fix(workflow): read task query variables from 'variables', not 'processVariables' (refs #13 )

Flowable's POST query/tasks returns the included process variables under the key 'variables' (the request opts in via includeProcessVariables). The client DTO, its unit test, and the live-check parser all looked for 'processVariables', so the werkbak never matched a task's registrationId and verify-domain timed out. Verified by driving a real Flowable instance end-to-end locally: start -> complete external job -> the Beoordelen task carries registrationId under 'variables'. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fix(workflow): query Flowable tasks at service/query/tasks, not runtime/tasks/query (refs #13 )
2026-07-15 10:29:43 +02:00 · 2026-07-15 09:57:11 +02:00 · 2026-07-15 09:24:53 +02:00 · 2026-07-15 09:21:35 +02:00 · 2026-07-15 09:19:19 +02:00 · 2026-07-15 09:18:03 +02:00
162 changed files with 248 additions and 9041 deletions
@@ -142,8 +142,6 @@ jobs:
      # reaches green health" smoke (it replaces the old compose-smoke job).
      - name: Bring up the full stack & wait for health
        run: make verify-up
      - name: Observability backplane (Grafana + Tempo + Prometheus datasources)
        run: OBS_TIMEOUT=180 make verify-observability
      - name: ACL ↔ OpenZaak integration tests
        run: make verify-acl
      - name: OpenZaak → NRC notification delivery
@@ -154,14 +152,12 @@ jobs:
        run: make verify-domain
      - name: BFF → Keycloak + domain + projection
        run: make verify-bff
      - name: Distributed traces reach Tempo (one connected trace across services)
        run: TRACING_TIMEOUT=120 make verify-tracing
      - name: Self-service e2e (Playwright, login → submit → success)
        run: make verify-e2e
      # Log dump must precede teardown (which removes the containers).
      - name: Dump container logs on failure
        if: failure()
-        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-db flowable-rest flowable-init keycloak acl bff domain projection-db event-subscriber projection-api self-service openbaar behandel tempo prometheus grafana 2>&1 || true
+        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-db flowable-rest flowable-init keycloak acl bff domain projection-db event-subscriber projection-api self-service 2>&1 || true
      - name: Tear down
        if: always()
        run: make down
@@ -199,25 +199,9 @@ _Split from the original S-09 — scoped to the portal only; the approval flow i
 ### S-10 · Document upload + boundary timer for document timeout (Flow 2)
-Split (issue #11 closed) into two independently-demoable slices per §13 — the original spanned six net-new surfaces including a new ZGW boundary:
+**Outcome:** BPMN extended with a "wacht op documenten" user task with a 30-day boundary timer. Self-service portal supports diploma upload. On timeout the case is cancelled.
-#### S-10a · Document-wait task + 30-day timeout cancellation + provision trigger — #102
+**Acceptance:** BDD scenarios for both branches; integration tests for the timer firing.
 **Outcome:** BPMN gains a `WachtOpDocumenten` user task with a 30-day (P30D) interrupting boundary timer. On timeout the case is cancelled — the timer runs to a dedicated cancel end-event and the domain aggregate moves to a new terminal status `Verlopen` via an external-worker (mirrors S-14 escalation / S-11 withdrawal). "Documents received" is wired end-to-end (domain endpoint + BFF + a "Documenten aanleveren" button on the self-service page) so the walking-skeleton e2e stays green — but the document is **not yet stored** in ZGW; that is S-10b.
 **Acceptance:** BDD both branches (documents-in-time vs timeout-cancel); live timer-fire via the management-API "move" idiom; the registration e2e provides documents before the behandelaar step.
 #### S-10b · Real diploma upload stored via the ACL Documenten API — #103
 **Outcome:** the self-service "Documenten aanleveren" action becomes a real file upload; the file (base64-encoded end-to-end) is stored in the ZGW Documenten (DRC) API as an `enkelvoudiginformatieobject` and related to the zaak, with all document calls routed through the ACL (§8.1, ADR-0018). Builds on the S-10a trigger/wait. Depends on #102.
 **Acceptance:** ACL Documenten gateway integration test (real OpenZaak); Playwright e2e uploads a real PDF.
 #### S-10c · Close the ZGW zaak on document-timeout expiry — #106
 **Outcome:** when the 30-day term lapses (S-10a `RegistratieVerlopen`), the ZGW zaak is set to a distinct non-terminal `Geannuleerd` status + `Vervallen` resultaat (not just the domain aggregate → `Verlopen`), resolved by name in the ACL. Adds the cancellation statustype/resultaattype to the seed + an ACL `CancelZaakAsync`/`POST /annuleringen` + expiry-worker wiring. Carved from S-10b (ADR-0017/0018/0019). Depends on #103.
 **Acceptance:** ACL↔OpenZaak integration test (cancellation records `Geannuleerd` + a resultaat, live); the domain verify script fires the P30D timer and asserts the zaak reaches `Geannuleerd` end-to-end; BDD asserts the zaak is cancelled on timeout but untouched when documents arrive in time.
 ### S-11 · Withdrawal (Flow 3)
@@ -239,12 +223,6 @@ Split (issue #11 closed) into two independently-demoable slices per §13 — the
 **Outcome:** Boundary timer on beoordeling user task — 14 days. On timeout, reassigns to a teamlead role.
 ### S-26 · Self-service — resume an existing registration after refresh — #111
 **Outcome:** a signed-in zorgprofessional who reloads the self-service portal (or returns later) gets back to their in-flight registration and its actions (Documenten aanleveren, Trek aanvraag in), instead of a blank submit form with the reference lost. Today all post-submit state lives in in-memory signals, the reference is not in the URL, and there is no self-service read endpoint — so a reload strands the registration. Adds an owner-scoped (DigiD bsn) `GET /self-service/registrations` on the BFF/domain and a load-on-init/route restore in the portal.
 **Acceptance:** BDD — resume after refresh shows the existing registration; lookup is owner-scoped (never another citizen's); a user with no in-flight registration still sees the submit form. Playwright e2e reloads mid-flow and asserts the actions remain reachable.
 ---
 ## Iteration 3 — Maintenance portal and observability *(milestone: `Iteration 3 — Beheer & Observability`)*
@@ -253,19 +231,13 @@ Split (issue #11 closed) into two independently-demoable slices per §13 — the
 **Outcome:** Beheer portal lets an admin view ZTC catalogi (read-only first), and manage the ACL's default-fill configuration via a CRUD UI. MFA on the medewerker realm enforced.
-### S-16 · OpenTelemetry traces + Grafana dashboard *(split — #17 closed)*
+### S-16 · OpenTelemetry traces + Grafana dashboard
 **Outcome:** Traces span portal → BFF → Domain → ACL → OpenZaak and portal → BFF → Domain → Flowable. Grafana dashboards pre-built for golden signals.
-Split into independently deployable sub-slices (CLAUDE.md §13):
+### S-17 · Quartz.NET scheduler — herregistratie reminder sweep
- **S-16a** (#122) · Observability backplane — Grafana Tempo + Prometheus + Grafana in compose, datasources auto-provisioned (ADR-0023). No collector; config baked into built images.
+**Outcome:** Nightly job that finds entries within 90 days of expiry and emits a domain event. (No outbound notification in v1 — logged.)
 - **S-16b** (#123) · Distributed traces across the five .NET services (OTLP → Tempo; traceparent propagates via the typed HttpClients). Depends on S-16a. ✅
 - **S-16c** (#124) · Prometheus metrics + golden-signal Grafana dashboards. Depends on S-16a.
 ### S-17 · Quartz.NET scheduler — herregistratie reminder sweep ✅
 **Outcome:** Daily Quartz.NET cron job finds inscriptions within 90 days of their herregistratie deadline and reminds each (flag on the aggregate + log). No outbound notification and no domain event in v1 — the reminder is the persisted flag, surfaced on the read model (ADR-0022, #120). Quartz fires time-triggered sweeps; the existing pumps stay as queue-drainers.
 ---
@@ -10,7 +10,7 @@ COMPOSE    := infra/docker-compose.yml
 # Long-running services with a healthcheck — the smoke polls these for readiness
 # (infra/wait-healthy.sh). One-shot init jobs (oz-init, nrc-init, flowable-init)
 # are not polled; they only need to have run. See docs/runbooks/gitea-actions-gotchas.md.
-WAIT_SVCS  := openzaak nrc-web acl bff domain event-subscriber projection-api self-service openbaar behandel
+WAIT_SVCS  := openzaak nrc-web acl bff domain event-subscriber projection-api self-service openbaar
 # Config files (OpenZaak data.yaml, Keycloak realms, Flowable BPMN) are streamed
 # into external named volumes via `docker cp` (infra/seed-config.sh) instead of
 # bind-mounted, because bind mounts don't reach sibling containers on the
@@ -43,7 +43,7 @@ export DOCKER_HOST := unix://$(PODMAN_SOCK)
 endif
 endif
-.PHONY: ci lint build unit mutation frontend integration verify verify-up verify-acl verify-nrc verify-projection verify-bff verify-domain verify-observability verify-tracing verify-notifications smoke up down local verify-local local-down changelog openzaak-up openzaak-smoke openzaak-seed openzaak-down stack-up stack-smoke stack-down keycloak-up keycloak-smoke keycloak-down flowable-up flowable-smoke flowable-down help
+.PHONY: ci lint build unit mutation frontend integration verify verify-up verify-acl verify-nrc verify-projection verify-bff verify-domain verify-notifications smoke up down local local-down changelog openzaak-up openzaak-smoke openzaak-seed openzaak-down stack-up stack-smoke stack-down keycloak-up keycloak-smoke keycloak-down flowable-up flowable-smoke flowable-down help
 ## ci: run the full pipeline — lint, build, unit, mutation, frontend, verify (mirrors Gitea Actions)
 ## `verify` is the live-stack stage (full stack up once → ACL + notification checks).
@@ -114,11 +114,6 @@ local:
 	docker compose -f $(LOCAL_COMPOSE) up -d --build
 	WAIT_TIMEOUT=420 bash infra/wait-healthy.sh $(WAIT_SVCS)
 ## verify-local: acceptance check for the local stack (S-B04) — a fresh `make local` completes the
 ## whole flow (zaaktype seeded + DMN deployed + NRC abonnement) with NO manual seeding.
 verify-local:
 	bash infra/run-local-flow-check.sh
 ## local-down: stop and remove the bind-mount stack
 local-down:
 	docker compose -f $(LOCAL_COMPOSE) down --volumes
@@ -170,16 +165,6 @@ verify-bff:
 verify-e2e:
 	bash infra/run-e2e-check.sh
 ## verify-observability: assert the observability backplane (Grafana + provisioned Tempo &
 ## Prometheus datasources) is live, against the already-running stack (S-16a).
 verify-observability:
 	bash infra/run-observability-check.sh
 ## verify-tracing: assert one connected distributed trace spans the .NET services in Tempo
 ## (S-16b), against the already-running stack.
 verify-tracing:
 	bash infra/run-tracing-check.sh
 ## verify: local mirror of the CI verify-stack job — full stack up once, all checks,
 ## tear down (always). For fast single-concern local iteration use `integration`
 ## (oz-only) or `verify-notifications` (oz+nrc) instead.
@@ -1,27 +0,0 @@
 # Multi-stage build for the behandel portal (Angular → nginx).
 # Build context is the repo root (the app needs the pnpm workspace + libs). See infra/docker-compose.yml.
 FROM node:24-slim AS build
 WORKDIR /src
 RUN corepack enable && corepack prepare pnpm@11.5.2 --activate
 # Restore first (cached unless the manifests change).
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml nx.json tsconfig.base.json eslint.config.mjs ./
 RUN pnpm install --frozen-lockfile
 # Sources (only what the app + its libs need).
 COPY apps/behandel apps/behandel
 COPY libs libs
 RUN pnpm nx build behandel
 FROM nginx:1.27-alpine AS runtime
 COPY apps/behandel/nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=build /src/dist/apps/behandel/browser /usr/share/nginx/html
 # Compose-time OIDC config: the browser (Playwright, on the compose network) reaches Keycloak by
 # service name, so the token issuer matches the BFF's medewerker authority (host-consistent, ADR-0013).
 RUN printf '{ "authority": "http://keycloak:8080/realms/medewerker" }\n' > /usr/share/nginx/html/config.json
