docs(backlog): split S-00 into S-00-a..e (refs #1)

Mirror the approved S-00 split into the backlog: replace the single S-00
slice with sub-slices S-00-a (BFF + health), S-00-b (Docker + compose +
smoke), S-00-c (Gitea Actions CI), S-00-d (contributor workflow), and
S-00-e (docs scaffold). Gitea remains the system of record; the issues
are managed with the tea CLI.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/ISSUE_TEMPLATE/adr-proposal.md

@@ -1,24 +0,0 @@
----
-name: ADR proposal
-about: Propose a decision that needs recording before coding (CLAUDE.md §14)
-title: "ADR: "
-labels:
-  - type:adr-proposal
----
-
-**Decision to be made:**
-
-**Context / forces:** <!-- what makes this non-obvious; constraints, trade-offs -->
-
-**Options considered:**
-1.
-2.
-
-**Proposed option + why:**
-
-**Consequences:** <!-- what becomes easier/harder; what we commit to -->
-
-**Coupling rules touched (CLAUDE.md §8):** <!-- none, or which and why -->
-
-> On acceptance, the ADR file (`docs/architecture/adr-NNNN-title.md`, Nygard
-> template) lands in the PR that implements the decision.

.gitea/ISSUE_TEMPLATE/bug.md

@@ -1,21 +0,0 @@
----
-name: Bug
-about: Something behaves incorrectly
-title: ""
-labels:
-  - type:bug
----
-
-**What happened:**
-
-**What you expected:**
-
-**Steps to reproduce:**
-1.
-2.
-
-**Environment:** <!-- branch/commit, OS, container engine, anything relevant -->
-
-**Logs / evidence:**
-
-**Suspected area:** <!-- e.g. area:bff, area:acl — add the matching area label -->

.gitea/ISSUE_TEMPLATE/slice.md

@@ -1,31 +0,0 @@
----
-name: Slice (user story)
-about: A backlog slice — independently demoable, encodes the Definition of Done
-title: "S-NN · "
-labels:
-  - type:slice
----
-
-**Outcome:** <!-- one sentence; user-visible if possible -->
-
-**Acceptance:**
-<!-- Gherkin scenarios or testable assertions -->
--
-
-**Touches:** <!-- services and folders -->
-
-**Out of scope:** <!-- explicit non-goals -->
-
-## Definition of Done
-
-- [ ] This linked Gitea issue exists and is on the right milestone.
-- [ ] Failing test written and committed first (`test(scope): … (refs #NN)`).
-- [ ] Implementation makes the test pass (`feat(scope): … (refs #NN)`).
-- [ ] Refactor commit follows if structure improved.
-- [ ] Conventional Commit messages referencing this issue.
-- [ ] All Gitea Actions CI jobs green (or `make ci` green while no runner exists).
-- [ ] `docker compose up` from a fresh clone reaches green health checks within 3 minutes.
-- [ ] Docs touched if behaviour, contracts, or operations changed.
-- [ ] ADR added in `docs/architecture/` if a non-obvious decision was made.
-- [ ] Demo note appended to `docs/demo-script.md` if the slice is user-visible.
-- [ ] This issue closed by the merging PR (`closes #NN`).

.gitea/PULL_REQUEST_TEMPLATE.md

@@ -1,23 +0,0 @@
-<!-- Title: Conventional Commit style, e.g. feat(bff): … (closes #NN) -->
-
-## What & why
-
-<!-- Summary of the change and the slice/bug it addresses. -->
-
-Closes #
-
-## Definition of Done
-
-- [ ] Linked Gitea issue (above).
-- [ ] Failing test committed before the implementation.
-- [ ] Implementation makes the test pass; refactor commit if structure improved.
-- [ ] Conventional Commits referencing the issue (`refs #NN`).
-- [ ] CI green — all Gitea Actions jobs (or `make ci` green while no runner exists).
-- [ ] `docker compose up` from a fresh clone reaches green health checks within 3 minutes.
-- [ ] Docs updated if behaviour, contracts, or operations changed.
-- [ ] ADR added in `docs/architecture/` if a non-obvious decision was made.
-- [ ] Demo note in `docs/demo-script.md` if user-visible.
-
-## Notes for reviewers
-
-<!-- Anything that helps review: trade-offs, follow-ups, known gaps. -->

.gitea/workflows/ci.yaml

@@ -1,50 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-permissions:
-  contents: read
-
-# Self-hosted runner — see docs/runbooks/ci.md for the runner setup.
-# `uses:` are absolute, tag-pinned URLs (CLAUDE.md §8.7 / §15).
-
-# Each job calls a `make` target — the same one developers run locally
-# (`make ci`). The Makefile is the single source of truth; see docs/runbooks/ci.md.
-
-jobs:
-  lint:
-    runs-on: respellion-linux
-    steps:
-      - uses: https://github.com/actions/checkout@v4
-      - uses: https://github.com/actions/setup-dotnet@v4
-        with:
-          dotnet-version: '10.0.x'
-      - run: make lint
-
-  build:
-    runs-on: respellion-linux
-    steps:
-      - uses: https://github.com/actions/checkout@v4
-      - uses: https://github.com/actions/setup-dotnet@v4
-        with:
-          dotnet-version: '10.0.x'
-      - run: make build
-
-  unit:
-    runs-on: respellion-linux
-    steps:
-      - uses: https://github.com/actions/checkout@v4
-      - uses: https://github.com/actions/setup-dotnet@v4
-        with:
-          dotnet-version: '10.0.x'
-      - run: make unit
-
-  compose-smoke:
-    runs-on: respellion-linux
-    steps:
-      - uses: https://github.com/actions/checkout@v4
-      - run: make smoke

