream Common Ground modules —
 OpenZaak (ZGW APIs), Open Notificaties (NRC), Objecten/Objecttypen, Flowable,
 Keycloak. Each is an independently developed, independently deployed peer. The
 temptation in a demo is to reach straight into a peer's database or couple to its
 internal schema to move faster. That coupling is exactly what makes Common Ground
 landscapes brittle and un-upgradeable in practice.
 We need a stance, recorded up front, on how our services may talk to these peers.
 ## Decision
 **We integrate with upstream modules only through their documented public APIs, and
 we isolate that integration behind explicit anti-corruption boundaries.**
 Concretely (mirrors CLAUDE.md §8):
 1. The **ACL** is the only code that talks to ZGW APIs; no other service constructs
   ZGW URLs.
 2. The **Workflow Client** is the only code that talks to Flowable; BPMN models hold
   no OpenZaak knowledge.
 3. **Portals talk only to the BFF** — never directly to a backend or a peer module.
 4. **No direct database access across services or to any peer.** Each service owns
   its schema; the Read Projection is a rebuildable derived artefact.
 5. **Idempotency at every event boundary** (the Event Subscriber tolerates duplicate
   and out-of-order NRC events).
 Bending any of these is an ADR-worthy moment (CLAUDE.md §14): stop and open an
 `adr-proposal` issue first.
 ## Consequences
 **Positive**
 - Upstream modules can be upgraded or swapped behind their APIs without rippling
  through our services.
 - Coupling is visible and minimal — anti-corruption code lives in one named place.
 - The architecture teaches the Common Ground pattern by enforcing it.
 **Negative / costs**
 - More indirection: a translation layer (ACL, Workflow Client) instead of direct
  calls. Accepted — it's the point.
 - Eventual consistency across aggregates must be designed for, not assumed away.
 **Follow-up**
 - Each integration slice that touches a boundary references this ADR; new boundary
  decisions get their own ADR.
--- a/docs/architecture/adr-0002-catalogus-design.md
+++ b/docs/architecture/adr-0002-catalogus-design.md
@@ -0,0 +1,53 @@
 # ADR-0002: BIG catalogus design and OpenZaak seeding
 - **Status:** Accepted
 - **Date:** 2026-06-03
 - **Deciders:** Respellion engineering
 - **Relates to:** S-01 (#2)
 ## Context
 S-01 needs a reproducible `BIG` catalogus in OpenZaak with a **lean** `BIG-registratie`
 zaaktype (only schema-mandatory fields) plus a `bsn` eigenschap, and a JWT client that
 can list zaaktypen. We had to decide *how* to provision this idempotently at startup.
 Findings from the OpenZaak image (`openzaak/open-zaak:latest`):
 - `setup_configuration` (run by the init container) is declarative and idempotent, with
  steps for **JWT secrets** and **applicaties** (`vng_api_common_credentials`,
  `vng_api_common_applicaties`) — but **no step for catalogi/zaaktypen**.
 - Catalogus/zaaktype/eigenschap can only be created through the **ZTC REST API**.
 - Publishing a zaaktype requires ≥1 roltype, ≥1 resultaattype and ≥2 statustypen.
 ## Decision
 1. **Provision the JWT client declaratively** via `infra/openzaak/setup_configuration/data.yaml`:
   a `JWTSecret` (`big-reference-seed` / dev secret) and an `Applicatie` with
   `heeft_alle_autorisaties: true`. Idempotent, runs in the init container.
 2. **Seed the catalogus/zaaktype/eigenschap via the ZTC API** with an idempotent,
   stdlib-only script (`infra/openzaak/seed_catalogus.py`, `make openzaak-seed`). It mints
   a ZGW JWT from the provisioned client and matches existing objects (by `domein` /
   `identificatie` / `naam`, querying `status=alles` so concepts are seen) before creating.
 3. **Keep the zaaktype a CONCEPT (not published).** Publishing pulls in roltypen,
   statustypen and resultaattypen, which go beyond "schema-mandatory"; those arrive with
   the workflow/zaak slices that actually need a published type. Listing uses `status=alles`.
 4. **Disable outbound notifications** (`NOTIFICATIONS_DISABLED=true`) until Open Notificaties
   (NRC) lands in S-01-c — otherwise every ZTC write 500s trying to notify.
 5. **Fixed dev values:** RSIN `517439943` (elfproef-valid test value); the JWT secret is
   dev-only and documented as such.
 ## Consequences
 - **Reproducible & version-robust:** the API-driven seed doesn't depend on fixture PKs or
  a catalogi `setup_configuration` step that may change between versions.
 - **Teaches the pattern:** the seed talks to OpenZaak exactly the way the ACL will later —
  through the documented ZGW API, with a JWT (ADR-0001).
 - The seed is a script, but a **data loader is explicitly anticipated** (PRD §8); it lives
  under `infra/openzaak/`, not as ad-hoc tooling.
 - **Follow-ups:** re-enable notifications when NRC is up (S-01-c); publish the zaaktype (add
  the related types) when a slice needs to create real zaken; pin the OpenZaak image tag.
 ## Alternatives considered
 - **Fully declarative in `data.yaml`** — rejected: no catalogi/zaaktype step exists.
 - **Django `loaddata` fixture** — rejected: brittle, tied to model PKs and the exact image
  version; bypasses the API the rest of the system uses.
--- a/docs/gitea-workflow.md
+++ b/docs/gitea-workflow.md
@@ -0,0 +1,52 @@
 # Working with Gitea: issues, milestones, PRs
 Gitea is the **system of record** (CLAUDE.md §7). `BACKLOG.md` is a human-readable
 mirror of the active milestone — when they disagree, Gitea wins.
 ## Issues
 - Open issues from the templates in `.gitea/ISSUE_TEMPLATE/`:
  - **Slice** — a backlog user story (`S-NN · …`), encodes the Definition of Done.
  - **Bug** — a defect.
  - **ADR proposal** — a decision to record before coding (CLAUDE.md §14).
 - Every issue gets `type:*` plus the relevant `area:*` label(s), and is assigned to
  its iteration **milestone** (`Iteration N — …`).
 - Splitting a slice that grew too big: see CLAUDE.md §13 and the "How to split a
  slice" section of `BACKLOG.md`.
 ## Branches & commits
 - Trunk-based: short-lived branches off `main`, squash-merged. Never push to `main`.
 - Branch name: `<type>/<issue-number>-<slug>`, e.g. `feat/28-bff-health`.
 - Conventional Commits, each referencing its issue: `feat(bff): … (refs #28)`.
 - TDD order: the `test(...)` red commit precedes the `feat(...)` green commit.
 ## Pull requests
 - Open with `tea pr create` (the Gitea CLI) or the web UI; the body uses
  `.gitea/PULL_REQUEST_TEMPLATE.md` and its DoD checklist.
 - The merging PR closes its issue via `closes #NN` in the squash-commit body.
  Work that isn't finished (e.g. CI green pending a runner) uses `refs #NN` and the
  issue stays open.
 - A PR needs a linked issue. Don't open one without it.
 ## CI gate
 Until a self-hosted `respellion-linux` runner is registered, `make ci` is the gate
 (it runs the same checks the workflow does). See [runbooks/ci.md](runbooks/ci.md).
 ## CLI cheatsheet (`tea`)
 ```bash
 tea issues list --state open          # backlog
 tea issue create --title "S-NN · …" --labels type:slice,area:bff --milestone "Iteration 1 — Walking Skeleton"
 tea pr create --base main --head <branch> --title "…" --description "… closes #NN"
 tea pr list                           # open PRs
 tea pr merge <n> --style squash       # merge (after review)
 ```
 ## Changelog & releases
 `CHANGELOG.md` is generated from commits by `git-cliff` (`make changelog`), refreshed
 on tag. Versioning is **CalVer** `YYYY.MM.PATCH`; releases are published via Gitea
 Releases.
--- a/docs/index.md
+++ b/docs/index.md
@@ -0,0 +1,23 @@
 # register-referentie
 A reference application demonstrating Respellion's Common Ground architecture
 pattern. Quality and architectural clarity over feature throughput — every commit
 should teach.
 ## Where to go
 - **[Product Requirements](PRD.md)** — what we're building and why.
 - **[ADR-0001: Loose coupling](architecture/adr-0001-loose-coupling.md)** — the
  non-negotiable integration stance; the template for future ADRs.
 - **[Working in Gitea](gitea-workflow.md)** — issues, milestones, branches, PRs.
 - **[CI runbook](runbooks/ci.md)** — the pipeline and the `make ci` local gate.
 ## Quickstart
 See the repository `README.md`. In short: clone, then either run the checks with
 `make ci`, or bring the BFF up with
 `docker compose -f infra/docker-compose.yml up -d --build --wait` and
 `curl http://localhost:8080/health`.