 # Make the reverse-proxy resolver engine-portable (Docker 127.0.0.11 vs podman aardvark); runs from
 # the nginx image's /docker-entrypoint.d before nginx starts.
 COPY apps/portal-nginx-resolver.sh /docker-entrypoint.d/40-resolver.sh
 RUN chmod +x /docker-entrypoint.d/40-resolver.sh
 EXPOSE 80
@@ -1,34 +0,0 @@
 import nx from '@nx/eslint-plugin';
 import baseConfig from '../../eslint.config.mjs';
 export default [
  ...nx.configs['flat/angular'],
  ...nx.configs['flat/angular-template'],
  ...baseConfig,
  {
    files: ['**/*.ts'],
    rules: {
      '@angular-eslint/directive-selector': [
        'error',
        {
          type: 'attribute',
          prefix: 'app',
          style: 'camelCase',
        },
      ],
      '@angular-eslint/component-selector': [
        'error',
        {
          type: 'element',
          prefix: 'app',
          style: 'kebab-case',
        },
      ],
    },
  },
  {
    files: ['**/*.html'],
    // Override or add rules here
    rules: {},
  },
 ];
@@ -1,24 +0,0 @@
 server {
  listen 80;
  server_name _;
  root /usr/share/nginx/html;
  index index.html;
  # Resolve the BFF via Docker's embedded DNS at request time (variable proxy_pass), so nginx starts
  # even before the BFF is up and picks up restarts — instead of failing to load the config.
  resolver 127.0.0.11 ipv6=off valid=30s;
  # Same-origin API: proxy the behandel endpoint group to the bff service. The api-client uses
  # relative URLs, so the browser calls this origin and nginx forwards to the BFF — no CORS, and the
  # medewerker token (same-origin) is attached by the app's interceptor (ADR-0013).
  location /behandel/ {
    set $bff http://bff:8080;
    proxy_pass $bff;
    proxy_set_header Host $host;
  }
  # SPA fallback — Angular client-side routing.
  location / {
    try_files $uri $uri/ /index.html;
  }
 }
@@ -1,80 +0,0 @@
 {
  "name": "behandel",
  "$schema": "../../node_modules/nx/schemas/project-schema.json",
  "projectType": "application",
  "prefix": "app",
  "sourceRoot": "apps/behandel/src",
  "tags": [],
  "targets": {
    "build": {
      "executor": "@angular/build:application",
      "outputs": ["{options.outputPath}"],
      "defaultConfiguration": "production",
      "options": {
        "outputPath": "dist/apps/behandel",
        "browser": "apps/behandel/src/main.ts",
        "tsConfig": "apps/behandel/tsconfig.app.json",
        "assets": [
          {
            "glob": "**/*",
            "input": "apps/behandel/public"
          }
        ],
        "styles": ["apps/behandel/src/styles.css"]
      },
      "configurations": {
        "production": {
          "budgets": [
            {
              "type": "initial",
              "maximumWarning": "1mb",
              "maximumError": "2mb"
            },
            {
              "type": "anyComponentStyle",
              "maximumWarning": "4kb",
              "maximumError": "8kb"
            }
          ],
          "outputHashing": "all"
        },
        "development": {
          "optimization": false,
          "extractLicenses": false,
          "sourceMap": true
        }
      }
    },
    "serve": {
      "continuous": true,
      "executor": "@angular/build:dev-server",
      "defaultConfiguration": "development",
      "configurations": {
        "production": {
          "buildTarget": "behandel:build:production"
        },
        "development": {
          "buildTarget": "behandel:build:development"
        }
      }
    },
    "lint": {
      "executor": "@nx/eslint:lint"
    },
    "test": {
      "executor": "@angular/build:unit-test",
      "options": {
        "watch": false
      }
    },
    "serve-static": {
      "continuous": true,
      "executor": "@nx/web:file-server",
      "options": {
        "buildTarget": "behandel:build",
        "staticFilePath": "dist/apps/behandel/browser",
        "spa": true
      }
    }
  }
 }
@@ -1,3 +0,0 @@
 {
  "authority": "http://localhost:8180/realms/medewerker"
 }
@@ -1,73 +0,0 @@
 import { provideHttpClient, withInterceptors } from '@angular/common/http';
 import { HttpTestingController, provideHttpClientTesting } from '@angular/common/http/testing';
 import { TestBed } from '@angular/core/testing';
 import { BffApiV1Service } from 'api-client';
 import { authInterceptor } from 'auth';
 import { AbstractSecurityStorage, ConfigurationService } from 'angular-auth-oidc-client';
 import { SECURE_API_ROUTES } from './app.config';
 // Guards the medewerker token wiring end-to-end. The api-client calls the BFF with RELATIVE URLs, and
 // the angular-auth-oidc-client interceptor attaches the token only when `req.url` starts with a
 // configured secureRoute. A regression to an absolute origin makes the relative URL never match, so
 // the behandel calls go out unauthenticated and the BFF answers 401. This drives the REAL interceptor
 // and the REAL api-client against the REAL production route value (SECURE_API_ROUTES); only the config
 // source and token storage are faked, so the assertion turns on the actual route-matching.
 describe('behandel medewerker token wiring', () => {
  let http: HttpTestingController;
  let bff: BffApiV1Service;
  const token = 'medewerker-access-token';
  beforeEach(() => {
    TestBed.configureTestingModule({
      providers: [
        provideHttpClient(withInterceptors([authInterceptor()])),
        provideHttpClientTesting(),
        {
          provide: ConfigurationService,
          useValue: {
            hasAtLeastOneConfig: () => true,
            getAllConfigurations: () => [{ configId: 'medewerker', secureRoutes: SECURE_API_ROUTES }],
          },
        },
        {
          // A signed-in session: the storage the interceptor's token lookup reads from.
          provide: AbstractSecurityStorage,
          useValue: {
            read: () => JSON.stringify({ authzData: token, authnResult: { id_token: 'id-token' } }),
            write: () => undefined,
            remove: () => undefined,
            clear: () => undefined,
          },
        },
      ],
    });
    http = TestBed.inject(HttpTestingController);
    bff = TestBed.inject(BffApiV1Service);
  });
  afterEach(() => http.verify());
  it('attaches the bearer token to the relative werkbak call', () => {
    bff.getBehandelWerkbak().subscribe();
    const req = http.expectOne('/behandel/werkbak');
    expect(req.request.headers.get('Authorization')).toBe(`Bearer ${token}`);
    req.flush([]);
  });
  it('attaches the bearer token to the relative decide call', () => {
    bff.postBehandelRegistrationsIdDecide('reg-1', { besluit: 'goedkeuren' }).subscribe();
    const req = http.expectOne('/behandel/registrations/reg-1/decide');
    expect(req.request.headers.get('Authorization')).toBe(`Bearer ${token}`);
    req.flush(null);
  });
  it('leaves the anonymous openbaar register call unauthenticated', () => {
    bff.getOpenbaarRegister().subscribe();
    const req = http.expectOne((r) => r.url === '/openbaar/register');
    expect(req.request.headers.has('Authorization')).toBe(false);
    req.flush([]);
  });
 });
@@ -1,39 +0,0 @@
 import { provideHttpClient, withInterceptors } from '@angular/common/http';
 import { ApplicationConfig, provideBrowserGlobalErrorListeners } from '@angular/core';
 import { provideRouter } from '@angular/router';
 import { authInterceptor, provideMedewerkerAuth } from 'auth';
 import { appRoutes } from './app.routes';
 /** Environment-specific settings fetched from /config.json at startup (see main.ts). */
 export interface RuntimeConfig {
  /** The Keycloak `medewerker` realm issuer as the browser reaches it (dev: localhost; compose: keycloak:8080). */
  authority: string;
 }
 /**
 * Route prefixes whose requests carry the medewerker token. These MUST match the **relative** URLs
 * the api-client actually calls (same-origin via the nginx proxy) — the interceptor matches on
 * `req.url`, which stays relative, so an absolute origin would never match and the token would go
 * unattached. Only `/behandel/` is secured; the app calls no other endpoint group.
 */
 export const SECURE_API_ROUTES = ['/behandel/'];
 /**
 * Build the app providers from runtime config. `redirectUrl` is the app's own origin (where Keycloak
 * redirects back). `secureRoutes` uses {@link SECURE_API_ROUTES} — relative prefixes, not the origin.
 */
 export function appConfig(runtime: RuntimeConfig): ApplicationConfig {
  const origin = typeof window !== 'undefined' ? window.location.origin : '/';
  return {
    providers: [
      provideBrowserGlobalErrorListeners(),
      provideRouter(appRoutes),
      provideHttpClient(withInterceptors([authInterceptor()])),
      provideMedewerkerAuth({
        authority: runtime.authority,
        redirectUrl: origin,
        secureRoutes: SECURE_API_ROUTES,
      }),
    ],
  };
 }
@@ -1 +0,0 @@
 <router-outlet></router-outlet>
@@ -1,7 +0,0 @@
 import { Route } from '@angular/router';
 import { authenticatedGuard } from 'auth';
 import { WerkbakPage } from './werkbak/werkbak-page';
 export const appRoutes: Route[] = [
  { path: '', component: WerkbakPage, canActivate: [authenticatedGuard] },
 ];
@@ -1,15 +0,0 @@
 import { provideRouter } from '@angular/router';
 import { render, screen } from '@testing-library/angular';
 import { App } from './app';
 describe('App', () => {
  it('renders the router outlet shell', async () => {
    const { container } = await render(App, {
      providers: [provideRouter([])],
    });
    // The shell is a thin host for routed pages (the WerkbakPage owns the heading).
    expect(container.querySelector('router-outlet')).toBeTruthy();
    expect(screen).toBeTruthy();
  });
 });
@@ -1,12 +0,0 @@
 import { Component } from '@angular/core';
 import { RouterModule } from '@angular/router';
@Component({
  imports: [RouterModule],
  selector: 'app-root',
  templateUrl: './app.html',
  styleUrl: './app.css',
 })
 export class App {
  protected title = 'behandel';
 }
@@ -1,64 +0,0 @@
 <main utrecht-document class="utrecht-theme">
  <utrecht-article>
    <utrecht-heading-1>Werkbak</utrecht-heading-1>
    <p utrecht-paragraph>
      Registraties die wachten op beoordeling. Keur elke registratie goed of wijs deze af.
    </p>
    @if (loading()) {
      <p utrecht-paragraph role="status">Bezig met laden…</p>
    } @else if (failed()) {
      <p utrecht-paragraph role="alert">
        Kon de werkbak niet laden. Controleer of je als behandelaar bent ingelogd en probeer het
        opnieuw.
      </p>
    } @else if (loaded() && items().length === 0) {
      <p utrecht-paragraph role="status">De werkbak is leeg.</p>
    } @else if (items().length > 0) {
      <table utrecht-table>
        <caption>
          Registraties in behandeling
        </caption>
        <thead>
          <tr>
            <th scope="col">Referentie</th>
            <th scope="col">BSN</th>
            <th scope="col">Status</th>
            <th scope="col">Actie</th>
          </tr>
        </thead>
        <tbody>
          @for (item of items(); track item.registrationId) {
            <tr>
              <td>{{ item.registrationId }}</td>
              <td>{{ item.bsn }}</td>
              <td>{{ item.status }}</td>
              <td>
                <button
                  utrecht-button
                  appearance="primary-action-button"
                  type="button"
                  [attr.aria-label]="'Goedkeuren ' + item.registrationId"
                  [disabled]="deciding() === item.registrationId"
                  (click)="decide(item.registrationId, 'goedkeuren')"
                >
                  Goedkeuren
                </button>
                <button
                  utrecht-button
                  appearance="secondary-action-button"
                  type="button"
                  [attr.aria-label]="'Afwijzen ' + item.registrationId"
                  [disabled]="deciding() === item.registrationId"
                  (click)="decide(item.registrationId, 'afwijzen')"
                >
                  Afwijzen
                </button>
              </td>
            </tr>
          }
        </tbody>
      </table>
    }
  </utrecht-article>
 </main>
@@ -1,110 +0,0 @@
 import { signal } from '@angular/core';
 import { fireEvent, render, screen } from '@testing-library/angular';
 import { of, throwError } from 'rxjs';
 import { BffApiV1Service, type WerkbakItem } from 'api-client';
 import { AuthService } from 'auth';
 import { axe } from 'vitest-axe';
 import { WerkbakPage } from './werkbak-page';
 const sample: WerkbakItem[] = [
  { registrationId: 'reg-1', bsn: '123456782', status: 'InBehandeling' },
  { registrationId: 'reg-2', bsn: '111222333', status: 'InBehandeling' },
 ];
 class FakeAuth extends AuthService {
  readonly isAuthenticated = signal(true);
  readonly bsn = signal<string | undefined>(undefined);
  override readonly roles = signal<readonly string[]>(['behandelaar']);
  login(): void {
    /* not exercised here */
  }
  logout(): void {
    /* spied in tests */
  }
 }
 function setup(
  overrides: {
    getBehandelWerkbak?: ReturnType<typeof vi.fn>;
    postBehandelRegistrationsIdDecide?: ReturnType<typeof vi.fn>;
  } = {},
 ) {
  const getBehandelWerkbak =
    overrides.getBehandelWerkbak ?? vi.fn().mockReturnValue(of(sample));
  const postBehandelRegistrationsIdDecide =
    overrides.postBehandelRegistrationsIdDecide ?? vi.fn().mockReturnValue(of(undefined));
  return {
    getBehandelWerkbak,
    postBehandelRegistrationsIdDecide,
    providers: [
      {
        provide: BffApiV1Service,
        useValue: { getBehandelWerkbak, postBehandelRegistrationsIdDecide },
      },
      { provide: AuthService, useClass: FakeAuth },
    ],
  };
 }
 describe('WerkbakPage', () => {
  it('lists the registrations awaiting beoordeling on open', async () => {
    const { getBehandelWerkbak, providers } = setup();
    await render(WerkbakPage, { providers });
    expect(getBehandelWerkbak).toHaveBeenCalled();
    expect(await screen.findByText('reg-1')).toBeTruthy();
    expect(screen.getByText('123456782')).toBeTruthy();
    expect(screen.getByText('reg-2')).toBeTruthy();
  });
  it('approves a registration (goedkeuren) and refreshes the werkbak', async () => {
    const { getBehandelWerkbak, postBehandelRegistrationsIdDecide, providers } = setup();
    await render(WerkbakPage, { providers });
    fireEvent.click((await screen.findAllByRole('button', { name: /goedkeuren/i }))[0]);
    expect(postBehandelRegistrationsIdDecide).toHaveBeenCalledWith('reg-1', {
      besluit: 'goedkeuren',
    });
    // Reloaded after the decision: once on open, once after deciding.