.gitignore

@@ -1,31 +0,0 @@
-# .NET build output
-bin/
-obj/
-[Dd]ebug/
-[Rr]elease/
-*.user
-
-# Test results / coverage
-[Tt]est[Rr]esults/
-*.trx
-coverage*.json
-coverage*.xml
-*.coverage
-
-# Rider / VS / VS Code
-.idea/
-.vs/
-.vscode/
-
-# Node / Angular (added as the frontend lands)
-node_modules/
-dist/
-.angular/
-
-# Python / MkDocs
-.venv/
-site/
-
-# OS
-.DS_Store
-Thumbs.db

CHANGELOG.md

@@ -1,20 +0,0 @@
-# Changelog
-
-All notable changes to this project. Generated from Conventional Commits by git-cliff.
-
-## Unreleased
-
-### CI
-- Gitea Actions pipeline + runner runbook (refs #30) (#37)
-
-### Chores
-- Add idempotent Gitea backlog seeder
-- Remove bootstrap scripts from main (#35)
-
-### Documentation
-- Split S-00 into sub-slices (refs #1) (#33)
-
-### Features
-- Placeholder BFF + /health endpoint (closes #28) (#34)
-- Containerize BFF + compose-up smoke (closes #29) (#36)
-

Makefile

@@ -1,80 +0,0 @@
-# Developer + CI entrypoints.
-#
-# These targets are the single source of truth for the checks. The Gitea
-# Actions workflow (.gitea/workflows/ci.yaml) invokes the SAME targets, so
-# `make ci` locally runs exactly what the pipeline runs — no drift. Until a
-# self-hosted runner is registered, `make ci` is the gate (see docs/runbooks/ci.md).
-
-SLN        := services/bff/Bff.slnx
-COMPOSE    := infra/docker-compose.yml
-HEALTH_URL := http://localhost:8080/health
-OZ_COMPOSE := infra/openzaak/docker-compose.yml
-OZ_BASE    := http://localhost:8000
-
-# On a rootless Podman dev box, point Docker CLI/Compose at the Podman socket —
-# but only if that socket exists and DOCKER_HOST isn't already set, so real
-# Docker hosts and CI runners are left untouched.
-PODMAN_SOCK := /run/user/$(shell id -u)/podman/podman.sock
-ifeq ($(wildcard $(PODMAN_SOCK)),$(PODMAN_SOCK))
-ifeq ($(origin DOCKER_HOST),undefined)
-export DOCKER_HOST := unix://$(PODMAN_SOCK)
-endif
-endif
-
-.PHONY: ci lint build unit smoke down changelog openzaak-up openzaak-smoke openzaak-down help
-
-## ci: run the full pipeline — lint, build, unit, smoke (mirrors Gitea Actions)
-ci: lint build unit smoke
-
-## lint: verify formatting (no changes)
-lint:
-	dotnet format $(SLN) --verify-no-changes
-
-## build: release build
-build:
-	dotnet build $(SLN) -c Release
-
-## unit: run unit tests
-unit:
-	dotnet test $(SLN) -c Release
-
-## smoke: compose up (wait for healthy), curl /health, then tear down
-smoke:
-	docker compose -f $(COMPOSE) up -d --build --wait
-	bash -c 'curl -fsS $(HEALTH_URL); rc=$$?; docker compose -f $(COMPOSE) down --volumes; exit $$rc'
-
-## down: stop and remove the local stack
-down:
-	docker compose -f $(COMPOSE) down --volumes
-
-## changelog: regenerate CHANGELOG.md from Conventional Commits (git-cliff)
-changelog:
-	git-cliff --output CHANGELOG.md
-
-## openzaak-up: start the OpenZaak stack (migrations run on first start)
-openzaak-up:
-	docker compose -f $(OZ_COMPOSE) up -d
-
-## openzaak-smoke: start OpenZaak, then assert it is up with auth enforced
-openzaak-smoke:
-	docker compose -f $(OZ_COMPOSE) up -d
-	@bash -c 'set -e; \
-	  echo "waiting for OpenZaak to respond..."; \
-	  for i in $$(seq 1 60); do \
-	    code=$$(curl -s -o /dev/null -w "%{http_code}" $(OZ_BASE)/zaken/api/v1/zaken || true); \
-	    [ -n "$$code" ] && [ "$$code" != "000" ] && break; sleep 3; \
-	  done; \
-	  echo "GET /zaken/api/v1/zaken (unauth) -> $$code (expect 403, auth enforced)"; test "$$code" = "403"; \
-	  admin=$$(curl -s -o /dev/null -w "%{http_code}" $(OZ_BASE)/admin/); \
-	  echo "GET /admin/             -> $$admin (expect 302)"; test "$$admin" = "302"; \
-	  root=$$(curl -s -o /dev/null -w "%{http_code}" $(OZ_BASE)/zaken/api/v1/); \
-	  echo "GET /zaken/api/v1/      -> $$root (expect 200)"; test "$$root" = "200"; \
-	  echo "OpenZaak smoke OK"'
-
-## openzaak-down: stop and remove the OpenZaak stack (wipes data)
-openzaak-down:
-	docker compose -f $(OZ_COMPOSE) down --volumes
-
-## help: list available targets
-help:
-	@grep -E '^## ' $(MAKEFILE_LIST) | sed 's/^## //'