 > This site is built with MkDocs Material (`mkdocs build`). It grows with the
 > backlog; sections appear as their slices land.
--- a/docs/runbooks/ci.md
+++ b/docs/runbooks/ci.md
@@ -0,0 +1,104 @@
 # CI runbook — Gitea Actions
 > **Status: no runner yet → run CI locally with `make ci`.** The workflow
 > `.gitea/workflows/ci.yaml` is in place, but the pipeline cannot go green until a
 > self-hosted `respellion-linux` runner is registered against the Gitea instance.
 > Until then, **`make ci` is the gate** — it runs the exact same checks locally
 > (the workflow calls the same `make` targets). Issue **#30 (S-00-c)** stays open
 > until CI is verified green on a runner.
 ## The pipeline
 `.gitea/workflows/ci.yaml` runs on every push and pull request to `main`. Each job
 calls a `make` target — the **single source of truth** for the checks, so local
 and CI cannot drift:
 | Job | Target | Needs |
 |---|---|---|
 | `lint` | `make lint` → `dotnet format … --verify-no-changes` | .NET 10 SDK |
 | `build` | `make build` → `dotnet build … -c Release` | .NET 10 SDK |
 | `unit` | `make unit` → `dotnet test … -c Release` | .NET 10 SDK |
 | `compose-smoke` | `make smoke` → compose up `--wait` → `curl /health` → `down` | container engine + compose v2 |
 All `uses:` references are absolute, tag-pinned URLs (`https://github.com/actions/checkout@v4`,
 `https://github.com/actions/setup-dotnet@v4`) per CLAUDE.md §8.7 and §15 — Gitea
 Actions resolves them from GitHub.
 ## Running CI locally (`make ci`)
 Until the runner exists, run the full pipeline yourself before pushing:
 ```bash
 make ci          # lint + build + unit + smoke — what the pipeline runs
 make lint        # or a single stage
 make smoke       # compose up --wait, curl /health, tear down
 ```
 **Prerequisites:** .NET 10 SDK, a container engine with Compose v2, and `curl`.
 On a **rootless Podman** box (the default dev setup here), the `smoke` target needs
 the Podman API socket and a Compose provider:
 ```bash
 systemctl --user enable --now podman.socket            # start the API socket
 ln -sf "$(command -v podman)" ~/.local/bin/docker      # docker -> podman shim
 # install Docker Compose v2 into ~/.local/bin as `docker-compose` (the provider)
 ```
 The Makefile auto-points `DOCKER_HOST` at `/run/user/$(id -u)/podman/podman.sock`
 when that socket exists and `DOCKER_HOST` is unset, so `make smoke` "just works"
 locally while leaving real Docker hosts / CI runners untouched.
 ## Runner: `respellion-linux`
 The single self-hosted runner label this repo targets is **`respellion-linux`**
 (declared here per §15). It is intended to run **co-located on the Gitea server**
 (`git.labs.respellion.tech` / `46.224.220.37`) so CI is durable and independent of
 any developer machine.
 ### Host prerequisites
 The runner executes jobs in **host mode** (see registration below), so the host
 must have, on `PATH`:
 - .NET 10 SDK (or let `setup-dotnet` install it into the runner tool cache)
 - A container engine with Compose v2 — Docker, or Podman with the Docker-compatible
  socket and the `docker-compose` provider (as configured on the dev box)
 - `curl`
 ### Install & register `act_runner` (on the Gitea server)
 ```bash
 # 1. Install the binary (pick the version matching the Gitea release line)
 VER=0.2.11
 curl -fsSL -o /usr/local/bin/act_runner \
  "https://dl.gitea.com/act_runner/${VER}/act_runner-${VER}-linux-amd64"
 chmod +x /usr/local/bin/act_runner
 # 2. Obtain a registration token from the Gitea UI:
 #    Site Administration → Actions → Runners → "Create new Runner"  (instance-level)
 #    (or Repo → Settings → Actions → Runners for a repo-scoped runner)
 # 3. Register with the respellion-linux label in HOST execution mode.
 #    The ":host" suffix means jobs run directly on the host shell, so
 #    `docker compose` in compose-smoke uses the host engine (no docker-in-docker).
 act_runner register --no-interactive \
  --instance https://git.labs.respellion.tech \
  --token <REGISTRATION_TOKEN> \
  --name respellion-ci-1 \
  --labels "respellion-linux:host"
 # 4. Run it (foreground to verify, then install as a systemd service)
 act_runner daemon
 ```
 Verify in the Gitea UI (Actions → Runners) that `respellion-ci-1` shows **Idle**,
 then re-run the `CI` workflow; all four jobs should pass.
 ## Security note
 A self-hosted runner in **host mode** executes workflow code directly on the Gitea
 server host. Anyone who can push a workflow can run code there. This is acceptable
 for a **private lab** instance with trusted contributors. For anything
 internet-facing, switch to container/VM isolation (`--labels "respellion-linux:docker://..."`)
 or a dedicated runner host, and gate workflow runs on approval for outside PRs.
--- a/docs/runbooks/opennotificaties.md
+++ b/docs/runbooks/opennotificaties.md
@@ -0,0 +1,44 @@
 # Open Notificaties (NRC) runbook
 The Open Notificaties stack (`infra/opennotificaties/docker-compose.yml`) is a lean
 adaptation of the upstream dev compose: PostGIS db, redis (also the Celery broker), a
 one-shot migrate-init, the API, and a celery worker. It shares the **`cg`** Docker
 network with the OpenZaak stack so the two can reach each other by service name.
 NRC is published on host **:8001** (OpenZaak holds :8000).
 ## Quick test (`make`) — both platforms together
 ```bash
 make stack-up      # OpenZaak + Open Notificaties on the shared network
 make stack-smoke   # start both + assert reachable (OZ 403/302/200, NRC 302)
 make stack-down    # stop + wipe both
 ```
 `make stack-smoke` runs `docker compose -f infra/openzaak/... -f infra/opennotificaties/... up -d`
 and asserts:
 | Check | Expected |
 |---|---|
 | OpenZaak `GET /zaken/api/v1/zaken` (no JWT) | 403 (auth enforced) |
 | OpenZaak `GET /admin/` | 302 |
 | Open Notificaties `GET /admin/` | 302 |
 NRC admin UI: <http://localhost:8001/admin/> (dev superuser **admin / admin**).
 ## Notification wiring is deferred to S-06
 Both platforms are **up and reachable**, but OpenZaak→NRC notification *delivery* is not
 wired yet, and OpenZaak still runs with `NOTIFICATIONS_DISABLED=true`. The bidirectional
 auth wiring (NRC `setup_configuration`: Services + Authorization to OpenZaak's
 Autorisaties API + JWT secrets + Kanalen + Abonnementen; OpenZaak's NotificationConfig)
 lands with **S-06 (Event Subscriber)** — the slice that actually consumes events. NRC's
 `setup_configuration/data.yaml` is intentionally minimal (migrations only) until then.
 This matches S-01's acceptance, which asks only that the platforms *come up in compose*
 and a health check confirms them reachable.
 ## Prerequisites
 Same rootless-Podman setup as the rest of the repo — see [ci.md](ci.md) and
 [openzaak.md](openzaak.md). `systemctl --user start podman.socket` once per session.
--- a/docs/runbooks/openzaak.md
+++ b/docs/runbooks/openzaak.md
@@ -0,0 +1,75 @@
 # OpenZaak runbook
 The OpenZaak stack (`infra/openzaak/docker-compose.yml`) is a lean adaptation of the
 upstream open-zaak dev compose: PostGIS db, redis, a one-shot init that runs
 migrations, the OpenZaak API, and a celery worker.
 ## Quick test (`make`)
 ```bash
 make openzaak-up       # start the stack (first run pulls images + migrates: 1-3 min)
 make openzaak-smoke    # start + assert it's up with auth enforced (403/302/200)
 make openzaak-seed     # start + seed the BIG catalogus (idempotent)
 make openzaak-down     # stop and wipe data
 ```
 ## Seed the BIG catalogus
 `make openzaak-seed` brings the stack up and runs `infra/openzaak/seed_catalogus.py`,
 which creates (idempotently, via the ZTC API):
 - catalogus **BIG**
 - a lean **BIG-REGISTRATIE** zaaktype (concept; only schema-mandatory fields)
 - a **bsn** eigenschap on it
 then confirms the JWT client can list it. See **ADR-0002** for the design (why the
 zaaktype stays a concept, why notifications are disabled, why the API not a fixture).
 **JWT client** (provisioned declaratively by `setup_configuration/data.yaml`, **dev only**):
 | | |
 |---|---|
 | client_id | `big-reference-seed` |
 | secret | `insecure-dev-secret-change-me` |
 | authorizations | `heeft_alle_autorisaties` (all) |
 The seed mints a ZGW JWT (HS256) from these and calls `/catalogi/api/v1/...`.