    expect(getBehandelWerkbak).toHaveBeenCalledTimes(2);
  });
  it('rejects a registration (afwijzen) via the decide endpoint', async () => {
    const { postBehandelRegistrationsIdDecide, providers } = setup();
    await render(WerkbakPage, { providers });
    fireEvent.click((await screen.findAllByRole('button', { name: /afwijzen/i }))[0]);
    expect(postBehandelRegistrationsIdDecide).toHaveBeenCalledWith('reg-1', {
      besluit: 'afwijzen',
    });
  });
  it('shows an empty state when the werkbak has no items', async () => {
    const { providers } = setup({ getBehandelWerkbak: vi.fn().mockReturnValue(of([])) });
    await render(WerkbakPage, { providers });
    expect(await screen.findByText(/werkbak is leeg/i)).toBeTruthy();
  });
  it('surfaces a load failure instead of swallowing it', async () => {
    const { providers } = setup({
      getBehandelWerkbak: vi.fn().mockReturnValue(throwError(() => new Error('403'))),
    });
    await render(WerkbakPage, { providers });
    expect(await screen.findByText(/kon de werkbak niet laden/i)).toBeTruthy();
  });
  it('has no WCAG 2.1 AA violations', async () => {
    document.documentElement.lang = 'nl';
    const { container } = await render(WerkbakPage, { providers: setup().providers });
    const results = await axe(container, {
      runOnly: { type: 'tag', values: ['wcag2a', 'wcag2aa', 'wcag21a', 'wcag21aa'] },
    });
    expect(results.violations).toEqual([]);
  });
 });
@@ -1,65 +0,0 @@
 import { Component, inject, signal } from '@angular/core';
 import { BffApiV1Service, type WerkbakItem } from 'api-client';
 import { UtrechtComponentsModule } from 'ui';
 /** The two decisions a behandelaar can make; the BFF validates these exact values (ADR-0013). */
 type Besluit = 'goedkeuren' | 'afwijzen';
 /**
 * The behandel werkbak: a signed-in behandelaar sees the registrations awaiting beoordeling (the open
 * Flowable `Beoordelen` tasks, read through the domain) and decides each — goedkeuren or afwijzen. A
 * decision posts to the BFF, which applies the domain transition and completes the workflow task
 * (ADR-0013; S-12). After a decision the werkbak refreshes so the handled item drops off the list.
 */
@Component({
  selector: 'app-werkbak-page',
  imports: [UtrechtComponentsModule],
  templateUrl: './werkbak-page.html',
 })
 export class WerkbakPage {
  private readonly bff = inject(BffApiV1Service);
  protected readonly items = signal<WerkbakItem[]>([]);
  protected readonly loading = signal(false);
  protected readonly loaded = signal(false);
  protected readonly failed = signal(false);
  protected readonly deciding = signal<string | undefined>(undefined);
  constructor() {
    this.load();
  }
  load(): void {
    this.loading.set(true);
    this.failed.set(false);
    this.bff.getBehandelWerkbak().subscribe({
      next: (rows: WerkbakItem[]) => {
        this.items.set(rows);
        this.loading.set(false);
        this.loaded.set(true);
      },
      // Surface the failure (e.g. 403 for a non-behandelaar) instead of swallowing it.
      error: () => {
        this.items.set([]);
        this.loading.set(false);
        this.loaded.set(true);
        this.failed.set(true);
      },
    });
  }
  decide(registrationId: string, besluit: Besluit): void {
    this.deciding.set(registrationId);
    this.bff.postBehandelRegistrationsIdDecide(registrationId, { besluit }).subscribe({
      // Refresh so the decided registration drops off the werkbak (its task is now completed).
      next: () => {
        this.deciding.set(undefined);
        this.load();
      },
      error: () => {
        this.deciding.set(undefined);
        this.failed.set(true);
      },
    });
  }
 }
@@ -1,13 +0,0 @@
 <!doctype html>
 <html lang="nl">
  <head>
    <meta charset="utf-8" />
    <title>Behandelportaal BIG-register</title>
    <base href="/" />
    <meta name="viewport" content="width=device-width, initial-scale=1" />
    <link rel="icon" type="image/x-icon" href="favicon.ico" />
  </head>
  <body>
    <app-root></app-root>
  </body>
 </html>
@@ -1,10 +0,0 @@
 import { bootstrapApplication } from '@angular/platform-browser';
 import { App } from './app/app';
 import { appConfig, type RuntimeConfig } from './app/app.config';
 // Load environment config before bootstrap so the OIDC authority is set per environment
 // (dev: localhost; compose: keycloak:8080) from a single build — 12-factor (S-08d).
 fetch('config.json')
  .then((response) => response.json() as Promise<RuntimeConfig>)
  .then((config) => bootstrapApplication(App, appConfig(config)))
  .catch((err) => console.error(err));
@@ -1,2 +0,0 @@
 /* NL Design System theme — Utrecht design tokens (docs/frontend-decisions.md). */
@import '@utrecht/design-tokens/dist/index.css';
@@ -1,9 +0,0 @@
 {
  "extends": "./tsconfig.json",
  "compilerOptions": {
    "outDir": "../../dist/out-tsc",
    "types": []
  },
  "include": ["src/**/*.ts"],
  "exclude": ["src/**/*.spec.ts", "src/**/*.test.ts"]
 }
@@ -1,31 +0,0 @@
 {
  "extends": "../../tsconfig.base.json",
  "compilerOptions": {
    "strict": true,
    "noImplicitOverride": true,
    "noPropertyAccessFromIndexSignature": true,
    "noImplicitReturns": true,
    "noFallthroughCasesInSwitch": true,
    "isolatedModules": true,
    "target": "es2022",
    "moduleResolution": "bundler",
    "emitDecoratorMetadata": false,
    "module": "preserve"
  },
  "angularCompilerOptions": {
    "enableI18nLegacyMessageIdFormat": false,
    "strictInjectionParameters": true,
    "strictInputAccessModifiers": true,
    "strictTemplates": true
  },
  "files": [],
  "include": [],
  "references": [
    {
      "path": "./tsconfig.app.json"
    },
    {
      "path": "./tsconfig.spec.json"
    }
  ]
 }
@@ -1,8 +0,0 @@
 {
  "extends": "./tsconfig.json",
  "compilerOptions": {
    "outDir": "../../dist/out-tsc",
    "types": ["vitest/globals"]
  },
  "include": ["src/**/*.ts", "src/**/*.d.ts"]
 }
@@ -17,9 +17,5 @@ FROM nginx:1.27-alpine AS runtime
 COPY apps/openbaar/nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=build /src/dist/apps/openbaar/browser /usr/share/nginx/html
 # No runtime config: the openbaar register is anonymous (no OIDC authority to inject).
 # Make the reverse-proxy resolver engine-portable (Docker 127.0.0.11 vs podman aardvark); runs from
 # the nginx image's /docker-entrypoint.d before nginx starts.
 COPY apps/portal-nginx-resolver.sh /docker-entrypoint.d/40-resolver.sh
 RUN chmod +x /docker-entrypoint.d/40-resolver.sh
 EXPOSE 80
@@ -1,17 +0,0 @@
 #!/bin/sh
 # Point nginx's reverse-proxy `resolver` at THIS container's real DNS server.
 #
 # The portal nginx configs use a variable proxy_pass, which needs a `resolver` so the BFF hostname is
 # resolved at request time (nginx can start before the BFF is up). The config hardcodes Docker's
 # embedded DNS (127.0.0.11) — correct on Docker/Docker Desktop, but rootless podman uses a
 # network-specific address (aardvark, e.g. 10.89.0.1), so proxied calls 502 there. Read the actual
 # nameserver from /etc/resolv.conf and substitute it, so the reverse proxy works on any engine.
 #
 # Runs from the nginx image's /docker-entrypoint.d/ before nginx starts. On Docker the nameserver IS
 # 127.0.0.11, so the substitution is a no-op. Guarded (no `set -e`) so it's safe whether the nginx
 # entrypoint executes or sources it.
 ns="$(awk '/^nameserver/{print $2; exit}' /etc/resolv.conf 2>/dev/null)"
 if [ -n "$ns" ] && [ "$ns" != "127.0.0.11" ]; then
  sed -i "s/resolver 127\.0\.0\.11/resolver $ns/" /etc/nginx/conf.d/default.conf 2>/dev/null || true
  echo "portal-nginx-resolver: set resolver to $ns"
 fi
@@ -19,9 +19,5 @@ COPY --from=build /src/dist/apps/self-service/browser /usr/share/nginx/html
 # Compose-time OIDC config: the browser (Playwright, on the compose network) reaches Keycloak by
 # service name, so the token issuer matches the BFF's authority (host-consistent, ADR-0010).
 RUN printf '{ "authority": "http://keycloak:8080/realms/digid" }\n' > /usr/share/nginx/html/config.json
 # Make the reverse-proxy resolver engine-portable (Docker 127.0.0.11 vs podman aardvark); runs from
 # the nginx image's /docker-entrypoint.d before nginx starts.
 COPY apps/portal-nginx-resolver.sh /docker-entrypoint.d/40-resolver.sh
 RUN chmod +x /docker-entrypoint.d/40-resolver.sh
 EXPOSE 80
@@ -3,56 +3,9 @@
    <utrecht-heading-1>Zelfservice — BIG-registratie</utrecht-heading-1>
    @if (submitted()) {
-      @if (withdrawn()) {
+      <p utrecht-paragraph role="status">
-        <p utrecht-paragraph role="status">
+        Uw registratie is ontvangen. Referentie: {{ reference() }}.
-          Uw registratie met referentie {{ reference() }} is ingetrokken.
+      </p>
        </p>
      } @else {
        <p utrecht-paragraph role="status">
          Uw registratie is ontvangen. Referentie: {{ reference() }}.
        </p>
        @if (documentsProvided()) {
          <p utrecht-paragraph role="status">Uw documenten zijn aangeleverd.</p>
        } @else {
          @if (provideDocumentsFailed()) {
            <p utrecht-paragraph role="alert">
              Het aanleveren van uw documenten is niet gelukt. Probeer het opnieuw.
            </p>
          }
          <p utrecht-paragraph>Lever uw diploma aan (PDF).</p>
          <label utrecht-form-label for="diploma">Diploma</label>
          <input
            id="diploma"
            type="file"
            accept="application/pdf"
            [disabled]="providingDocuments()"
            (change)="onFileSelected($event)"
          />
          <button
            utrecht-button
            appearance="primary-action-button"
            type="button"
            [disabled]="providingDocuments() || !selectedFile()"
            (click)="provideDocuments()"
          >
            Documenten aanleveren
          </button>
        }
        @if (withdrawFailed()) {
          <p utrecht-paragraph role="alert">
            Het intrekken van uw registratie is niet gelukt. Probeer het opnieuw.