README.md

@@ -41,32 +41,22 @@ For the architecture rationale, see [docs/PRD.md §3](docs/PRD.md) and [docs/arc
 
 **Prerequisites**
 
-- .NET 10 SDK (for `make lint/build/unit`)
+- Docker Engine (or Docker Desktop) with Compose v2
-- A container engine with Compose v2 — Docker, or rootless Podman (see [docs/runbooks/ci.md](docs/runbooks/ci.md) for the Podman + Compose-provider setup)
+- ~8 GB free RAM, ~10 GB free disk
-- `make`, `curl`, `git`
+- Bash or PowerShell
-- ~4 GB free RAM, ~5 GB free disk (grows as services land)
 
-**Clone**
+**Bring the stack up**
 
 ```bash
-git clone git@git.labs.respellion.tech:eho/register-referentie.git
+git clone https://gitea.respellion.local/respellion/register-reference.git
-cd register-referentie
+cd register-reference
+cp .env.example .env          # edit if you change ports
+docker compose -f infra/docker-compose.yml up -d
 ```
 
-**Wired today (Iteration 0):** only the placeholder BFF exists so far. Get to green in under 10 minutes — run the full check gate, or just the running service:
+Health checks should be green within ~3 minutes on a developer machine. If something fails, see [docs/runbooks/local-startup.md](docs/runbooks/local-startup.md).
 
-```bash
+**Default URLs**
-make ci          # lint + build + unit + container smoke — the CI gate
-```
-
-```bash
-docker compose -f infra/docker-compose.yml up -d --build --wait
-curl http://localhost:8080/health     # -> Healthy
-```
-
-`--wait` exits non-zero unless the container reports healthy, so it doubles as the compose-up smoke test. The remaining services and the URLs below land in later slices.
-
-**Target service URLs** *(most land in later slices)*
 
 | Service | URL |
 |---|---|
@@ -74,7 +64,7 @@ curl http://localhost:8080/health     # -> Healthy
 | Openbaar register | http://localhost:4201 |
 | Behandel-portal | http://localhost:4202 |
 | Beheer-portal | http://localhost:4203 |
-| BFF | http://localhost:8080 |
+| BFF | http://localhost:5000 |
 | OpenZaak | http://localhost:8000 |
 | Open Notificaties | http://localhost:8001 |
 | Flowable | http://localhost:8080 |
@@ -83,12 +73,10 @@ curl http://localhost:8080/health     # -> Healthy
 
 Test credentials, BSNs, and personas: see [docs/synthetic-data.md](docs/synthetic-data.md).
 
-**Build the docs site**
+**Re-seed synthetic data**
 
 ```bash
-python3 -m venv .venv && .venv/bin/pip install mkdocs-material
+./tools/seed.sh               # or pwsh ./tools/seed.ps1
-.venv/bin/mkdocs serve         # live preview at http://localhost:8000
-.venv/bin/mkdocs build         # static site in ./site
 ```
 
 ---

cliff.toml

@@ -1,45 +0,0 @@
-# git-cliff configuration — generates CHANGELOG.md from Conventional Commits.
-# Run via `make changelog`. See https://git-cliff.org.
-
-[changelog]
-header = """
-# Changelog
-
-All notable changes to this project. Generated from Conventional Commits by git-cliff.\n
-"""
-body = """
-{% if version %}\
-## {{ version }} — {{ timestamp | date(format="%Y-%m-%d") }}
-{% else %}\
-## Unreleased
-{% endif %}\
-{% for group, commits in commits | group_by(attribute="group") %}
-### {{ group | upper_first }}
-{% for commit in commits %}\
-- {{ commit.message | upper_first }}{% if commit.breaking %} **[BREAKING]**{% endif %}
-{% endfor %}\
-{% endfor %}\n
-"""
-trim = true
-
-[git]
-conventional_commits = true
-filter_unconventional = true
-split_commits = false
-protect_breaking_commits = true
-tag_pattern = "v[0-9]*"
-# CalVer tags: YYYY.MM.PATCH
-filter_commits = false
-commit_parsers = [
-  { message = "^feat", group = "Features" },
-  { message = "^fix", group = "Bug Fixes" },
-  { message = "^perf", group = "Performance" },
-  { message = "^refactor", group = "Refactor" },
-  { message = "^docs", group = "Documentation" },
-  { message = "^test", group = "Tests" },
-  { message = "^ci", group = "CI" },
-  { message = "^build", group = "Build" },
-  { message = "^arch", group = "Architecture" },
-  { message = "^chore", group = "Chores" },
-  { message = ".*", group = "Other" },
-]

docs/PRD.md

@@ -85,7 +85,7 @@ The five flows form the BDD acceptance backbone (Gherkin scenarios in `tests/acc
 