 `make openzaak-smoke` polls until the API responds, then asserts:
 | Check | Expected |
 |---|---|
 | `GET /zaken/api/v1/zaken` (no JWT) | **403** — `PermissionDenied` ZGW fout (auth enforced) |
 | `GET /admin/` | **302** — admin login redirect |
 | `GET /zaken/api/v1/` | **200** — ZGW API schema root |
 > **403, not 401.** OpenZaak's ZGW APIs return `403 PermissionDenied` for a missing
 > or invalid JWT. The S-01 acceptance text says "401" — that's inaccurate; 403 is the
 > correct auth-enforced response.
 The admin UI is at <http://localhost:8000/admin/>; the dev superuser is **admin /
 admin** (from the compose env — dev only).
 ## Prerequisites (rootless Podman)
 Same setup as the rest of the repo (see [ci.md](ci.md)):
 ```bash
 systemctl --user start podman.socket    # the Docker-API socket the shim talks to
 ```
 The Makefile auto-points `DOCKER_HOST` at the Podman socket when it exists, so the
 `make openzaak-*` targets work without extra env.
 ## Notes
 - **Not in `make ci`.** The OpenZaak smoke is a separate, heavier check (large image
  pull + migrations); it is intentionally kept out of `make ci` so the core gate
  stays fast. Run `make openzaak-smoke` when you touch the OpenZaak stack.
 - **Notifications disabled.** `NOTIFICATIONS_DISABLED=true` — otherwise ZTC writes 500
  trying to notify. Open Notificaties is now up (see [opennotificaties.md](opennotificaties.md)),
  but OZ→NRC delivery wiring + re-enabling lands with **S-06**.
 - **Zaaktype is a concept**, not published (publishing needs roltypen/statustypen/
  resultaattypen — beyond the lean seed). List with `?status=alles`.
 - **Image tag.** Currently `openzaak/open-zaak:latest` via `${OPENZAAK_TAG}`; pin to
  a known-good tag (ADR-0002 follow-up).
--- a/global.json
+++ b/global.json
@@ -0,0 +1,6 @@
 {
  "sdk": {
    "version": "10.0.203",
    "rollForward": "latestFeature"
  }
 }
--- a/infra/docker-compose.yml
+++ b/infra/docker-compose.yml
@@ -0,0 +1,19 @@
 # Local development stack. Grows service-by-service with each slice.
 # S-00-b: the placeholder BFF with a /health check.
 #
 #   docker compose -f infra/docker-compose.yml up -d --build --wait
 #   curl http://localhost:8080/health   # -> Healthy
 services:
  bff:
    build:
      context: ../services/bff
      dockerfile: Dockerfile
    image: register-referentie/bff:dev
    ports:
      - "8080:8080"
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s
--- a/infra/opennotificaties/docker-compose.yml
+++ b/infra/opennotificaties/docker-compose.yml
@@ -0,0 +1,91 @@
 # Open Notificaties (NRC) stack (S-01-c). Lean adaptation of the upstream dev compose:
 # db (PostGIS) + redis (also the Celery broker) + migrate-init + the API + a celery worker.
 #
 # Shares the `cg` network with the OpenZaak stack so the two can reach each other.
 # Run BOTH together (NRC needs OpenZaak's Autorisaties API for auth wiring):
 #
 #   docker compose -f infra/openzaak/docker-compose.yml -f infra/opennotificaties/docker-compose.yml up -d
 #   curl -s -o /dev/null -w '%{http_code}\n' http://localhost:8001/admin/   # -> 302
 #
 # NRC is published on host :8001 (OpenZaak holds :8000).
 services:
  nrc-db:
    image: docker.io/postgis/postgis:17-3.5
    environment:
      POSTGRES_USER: opennotificaties
      POSTGRES_PASSWORD: opennotificaties
      POSTGRES_DB: opennotificaties
    command: postgres -c max_connections=300
    volumes:
      - nrc-db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U opennotificaties -d opennotificaties"]
      interval: 5s
      timeout: 3s
      retries: 10
    networks: [cg]
  nrc-redis:
    image: docker.io/library/redis:7
    networks: [cg]
  nrc-init:
    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-latest}
    environment: &nrc-env
      DJANGO_SETTINGS_MODULE: nrc.conf.docker
      SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production}
      DB_HOST: nrc-db
      DB_NAME: opennotificaties
      DB_USER: opennotificaties
      DB_PASSWORD: opennotificaties
      IS_HTTPS: "no"
      ALLOWED_HOSTS: "*"
      CACHE_DEFAULT: nrc-redis:6379/0
      CACHE_AXES: nrc-redis:6379/0
      CELERY_BROKER_URL: redis://nrc-redis:6379/1
      CELERY_RESULT_BACKEND: redis://nrc-redis:6379/1
      DISABLE_2FA: "true"
      OPENNOTIFICATIES_SUPERUSER_USERNAME: admin
      DJANGO_SUPERUSER_PASSWORD: admin
      OPENNOTIFICATIES_SUPERUSER_EMAIL: admin@localhost
      RUN_SETUP_CONFIG: "true"
    command: /setup_configuration.sh
    volumes:
      - ./setup_configuration:/app/setup_configuration:ro,z
    depends_on:
      nrc-db:
        condition: service_healthy
      nrc-redis:
        condition: service_started
    networks: [cg]
  nrc-web:
    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-latest}
    environment: *nrc-env
    healthcheck:
      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s
    ports:
      - "8001:8000"
    depends_on:
      nrc-init:
        condition: service_completed_successfully
    networks: [cg]
  nrc-celery:
    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-latest}
    environment: *nrc-env
    command: /celery_worker.sh
    depends_on:
      nrc-init:
        condition: service_completed_successfully
    networks: [cg]
 volumes:
  nrc-db:
 networks:
  cg:
--- a/infra/opennotificaties/setup_configuration/data.yaml
+++ b/infra/opennotificaties/setup_configuration/data.yaml
@@ -0,0 +1,5 @@
 # Open Notificaties setup_configuration.
 # Stage 1 (this commit): intentionally minimal — the init container runs
 # migrations; no steps enabled yet. The OpenZaak<->NRC notification wiring
 # (Services, Authorization, JWT, Kanalen) is added next. See ADR-0002 / S-01-c.
 {}
--- a/infra/openzaak/docker-compose.yml
+++ b/infra/openzaak/docker-compose.yml
@@ -0,0 +1,95 @@
 # OpenZaak stack (S-01). Lean adaptation of the upstream open-zaak dev compose:
 # db (PostGIS) + redis + a one-shot init (migrations) + the API + a celery worker.
 # Dropped from upstream for leanness: nginx, celery-beat, flower, OTEL.
 #
 #   docker compose -f infra/openzaak/docker-compose.yml up -d --wait
 #   curl -i http://localhost:8000/zaken/api/v1/zaken   # -> 401 (auth required)
 #
 # NOTE: image pinned to a tag (not :latest) once a known-good tag is chosen; see
 # the catalogus-design ADR. Using a tag var with a sensible default for now.
 services:
  oz-db:
    image: docker.io/postgis/postgis:17-3.5
    environment:
      POSTGRES_USER: openzaak
      POSTGRES_PASSWORD: openzaak
      POSTGRES_DB: openzaak
    command: postgres -c max_connections=300
    volumes:
      - oz-db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U openzaak -d openzaak"]
      interval: 5s
      timeout: 3s
      retries: 10
    networks: [cg]
  oz-redis:
    image: docker.io/library/redis:7
    networks: [cg]
  oz-init:
    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
    environment: &oz-env
      DJANGO_SETTINGS_MODULE: openzaak.conf.docker
      SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production}
      DB_HOST: oz-db
      DB_NAME: openzaak
      DB_USER: openzaak
      DB_PASSWORD: openzaak
      IS_HTTPS: "no"
      ALLOWED_HOSTS: "*"
      CACHE_DEFAULT: oz-redis:6379/0
      CACHE_AXES: oz-redis:6379/0
      CELERY_BROKER_URL: redis://oz-redis:6379/1
      CELERY_RESULT_BACKEND: redis://oz-redis:6379/1
      DISABLE_2FA: "true"
      # Notifications go to Open Notificaties (NRC), which arrives in S-01-c.
      # Until then, disable outbound notifications so writes don't 500.
      NOTIFICATIONS_DISABLED: "true"
      OPENZAAK_SUPERUSER_USERNAME: admin
      DJANGO_SUPERUSER_PASSWORD: admin
      OPENZAAK_SUPERUSER_EMAIL: admin@localhost
      RUN_SETUP_CONFIG: "true"
    command: /setup_configuration.sh
    volumes:
      # :z relabels for SELinux; the dir/file must be world-readable for the
      # container user (rootless Podman uid mapping). See docs/runbooks/openzaak.md.
      - ./setup_configuration:/app/setup_configuration:ro,z
    depends_on:
      oz-db:
        condition: service_healthy
      oz-redis:
        condition: service_started
    networks: [cg]
  openzaak:
    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
    environment: *oz-env
    healthcheck:
      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s
    ports:
      - "8000:8000"
    depends_on:
      oz-init:
        condition: service_completed_successfully
    networks: [cg]
  oz-celery:
    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
    environment: *oz-env
    command: /celery_worker.sh
    depends_on:
      oz-init:
        condition: service_completed_successfully
    networks: [cg]
 volumes:
  oz-db:
 networks:
  cg:
--- a/infra/openzaak/seed_catalogus.py
+++ b/infra/openzaak/seed_catalogus.py
@@ -0,0 +1,137 @@
 #!/usr/bin/env python3
 """Idempotent seed of the BIG catalogus into OpenZaak via the ZTC API.