          </p>
        }
        <button
          utrecht-button
          appearance="secondary-action-button"
          type="button"
          [disabled]="withdrawing()"
          (click)="withdraw()"
        >
          Trek aanvraag in
        </button>
      }
    } @else {
      <p utrecht-paragraph>U bent ingelogd met BSN {{ bsn() }}.</p>
      @if (failed()) {
@@ -17,29 +17,12 @@ class FakeAuth extends AuthService {
  }
 }
-function providers(
+function providers(post = vi.fn().mockReturnValue(of({ registrationId: 'reg-9', status: 'Ingediend' }))) {
  post = vi.fn().mockReturnValue(of({ registrationId: 'reg-9', status: 'Ingediend' })),
  withdraw = vi.fn().mockReturnValue(of(undefined)),
  provideDocuments = vi.fn().mockReturnValue(of(undefined)),
  // Resume lookup (S-26): default to 204/empty — no in-flight registration, so the submit form shows.
  getCurrent = vi.fn().mockReturnValue(of(undefined)),
 ) {
  return {
    post,
    withdraw,
    provideDocuments,
    getCurrent,
    providers: [
      { provide: AuthService, useClass: FakeAuth },
-      {
+      { provide: BffApiV1Service, useValue: { postSelfServiceRegistrations: post } },
        provide: BffApiV1Service,
        useValue: {
          getSelfServiceRegistrations: getCurrent,
          postSelfServiceRegistrations: post,
          postSelfServiceRegistrationsIdWithdraw: withdraw,
          postSelfServiceRegistrationsIdDocuments: provideDocuments,
        },
      },
    ],
  };
 }
@@ -60,21 +43,6 @@ describe('RegistrationPage', () => {
    expect(await screen.findByText(/ontvangen/i)).toBeTruthy();
  });
  it('resumes an existing registration on load, without submitting again (S-26)', async () => {
    const { post, providers: p } = providers(
      undefined,
      undefined,
      undefined,
      vi.fn().mockReturnValue(of({ registrationId: 'reg-77', status: 'Ingediend' })),
    );
    await render(RegistrationPage, { providers: p });
    // The confirmation view is restored from the in-flight registration — no submit click.
    expect(await screen.findByText(/ontvangen/i)).toBeTruthy();
    expect(screen.getByText(/reg-77/)).toBeTruthy();
    expect(post).not.toHaveBeenCalled();
  });
  it('shows an error and keeps the submit available when the BFF call fails', async () => {
    const { post, providers: p } = providers(vi.fn().mockReturnValue(throwError(() => new Error('BFF rejected'))));
    await render(RegistrationPage, { providers: p });
@@ -88,76 +56,6 @@ describe('RegistrationPage', () => {
    expect(screen.getByRole('button', { name: /indienen/i })).toBeTruthy();
  });
  it('offers to withdraw after submitting, and withdrawing confirms', async () => {
    const { withdraw, providers: p } = providers();
    await render(RegistrationPage, { providers: p });
    fireEvent.click(screen.getByRole('button', { name: /indienen/i }));
    await screen.findByText(/ontvangen/i);
    fireEvent.click(await screen.findByRole('button', { name: /trek aanvraag in/i }));
    // The withdrawal is keyed by the reference the submit returned, and the page confirms it.
    expect(withdraw).toHaveBeenCalledWith('reg-9');
    expect(await screen.findByText(/ingetrokken/i)).toBeTruthy();
  });
  // A small PDF file the citizen "uploads"; the component base64-encodes it client-side.
  const diploma = () => new File([new Uint8Array([1, 2, 3])], 'diploma.pdf', { type: 'application/pdf' });
  it('uploads a chosen diploma after submitting, and doing so confirms', async () => {
    const { provideDocuments, providers: p } = providers();
    await render(RegistrationPage, { providers: p });
    fireEvent.click(screen.getByRole('button', { name: /indienen/i }));
    await screen.findByText(/ontvangen/i);
    // Choose the file, then upload it.
    fireEvent.change(screen.getByLabelText(/diploma/i), { target: { files: [diploma()] } });
    fireEvent.click(await screen.findByRole('button', { name: /documenten aanleveren/i }));
    // The upload is keyed by the reference and carries the base64 file + its name; the page confirms.
    expect(await screen.findByText(/documenten.*aangeleverd/i)).toBeTruthy();
    expect(provideDocuments).toHaveBeenCalledWith(
      'reg-9',
      expect.objectContaining({ fileName: 'diploma.pdf', contentType: 'application/pdf', contentBase64: expect.any(String) }),
    );
  });
  it('surfaces a diploma-upload failure and keeps the action available', async () => {
    const { providers: p } = providers(
      vi.fn().mockReturnValue(of({ registrationId: 'reg-9', status: 'Ingediend' })),
      vi.fn().mockReturnValue(of(undefined)),
      vi.fn().mockReturnValue(throwError(() => new Error('documents rejected'))),
    );
    await render(RegistrationPage, { providers: p });
    fireEvent.click(screen.getByRole('button', { name: /indienen/i }));
    await screen.findByText(/ontvangen/i);
    fireEvent.change(screen.getByLabelText(/diploma/i), { target: { files: [diploma()] } });
    fireEvent.click(await screen.findByRole('button', { name: /documenten aanleveren/i }));
    expect(await screen.findByRole('alert')).toBeTruthy();
    expect(screen.queryByText(/aangeleverd/i)).toBeNull();
    expect(screen.getByRole('button', { name: /documenten aanleveren/i })).toBeTruthy();
  });
  it('surfaces a withdraw failure and keeps the action available', async () => {
    const { providers: p } = providers(
      vi.fn().mockReturnValue(of({ registrationId: 'reg-9', status: 'Ingediend' })),
      vi.fn().mockReturnValue(throwError(() => new Error('withdraw rejected'))),
    );
    await render(RegistrationPage, { providers: p });
    fireEvent.click(screen.getByRole('button', { name: /indienen/i }));
    await screen.findByText(/ontvangen/i);
    fireEvent.click(await screen.findByRole('button', { name: /trek aanvraag in/i }));
    expect(await screen.findByRole('alert')).toBeTruthy();
    expect(screen.queryByText(/is ingetrokken/i)).toBeNull();
    expect(screen.getByRole('button', { name: /trek aanvraag in/i })).toBeTruthy();
  });
  it('has no WCAG 2.1 AA violations on the submit page', async () => {
    // The portal is Dutch; the real index.html sets lang. Set it here so the document-level
    // html-has-lang rule reflects the app, not the bare jsdom document.
@@ -1,23 +1,19 @@
-import { Component, inject, type OnInit, signal } from '@angular/core';
+import { Component, inject, signal } from '@angular/core';
-import { BffApiV1Service, type CurrentRegistration, type SubmitAccepted } from 'api-client';
+import { BffApiV1Service, type SubmitAccepted } from 'api-client';
 import { AuthService } from 'auth';
 import { UtrechtComponentsModule } from 'ui';
 /**
 * The self-service submit page: a signed-in zorgprofessional confirms and submits their BIG
 * registration. The bsn comes from the DigiD token (not a form field), so this is a confirm-and-
- * submit flow that posts to the BFF and shows the returned reference (ADR-0010; S-08c). After
+ * submit flow that posts to the BFF and shows the returned reference (ADR-0010; S-08c).
 * submitting they can withdraw it — "trek aanvraag in" — keyed by that reference (S-11c).
 *
 * On load it asks the BFF for the caller's current open registration and restores the submitted view
 * if there is one, so a page refresh no longer strands an in-flight registration (S-26).
 */
@Component({
  selector: 'app-registration-page',
  imports: [UtrechtComponentsModule],
  templateUrl: './registration-page.html',
 })
-export class RegistrationPage implements OnInit {
+export class RegistrationPage {
  private readonly auth = inject(AuthService);
  private readonly bff = inject(BffApiV1Service);
@@ -26,30 +22,6 @@ export class RegistrationPage implements OnInit {
  protected readonly reference = signal<string | undefined>(undefined);
  protected readonly submitted = signal(false);
  protected readonly failed = signal(false);
  protected readonly withdrawing = signal(false);
  protected readonly withdrawn = signal(false);
  protected readonly withdrawFailed = signal(false);
  protected readonly providingDocuments = signal(false);
  protected readonly documentsProvided = signal(false);
  protected readonly provideDocumentsFailed = signal(false);
  protected readonly selectedFile = signal<File | undefined>(undefined);
  /** Resume an existing in-flight registration after a refresh (S-26): the BFF returns the caller's
   * current open registration, or 204 (empty body) when there is none — in which case we show the
   * submit form as before. Failures are non-fatal for the same reason. */
  ngOnInit(): void {
    this.bff.getSelfServiceRegistrations().subscribe({
      next: (current: CurrentRegistration | void) => {
        if (current && current.registrationId) {
          this.reference.set(current.registrationId);
          this.submitted.set(true);
        }
      },
      error: () => {
        // No resumable registration (or the lookup failed) — fall back to the submit form.
      },
    });
  }
  submit(): void {
    this.submitting.set(true);
@@ -67,74 +39,4 @@ export class RegistrationPage implements OnInit {
      },
    });
  }
  onFileSelected(event: Event): void {
    const input = event.target as HTMLInputElement;
    this.selectedFile.set(input.files?.[0] ?? undefined);
  }
  async provideDocuments(): Promise<void> {
    const reference = this.reference();
    const file = this.selectedFile();
    if (!reference || !file) {
      return;
    }
    this.providingDocuments.set(true);
    this.provideDocumentsFailed.set(false);
    let contentBase64: string;
    try {
      contentBase64 = await readAsBase64(file);
    } catch {
      this.provideDocumentsFailed.set(true);
      this.providingDocuments.set(false);
      return;
    }
    this.bff
      .postSelfServiceRegistrationsIdDocuments(reference, {
        contentBase64,
        fileName: file.name,
        contentType: file.type || 'application/pdf',
      })
      .subscribe({
        next: () => {
          this.documentsProvided.set(true);
          this.providingDocuments.set(false);
        },
        // Surface the failure instead of swallowing it: keep the action so the user can retry.
        error: () => {
          this.provideDocumentsFailed.set(true);
          this.providingDocuments.set(false);
        },
      });
  }
  withdraw(): void {
    const reference = this.reference();
    if (!reference) {
      return;
    }
    this.withdrawing.set(true);
    this.withdrawFailed.set(false);
    this.bff.postSelfServiceRegistrationsIdWithdraw(reference).subscribe({
      next: () => {
        this.withdrawn.set(true);
        this.withdrawing.set(false);
      },
      // Surface the failure instead of swallowing it: keep the action so the user can retry.
      error: () => {
        this.withdrawFailed.set(true);
        this.withdrawing.set(false);
      },
    });
  }
 }
 /** Read a file's bytes as a base64 string (without the `data:...;base64,` prefix). */
 function readAsBase64(file: File): Promise<string> {
  return new Promise<string>((resolve, reject) => {
    const reader = new FileReader();
    reader.onload = () => resolve(((reader.result as string) ?? '').split(',', 2)[1] ?? '');
    reader.onerror = () => reject(reader.error ?? new Error('Could not read the file.'));
    reader.readAsDataURL(file);
  });
 }
@@ -1,76 +0,0 @@
 # ADR-0013: Behandel-portal wiring — multi-realm BFF auth, werkbak from Flowable tasks, decision completes the task
 - **Status:** Accepted
 - **Date:** 2026-07-15
 - **Deciders:** Respellion engineering
 - **Relates to:** #84 (adr-proposal), S-12 (#13); builds on ADR-0010 (BFF OIDC), ADR-0011 (approval status flow), ADR-0009 (external-task worker), ADR-0008 (read projection)
 ## Context
 S-12 adds the behandel-portal: a behandelaar logs in, sees a **werkbak** of registrations awaiting
 beoordeling, and decides each (goedkeuren/afwijzen). Three questions had no obvious answer and shape
 the whole slice.
 1. **Which realm authenticates behandelaars, and how does the BFF accept it?** Citizens use the
   `digid` realm (ADR-0010); staff use a separate `medewerker` realm with roles (`behandelaar`,
   `teamlead`). Keycloak realms are distinct issuers with distinct signing keys, so the BFF's single
   `digid`-realm JWT validation rejects a medewerker token outright.
 2. **Where does the werkbak get its data?** The registrations awaiting beoordeling could come from
   the read projection (status-filtered rows) or from the Flowable `Beoordelen` user tasks (S-12b).
 3. **How does a decision correlate to the workflow?** The process parks at the `Beoordelen` user
   task; the decision must advance it, and also apply the domain transition (ADR-0011).
 ## Decision
 **The BFF validates a second realm for behandel endpoints; the werkbak is the set of open Flowable
 `Beoordelen` tasks (read through the domain); and a decision both applies the domain transition and
 completes the Flowable task.**
 - **Multi-realm BFF auth.** The BFF registers a second JWT bearer scheme (`medewerker`, authority =
  the medewerker realm) alongside the default `digid` scheme. `/behandel/*` endpoints require an
  authorization policy bound to the `medewerker` scheme **and** the `behandelaar` role. Keycloak puts
  realm roles in the nested `realm_access.roles` claim, which ASP.NET does not map automatically, so
  the scheme's `OnTokenValidated` lifts those roles onto the principal as role claims. Self-service
  keeps the `digid` scheme. Audience validation stays off (ADR-0010's deferred hardening).