 - **Source control & collaboration:** **Gitea** (Respellion self-hosted) — repository, issues, milestones, labels, projects, releases, container registry, wiki, packages.
 - **CI/CD:** **Gitea Actions** running on Respellion-hosted `act_runner` instances. Workflow files live in `.gitea/workflows/`. Marketplace actions are referenced via absolute URLs (`uses: https://github.com/actions/checkout@v4` or Gitea-hosted equivalents where available) for reproducibility.
-- **Backend:** .NET 10 (LTS at iteration time), C#, minimal APIs for BFF, MediatR for in-process messaging within Domain Service, EF Core for the projection store and domain DB.
+- **Backend:** .NET 9 (LTS at iteration time), C#, minimal APIs for BFF, MediatR for in-process messaging within Domain Service, EF Core for the projection store and domain DB.
 - **Frontend:** Angular (latest LTS) + TypeScript, standalone components + signals, Nx monorepo, NL Design System component library, Angular Testing Library + Playwright.
 - **Workflow:** Flowable (BPMN + DMN) via Docker image; Postgres for engine store.
 - **Identity:** Keycloak with pre-seeded realms.

docs/architecture/adr-0001-loose-coupling.md

@@ -1,58 +0,0 @@
-# ADR-0001: Loose coupling to upstream Common Ground modules
-
-- **Status:** Accepted
-- **Date:** 2026-06-03
-- **Deciders:** Respellion engineering
-- **Template note:** This is the first ADR and doubles as the worked example of
-  the Nygard template. Copy its shape for new ADRs (`adr-NNNN-title.md`).
-
-## Context
-
-This reference application orchestrates several upstream Common Ground modules —
-OpenZaak (ZGW APIs), Open Notificaties (NRC), Objecten/Objecttypen, Flowable,
-Keycloak. Each is an independently developed, independently deployed peer. The
-temptation in a demo is to reach straight into a peer's database or couple to its
-internal schema to move faster. That coupling is exactly what makes Common Ground
-landscapes brittle and un-upgradeable in practice.
-
-We need a stance, recorded up front, on how our services may talk to these peers.
-
-## Decision
-
-**We integrate with upstream modules only through their documented public APIs, and
-we isolate that integration behind explicit anti-corruption boundaries.**
-
-Concretely (mirrors CLAUDE.md §8):
-
-1. The **ACL** is the only code that talks to ZGW APIs; no other service constructs
-   ZGW URLs.
-2. The **Workflow Client** is the only code that talks to Flowable; BPMN models hold
-   no OpenZaak knowledge.
-3. **Portals talk only to the BFF** — never directly to a backend or a peer module.
-4. **No direct database access across services or to any peer.** Each service owns
-   its schema; the Read Projection is a rebuildable derived artefact.
-5. **Idempotency at every event boundary** (the Event Subscriber tolerates duplicate
-   and out-of-order NRC events).
-
-Bending any of these is an ADR-worthy moment (CLAUDE.md §14): stop and open an
-`adr-proposal` issue first.
-
-## Consequences
-
-**Positive**
-
-- Upstream modules can be upgraded or swapped behind their APIs without rippling
-  through our services.
-- Coupling is visible and minimal — anti-corruption code lives in one named place.
-- The architecture teaches the Common Ground pattern by enforcing it.
-
-**Negative / costs**
-
-- More indirection: a translation layer (ACL, Workflow Client) instead of direct
-  calls. Accepted — it's the point.
-- Eventual consistency across aggregates must be designed for, not assumed away.
-
-**Follow-up**
-
-- Each integration slice that touches a boundary references this ADR; new boundary
-  decisions get their own ADR.