 Creates (if absent):
  - catalogus "BIG"
  - a lean "BIG-registratie" zaaktype (only schema-mandatory fields)
  - a "bsn" eigenschap on that zaaktype
  - then publishes the zaaktype.
 Auth uses the JWT client provisioned by setup_configuration (see ADR-0002).
 Stdlib only — no pip deps. Re-running is safe (matches existing by identifier).
 """
 import base64, hashlib, hmac, json, os, sys, time, urllib.error, urllib.request
 BASE = os.environ.get("OZ_BASE", "http://localhost:8000")
 CLIENT_ID = os.environ.get("OZ_CLIENT_ID", "big-reference-seed")
 SECRET = os.environ.get("OZ_SECRET", "insecure-dev-secret-change-me")
 ZTC = f"{BASE}/catalogi/api/v1"
 RSIN = "517439943"  # elfproef-valid test RSIN
 def token():
    b64 = lambda b: base64.urlsafe_b64encode(b).rstrip(b"=")
    hdr = {"alg": "HS256", "typ": "JWT"}
    pl = {"iss": CLIENT_ID, "iat": int(time.time()), "client_id": CLIENT_ID,
          "user_id": "seed", "user_representation": "seed"}
    seg = b64(json.dumps(hdr, separators=(",", ":")).encode()) + b"." + \
          b64(json.dumps(pl, separators=(",", ":")).encode())
    sig = b64(hmac.new(SECRET.encode(), seg, hashlib.sha256).digest())
    return (seg + b"." + sig).decode()
 def api(method, path, body=None):
    url = path if path.startswith("http") else f"{ZTC}{path}"
    data = json.dumps(body).encode() if body is not None else None
    req = urllib.request.Request(url, data=data, method=method, headers={
        "Authorization": "Bearer " + token(),
        "Content-Type": "application/json",
        "Accept": "application/json",
    })
    try:
        with urllib.request.urlopen(req, timeout=30) as r:
            return r.status, json.loads(r.read() or "null")
    except urllib.error.HTTPError as e:
        return e.code, json.loads(e.read() or "null")
 def find(path):
    status, body = api("GET", path)
    if status != 200:
        sys.exit(f"GET {path} -> {status}: {body}")
    return body.get("results", [])
 def main():
    # 1. Catalogus
    existing = [c for c in find(f"/catalogussen?domein=BIG") if c.get("domein") == "BIG"]
    if existing:
        cat = existing[0]
        print(f"skip   catalogus BIG ({cat['url']})")
    else:
        st, cat = api("POST", "/catalogussen", {
            "domein": "BIG", "rsin": RSIN,
            "contactpersoonBeheerNaam": "BIG Beheer",
        })
        if st != 201:
            sys.exit(f"create catalogus -> {st}: {cat}")
        print(f"create catalogus BIG ({cat['url']})")
    # 2. Zaaktype (concept)
    # status=alles so concept zaaktypen are matched too (else we'd duplicate).
    zts = [z for z in find(f"/zaaktypen?catalogus={cat['url']}&status=alles")
           if z.get("identificatie") == "BIG-REGISTRATIE"]
    if zts:
        zt = zts[0]
        print(f"skip   zaaktype BIG-REGISTRATIE ({zt['url']}) concept={zt.get('concept')}")
    else:
        st, zt = api("POST", "/zaaktypen", {
            "identificatie": "BIG-REGISTRATIE",
            "omschrijving": "BIG-registratie",
            "vertrouwelijkheidaanduiding": "openbaar",
            "doel": "Registratie van een zorgprofessional in het BIG-register",
            "aanleiding": "Aanvraag tot registratie",
            "indicatieInternOfExtern": "extern",
            "handelingInitiator": "indienen",
            "onderwerp": "BIG-registratie",
            "handelingBehandelaar": "behandelen",
            "doorlooptijd": "P30D",
            "opschortingEnAanhoudingMogelijk": False,
            "verlengingMogelijk": False,
            "publicatieIndicatie": False,
            "productenOfDiensten": [],
            "referentieproces": {"naam": "BIG-registratie"},
            "catalogus": cat["url"],
            "besluittypen": [],
            "gerelateerdeZaaktypen": [],
            "beginGeldigheid": "2026-01-01",
            "versiedatum": "2026-01-01",
            "verantwoordelijke": RSIN,
        })
        if st != 201:
            sys.exit(f"create zaaktype -> {st}: {json.dumps(zt, indent=2)}")
        print(f"create zaaktype BIG-REGISTRATIE ({zt['url']})")
    # 3. bsn eigenschap (only addable while concept)
    eigs = [e for e in find(f"/eigenschappen?zaaktype={zt['url']}&status=alles")
            if e.get("naam") == "bsn"]
    if eigs:
        print("skip   eigenschap bsn")
    elif zt.get("concept", True):
        st, eig = api("POST", "/eigenschappen", {
            "naam": "bsn",
            "definitie": "Burgerservicenummer van de zorgprofessional",
            "zaaktype": zt["url"],
            "specificatie": {"groep": "aanvrager", "formaat": "tekst",
                             "lengte": "9", "kardinaliteit": "1", "waardenverzameling": []},
        })
        if st != 201:
            sys.exit(f"create eigenschap -> {st}: {json.dumps(eig, indent=2)}")
        print("create eigenschap bsn")
    else:
        print("warn   zaaktype already published; cannot add bsn eigenschap")
    # Intentionally NOT published. Publishing requires roltypen, resultaattypen
    # and statustypen, which go beyond the "lean / schema-mandatory" zaaktype this
    # slice asks for; they arrive with the workflow/zaak slices. See ADR-0002.
    # 4. Verify the JWT client can list the zaaktype (concepts included).
    zaaktypen = find(f"/zaaktypen?catalogus={cat['url']}&status=alles")
    names = [z.get("identificatie") for z in zaaktypen]
    print(f"zaaktypen in BIG: {names}")
    assert "BIG-REGISTRATIE" in names, "BIG-REGISTRATIE not listed"
    print("OK — BIG catalogus seeded (BIG-REGISTRATIE concept + bsn eigenschap)")
 if __name__ == "__main__":
    main()
--- a/infra/openzaak/setup_configuration/data.yaml
+++ b/infra/openzaak/setup_configuration/data.yaml
@@ -0,0 +1,22 @@
 # OpenZaak setup_configuration (idempotent, declarative).
 # Provisions the JWT client the seed + ACL use to call OpenZaak's APIs.
 # Dev-only credentials — not for production.
 #
 # Steps come from vng_api_common.contrib.setup_configuration (see ADR-0002).
 vng_api_common_credentials_config_enable: true
 vng_api_common_credentials:
  items:
    - identifier: big-reference-seed
      secret: insecure-dev-secret-change-me
 vng_api_common_applicaties_config_enable: true
 vng_api_common_applicaties:
  items:
    # uuid must be given explicitly as a string (the step's auto-default is a
    # UUID object that fails its own validation).
    - uuid: "11111111-1111-4111-8111-111111111111"
      client_ids:
        - big-reference-seed
      label: BIG reference seed client
      heeft_alle_autorisaties: true
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -0,0 +1,41 @@
 site_name: register-referentie
 site_description: Reference application for Respellion's Common Ground architecture pattern
 docs_dir: docs
 theme:
  name: material
  features:
    - navigation.sections
    - navigation.top
    - content.code.copy
  palette:
    - scheme: default
      toggle:
        icon: material/brightness-7
        name: Switch to dark mode
    - scheme: slate
      toggle:
        icon: material/brightness-4
        name: Switch to light mode
 nav:
  - Home: index.md
  - Product Requirements: PRD.md
  - Architecture:
      - "ADR-0001: Loose coupling": architecture/adr-0001-loose-coupling.md
  - Working in Gitea: gitea-workflow.md
  - Runbooks:
      - CI: runbooks/ci.md
 markdown_extensions:
  - admonition
  - toc:
      permalink: true
  - pymdownx.superfences
 # Many docs referenced by PRD.md land in later slices; don't fail the build on them.
 validation:
  nav:
    omitted_files: warn
  links:
    not_found: warn
--- a/services/bff/.dockerignore
+++ b/services/bff/.dockerignore
@@ -0,0 +1,3 @@
 **/bin
 **/obj
 **/*.user
--- a/services/bff/Bff.Api/Bff.Api.csproj
+++ b/services/bff/Bff.Api/Bff.Api.csproj
@@ -0,0 +1,9 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
  <PropertyGroup>
    <TargetFramework>net10.0</TargetFramework>
    <Nullable>enable</Nullable>
    <ImplicitUsings>enable</ImplicitUsings>
  </PropertyGroup>
 </Project>
--- a/services/bff/Bff.Api/Program.cs
+++ b/services/bff/Bff.Api/Program.cs
@@ -0,0 +1,12 @@
 var builder = WebApplication.CreateBuilder(args);
 builder.Services.AddHealthChecks();
 var app = builder.Build();
 app.MapGet("/", () => "BFF placeholder");
 app.MapHealthChecks("/health");
 app.Run();
 // Exposed so the test host (WebApplicationFactory<Program>) can boot the app.
 public partial class Program;
--- a/services/bff/Bff.Api/Properties/launchSettings.json
+++ b/services/bff/Bff.Api/Properties/launchSettings.json
@@ -0,0 +1,23 @@
 {
  "$schema": "https://json.schemastore.org/launchsettings.json",
  "profiles": {
    "http": {
      "commandName": "Project",
      "dotnetRunMessages": true,
      "launchBrowser": true,
      "applicationUrl": "http://localhost:5249",
      "environmentVariables": {
        "ASPNETCORE_ENVIRONMENT": "Development"
      }
    },
    "https": {
      "commandName": "Project",
      "dotnetRunMessages": true,
      "launchBrowser": true,
      "applicationUrl": "https://localhost:7106;http://localhost:5249",
      "environmentVariables": {
        "ASPNETCORE_ENVIRONMENT": "Development"
      }
    }
  }
 }
--- a/services/bff/Bff.Api/appsettings.Development.json
+++ b/services/bff/Bff.Api/appsettings.Development.json
@@ -0,0 +1,8 @@
 {
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  }
 }
--- a/services/bff/Bff.Api/appsettings.json
+++ b/services/bff/Bff.Api/appsettings.json
@@ -0,0 +1,9 @@
 {
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*"
 }
--- a/services/bff/Bff.Tests/Bff.Tests.csproj
+++ b/services/bff/Bff.Tests/Bff.Tests.csproj
@@ -0,0 +1,26 @@
 <Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <TargetFramework>net10.0</TargetFramework>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
    <IsPackable>false</IsPackable>
  </PropertyGroup>
  <ItemGroup>
    <PackageReference Include="coverlet.collector" Version="6.0.4" />
    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.8" />
    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
    <PackageReference Include="xunit" Version="2.9.3" />
    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
  </ItemGroup>
  <ItemGroup>
    <Using Include="Xunit" />
  </ItemGroup>
  <ItemGroup>
    <ProjectReference Include="..\Bff.Api\Bff.Api.csproj" />
  </ItemGroup>
 </Project>
--- a/services/bff/Bff.Tests/HealthEndpointTests.cs
+++ b/services/bff/Bff.Tests/HealthEndpointTests.cs
@@ -0,0 +1,20 @@
 using System.Net;
 using Microsoft.AspNetCore.Mvc.Testing;
 namespace Bff.Tests;
 public class HealthEndpointTests(WebApplicationFactory<Program> factory)
    : IClassFixture<WebApplicationFactory<Program>>
 {
    [Fact]
    public async Task Health_endpoint_returns_200_and_reports_healthy()
    {
        var client = factory.CreateClient();
        var response = await client.GetAsync("/health");
        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
        var body = await response.Content.ReadAsStringAsync();
        Assert.Contains("Healthy", body);
    }
 }
--- a/services/bff/Bff.slnx
+++ b/services/bff/Bff.slnx
@@ -0,0 +1,4 @@
 <Solution>
  <Project Path="Bff.Api/Bff.Api.csproj" />
  <Project Path="Bff.Tests/Bff.Tests.csproj" />
 </Solution>
--- a/services/bff/Dockerfile
+++ b/services/bff/Dockerfile
@@ -0,0 +1,30 @@
 # Multi-stage build for the placeholder BFF (.NET 10).
 # Build context is services/bff (see infra/docker-compose.yml).
 FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
 WORKDIR /src
 # Restore first (cached unless the csproj changes).
 COPY Bff.Api/Bff.Api.csproj Bff.Api/
 RUN dotnet restore Bff.Api/Bff.Api.csproj
 # Then build + publish.
 COPY Bff.Api/ Bff.Api/
 RUN dotnet publish Bff.Api/Bff.Api.csproj -c Release -o /app/publish /p:UseAppHost=false
 FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtime
 WORKDIR /app
 # curl is used by the container HEALTHCHECK / compose healthcheck.
 RUN apt-get update \
    && apt-get install -y --no-install-recommends curl \
    && rm -rf /var/lib/apt/lists/*
 COPY --from=build /app/publish .
 ENV ASPNETCORE_URLS=http://+:8080
 EXPOSE 8080
 HEALTHCHECK --interval=5s --timeout=3s --start-period=10s --retries=5 \
    CMD curl -fsS http://localhost:8080/health || exit 1
 ENTRYPOINT ["dotnet", "Bff.Api.dll"]
--- a/tools/README.md
+++ b/tools/README.md
@@ -1,54 +0,0 @@
 # tools/
 Repo bootstrap and maintenance scripts. Not part of the application runtime.
 ## `seed-gitea.sh` — bootstrap the Gitea backlog
 One-time (idempotent) script that creates the project's backlog in Gitea from the
 contents of [`BACKLOG.md`](../BACKLOG.md): the label taxonomy, the iteration
 milestones, and all 26 slice issues (`S-00`…`S-25`). Gitea is the system of record
 (see `CLAUDE.md` §7); this script just gets the empty repo to that starting state.
 It overlaps part of **S-00**'s acceptance ("milestones, labels … exist in Gitea").
 The authoritative operational write-up will move to `docs/runbooks/` and
 `docs/gitea-workflow.md` when S-00 is implemented.
 ### Prerequisites
 - `curl` and `jq` on `PATH`.
 - A Gitea **personal access token** with scopes **`write:issue`** and
  **`write:repository`** (Gitea → Settings → Applications → Generate New Token).
 ### Usage
 ```sh
 GITEA_TOKEN=<your-pat> bash tools/seed-gitea.sh
 ```
 The token is read from the environment only — it is never written to disk or
 committed. The target repo (`eho/register-referentie` on
 `git.labs.respellion.tech`) is hard-coded near the top of the script; edit the
 `BASE`/`OWNER`/`REPO` variables to point elsewhere.
 ### What it creates
 | Step | Items |
 |------|-------|
 | Labels | `type:{slice,bug,adr-proposal,chore}` + 12 `area:*` labels (16 total) |
 | Milestones | `Iteration 0 — Foundations` … `Iteration 6 — Production Posture` (7 total) |
 | Issues | `S-00`…`S-25` (26 total), each with body, milestone, and area labels |
 ### Idempotency
 Every item is matched by name (labels), title (milestones), or issue title prefix
 (`S-NN · …`) before creation, and skipped if it already exists. A partial or failed
 run can be re-run safely — the second run reports every item as `skip`.