 - **Werkbak = Flowable user tasks (via the domain).** The domain's `Werkbak` query reads the open
  `Beoordelen` tasks from the Workflow Client (§8.2, `IUserTaskClient`) and enriches each with its
  aggregate's bsn + status; `GET /behandel/werkbak` exposes it and the BFF proxies it behind the
  behandelaar policy. The list **is** the authoritative set of claimable/decidable work items, so a
  decision acts on a real task with no separate correlation store. The read projection stays the
  anonymous openbaar model — we do **not** project `IN_BEHANDELING` or populate staff-only personal
  data (both deferred in ADR-0008) just to render a staff view.
 - **Decision completes the task (S-12c-2).** A behandelaar decision applies the domain transition
  (aggregate + ACL for approval, per ADR-0011) **and** completes the Flowable `Beoordelen` task
  (looked up by registrationId), so the process advances. Implemented in the next sub-slice; recorded
  here so the boundary is decided up front.
 Delivery is split: **S-12c-1** (this PR) = multi-realm auth + werkbak read; **S-12c-2** = the decide
 endpoint + task completion.
 ## Consequences
 **Positive**
 - Staff and citizens are cleanly separated by realm; the `behandelaar` role gates the behandel API.
 - The werkbak reflects exactly what a behandelaar can act on; claim/decide need no extra correlation.
 - No premature projection changes — the openbaar read model stays focused and personal-data-free.
 - Only the ACL/Workflow Client talk to their peers; the BFF still fans out only to domain/projection
  (§8.3).
 **Negative / costs**
 - The BFF now depends on two Keycloak realms being reachable (`Keycloak:MedewerkerAuthority`).
 - Rendering the werkbak fans out to Flowable (one task query) plus a store read per task — acceptable
  for the caseload sizes here; a denormalized staff read model is an additive follow-up if needed.
 - Realm separation (distinct issuers/keys) is validated live, not in the BFF unit tests, where issuer
  validation is off and one test key signs both realms; the tests exercise the role-based authorization.
 ## Alternatives considered
 - **Werkbak from the read projection** — rejected for now: needs new plumbing to project
  `IN_BEHANDELING` and to populate staff-only bsn/naam (deferred, ADR-0008), plus a separate way to
  find the Flowable task at decide-time. Revisit if a high-volume denormalized staff view is needed.
 - **One JWT scheme accepting both realms (issuer validation off)** — rejected: trusting multiple
  issuers without validation is a security regression; two schemes keep each realm's issuer/key checked.
 - **A dedicated behandel BFF/service** — rejected as premature; one BFF with per-endpoint policies is
  enough at this size and keeps §8.3 simple.
@@ -1,72 +0,0 @@
 # ADR-0014: Withdrawal cancels the registratie process via a BPMN message event
 - **Status:** Accepted
 - **Date:** 2026-07-16
 - **Deciders:** Respellion engineering
 - **Relates to:** S-11 (#12); builds on ADR-0009 (external-task worker / Workflow Client), ADR-0013
  (behandel-portal wiring, the Beoordelen user task)
 ## Context
 S-11 lets a zorgprofessional withdraw a still-open registration ("trek aanvraag in"). S-11a already
 advances the aggregate to INGETROKKEN (domain state). But the registratie process is still running in
 Flowable — parked at the `Beoordelen` user task — so without a second step the withdrawn registration
 would linger as work for a behandelaar. The withdrawal must also **cancel the running process**.
 Two questions shape this sub-slice.
 1. **How does the case get cancelled — in code, or in the BPMN model?**
 2. **How does a withdrawal correlate to the right running process instance?**
 ## Decision
 **The BPMN models the cancellation as an interrupting message boundary event on the `Beoordelen`
 task; the Workflow Client correlates a `RegistratieIngetrokken` message to the task's execution.**
 - **Modelled in BPMN, not deleted from code.** The `Beoordelen` user task carries an interrupting
  message boundary event (`RegistratieIngetrokken`) that routes to a dedicated "Registratie
  ingetrokken" end event. The process's own model says *how* a withdrawal ends it — the Workflow
  Client only delivers the message; it never reaches into Flowable to delete an instance. This keeps
  the workflow's control flow in the workflow (§8.2) and leaves an audit trail in Flowable history
  (the process ended via the ingetrokken path, not a raw delete).
 - **Correlated by the registration's own process instance.** The aggregate records its Flowable
  process instance id at submit, so the `WithdrawRegistration` handler correlates directly by that
  id — no task lookup. The Workflow Client asks Flowable for the execution **subscribed to** the
  `RegistratieIngetrokken` message in that instance and delivers `messageEventReceived` to it.
  Targeting the subscribed execution (not the user task's execution — a message boundary event's
  subscription lives on its own execution) is what makes the correlation land.
 - **Best-effort, mirroring the beoordeling.** If no open `Beoordelen` task is found (the process has
  not yet parked there — the `OpenZaakAanmaken` window — or has already ended), the withdrawal still
  stands: the aggregate is INGETROKKEN and the werkbak filters it out regardless (S-11b). We complete
  the domain transition first and cancel the workflow best-effort, exactly as `BeoordeelRegistratie`
  completes its task best-effort.
 ## Consequences
 **Positive**
 - The cancellation path is visible in `registratie.bpmn`; the Workflow Client stays the only code
  that talks to Flowable and does not delete instances behind the model's back.
 - Reuses the existing task-query correlation — no new plumbing, no correlation store.
 - A withdrawn case leaves the werkbak (its `Beoordelen` task is cancelled), and the werkbak also
  filters non-open registrations as a belt-and-braces for the brief window before cancellation lands.
 **Negative / costs**
 - A withdrawal raced ahead of the process reaching `Beoordelen` (during `OpenZaakAanmaken`, seconds)
  finds no task to cancel, so that process instance runs on to `Beoordelen` and parks there with no
  one to act on it (it is hidden from the werkbak by the status filter). Acceptable for this
  reference at these volumes; a process-level interrupting event subprocess would close the gap and
  is an additive follow-up if it matters.
 - The Flowable message-correlation REST shape is validated live (verify-stack), not in the
  Workflow Client's unit tests, which stub the HTTP exchange and assert only the request shape
  (consistent with ADR-0009).
 ## Alternatives considered
 - **Delete the process instance from the Workflow Client** (`DELETE /runtime/process-instances/{id}`)
  — rejected: it cancels the case but hides the reason from the BPMN model; the "why" lives in code,
  not the process. The message event keeps the cancellation a first-class part of the workflow.
 - **Interrupting message event subprocess at process level** — more robust (correlates anytime,
  closing the `OpenZaakAanmaken`-race gap), but a heavier BPMN construct; deferred as an additive
  change if the race proves to matter.
@@ -1,77 +0,0 @@
 # ADR-0015: Beoordeling escalation reassigns via an external-worker task
 - **Status:** Accepted
 - **Date:** 2026-07-17
 - **Deciders:** Respellion engineering
 - **Relates to:** S-14 (#15); proposal #98. Builds on ADR-0009 (external-task worker / Workflow
  Client), ADR-0013 (behandel-portal wiring, the `Beoordelen` user task), ADR-0014 (the boundary-event
  pattern on `Beoordelen`).
 ## Context
 S-14 escalates a beoordeling that a behandelaar does not pick up in time: after 14 days the case must
 move to the `teamlead` role (PRD §5, flow 5). The `Beoordelen` user task already exists, claimable by
 the `behandelaar` candidate group; the teamlead role is seeded in the medewerker realm.
 Two forces shape this.
 1. **The task must stay open.** Escalation changes *who may claim* an unclaimed beoordeling, not the
   work itself — so the timer must be **non-interrupting**: the `Beoordelen` task keeps running while
   escalation happens alongside it.
 2. **Reassigning an open task's candidate group needs code.** Flowable cannot rewrite the candidate
   groups of an already-open user task from BPMN XML alone — that requires either a Java delegate/listener
   embedded in the engine, or an out-of-process actor driving the REST API. The repository has held a
   "stock Flowable image, no custom jars; the Workflow Client is the only code that talks to Flowable
   (§8.2)" posture since ADR-0009.
 ## Decision
 **A non-interrupting `P14D` boundary timer on `Beoordelen` fires an external-worker task
 (`BeoordelingEscaleren`); the Workflow Client reassigns the still-open `Beoordelen` task from the
 behandelaar group to teamlead.**
 - **Modelled in BPMN, driven by an external worker.** The timer routes a parallel token to an
  `external-worker` service task on the `BeoordelingEscaleren` topic, ending at a dedicated "Beoordeling
  geëscaleerd" end event. The model owns *when* escalation happens; the Workflow Client — the only code
  that talks to Flowable (§8.2) — owns *how* the reassignment is applied, exactly as `OpenZaakAanmaken`
  delegates the ZGW call (ADR-0009). No custom code runs inside Flowable.
 - **Reassignment is a candidate-group swap.** The escalation worker finds the still-open `Beoordelen`
  task in the escalating instance (task query by `processInstanceId` + `taskDefinitionKey`), adds
  `teamlead` as a candidate group via the task identity links, then removes `behandelaar`. The task now
  belongs to the teamlead; its history and variables are untouched.
 - **Best-effort, mirroring beoordeling and withdrawal.** If the task is no longer open — the behandelaar
  completed it in the window before the timer fired — the reassignment is a no-op. A failed reassignment
  leaves the escalation job un-completed so Flowable redelivers it (§8.6), consistent with the
  `OpenZaakAanmaken` worker.
 - **Segregated interface.** The escalation methods live on `IBeoordelingEscalatieClient`, separate from
  the `OpenZaakAanmaken` worker's `IExternalWorkerClient`, so the OpenZaak worker never sees escalation
  (interface segregation). Both are implemented by the one `FlowableWorkflowClient`.
 ## Consequences
 **Positive**
 - The escalation trigger is visible in `registratie.bpmn`; Flowable stays a stock image, and the
  Workflow Client remains the sole Flowable client (§8.2 upheld, not bent).
 - Reuses the external-worker mechanics (topic acquire/complete, hosted pump, per-tick scope,
  redelivery-on-failure) wholesale — the new code is one client capability, one processor, one pump.
 - Escalation latency is bounded by the worker's poll interval (seconds) — negligible against a 14-day
  timer.
 **Negative / costs**
 - Escalation is two REST hops (add teamlead, remove behandelaar) rather than one atomic update; between
  them the task is briefly claimable by both groups. Harmless at these volumes, and the pair is idempotent
  on redelivery.
 - The Flowable identity-link and management-job REST shapes are validated live (verify-domain fires the
  timer early via the management API), not in the Workflow Client's unit tests, which stub the HTTP
  exchange and assert only the request shape — consistent with ADR-0009 and ADR-0014.
 ## Alternatives considered
 - **Flowable timer/task listener (Java delegate).** Reassign in-engine when the timer fires. Rejected:
  it needs a custom jar in Flowable, breaking the stock-image, REST-only posture and adding a build/deploy
  surface to the engine for no capability the external-worker route lacks.
 - **Interrupting timer that re-creates the task for teamlead.** Cancel `Beoordelen` and start a fresh
  teamlead task. Rejected: it loses the task's identity/history and complicates correlation, where a
  candidate-group swap on the same task expresses "the same work, now the teamlead's" directly.
@@ -1,77 +0,0 @@
 # ADR-0016: Diploma eligibility is a DMN evaluated inline as a BPMN DMN service task
 - **Status:** Accepted
 - **Date:** 2026-07-17
 - **Deciders:** Respellion engineering
 - **Relates to:** S-13 (#14); proposal #100. Builds on ADR-0009 (external-task worker / Workflow
  Client), ADR-0014/0015 (the boundary-event and routing constructs on the registratie process).
 ## Context
 S-13 adds flow 4: a foreign diploma must get an extra CBGV-advies assessment before beoordeling
 (PRD §5). The eligibility decision — domestic goes straight to beoordeling, foreign routes through
 CBGV-advies — needs a home. The Flowable REST app bundles a DMN engine, and the same
 `repository/deployments` machinery that deploys `registratie.bpmn` can deploy a `.dmn`. §8.2 makes
 the Workflow Client the only code that talks to Flowable; the PRD frames the workflow as "BPMN + DMN
 governing the registration workflow" (Flowable as a peer orchestration module).