docs/gitea-workflow.md

@@ -1,52 +0,0 @@
-# Working with Gitea: issues, milestones, PRs
-
-Gitea is the **system of record** (CLAUDE.md §7). `BACKLOG.md` is a human-readable
-mirror of the active milestone — when they disagree, Gitea wins.
-
-## Issues
-
-- Open issues from the templates in `.gitea/ISSUE_TEMPLATE/`:
-  - **Slice** — a backlog user story (`S-NN · …`), encodes the Definition of Done.
-  - **Bug** — a defect.
-  - **ADR proposal** — a decision to record before coding (CLAUDE.md §14).
-- Every issue gets `type:*` plus the relevant `area:*` label(s), and is assigned to
-  its iteration **milestone** (`Iteration N — …`).
-- Splitting a slice that grew too big: see CLAUDE.md §13 and the "How to split a
-  slice" section of `BACKLOG.md`.
-
-## Branches & commits
-
-- Trunk-based: short-lived branches off `main`, squash-merged. Never push to `main`.
-- Branch name: `<type>/<issue-number>-<slug>`, e.g. `feat/28-bff-health`.
-- Conventional Commits, each referencing its issue: `feat(bff): … (refs #28)`.
-- TDD order: the `test(...)` red commit precedes the `feat(...)` green commit.
-
-## Pull requests
-
-- Open with `tea pr create` (the Gitea CLI) or the web UI; the body uses
-  `.gitea/PULL_REQUEST_TEMPLATE.md` and its DoD checklist.
-- The merging PR closes its issue via `closes #NN` in the squash-commit body.
-  Work that isn't finished (e.g. CI green pending a runner) uses `refs #NN` and the
-  issue stays open.
-- A PR needs a linked issue. Don't open one without it.
-
-## CI gate
-
-Until a self-hosted `respellion-linux` runner is registered, `make ci` is the gate
-(it runs the same checks the workflow does). See [runbooks/ci.md](runbooks/ci.md).
-
-## CLI cheatsheet (`tea`)
-
-```bash
-tea issues list --state open          # backlog
-tea issue create --title "S-NN · …" --labels type:slice,area:bff --milestone "Iteration 1 — Walking Skeleton"
-tea pr create --base main --head <branch> --title "…" --description "… closes #NN"
-tea pr list                           # open PRs
-tea pr merge <n> --style squash       # merge (after review)
-```
-
-## Changelog & releases
-
-`CHANGELOG.md` is generated from commits by `git-cliff` (`make changelog`), refreshed
-on tag. Versioning is **CalVer** `YYYY.MM.PATCH`; releases are published via Gitea
-Releases.

docs/index.md

@@ -1,23 +0,0 @@
-# register-referentie
-
-A reference application demonstrating Respellion's Common Ground architecture
-pattern. Quality and architectural clarity over feature throughput — every commit
-should teach.
-
-## Where to go
-
-- **[Product Requirements](PRD.md)** — what we're building and why.
-- **[ADR-0001: Loose coupling](architecture/adr-0001-loose-coupling.md)** — the
-  non-negotiable integration stance; the template for future ADRs.
-- **[Working in Gitea](gitea-workflow.md)** — issues, milestones, branches, PRs.
-- **[CI runbook](runbooks/ci.md)** — the pipeline and the `make ci` local gate.
-
-## Quickstart
-
-See the repository `README.md`. In short: clone, then either run the checks with
-`make ci`, or bring the BFF up with
-`docker compose -f infra/docker-compose.yml up -d --build --wait` and
-`curl http://localhost:8080/health`.
-
-> This site is built with MkDocs Material (`mkdocs build`). It grows with the
-> backlog; sections appear as their slices land.