 ### Verify (no token needed — reads are anonymous)
 ```sh
 B=https://git.labs.respellion.tech/api/v1/repos/eho/register-referentie
 curl -s "$B/labels?limit=100"                  | jq length   # expect 16
 curl -s "$B/milestones?state=all&limit=100"    | jq length   # expect 7
 curl -s "$B/issues?state=all&type=issues&limit=100" | jq length   # expect 26
 ```
--- a/tools/seed-gitea.sh
+++ b/tools/seed-gitea.sh
@@ -1,430 +0,0 @@
 #!/usr/bin/env bash
 #
 # seed-gitea.sh — populate the register-referentie Gitea repo with the backlog:
 #   1. label taxonomy   2. iteration milestones   3. all 26 slice issues (S-00..S-25)
 #
 # Idempotent: existing labels/milestones/issues (matched by name/title) are skipped,
 # so a partial or failed run can simply be re-run.
 #
 # Usage:
 #   GITEA_TOKEN=<pat> bash tools/seed-gitea.sh
 #
 # The token needs scopes: write:issue and write:repository (for labels + milestones).
 #
 set -euo pipefail
 : "${GITEA_TOKEN:?Set GITEA_TOKEN to a Gitea personal access token (scopes: write:issue, write:repository)}"
 BASE="https://git.labs.respellion.tech/api/v1"
 OWNER="eho"
 REPO="register-referentie"
 REPO_API="$BASE/repos/$OWNER/$REPO"
 AUTH=(-H "Authorization: token $GITEA_TOKEN")
 JSON=(-H "Content-Type: application/json" -H "Accept: application/json")
 say() { printf '%s\n' "$*"; }
 # ---------------------------------------------------------------------------
 # Preflight: confirm the token can see the repo.
 # ---------------------------------------------------------------------------
 code=$(curl -s -o /dev/null -w '%{http_code}' "${AUTH[@]}" "$REPO_API")
 if [ "$code" != "200" ]; then
  say "ERROR: cannot access $OWNER/$REPO (HTTP $code). Check the token and its scopes."
  exit 1
 fi
 say "Authenticated against $REPO_API"
 # ---------------------------------------------------------------------------
 # 1. Labels
 # ---------------------------------------------------------------------------
 say ""
 say "== Labels =="
 existing_labels=$(curl -s "${AUTH[@]}" "$REPO_API/labels?limit=100")
 create_label() {
  local name="$1" color="$2"
  if echo "$existing_labels" | jq -e --arg n "$name" 'any(.[]; .name == $n)' >/dev/null; then
    say "  skip   $name"
    return
  fi
  curl -s "${AUTH[@]}" "${JSON[@]}" -X POST "$REPO_API/labels" \
    -d "$(jq -n --arg n "$name" --arg c "$color" '{name:$n, color:$c}')" >/dev/null
  say "  create $name"
 }
 create_label "type:slice"        "#0e8a16"
 create_label "type:bug"          "#d73a4a"
 create_label "type:adr-proposal" "#5319e7"
 create_label "type:chore"        "#fbca04"
 for area in acl domain portal-self-service portal-openbaar portal-behandel \
            portal-beheer infra workflow event-subscriber projection bff docs; do
  create_label "area:$area" "#1d76db"
 done
 # ---------------------------------------------------------------------------
 # 2. Milestones
 # ---------------------------------------------------------------------------
 say ""
 say "== Milestones =="
 existing_ms=$(curl -s "${AUTH[@]}" "$REPO_API/milestones?state=all&limit=100")
 create_milestone() {
  local title="$1"
  if echo "$existing_ms" | jq -e --arg t "$title" 'any(.[]; .title == $t)' >/dev/null; then
    say "  skip   $title"
    return
  fi
  curl -s "${AUTH[@]}" "${JSON[@]}" -X POST "$REPO_API/milestones" \
    -d "$(jq -n --arg t "$title" '{title:$t}')" >/dev/null
  say "  create $title"
 }
 create_milestone "Iteration 0 — Foundations"
 create_milestone "Iteration 1 — Walking Skeleton"
 create_milestone "Iteration 2 — Flow Completeness"
 create_milestone "Iteration 3 — Beheer & Observability"
 create_milestone "Iteration 4 — Objecten"
 create_milestone "Iteration 5 — Data Governance"
 create_milestone "Iteration 6 — Production Posture"
 # Re-fetch labels + milestones so we have ids for issue creation.
 labels_json=$(curl -s "${AUTH[@]}" "$REPO_API/labels?limit=100")
 milestones_json=$(curl -s "${AUTH[@]}" "$REPO_API/milestones?state=all&limit=100")
 existing_issues=$(curl -s "${AUTH[@]}" "$REPO_API/issues?state=all&type=issues&limit=100")
 # Definition of Done checklist appended to every slice body (CLAUDE.md §3).
 DOD=$(cat <<'EOF'
 ## Definition of Done
 - [ ] A linked Gitea issue exists (this one).
 - [ ] Failing test written and committed first.
 - [ ] Implementation makes the test pass.
 - [ ] Refactor commit follows if structure improved.
 - [ ] Conventional Commit messages referencing this issue (`refs #NN`).
 - [ ] All Gitea Actions CI jobs green: lint, unit, integration, mutation (ratchet), e2e, container build + push, compose-up smoke test.
 - [ ] `docker compose up` from a fresh clone reaches green health checks within 3 minutes.
 - [ ] Docs touched if behaviour, contracts, or operations changed.
 - [ ] ADR added in `docs/architecture/` if a non-obvious decision was made.
 - [ ] Demo note appended to `docs/demo-script.md` if the slice is user-visible.
 - [ ] This issue closed by the merging PR (`closes #NN`).
 EOF
 )
 # ---------------------------------------------------------------------------
 # 3. Issues
 # ---------------------------------------------------------------------------
 say ""
 say "== Issues =="
 create_issue() {
  local title="$1" milestone="$2" labels_csv="$3" body="$4"
  if echo "$existing_issues" | jq -e --arg t "$title" 'any(.[]; .title == $t)' >/dev/null; then
    say "  skip   $title"
    return
  fi
  local ms_id
  ms_id=$(echo "$milestones_json" | jq -r --arg m "$milestone" '.[] | select(.title == $m) | .id')
  if [ -z "$ms_id" ]; then
    say "  ERROR  milestone not found: $milestone (issue: $title)"
    exit 1
  fi
  local want label_ids
  want=$(printf '%s' "$labels_csv" | jq -R 'split(",")')
  label_ids=$(echo "$labels_json" | jq -c --argjson want "$want" \
    '[ .[] | select(.name as $n | $want | index($n)) | .id ]')
  local full_body="${body}${DOD}"
  local payload
  payload=$(jq -n --arg t "$title" --arg b "$full_body" \
    --argjson ms "$ms_id" --argjson ls "$label_ids" \
    '{title:$t, body:$b, milestone:$ms, labels:$ls}')
  curl -s "${AUTH[@]}" "${JSON[@]}" -X POST "$REPO_API/issues" -d "$payload" >/dev/null
  say "  create $title"
 }
 # ---- Iteration 0 ----------------------------------------------------------
 create_issue "S-00 · Repository skeleton, Gitea Actions CI, contributor workflow" \
  "Iteration 0 — Foundations" "type:slice,area:infra,area:docs" "$(cat <<'EOF'
 **Outcome:** A fresh `git clone` from the Respellion Gitea remote, followed by `docker compose up`, produces a green "hello world" health endpoint from a placeholder BFF. Gitea Actions runs lint, build, unit tests, and the compose-up smoke test, all green. Issue templates, PR template, milestones, labels, and the first project board exist in Gitea.
 **Acceptance:**
 - New developer follows `README.md` and reaches a green local environment in under 10 minutes.
 - Gitea Actions pipeline green on `main`.
 - `git-cliff` produces an empty `CHANGELOG.md`.
 - `docs/PRD.md`, `CLAUDE.md`, `BACKLOG.md`, `docs/architecture/adr-0001-loose-coupling.md`, `docs/gitea-workflow.md` all in repo.
 - `.gitea/workflows/ci.yaml`, `.gitea/ISSUE_TEMPLATE/{slice,bug,adr-proposal}.md`, `.gitea/PULL_REQUEST_TEMPLATE.md` all in repo.
 - Gitea milestone `Iteration 1 — Walking Skeleton` exists, populated with issues S-01 through S-09.
 **Touches:** repo layout, Gitea Actions workflows, Dockerfile for placeholder BFF, `docker-compose.yml` skeleton, MkDocs scaffold, Gitea issue/PR templates.
 **Out of scope:** any business logic, frontend, OpenZaak.
 EOF
 )"
 # ---- Iteration 1 ----------------------------------------------------------
 create_issue "S-01 · OpenZaak + Open Notificaties + Postgres come up in compose" \
  "Iteration 1 — Walking Skeleton" "type:slice,area:infra" "$(cat <<'EOF'
 **Outcome:** Local `docker compose up` brings up OpenZaak, Open Notificaties, their dependencies, and a seeded ZTC catalogus called `BIG`. A health check confirms all reachable.
 **Acceptance:**
 - `curl` to OpenZaak `/zaken/api/v1/` returns 401 (auth working).
 - A test client with a generated JWT can list zaaktypen in the `BIG` catalogus.
 - The seeded catalogus contains one lean `BIG-registratie` zaaktype with only the schema-mandatory fields plus `bsn` as an eigenschap.
 **Touches:** `infra/openzaak/`, `infra/opennotificaties/`, `infra/seed/`, ADR for catalogus design.
 **Out of scope:** any portal, BFF, Flowable, ACL code.
 EOF
 )"
 create_issue "S-02 · Keycloak with mock DigiD, eHerkenning, eIDAS, medewerker realms" \
  "Iteration 1 — Walking Skeleton" "type:slice,area:infra" "$(cat <<'EOF'
 **Outcome:** Keycloak runs locally with four realms pre-seeded. Each realm has 1–2 test users with known credentials documented in `docs/synthetic-data.md`.