 The issue's wording ("a DMN decision table evaluated by the Domain Service via Workflow Client")
 suggests the domain reaches into Flowable's DMN API to evaluate the decision and feeds the result
 back. That is one option; it is not the only one, and it is not the cleanest.
 ## Decision
 **The diploma-eligibility DMN is deployed to Flowable and evaluated inline by the registratie process
 as a DMN service task (`flowable:type="dmn"`); an exclusive gateway routes on its output. The domain's
 only new job is to carry the diploma origin and pass it into the process as a start variable.**
 - **The decision lives in the workflow.** `workflows/diploma-eligibility.dmn` maps `diplomaOrigin`
  → `route` (`Buitenlands` ⇒ `CBGV_ADVIES`, otherwise `DIRECT`). A DMN service task
  (`flowable:type="dmn"`, `decisionTableReferenceKey=diploma-eligibility`) runs it between
  `OpenZaakAanmaken` and `Beoordelen`, and an exclusive gateway sends `CBGV_ADVIES` through a new
  `CBGVAdvies` user task before `Beoordelen`, `DIRECT` straight there. (A `businessRuleTask` would
  bind Flowable's legacy Drools/KIE implementation, which `flowable-rest` does not bundle — its parse
  handler throws `NoClassDefFoundError` at deploy time; the DMN service task is the supported route.)
 - **The domain carries the input, not the decision.** The `Registration` aggregate gains a
  `DiplomaOrigin` (Binnenlands/Buitenlands); `SubmitRegistration` passes it to
  `StartRegistrationProcessAsync`, which sets it as the `diplomaOrigin` start variable. The domain
  never evaluates the DMN and never learns the route — that is the process's concern.
 - **Deployed as its own DMN-engine deployment, separate from the BPMN.** The DMN is version-controlled
  in `workflows/` and `flowable-init` deploys it to the DMN engine via the `dmn-api`
  (`/dmn-api/dmn-repository/deployments`), while `registratie.bpmn` goes to the process engine via
  `/service/repository/deployments`. Two things were learned the hard way here (both cost a CI cycle):
  (1) `flowable-rest` does **not** cascade a `.dmn` bundled inside a process `.bar` into the DMN engine
  — the resource is stored but no decision is created, so the service task fails at runtime with
  `FlowableObjectNotFoundException: No decision found for key`; the DMN must go through `dmn-api`.
  (2) Flowable's DMN XML converter rejects an XML comment placed between the `<?xml?>` declaration and
  the root `<definitions>` element (`XMLStreamReader not in START_DOCUMENT or START_ELEMENT state`),
  unlike its BPMN converter — so the DMN's documentation comment lives *inside* `<definitions>`.
  With the decision present in the DMN repository, the process's DMN service task resolves it across
  deployments by key (verified live), so no shared parent deployment id is needed.
 ## Consequences
 **Positive**
 - The eligibility rule is a first-class, inspectable workflow artefact (matching the PRD's BPMN+DMN
  framing); business users can read/adjust the decision table without touching domain code.
 - §8.2 stays clean: the Workflow Client remains the only code talking to Flowable, and the decision
  runs inside the process the client already started — no domain→Flowable round-trip for a decision.
 - The domain change is minimal and additive: one value on the aggregate, one start variable.
 **Negative / costs**
 - Deviates from #14's literal "evaluated by the Domain Service via Workflow Client" wording (noted on
  the issue). The outcome — DMN decides eligibility, foreign diplomas get the CBGV step — is unchanged.
 - The DMN and its service-task wiring are validated live (verify-domain drives a foreign
  registration through CBGV-advies and a domestic one straight to beoordeling, exercising both
  branches), not in unit tests — consistent with ADR-0009/0014/0015. The domain unit/acceptance tests
  cover only that the origin is carried into the process.
 ## Alternatives considered
 - **Domain evaluates the DMN via the Workflow Client** (the issue's wording). Rejected: it couples
  the domain to Flowable for a decision and splits the routing across two places (domain computes,
  BPMN branches), for no benefit over letting the engine that owns the process own the decision.
 - **Eligibility rules in domain C#.** Rejected: it moves a governable business decision out of the
  DMN the PRD calls for, and hard-codes what the reference app is meant to demonstrate as data.
@@ -1,90 +0,0 @@
 # ADR-0017: A document-wait task with a 30-day interrupting timer cancels the registration
 - **Status:** Accepted
 - **Date:** 2026-07-20
 - **Deciders:** Respellion engineering
 - **Relates to:** S-10a (#102); proposal #104; split from S-10 (#11). Builds on ADR-0009 (external-task
  worker / Workflow Client), ADR-0014 (withdrawal cancels the process), ADR-0015 (beoordeling
  escalation — the boundary-timer + external-worker pattern), ADR-0016 (diploma-eligibility DMN).
 ## Context
 Flow 2 (PRD §5) requires the citizen to supply documents (their diploma) after submitting. The
 registratie process must park waiting for those documents and, if they do not arrive within 30 days,
 cancel the case. S-10 was split (§13): **S-10a** is this workflow/timeout spine (backend only);
 **S-10b** wires the actual upload (portal → BFF → domain → ACL → Documenten API) that completes the
 wait. This ADR records the spine: where the wait sits, how the timeout cancels, and how the domain
 aggregate stays in sync.
 ## Decision
 **A `WachtOpDocumenten` user task is inserted immediately after `OpenZaakAanmaken`, carrying an
 `cancelActivity="true"` (interrupting) `P30D` boundary timer. "Documents received" completes the task
 and the process continues into the diploma-eligibility routing; on timeout the timer cancels the task,
 runs a `RegistratieVerlopen` external-worker task, and ends the process at `endVerlopen`. A domain
 worker expires the correlated aggregate to a new terminal status `Verlopen`.**
 - **Where the wait sits.** Right after the zaak is opened, before the diploma-eligibility DMN: the zaak
  exists, then the process waits for documents; on receipt it continues to the DMN routing → Beoordelen
  (ADR-0016). The wait gates the whole assessment, so it precedes the routing rather than sitting
  between the gateway and Beoordelen.
 - **Interrupting timer, mirroring the existing constructs.** Unlike the S-14 escalation timer
  (non-interrupting — the Beoordelen task stays open), this timer is interrupting: when it fires the
  wait token is consumed and the case is cancelled, like the S-11 withdrawal boundary (ADR-0014). The
  timeout branch runs a `RegistratieVerlopen` external-worker task (topic mirrors
  `OpenZaakAanmaken`/`BeoordelingEscaleren`) → `endVerlopen`.
 - **The domain stays authoritative.** The `RegistratieVerlopen` job carries the `registrationId`; the
  `RegistratieVerlopenProcessor` drains it and the `ExpireRegistrationWorker` loads the aggregate and
  calls `Registration.Expire()`, moving it to the new terminal status `Verlopen`. This keeps the
  aggregate — which the projection/openbaar view reads — the source of truth, exactly as escalation and
  withdrawal do. Idempotent per §8.6: a redelivered job whose aggregate is already `Verlopen` completes
  without persisting again; an unknown registration throws so the job is redelivered.
 - **Documents-in-time transition.** `IWorkflowClient.CompleteDocumentWaitAsync(processInstanceId)`
  completes the `WachtOpDocumenten` task (the Workflow Client remains the only code that talks to
  Flowable, §8.2). It is best-effort — a no-op if the instance already left the wait (continued, or
  timed out). The trigger is wired end-to-end in S-10a: a `ProvideDocuments` application use case behind
  an owner-scoped domain endpoint `POST /registrations/{id}/documents`, a BFF passthrough
  `POST /self-service/registrations/{id}/documents` (bsn from the DigiD token), and a "Documenten
  aanleveren" action on the self-service page — so the walking-skeleton e2e stays green (a registration
  can still reach the behandelaar). **S-10b replaces the stub trigger with a real file upload stored in
  the ZGW Documenten (DRC) API via the ACL**; the completion of the wait is unchanged.
  - *Why the trigger lives here, not in S-10b:* inserting the `WachtOpDocumenten` gate without any way
    to pass it breaks the submit→beoordeling e2e (a merge gate). Splitting "gate" from "means to pass
    the gate" across slices would leave `main` red, so S-10a owns both; S-10b is purely the ZGW storage
    behind the same action.
 ## Consequences
 **Positive**
 - The wait/timeout is a first-class workflow construct that reuses the boundary-timer + external-worker
  pattern already proven by S-14, so the domain change is small and additive: one terminal status, one
  worker trio (worker + processor + pump), one Workflow Client method.
 - §8 stays clean: the Workflow Client is still the only Flowable caller, and no new ZGW boundary is
  introduced in S-10a.
 - The timeout is verified live (verify-domain fires the P30D timer via the management-API "move" idiom
  and asserts the domain reaches `Verlopen`), consistent with ADR-0009/0014/0015.
 **Negative / costs**
 - Every registration now parks at `WachtOpDocumenten` before Beoordelen, so the other flows must supply
  documents first: the live-check blocks (S-11/S-12b/S-13/S-14) complete the task via Flowable, and the
  registration e2e clicks "Documenten aanleveren". A small, explicit step, but it touches every path
  through the process.
 - On expiry S-10a cancels the *process* and marks the aggregate `Verlopen` but does **not** set the ZGW
  *zaak* to a cancellation status — that needs a new ACL method + statustype seeding, which overlaps
  S-10b's ACL/infra work. Deferred to S-10b (or a follow-up); noted here as the S-10a/S-10b boundary.
 - Withdrawing while parked at `WachtOpDocumenten` marks the aggregate `Ingetrokken` but does not cancel
  the process (the withdrawal message boundary is on `Beoordelen`); the timeout worker tolerates this
  by no-op'ing on an already-resolved aggregate. Extending withdrawal to the wait state is a follow-up.
 ## Alternatives considered
 - **Pure-BPMN cancellation (timer → end event, no worker).** Rejected: the domain aggregate would then
  be out of sync with the cancelled process, and the openbaar/projection view reads the aggregate's
  status — the case would still look open.
 - **Wait task between the gateway and Beoordelen.** Rejected: documents gate the whole assessment
  (including the CBGV-advies routing), so the wait belongs before the DMN, not after it.
 - **A dedicated timeout status per branch vs. reusing an open-state guard.** `Expire()` reuses the same
  `RequireOpenForDecision` guard as withdrawal/decision, so only an `INGEDIEND`/`IN_BEHANDELING`
  registration can lapse and the terminal states stay mutually exclusive — no new guard logic.
@@ -1,74 +0,0 @@
 # ADR-0018: Diploma upload is stored in the ZGW Documenten API, fronted by the ACL
 - **Status:** Accepted
 - **Date:** 2026-07-20
 - **Deciders:** Respellion engineering
 - **Relates to:** S-10b (#103); proposal #107. Builds on ADR-0001 (ACL is the only ZGW caller),
  ADR-0003 (ACL default-fill), ADR-0017 (document-wait + provision trigger). Carves the zaak-close on
  expiry to #106 (S-10c).
 ## Context
 S-10a wired the "documenten aanleveren" trigger (portal → BFF → domain → complete the WachtOpDocumenten
 wait) with the file itself stubbed. S-10b makes the upload real: the diploma must be **stored in the
 ZGW Documenten (DRC) API** and related to the zaak. §8.1 makes the ACL the only code that talks to ZGW.
 The DRC API is served by the same OpenZaak container as the Zaken/Catalogi APIs.
 ## Decision
 **The ACL fronts the Documenten API: it creates an `enkelvoudiginformatieobject` and relates it to the
 zaak. The file travels base64-encoded in JSON across every hop (the portal encodes it client-side); a
 "Diploma" `informatieobjecttype` is seeded in the catalogus and injected into the ACL like the
 zaaktype.**
 - **ACL gateway.** `OpenZaakGateway.StoreDocumentAsync` POSTs the `enkelvoudiginformatieobject`
  (`/documenten/api/v1/enkelvoudiginformatieobjecten`, base64 `inhoud`, `bestandsomvang`,
  `status=definitief`) then relates it to the zaak (`/zaken/api/v1/zaakinformatieobjecten`), reusing the
  established gateway patterns (ZGW Bearer JWT, buffered non-chunked body for uwsgi, **no CRS headers** —
  the Documenten API is not geo, unlike zaak-create). `AclService.StoreDiplomaAsync` default-fills the
  ZGW-mandatory fields (informatieobjecttype, bronorganisatie, vertrouwelijkheidaanduiding, `taal=nld`,
  creatiedatum); the domain hands over only the zaak, the bytes, and the file's name/type. No new ZGW
  scopes were needed — the seed applicatie holds `heeft_alle_autorisaties`.