docs/runbooks/ci.md

@@ -1,104 +0,0 @@
-# CI runbook — Gitea Actions
-
-> **Status: no runner yet → run CI locally with `make ci`.** The workflow
-> `.gitea/workflows/ci.yaml` is in place, but the pipeline cannot go green until a
-> self-hosted `respellion-linux` runner is registered against the Gitea instance.
-> Until then, **`make ci` is the gate** — it runs the exact same checks locally
-> (the workflow calls the same `make` targets). Issue **#30 (S-00-c)** stays open
-> until CI is verified green on a runner.
-
-## The pipeline
-
-`.gitea/workflows/ci.yaml` runs on every push and pull request to `main`. Each job
-calls a `make` target — the **single source of truth** for the checks, so local
-and CI cannot drift:
-
-| Job | Target | Needs |
-|---|---|---|
-| `lint` | `make lint` → `dotnet format … --verify-no-changes` | .NET 10 SDK |
-| `build` | `make build` → `dotnet build … -c Release` | .NET 10 SDK |
-| `unit` | `make unit` → `dotnet test … -c Release` | .NET 10 SDK |
-| `compose-smoke` | `make smoke` → compose up `--wait` → `curl /health` → `down` | container engine + compose v2 |
-
-All `uses:` references are absolute, tag-pinned URLs (`https://github.com/actions/checkout@v4`,
-`https://github.com/actions/setup-dotnet@v4`) per CLAUDE.md §8.7 and §15 — Gitea
-Actions resolves them from GitHub.
-
-## Running CI locally (`make ci`)
-
-Until the runner exists, run the full pipeline yourself before pushing:
-
-```bash
-make ci          # lint + build + unit + smoke — what the pipeline runs
-make lint        # or a single stage
-make smoke       # compose up --wait, curl /health, tear down
-```
-
-**Prerequisites:** .NET 10 SDK, a container engine with Compose v2, and `curl`.
-
-On a **rootless Podman** box (the default dev setup here), the `smoke` target needs
-the Podman API socket and a Compose provider:
-
-```bash
-systemctl --user enable --now podman.socket            # start the API socket
-ln -sf "$(command -v podman)" ~/.local/bin/docker      # docker -> podman shim
-# install Docker Compose v2 into ~/.local/bin as `docker-compose` (the provider)
-```
-
-The Makefile auto-points `DOCKER_HOST` at `/run/user/$(id -u)/podman/podman.sock`
-when that socket exists and `DOCKER_HOST` is unset, so `make smoke` "just works"
-locally while leaving real Docker hosts / CI runners untouched.
-
-## Runner: `respellion-linux`
-
-The single self-hosted runner label this repo targets is **`respellion-linux`**
-(declared here per §15). It is intended to run **co-located on the Gitea server**
-(`git.labs.respellion.tech` / `46.224.220.37`) so CI is durable and independent of
-any developer machine.
-
-### Host prerequisites
-
-The runner executes jobs in **host mode** (see registration below), so the host
-must have, on `PATH`:
-
-- .NET 10 SDK (or let `setup-dotnet` install it into the runner tool cache)
-- A container engine with Compose v2 — Docker, or Podman with the Docker-compatible
-  socket and the `docker-compose` provider (as configured on the dev box)
-- `curl`
-
-### Install & register `act_runner` (on the Gitea server)
-
-```bash
-# 1. Install the binary (pick the version matching the Gitea release line)
-VER=0.2.11
-curl -fsSL -o /usr/local/bin/act_runner \
-  "https://dl.gitea.com/act_runner/${VER}/act_runner-${VER}-linux-amd64"
-chmod +x /usr/local/bin/act_runner
-
-# 2. Obtain a registration token from the Gitea UI:
-#    Site Administration → Actions → Runners → "Create new Runner"  (instance-level)
-#    (or Repo → Settings → Actions → Runners for a repo-scoped runner)
-
-# 3. Register with the respellion-linux label in HOST execution mode.
-#    The ":host" suffix means jobs run directly on the host shell, so
-#    `docker compose` in compose-smoke uses the host engine (no docker-in-docker).
-act_runner register --no-interactive \
-  --instance https://git.labs.respellion.tech \
-  --token <REGISTRATION_TOKEN> \
-  --name respellion-ci-1 \
-  --labels "respellion-linux:host"
-
-# 4. Run it (foreground to verify, then install as a systemd service)
-act_runner daemon
-```
-
-Verify in the Gitea UI (Actions → Runners) that `respellion-ci-1` shows **Idle**,
-then re-run the `CI` workflow; all four jobs should pass.
-
-## Security note
-
-A self-hosted runner in **host mode** executes workflow code directly on the Gitea
-server host. Anyone who can push a workflow can run code there. This is acceptable
-for a **private lab** instance with trusted contributors. For anything
-internet-facing, switch to container/VM isolation (`--labels "respellion-linux:docker://..."`)
-or a dedicated runner host, and gate workflow runs on approval for outside PRs.

docs/runbooks/openzaak.md

@@ -1,50 +0,0 @@
-# OpenZaak runbook
-
-The OpenZaak stack (`infra/openzaak/docker-compose.yml`) is a lean adaptation of the
-upstream open-zaak dev compose: PostGIS db, redis, a one-shot init that runs
-migrations, the OpenZaak API, and a celery worker.
-
-## Quick test (`make`)
-
-```bash
-make openzaak-up       # start the stack (first run pulls images + migrates: 1-3 min)
-make openzaak-smoke    # start + assert it's up with auth enforced (403/302/200)
-make openzaak-down     # stop and wipe data
-```
-
-`make openzaak-smoke` polls until the API responds, then asserts:
-
-| Check | Expected |
-|---|---|
-| `GET /zaken/api/v1/zaken` (no JWT) | **403** — `PermissionDenied` ZGW fout (auth enforced) |
-| `GET /admin/` | **302** — admin login redirect |
-| `GET /zaken/api/v1/` | **200** — ZGW API schema root |
-
-> **403, not 401.** OpenZaak's ZGW APIs return `403 PermissionDenied` for a missing
-> or invalid JWT. The S-01 acceptance text says "401" — that's inaccurate; 403 is the
-> correct auth-enforced response.
-
-The admin UI is at <http://localhost:8000/admin/>; the dev superuser is **admin /
-admin** (from the compose env — dev only).
-
-## Prerequisites (rootless Podman)
-
-Same setup as the rest of the repo (see [ci.md](ci.md)):
-
-```bash
-systemctl --user start podman.socket    # the Docker-API socket the shim talks to
-```
-
-The Makefile auto-points `DOCKER_HOST` at the Podman socket when it exists, so the
-`make openzaak-*` targets work without extra env.
-
-## Notes
-
-- **Not in `make ci`.** The OpenZaak smoke is a separate, heavier check (large image
-  pull + migrations); it is intentionally kept out of `make ci` so the core gate
-  stays fast. Run `make openzaak-smoke` when you touch the OpenZaak stack.
-- **No catalogus/zaaktypen yet.** Seeding the `BIG` catalogus + `BIG-registratie`
-  zaaktype and a JWT client is the next slice (**S-01-b**); authenticated zaaktype
-  listing isn't testable until then.
-- **Image tag.** Currently `openzaak/open-zaak:latest` via `${OPENZAAK_TAG}`; pin to
-  a known-good tag as part of the catalogus-design ADR.