 **Acceptance:**
 - Browser-based OIDC login flow works for each realm against a placeholder client.
 - Mock DigiD realm returns a BSN claim; eHerkenning returns a KvK; eIDAS returns a foreign identifier; medewerker returns role claims.
 **Touches:** `infra/keycloak/`, seed scripts.
 **Out of scope:** real federation, MFA.
 EOF
 )"
 create_issue "S-03 · Flowable up with a minimal BPMN: \"Registratie ontvangen\"" \
  "Iteration 1 — Walking Skeleton" "type:slice,area:infra,area:workflow" "$(cat <<'EOF'
 **Outcome:** Flowable runs locally with Postgres. A single BPMN model (`registratie.bpmn`) deployed with one start event, one external task `OpenZaakAanmaken`, one end event.
 **Acceptance:**
 - BPMN model deployed via Flowable's REST API on container start.
 - An HTTP call can start a process instance and observe it waiting on the external task.
 **Touches:** `infra/flowable/`, `workflows/registratie.bpmn`.
 **Out of scope:** DMN, boundary timers, second model.
 EOF
 )"
 create_issue "S-04 · ACL skeleton with one operation: open a zaak" \
  "Iteration 1 — Walking Skeleton" "type:slice,area:acl" "$(cat <<'EOF'
 **Outcome:** A .NET library + service that exposes one method: `OpenZaak(domainPayload) → zaakUrl`. It default-fills `bronorganisatie`, `verantwoordelijkeOrganisatie`, `startdatum`, `vertrouwelijkheidaanduiding`, and posts to OpenZaak. **Strict TDD throughout.**
 **Acceptance:**
 - BDD scenario: "Given a domain registration payload, when I call the ACL, then a zaak exists in OpenZaak with the default-filled fields."
 - Mutation score baseline captured and enforced by the Gitea Actions pipeline.
 - Integration test using Testcontainers against real OpenZaak passes.
 **Touches:** `services/acl/`, tests, ADR for default-fill strategy.
 **Out of scope:** all other ZGW operations, status transitions, documents.
 EOF
 )"
 create_issue "S-05 · BIG Domain Service skeleton with the Registration aggregate" \
  "Iteration 1 — Walking Skeleton" "type:slice,area:domain" "$(cat <<'EOF'
 **Outcome:** A .NET service exposing a single endpoint `POST /registrations`. The Registration aggregate has a state machine with at minimum `INGEDIEND`. The service orchestrates: start a Flowable process → external task callback executes the ACL `OpenZaak` → zaak URL stored on the aggregate.
 **Acceptance:**
 - BDD scenario: "Given a zorgprofessional submits a registration, when the domain service receives it, then a Flowable process is started and a zaak is opened in OpenZaak."
 - Integration test exercises the full path (no real frontend yet).
 - The Workflow Client is the only code that calls Flowable.
 **Touches:** `services/domain/`, `services/acl/` (consumed), tests, ADR for external-task job-worker pattern.
 **Out of scope:** any other use case, documents, decisions.
 EOF
 )"
 create_issue "S-06 · Event Subscriber + Read Projection (minimal)" \
  "Iteration 1 — Walking Skeleton" "type:slice,area:event-subscriber,area:projection" "$(cat <<'EOF'
 **Outcome:** An NRC webhook consumer that, on `zaak.gecreeerd`, writes a row to a `register_projection` table with `id`, `bsn`, `naam_placeholder`, `status`. Idempotent. Rebuildable.
 **Acceptance:**
 - BDD scenario: "Given a zaak is created in OpenZaak, when the NRC event is delivered, then the projection contains a row with status INGEDIEND."
 - Replaying the same event twice does not create duplicates.
 - A `projection rebuild` admin command repopulates from OpenZaak.
 **Touches:** `services/event-subscriber/`, `services/projection-api/`, tests.
 **Out of scope:** decision events, multiple projections, public-safe field filtering (will tighten in S-09).
 EOF
 )"
 create_issue "S-07 · BFF with one endpoint per portal + OIDC validation" \
  "Iteration 1 — Walking Skeleton" "type:slice,area:bff" "$(cat <<'EOF'
 **Outcome:** A .NET BFF exposing four endpoint groups (one per portal). Validates tokens issued by Keycloak. Implements the minimum needed for the walking skeleton: `POST /self-service/registrations`, `GET /openbaar/register?q=...`.
 **Acceptance:**
 - BDD scenarios cover the two endpoints with valid and invalid tokens.
 - OpenAPI spec generated and committed.
 **Touches:** `services/bff/`, OpenAPI spec, tests.
 **Out of scope:** behandelaar and beheer endpoints (later slices).
 EOF
 )"
 create_issue "S-08 · Self-Service portal (Angular, NL DS) — submit a registration" \
  "Iteration 1 — Walking Skeleton" "type:slice,area:portal-self-service" "$(cat <<'EOF'
 **Outcome:** The self-service Angular app, in the Nx monorepo, lets a zorgprofessional log in via mock DigiD and submit a registration. NL Design System styling. Generated API client.
 **Acceptance:**
 - E2E test (Playwright): full happy path, login → submit → success page.
 - Component tests (Testing Library) for the form.
 - Accessibility audit (axe-core) passes WCAG 2.1 AA on the submit page.
 **Touches:** `apps/self-service/`, `libs/ui/`, `libs/auth/`, `libs/api-client/`, tests.
 **Out of scope:** document upload, status tracking page.
 EOF
 )"
 create_issue "S-09 · Openbaar Register portal — public lookup" \
  "Iteration 1 — Walking Skeleton" "type:slice,area:portal-openbaar,area:projection" "$(cat <<'EOF'
 **Outcome:** The openbaar Angular app shows a search box. Anonymous. Queries the BFF's `/openbaar/register` which reads only the projection's **public-safe** fields. Confirms the walking skeleton end-to-end.
 **Acceptance:**
 - E2E test: zorgprofessional registers via self-service (S-08), behandelaar approves via a temporary admin endpoint (no behandel-portal yet), openbaar register shows the entry.
 - Public-safe field whitelist enforced and tested.
 **Touches:** `apps/openbaar/`, projection-api hardening, tests.
 **Out of scope:** advanced search filters, sorting.
 _End of walking skeleton. Demo: submit → process → projection → public visibility. All CI gates green on Gitea Actions. Cut release `vYYYY.MM.0` and publish via Gitea Releases._
 EOF
 )"
 # ---- Iteration 2 ----------------------------------------------------------
 create_issue "S-10 · Document upload + boundary timer for document timeout (Flow 2)" \
  "Iteration 2 — Flow Completeness" "type:slice,area:workflow,area:portal-self-service" "$(cat <<'EOF'
 **Outcome:** BPMN extended with a "wacht op documenten" user task with a 30-day boundary timer. Self-service portal supports diploma upload. On timeout the case is cancelled.
 **Acceptance:** BDD scenarios for both branches; integration tests for the timer firing.
 EOF
 )"
 create_issue "S-11 · Withdrawal (Flow 3)" \
  "Iteration 2 — Flow Completeness" "type:slice,area:portal-self-service,area:domain,area:workflow" "$(cat <<'EOF'
 **Outcome:** Self-service portal has a "trek aanvraag in" action. Domain service issues a withdraw command; BPMN message event correlates; case cancels with audit trail.
 EOF
 )"
 create_issue "S-12 · Behandel-portal — werkbak + beoordeling" \
  "Iteration 2 — Flow Completeness" "type:slice,area:portal-behandel,area:workflow" "$(cat <<'EOF'
 **Outcome:** Behandel portal with login (medewerker realm), werkbak listing INGEDIEND/IN_BEHANDELING cases, claim and complete user tasks via Flowable, decision endpoint via Domain Service.
 **Acceptance:** BDD scenarios for claim, complete, request additional document, decide.
 EOF
 )"
 create_issue "S-13 · DMN decision: diploma eligibility (Flow 4)" \
  "Iteration 2 — Flow Completeness" "type:slice,area:workflow,area:domain" "$(cat <<'EOF'
 **Outcome:** A DMN decision table evaluated by the Domain Service via Workflow Client. Foreign diplomas route to an extra "CBGV-advies" user task in BPMN.