 - **The file travels as base64 JSON end-to-end.** The portal reads the chosen file client-side
  (`FileReader`) and posts `{ contentBase64, fileName, contentType }` as JSON to the BFF; the BFF
  forwards it to the domain, and the domain to the ACL, all as JSON. This deviates from proposal #107's
  "multipart on the portal→BFF hop": base64 JSON keeps **one** contract shape across all four services
  (no `IFormFile`/antiforgery plumbing, no multipart in the generated client), and a diploma is a small
  placeholder PDF, so the ~33% base64 overhead is immaterial. The ACL turns the base64 back into the
  ZGW `inhoud`.
 - **Storing precedes completing the wait.** `ProvideDocuments` (from S-10a) now stores the diploma via
  the ACL — once the zaak is opened — and then completes the `WachtOpDocumenten` task, so a registration
  reaches beoordeling only after its diploma is stored. Both steps stay best-effort about missing
  preconditions (no zaak yet → skip storage; no process yet → skip completion), mirroring withdrawal.
 - **Catalogus.** `seed_catalogus.py` (OZ_PUBLISH) creates a "Diploma" `informatieobjecttype`, relates it
  to the zaaktype (`zaaktype-informatieobjecttypen`, while both concept), publishes both, and prints
  `INFORMATIEOBJECTTYPE_URL`; verify-domain injects it as `Acl__Defaults__InformatieobjecttypeUrl`
  (a zeros-uuid placeholder otherwise, so the ACL still boots).
 ## Consequences
 **Positive**
 - §8.1 stays intact: the ACL is still the only ZGW caller; the portal only talks to the BFF; the domain
  only crosses the ACL boundary. Adding a document was almost entirely additive (one gateway method, one
  default, one seed block).
 - One JSON contract shape across portal/BFF/domain/ACL keeps the generated client and the service
  contracts uniform; the upload is exercised live (ACL integration test against real OpenZaak; the
  Playwright journey uploads a real PDF).
 **Negative / costs**
 - Base64 inflates the payload ~33% and holds the whole file in memory at each hop — fine for a small
  diploma, but not a pattern to reuse for large documents without streaming/multipart.
 - The zaak is **not** set to a cancellation status when the 30-day term lapses — carved to #106 (S-10c),
  which adds the cancellation statustype/resultaattype + ACL method + expiry-worker wiring.
 - Providing documents before the zaak is opened silently skips storage (best-effort); the e2e/live flow
  avoids this by uploading only after the openbaar register shows the zaak (INGEDIEND).
 ## Alternatives considered
 - **Multipart on the portal→BFF hop** (proposal #107). Rejected: it splits the transport into two shapes
  (multipart then JSON), needs `IFormFile` + antiforgery handling and a multipart method in the generated
  client, for no benefit at diploma size.
 - **The domain talks to the Documenten API directly.** Rejected outright: violates §8.1 (only the ACL
  talks to ZGW).
@@ -1,81 +0,0 @@
 # ADR-0019: A timed-out zaak is cancelled with a distinct status + resultaat, resolved by name
 - **Status:** Accepted
 - **Date:** 2026-07-21
 - **Deciders:** Respellion engineering
 - **Relates to:** S-10c (#106). Completes the S-10a/S-10b boundary noted in ADR-0017 (§Consequences) and
  reuses the ACL close-zaak machinery from S-09b (approval) and the Documenten work in ADR-0018.
 ## Context
 ADR-0017 (S-10a) cancels the *process* and marks the domain aggregate `Verlopen` when the 30-day
 document term lapses, but explicitly deferred setting the ZGW **zaak** to a cancellation status. Left
 open, a timed-out zaak stays open in OpenZaak while the register shows the registration as lapsed — the
 two diverge. S-10c closes that gap: on expiry the domain must also cancel the zaak through the ACL
 (§8.1, the only code that talks to ZGW).
 The non-obvious part is *how to represent "cancelled" in ZGW* alongside the existing "approved" close.
 The approval path (S-09b) sets the zaak's **eindstatus** (the terminal statustype) plus a resultaat. In
 ZGW a zaaktype has exactly one eindstatus — the highest-`volgnummer` statustype — and setting it is what
 closes the zaak (`einddatum`). A second *terminal* status would collide with that single-eindstatus rule.
 ## Decision
 **Model cancellation as a distinct, non-terminal `Geannuleerd` statustype plus a distinct `Vervallen`
 resultaat, and resolve both the approval and cancellation statustype/resultaat by their omschrijving
 (name) rather than by position or the eindstatus flag alone.**
 - **Seed.** `Geannuleerd` is seeded at `volgnummer` 2 — between `Ontvangen` (1) and the `Afgehandeld`
  eindstatus (3) — so it is a *non-terminal* status and never displaces the eindstatus the approval path
  resolves. A second resultaattype `Vervallen` (archiefnominatie `vernietigen`) is seeded beside the
  approval `Geregistreerd` (`blijvend_bewaren`); both draw their `selectielijstklasse` from the
  zaaktype's single `selectielijstProcestype` so they validate on publish.
 - **The ACL owns the mapping.** `OpenZaakGateway.SetZaakToCancellationStatusAsync` resolves `Geannuleerd`
  + `Vervallen` by omschrijving and POSTs the resultaat then the status (OpenZaak requires a resultaat
  before a closing/terminal status), mirroring `SetZaakToEindstatusAsync`. Exposed as
  `AclService.CancelZaakAsync` behind the ACL endpoint `POST /annuleringen`. The omschrijvingen live as
  constants in the gateway — the ACL, not the domain, knows which ZGW status means what (§8.1).
 - **Approval now resolves its resultaat by name too.** With two resultaattypen present, taking the first
  is ambiguous (the Zaken API does not guarantee order), so the approval path resolves `Geregistreerd`
  by omschrijving. Its statustype resolution is unchanged (still the eindstatus).
 - **Domain wiring.** The `ExpireRegistrationWorker` calls `IAclClient.CancelZaakAsync(zaakUrl)` **before**
  advancing the aggregate to `Verlopen` (ACL-first, mirroring approval): if the ACL call fails the job is
  redelivered (§8.6) rather than leaving the aggregate `Verlopen` with an open zaak. The existing
  open-state guard stops a redelivered job from cancelling twice (a second resultaat would be a 400); a
  registration that lapsed before its zaak was opened has nothing to cancel.
 ## Consequences
 **Positive**
 - The domain aggregate and the ZGW zaak no longer diverge on timeout — both reflect the cancellation.
 - Reuses the approval close machinery (resultaat-then-status, ACL endpoint shape, ACL-first ordering), so
  the change is additive and §8 stays clean (only the ACL talks to ZGW).
 - Verified at two levels: an ACL↔OpenZaak integration test asserts the live zaak reaches `Geannuleerd`
  with a resultaat, and the domain verify script fires the real P30D timer and confirms the zaak is
  cancelled end-to-end.
 **Negative / costs**
 - `Geannuleerd` is non-terminal, so the cancelled zaak's `einddatum` is not set — it carries a
  cancellation status + resultaat but is not formally "closed" in ZGW. Accepted: the register reads the
  domain aggregate's status, and a single eindstatus per zaaktype is a ZGW constraint we chose not to
  fight. Formally closing a cancelled zaak (a second eindstatus, or reusing `Afgehandeld` with a
  `Vervallen` resultaat) is a possible follow-up.
 - The ACL couples to the seeded omschrijvingen (`Geregistreerd`/`Geannuleerd`/`Vervallen`) by string
  constants. This mirrors the existing implicit coupling to the catalogus (zaaktype URL, eindstatus) and
  is documented in the gateway.
 - Renumbering `Afgehandeld` from `volgnummer` 2 to 3 means a *stale* local catalogus must have its
  OpenZaak volumes reset for the change to take effect; CI reseeds a fresh catalogus each run.
 ## Alternatives considered
 - **Shared eindstatus, distinct resultaat only** (reuse `Afgehandeld`, distinguish approval vs
  cancellation purely by the resultaat). ZGW-idiomatic and would set `einddatum` on cancellation too, but
  the register would show no visibly distinct cancellation *status*. Rejected in favour of the issue's
  explicit "distinct statustype + resultaattype" outcome, which makes the cancellation legible in ZGW.
 - **A second terminal (eindstatus) `Geannuleerd`.** Rejected: ZGW allows only one eindstatus per
  zaaktype (highest volgnummer); a second terminal status would either not close the zaak or collide with
  the approval eindstatus resolution.
 - **Passing the target omschrijvingen from the domain.** Rejected: which ZGW status means "cancelled" is
  ZGW vocabulary the ACL owns (§8.1); the domain says only "cancel this zaak".
@@ -1,92 +0,0 @@
 # ADR-0020: The local stack self-seeds the zaaktype, DMN, and NRC abonnement at bring-up
 - **Status:** Accepted
 - **Date:** 2026-07-22
 - **Deciders:** Respellion engineering
 - **Relates to:** S-B04 (#110). Local-stack twin of the seeding the verify-* scripts do for CI
  (`infra/run-domain-check.sh`, `infra/verify-notification-driver.py`). Superseded in part by S-27
  (#113), which would let the ACL resolve its zaaktype by identificatie and remove the URL injection.
 ## Context
 `infra/docker-compose.local.yml` is the host-browser-friendly stack (`make local`) — the one a
 developer clicks through the portals with. It had drifted behind three slices, so a fresh bring-up
 could not complete the flow:
 1. The ACL pointed at a placeholder zaaktype (`…/00000000-…`), so zaak creation failed with OpenZaak
   `400` and the registratie process stuck at `OpenZaakAanmaken` (S-05).
 2. `flowable-init` deployed only `registratie.bpmn`, not `diploma-eligibility.dmn`, so completing
   `WachtOpDocumenten` 404'd on the missing decision and never reached `Beoordelen` (S-10a/S-13).
 3. No NRC abonnement was registered, so notifications reached NRC and went nowhere — the projection
   and the openbaar register stayed empty (S-06).
 The CI stack (`infra/docker-compose.yml`) does not hit this because its `verify-*` scripts seed the
 zaaktype, deploy the DMN, and register the abonnement at *test* time. The local stack has no such
 harness — a developer just runs `make local` and browses. The non-obvious wrinkle is (1): the
 zaaktype **UUID is assigned by OpenZaak at creation**, so the ACL's zaaktype URL is not knowable when
 the compose file is written and cannot be a static value.
 ## Decision
 **Make the local stack self-seed at bring-up via one-shot init containers, and hand the ACL its
 server-assigned zaaktype URL through a shared-volume env file it sources on startup.**
 - **DMN (gap 2).** `flowable-init` now deploys `diploma-eligibility.dmn` to the DMN engine
  (`/flowable-rest/dmn-api/dmn-repository/deployments`) as a separate deployment alongside the BPMN —
  identical to the CI `flowable-init`. Idempotent.
 - **Zaaktype + ACL wiring (gap 1).** A `local-seed` one-shot runs the existing
  `infra/openzaak/seed_catalogus.py` (`OZ_PUBLISH=1`) against OpenZaak and writes the resulting
  `Acl__Defaults__ZaaktypeUrl` / `…InformatieobjecttypeUrl` / `Acl__OpenZaak__BaseUrl` into
  `seed-env:/out/acl.env`. The ACL mounts that volume read-only and overrides its entrypoint to
  `sh -c 'set -a; . /seed/acl.env; set +a; exec dotnet Acl.Api.dll'`, so the real values override the
  compose placeholders before the app reads config. The ACL `depends_on: local-seed
  (service_completed_successfully)`.
 - **Abonnement (gap 3).** A `nrc-subscribe` one-shot registers an abonnement on the `zaken` kanaal
  pointing at the event-subscriber's `/notifications` callback (`infra/local/register-abonnement.py`).
  It is a leaf — nothing depends on it — so it can wait for the event-subscriber without forming a
  cycle with the ACL bootstrap.
 - **Reach OpenZaak/NRC by container IP, not service name.** Both the seed's ZTC calls and the
  abonnement's `callbackUrl` are validated by Django's URLValidator, which rejects a single-label host
  like `openzaak` / `event-subscriber`. The scripts resolve the target's container IP at runtime (as
  `infra/run-domain-check.sh` does), keeping the seeded URLs valid **and** host-consistent — the ACL's
  base URL is set to the same OpenZaak IP that owns the zaaktype URL.
 - **Acceptance.** `make verify-local` (`infra/run-local-flow-check.sh`) submits against a fresh stack
  and asserts the zaak opens, the case reaches the werkbak after documents, and the reference appears
  in the openbaar register — the red-to-green test for all three gaps.
 ## Consequences
 **Positive**
 - A fresh `make local` completes the full demo (submit → werkbak → openbaar) with no manual seeding —
  the slice's stated outcome.
 - Reuses the proven CI mechanisms (`seed_catalogus.py`, the DMN deploy, the abonnement driver) rather
  than inventing new ones; the only genuinely new piece is the entrypoint-sourced env file.