global.json

@@ -1,6 +0,0 @@
-{
-  "sdk": {
-    "version": "10.0.203",
-    "rollForward": "latestFeature"
-  }
-}

infra/docker-compose.yml

@@ -1,19 +0,0 @@
-# Local development stack. Grows service-by-service with each slice.
-# S-00-b: the placeholder BFF with a /health check.
-#
-#   docker compose -f infra/docker-compose.yml up -d --build --wait
-#   curl http://localhost:8080/health   # -> Healthy
-services:
-  bff:
-    build:
-      context: ../services/bff
-      dockerfile: Dockerfile
-    image: register-referentie/bff:dev
-    ports:
-      - "8080:8080"
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s

infra/openzaak/docker-compose.yml

@@ -1,88 +0,0 @@
-# OpenZaak stack (S-01). Lean adaptation of the upstream open-zaak dev compose:
-# db (PostGIS) + redis + a one-shot init (migrations) + the API + a celery worker.
-# Dropped from upstream for leanness: nginx, celery-beat, flower, OTEL.
-#
-#   docker compose -f infra/openzaak/docker-compose.yml up -d --wait
-#   curl -i http://localhost:8000/zaken/api/v1/zaken   # -> 401 (auth required)
-#
-# NOTE: image pinned to a tag (not :latest) once a known-good tag is chosen; see
-# the catalogus-design ADR. Using a tag var with a sensible default for now.
-services:
-  oz-db:
-    image: docker.io/postgis/postgis:17-3.5
-    environment:
-      POSTGRES_USER: openzaak
-      POSTGRES_PASSWORD: openzaak
-      POSTGRES_DB: openzaak
-    command: postgres -c max_connections=300
-    volumes:
-      - oz-db:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U openzaak -d openzaak"]
-      interval: 5s
-      timeout: 3s
-      retries: 10
-    networks: [oz]
-
-  oz-redis:
-    image: docker.io/library/redis:7
-    networks: [oz]
-
-  oz-init:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
-    environment: &oz-env
-      DJANGO_SETTINGS_MODULE: openzaak.conf.docker
-      SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production}
-      DB_HOST: oz-db
-      DB_NAME: openzaak
-      DB_USER: openzaak
-      DB_PASSWORD: openzaak
-      IS_HTTPS: "no"
-      ALLOWED_HOSTS: "*"
-      CACHE_DEFAULT: oz-redis:6379/0
-      CACHE_AXES: oz-redis:6379/0
-      CELERY_BROKER_URL: redis://oz-redis:6379/1
-      CELERY_RESULT_BACKEND: redis://oz-redis:6379/1
-      DISABLE_2FA: "true"
-      OPENZAAK_SUPERUSER_USERNAME: admin
-      DJANGO_SUPERUSER_PASSWORD: admin
-      OPENZAAK_SUPERUSER_EMAIL: admin@localhost
-      RUN_SETUP_CONFIG: "false"
-    command: /setup_configuration.sh
-    depends_on:
-      oz-db:
-        condition: service_healthy
-      oz-redis:
-        condition: service_started
-    networks: [oz]
-
-  openzaak:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
-    environment: *oz-env
-    healthcheck:
-      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
-      start_period: 30s
-    ports:
-      - "8000:8000"
-    depends_on:
-      oz-init:
-        condition: service_completed_successfully
-    networks: [oz]
-
-  oz-celery:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
-    environment: *oz-env
-    command: /celery_worker.sh
-    depends_on:
-      oz-init:
-        condition: service_completed_successfully
-    networks: [oz]
-
-volumes:
-  oz-db:
-
-networks:
-  oz:

mkdocs.yml

@@ -1,41 +0,0 @@
-site_name: register-referentie
-site_description: Reference application for Respellion's Common Ground architecture pattern
-docs_dir: docs
-
-theme:
-  name: material
-  features:
-    - navigation.sections
-    - navigation.top
-    - content.code.copy
-  palette:
-    - scheme: default
-      toggle:
-        icon: material/brightness-7
-        name: Switch to dark mode
-    - scheme: slate
-      toggle:
-        icon: material/brightness-4
-        name: Switch to light mode
-
-nav:
-  - Home: index.md
-  - Product Requirements: PRD.md
-  - Architecture:
-      - "ADR-0001: Loose coupling": architecture/adr-0001-loose-coupling.md
-  - Working in Gitea: gitea-workflow.md
-  - Runbooks:
-      - CI: runbooks/ci.md
-
-markdown_extensions:
-  - admonition
-  - toc:
-      permalink: true
-  - pymdownx.superfences
-
-# Many docs referenced by PRD.md land in later slices; don't fail the build on them.
-validation:
-  nav:
-    omitted_files: warn
-  links:
-    not_found: warn