 **Acceptance:** BDD scenarios for domestic and foreign diploma paths; DMN evaluated separately is unit-tested.
 EOF
 )"
 create_issue "S-14 · Beoordeling escalation (Flow 5)" \
  "Iteration 2 — Flow Completeness" "type:slice,area:workflow" "$(cat <<'EOF'
 **Outcome:** Boundary timer on beoordeling user task — 14 days. On timeout, reassigns to a teamlead role.
 EOF
 )"
 # ---- Iteration 3 ----------------------------------------------------------
 create_issue "S-15 · Beheer-portal — catalogus & default-fill rules" \
  "Iteration 3 — Beheer & Observability" "type:slice,area:portal-beheer,area:acl" "$(cat <<'EOF'
 **Outcome:** Beheer portal lets an admin view ZTC catalogi (read-only first), and manage the ACL's default-fill configuration via a CRUD UI. MFA on the medewerker realm enforced.
 EOF
 )"
 create_issue "S-16 · OpenTelemetry traces + Grafana dashboard" \
  "Iteration 3 — Beheer & Observability" "type:slice,area:infra" "$(cat <<'EOF'
 **Outcome:** Traces span portal → BFF → Domain → ACL → OpenZaak and portal → BFF → Domain → Flowable. Grafana dashboards pre-built for golden signals.
 EOF
 )"
 create_issue "S-17 · Quartz.NET scheduler — herregistratie reminder sweep" \
  "Iteration 3 — Beheer & Observability" "type:slice,area:domain" "$(cat <<'EOF'
 **Outcome:** Nightly job that finds entries within 90 days of expiry and emits a domain event. (No outbound notification in v1 — logged.)
 EOF
 )"
 # ---- Iteration 4 ----------------------------------------------------------
 create_issue "S-18 · Objecten + Objecttypen up in compose; Register objecttype defined" \
  "Iteration 4 — Objecten" "type:slice,area:infra" "$(cat <<'EOF'
 **Outcome:** Objecten and Objecttypen running. A `RegisterRecord` objecttype defined with the public-safe schema.
 EOF
 )"
 create_issue "S-19 · ACL extension: write register-record to Objecten on approval" \
  "Iteration 4 — Objecten" "type:slice,area:acl,area:projection" "$(cat <<'EOF'
 **Outcome:** Approval path writes the canonical register record to Objecten, not OpenZaak eigenschappen. Projection now sourced from Objecten events.
 **ADR required:** "Why Objecten holds the register, OpenZaak holds the process."
 EOF
 )"
 # ---- Iteration 5 ----------------------------------------------------------
 create_issue "S-20 · OpenMetadata module + seed bundle deployed alongside" \
  "Iteration 5 — Data Governance" "type:slice,area:infra" "$(cat <<'EOF'
 **Outcome:** OpenMetadata stack runs as a separate compose file (`infra/governance/`). Seed bundle loaded: glossary, classification taxonomy, roles, default DQ tests.
 EOF
 )"
 create_issue "S-21 · Read-replica ingestion + API ingestion" \
  "Iteration 5 — Data Governance" "type:slice,area:infra" "$(cat <<'EOF'
 **Outcome:** Postgres read replicas of domain, Flowable, projection. OpenMetadata ingestion connectors discover schemas. API connector ingests OpenZaak and Objecten via OpenAPI.
 EOF
 )"
 create_issue "S-22 · Lineage SDK (.NET) + lineage assertions across the personal-data path" \
  "Iteration 5 — Data Governance" "type:slice,area:acl,area:event-subscriber,area:domain" "$(cat <<'EOF'
 **Outcome:** A thin .NET package wrapping OpenMetadata's lineage API, published to the **Gitea Packages** registry. ACL, Event Subscriber, and Domain Service call it as personal data flows. Each lineage edge carries purpose and legal basis.
 **ADR required:** "Lineage as a property of code, not docs."
 EOF
 )"
 create_issue "S-23 · GDPR reporting cookbook" \
  "Iteration 5 — Data Governance" "type:slice,area:docs" "$(cat <<'EOF'
 **Outcome:** `docs/gdpr-reporting.md` showing how to answer specific AVG questions using OpenMetadata (data subject request, processing register, lineage trace).
 EOF
 )"
 # ---- Iteration 6 ----------------------------------------------------------
 create_issue "S-24 · Helm chart (sketch) + Kubernetes manifests for the platform" \
  "Iteration 6 — Production Posture" "type:slice,area:infra" "$(cat <<'EOF'
 **Outcome:** A non-deployed-but-reviewable Helm chart and accompanying ADR on production posture. Documents HA, secrets, backup, observability, identity wiring.
 EOF
 )"
 create_issue "S-25 · Runbook completeness review" \
  "Iteration 6 — Production Posture" "type:slice,area:docs" "$(cat <<'EOF'
 **Outcome:** All runbooks complete: startup, seed, common failures, upgrade upstream modules, restore from backup, rotate secrets, Gitea Actions gotchas.
 EOF
 )"
 say ""
 say "Done. Verify counts (no token needed):"
 say "  curl -s '$REPO_API/labels?limit=100' | jq length        # expect 16"
 say "  curl -s '$REPO_API/milestones?state=all&limit=100' | jq length   # expect 7"
 say "  curl -s '$REPO_API/issues?state=all&type=issues&limit=100' | jq length   # expect 26"
Author	SHA1	Message	Date
Edwin van den Houdt	ee3be92e38	feat(infra): Open Notificaties up + shared network with OpenZaak (closes #2 ) Some checks failed CI / lint (pull_request) Has been cancelled Details CI / build (pull_request) Has been cancelled Details CI / unit (pull_request) Has been cancelled Details CI / compose-smoke (pull_request) Has been cancelled Details Add infra/opennotificaties/docker-compose.yml (PostGIS db, redis broker, migrate-init, API, celery worker) on a shared `cg` network with the OpenZaak stack (renamed oz->cg), published on host :8001. Add combined `make stack-up/stack-smoke/stack-down` targets and a runbook. Completes S-01's acceptance: OpenZaak + Open Notificaties + Postgres come up in compose and a health check confirms all reachable (OZ 403/302/200, NRC 302; cross-network DNS verified). Catalogus seed landed in S-01-b. OZ->NRC notification delivery wiring (NRC setup_configuration: Services + Authorization + JWT + Kanalen + Abonnementen; OZ NotificationConfig; re- enabling NOTIFICATIONS_DISABLED) is deferred to S-06 (Event Subscriber), the slice that consumes events. NRC data.yaml is migrate-only until then. Verified: `make stack-smoke` green (both platforms reachable). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-03 15:58:51 +02:00
Edwin van den Houdt	0409eb42c5	feat(infra): seed BIG catalogus + JWT client for OpenZaak (refs #2 ) (#41 ) Some checks failed CI / lint (push) Has been cancelled Details CI / build (push) Has been cancelled Details CI / unit (push) Has been cancelled Details CI / compose-smoke (push) Has been cancelled Details	2026-06-03 13:42:44 +00:00
Edwin van den Houdt	8c5bbe05a9	feat(infra): OpenZaak + Postgres + Redis up in compose (refs #10 ) (#40 ) Some checks failed CI / lint (push) Has been cancelled Details CI / build (push) Has been cancelled Details CI / unit (push) Has been cancelled Details CI / compose-smoke (push) Has been cancelled Details	2026-06-03 13:16:31 +00:00
Edwin van den Houdt	e85774d482	docs: MkDocs scaffold + ADR-0001 + README quickstart (closes #32 ) (#39 ) Some checks failed CI / lint (push) Has been cancelled Details CI / build (push) Has been cancelled Details CI / unit (push) Has been cancelled Details CI / compose-smoke (push) Has been cancelled Details	2026-06-03 12:13:32 +00:00
Edwin van den Houdt	ada2e807a3	chore: contributor workflow — templates, git-cliff, gitea-workflow doc (closes #31 ) (#38 ) Some checks failed CI / lint (push) Has been cancelled Details CI / build (push) Has been cancelled Details CI / unit (push) Has been cancelled Details CI / compose-smoke (push) Has been cancelled Details	2026-06-03 12:09:24 +00:00
Edwin van den Houdt	d4a89e6e62	ci: Gitea Actions pipeline + runner runbook (refs #30 ) (#37 ) Some checks failed CI / lint (push) Has been cancelled Details CI / build (push) Has been cancelled Details CI / unit (push) Has been cancelled Details CI / compose-smoke (push) Has been cancelled Details	2026-06-03 12:04:19 +00:00
Edwin van den Houdt	dfd6224fea	feat(infra): containerize BFF + compose-up smoke (closes #29 ) (#36 )	2026-06-03 11:46:27 +00:00
Edwin van den Houdt	7d67ecbde1	chore: remove bootstrap scripts from main (#35 )	2026-06-03 11:40:14 +00:00
Edwin van den Houdt	dfbaf7640a	feat(bff): placeholder BFF + /health endpoint (closes #28 ) (#34 )	2026-06-03 11:38:08 +00:00
Edwin van den Houdt	364d2eceb2	docs(backlog): split S-00 into sub-slices (refs #1 ) (#33 )	2026-06-03 11:37:57 +00:00