services/bff/.dockerignore

@@ -1,3 +0,0 @@
-**/bin
-**/obj
-**/*.user

services/bff/Bff.Api/Bff.Api.csproj

@@ -1,9 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk.Web">
-
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <Nullable>enable</Nullable>
-    <ImplicitUsings>enable</ImplicitUsings>
-  </PropertyGroup>
-
-</Project>

services/bff/Bff.Api/Program.cs

@@ -1,12 +0,0 @@
-var builder = WebApplication.CreateBuilder(args);
-builder.Services.AddHealthChecks();
-
-var app = builder.Build();
-
-app.MapGet("/", () => "BFF placeholder");
-app.MapHealthChecks("/health");
-
-app.Run();
-
-// Exposed so the test host (WebApplicationFactory<Program>) can boot the app.
-public partial class Program;

services/bff/Bff.Api/Properties/launchSettings.json

@@ -1,23 +0,0 @@
-{
-  "$schema": "https://json.schemastore.org/launchsettings.json",
-  "profiles": {
-    "http": {
-      "commandName": "Project",
-      "dotnetRunMessages": true,
-      "launchBrowser": true,
-      "applicationUrl": "http://localhost:5249",
-      "environmentVariables": {
-        "ASPNETCORE_ENVIRONMENT": "Development"
-      }
-    },
-    "https": {
-      "commandName": "Project",
-      "dotnetRunMessages": true,
-      "launchBrowser": true,
-      "applicationUrl": "https://localhost:7106;http://localhost:5249",
-      "environmentVariables": {
-        "ASPNETCORE_ENVIRONMENT": "Development"
-      }
-    }
-  }
-}

services/bff/Bff.Api/appsettings.Development.json

@@ -1,8 +0,0 @@
-{
-  "Logging": {
-    "LogLevel": {
-      "Default": "Information",
-      "Microsoft.AspNetCore": "Warning"
-    }
-  }
-}

services/bff/Bff.Api/appsettings.json

@@ -1,9 +0,0 @@
-{
-  "Logging": {
-    "LogLevel": {
-      "Default": "Information",
-      "Microsoft.AspNetCore": "Warning"
-    }
-  },
-  "AllowedHosts": "*"
-}

services/bff/Bff.Tests/Bff.Tests.csproj

@@ -1,26 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <Nullable>enable</Nullable>
-    <IsPackable>false</IsPackable>
-  </PropertyGroup>
-
-  <ItemGroup>
-    <PackageReference Include="coverlet.collector" Version="6.0.4" />
-    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.8" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
-    <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <Using Include="Xunit" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <ProjectReference Include="..\Bff.Api\Bff.Api.csproj" />
-  </ItemGroup>
-
-</Project>

services/bff/Bff.Tests/HealthEndpointTests.cs

@@ -1,20 +0,0 @@
-using System.Net;
-using Microsoft.AspNetCore.Mvc.Testing;
-
-namespace Bff.Tests;
-
-public class HealthEndpointTests(WebApplicationFactory<Program> factory)
-    : IClassFixture<WebApplicationFactory<Program>>
-{
-    [Fact]
-    public async Task Health_endpoint_returns_200_and_reports_healthy()
-    {
-        var client = factory.CreateClient();
-
-        var response = await client.GetAsync("/health");
-
-        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
-        var body = await response.Content.ReadAsStringAsync();
-        Assert.Contains("Healthy", body);
-    }
-}

services/bff/Bff.slnx

@@ -1,4 +0,0 @@
-<Solution>
-  <Project Path="Bff.Api/Bff.Api.csproj" />
-  <Project Path="Bff.Tests/Bff.Tests.csproj" />
-</Solution>

services/bff/Dockerfile

@@ -1,30 +0,0 @@
-# Multi-stage build for the placeholder BFF (.NET 10).
-# Build context is services/bff (see infra/docker-compose.yml).
-FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
-WORKDIR /src
-
-# Restore first (cached unless the csproj changes).
-COPY Bff.Api/Bff.Api.csproj Bff.Api/
-RUN dotnet restore Bff.Api/Bff.Api.csproj
-
-# Then build + publish.
-COPY Bff.Api/ Bff.Api/
-RUN dotnet publish Bff.Api/Bff.Api.csproj -c Release -o /app/publish /p:UseAppHost=false
-
-FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtime
-WORKDIR /app
-
-# curl is used by the container HEALTHCHECK / compose healthcheck.
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends curl \
-    && rm -rf /var/lib/apt/lists/*
-
-COPY --from=build /app/publish .
-
-ENV ASPNETCORE_URLS=http://+:8080
-EXPOSE 8080
-
-HEALTHCHECK --interval=5s --timeout=3s --start-period=10s --retries=5 \
-    CMD curl -fsS http://localhost:8080/health || exit 1
-
-ENTRYPOINT ["dotnet", "Bff.Api.dll"]