 - No service code changes — the fix is entirely in `infra/` (compose + two small scripts), so the ACL
  image and the CI stack are untouched.
 **Negative / costs**
 - The two compose files diverge further: the CI stack seeds at test time, the local stack at bring-up.
  Mitigated by reusing the same underlying scripts and cross-referencing them.
 - The ACL entrypoint override couples the local ACL to the seed-written file path (`/seed/acl.env`);
  if the seed fails, the ACL fails to start (loud, healthcheck-visible — preferred over silently
  running with a placeholder).
 - Container-IP-based URLs are re-derived on each bring-up; a keep-volumes restart with a changed
  OpenZaak IP relies on OpenZaak rebuilding hyperlinked URLs from the request host (it does) so the
  idempotent re-seed reports current-IP URLs.
 ## Alternatives considered
 - **ACL resolves its zaaktype by identificatie (`BIG-REGISTRATIE`) at startup.** The cleaner,
  less-brittle design — no server-assigned URL to capture — and it would help the CI stack too. But it
  changes a service's runtime behaviour and its config contract, needs new ACL tests + mutation
  coverage, and still needs a seed step to *create* the zaaktype. Deliberately split out as its own
  slice with its own ADR (S-27 / #113) rather than folded into this infra-only fix.
 - **A documented `make local-seed` step run after `make local`.** Smallest change, but it fails the
  slice's "no manual seeding" outcome — the local stack is exactly the one meant to just work in a
  browser. Rejected.
 - **Fixed zaaktype UUID via OpenZaak `setup_configuration`/fixtures.** OpenZaak assigns UUIDs on POST;
  declaratively creating a fully *published* zaaktype (statustypen + resultaattypen validated against
  the Selectielijst + roltypen + iot relations) is not something `setup_configuration` supports
  cleanly in 1.28.2. Rejected as more fragile than reusing `seed_catalogus.py`.
@@ -1,67 +0,0 @@
 # ADR-0021: The ACL resolves its zaaktype by identificatie, not a pinned URL
 - **Status:** Accepted
 - **Date:** 2026-07-22
 - **Deciders:** Respellion engineering
 - **Relates to:** S-27 (#113), proposed in #117. The cleaner design deliberately split out of S-B04
  (#110, ADR-0020), which fixed the local stack with an infra-only bootstrap.
 ## Context
 The ACL was handed a **pinned zaaktype URL** (`Acl__Defaults__ZaaktypeUrl`) and diploma
 informatieobjecttype URL. OpenZaak assigns those UUIDs at creation, so the URL is not knowable when
 the compose file is written — every stack had to seed the catalogus and then capture + inject the
 resulting URLs out of band: `run-domain-check.sh` for CI, and the `local-seed` → `acl.env` bootstrap
 (ADR-0020) for `make local`. Brittle, and a stale/placeholder URL failed opaquely (OpenZaak 400).
 ## Decision
 **The ACL resolves its zaaktype (by `identificatie`) and diploma informatieobjecttype (by
 `omschrijving`) from OpenZaak's Catalogi API, instead of being handed the URLs.**
 - **Config:** `AclDefaults.ZaaktypeUrl`/`InformatieobjecttypeUrl` → `ZaaktypeIdentificatie`
  (`BIG-REGISTRATIE`) / `InformatieobjecttypeOmschrijving` (`Diploma`).
 - **Lookup (gateway, §8.1):** `GET /catalogi/api/v1/zaaktypen?status=definitief&identificatie=…` →
  the published zaaktype URL; `GET /catalogi/api/v1/informatieobjecttypen?status=definitief` matched
  on `omschrijving`. Reuses the gateway's existing catalogus-query machinery.
 - **Timing = lazy + cached (`CachedZaaktypeCatalog`).** Resolve on first use (first zaak open /
  document store) and cache for the process lifetime. Lazy avoids a startup ordering coupling — the
  ACL never crash-loops when it boots before the catalogus is published. A **failed** resolution is
  not cached, so it is retried on the next call (e.g. once the zaaktype is published); a restart
  re-resolves.
 - **Failure mode:** no published match → a clear "No published zaaktype with identificatie '…' found
  in OpenZaak — is the BIG catalogus seeded and published?" error, replacing the opaque placeholder
  400.
 ## Consequences
 **Positive**
 - No stack captures or injects a server-assigned URL any more: `run-domain-check.sh` drops the
  `ACL_ZAAKTYPE_URL`/`ACL_INFORMATIEOBJECTTYPE_URL` capture+inject, `docker-compose.yml`/`.local.yml`
  drop the placeholder URL env, and `local-seed`/`acl.env` shrink to a single line. The ACL
  self-configures from the catalogus it already talks to.
 - The failure mode is legible (a named error instead of a 400 on a zeros-UUID).
 **Negative / costs**
 - The ACL still needs its OpenZaak **BaseUrl** pointed at a **URL-valid host (a container IP)**, so
  the base-URL injection from ADR-0020 stays (the local `acl.env` now carries only that; CI keeps
  `ACL_OPENZAAK_BASEURL`). This is **not** something S-27 can remove: OpenZaak validates the
  `zaaktype` field on zaak-create with Django's URLValidator and **rejects a single-label host**
  (`http://openzaak:8000/…` → `zaaktype: bad-url, "Voer een geldige URL in."`, confirmed empirically).
  So ADR-0020's `seed-env` volume + ACL entrypoint shim are **simplified, not deleted**.
 - New branching in the gateway/resolver → unit + integration test surface; the mutation ratchet
  covers it (§5).
 - A seed step still **creates + publishes** the zaaktype (this ADR changes only discovery). Reaching
  OpenZaak's Catalogi API to *seed* likewise needs the IP host (its query params hit the same
  URLValidator) — unchanged from before.
 ## Alternatives considered
 - **Resolve at startup** (eager). Simpler cache, but reintroduces the ordering coupling (crash-loop
  if the catalogus isn't published yet). Rejected in favour of lazy.
 - **Per-request resolution** (no cache). No stale-cache risk, but a Catalogi lookup on every ACL
  operation. Rejected; a process-lifetime cache with restart-to-refresh is enough here.
 - **Keep the pinned URL** (status quo / ADR-0020 only). Rejected — the brittleness this ADR removes is
  exactly what S-27 was carved out to fix.
@@ -1,79 +0,0 @@
 # ADR-0022: Quartz.NET for time-triggered fleet sweeps
 - **Status:** Accepted
 - **Date:** 2026-07-23
 - **Deciders:** Respellion engineering
 - **Slice:** S-17 (#18) · **Proposal issue:** #120
 ## Context
 A BIG inscription is valid for a fixed term; before it lapses the zorgprofessional
 must herregistreren. S-17 adds a **herregistratie reminder sweep**: once a day,
 scan the register for inscriptions whose deadline is within the reminder window and
 remind each one.
 The Domain Service already runs periodic background work — `OpenZaakJobPump`,
 `BeoordelingEscalatiePump`, `RegistratieVerlopenPump`. Those are **continuous job
 pollers**: they drain Flowable's external-task/job queues at-least-once, picking up
 work as soon as it is parked, on a short poll interval. The reminder sweep is a
 different shape of work: **time-triggered**, once a day, over our own store — there
 is no queue to drain and no "as soon as possible" requirement.
 The PRD already names the scheduler component: "Scheduler (Quartz.NET): fleet-wide
 sweeps (expiry, reminders)" (§39, §94). Adding Quartz.NET is nonetheless a new
 dependency, so this decision is recorded before the code lands (CLAUDE.md §14).
 ## Decision
 **Use Quartz.NET for time-triggered fleet sweeps, starting with the herregistratie
 reminder sweep. Leave the existing pumps as `BackgroundService` job pollers.**
 - `HerregistratieReminderJob` (a Quartz `IJob`) is fired by a cron trigger — daily
  at 03:00 by default, overridable with `Quartz__Cron`. It is a thin shell: it
  resolves the pure `HerregistratieReminderSweep` (application layer) and logs how
  many reminders went out.
 - The sweep's rule lives in the domain: `Registration.HerregistratieReminderDue(asOf)`,
  which the store query and the sweep both build on. The sweep marks each reminded
  inscription (`HerregistratieReminderVerstuurd`), so a re-fire reminds no one twice
  (§8.6).
 Two options were rejected:
 1. **A `BackgroundService` with a 24h `Task.Delay`.** No new dependency, but it
   drifts to process-start time, has no cron/misfire semantics, and contradicts the
   PRD's named component. A daily "run at 03:00" is exactly what cron scheduling is
   for.
 2. **Migrating the three pumps onto Quartz too, for one mechanism.** Rejected: the
   pumps are not schedulers. Forcing a "run at time T" tool onto "drain this queue
   continuously" work is churn and a boundary change for negative benefit. The
   teachable distinction is worth keeping: **pumps drain queues; Quartz fires
   sweeps.**
 ## Consequences
 **Positive**
 - Cron scheduling with restart-stable timing and misfire handling, for free.
 - The reminder rule is one domain method, reused by the store query and the sweep;
  the scheduler owns none of the policy.
 - The reference app now demonstrates the intended Scheduler component.
 **Negative / costs**
 - One new dependency (`Quartz`, `Quartz.Extensions.Hosting`) in the Domain Service.
 - Two periodic-work mechanisms coexist (pumps + Quartz). Deliberate — they model
  two genuinely different concerns, documented here.
 **Follow-up**
 - The validity term (5 years) and reminder lead time (16 weeks) are domain
  calibration knobs; promote them to beheer config (S-15) if a demo needs them
  per-catalogus.
 - The Quartz job stores its schedule in RAM (`RAMJobStore`); a persistent/clustered
  store is a later concern if the Domain Service is scaled out.
 ## Coupling rules touched (CLAUDE.md §8)
 None. Quartz is internal to the Domain Service and drives an application use case
 over the store port. No ZGW or Flowable coupling is added; the sweep talks to no
 peer module.
@@ -1,74 +0,0 @@
 # ADR-0023: Grafana-native observability stack (Tempo + Prometheus + Grafana)
 - **Status:** Accepted
 - **Date:** 2026-07-23
 - **Deciders:** Respellion engineering
 - **Slice:** S-16a (#122), first of the S-16 (#17) split
 ## Context
 The PRD calls for "OpenTelemetry traces, Prometheus metrics; a local Grafana with
 pre-built dashboards" (§80). S-16 was split (CLAUDE.md §13) into a backplane slice
 (this one), distributed tracing (#123), and metrics + dashboards (#124). The
 backplane must stand up first: a local, CI-friendly place for traces and metrics to
 land, viewable in one UI, reaching green health within the 3-minute compose budget.
 Two shape decisions are non-obvious enough to record.
 ## Decision
 **Run a Grafana-native stack — Grafana Tempo (traces) + Prometheus (metrics) +
 Grafana (UI) — with the services exporting OTLP straight to Tempo (no collector),
 and ship the config baked into small built images.**
 ### Trace backend: Tempo (not Jaeger)
 Tempo keeps everything under one Grafana pane alongside metrics (and later logs),
 which is exactly the "local Grafana with dashboards" the PRD asks for. Jaeger would
 add a second UI and a second mental model for no benefit at this scale.
 ### No OTLP collector
 Tempo ingests OTLP directly (gRPC 4317 / HTTP 4318) and Prometheus scrapes each
 service's `/metrics`, so a collector would be a hop that processes nothing. Skipped.
 If we later need fan-out, tail sampling, or log processing, a collector is an
 additive change — the services already speak OTLP.
 ### Config baked into built images, not config volumes
 The upstream Common Ground modules (OpenZaak, NRC, Keycloak, Flowable) run as
 **verbatim** images and get their config streamed into external named volumes by
 `infra/seed-config.sh`, because bind mounts don't reach sibling containers on the
 CI runner (see `docs/runbooks/gitea-actions-gotchas.md`). The observability tools
 are **not** peer modules we must run verbatim, so we take the simpler path: a
 three-line `Dockerfile` per tool that `COPY`s its config in. This reaches sibling
 containers everywhere (docker, podman, CI) with no seed step, no `CFG_VOLS` entry,
 and no Makefile sprawl.
 ### Verified, not assumed
 `infra/run-observability-check.sh` (the `verify-observability` step, run early in CI
 `verify-stack`) asks Grafana to reach both datasources — Prometheus via its health
 method, Tempo via the datasource proxy (Tempo's Grafana plugin implements no health
 method) — so the check proves the datasources are actually wired, not merely that
 containers started. The containers are not in `WAIT_SVCS`; the check polls Grafana
 itself, so no in-image healthcheck tool is required.
 ## Consequences
 **Positive**
 - One UI for traces + metrics + (future) logs. Config is versioned in
  `infra/observability/` and self-contained in the images.
 - Backplane is independent of app instrumentation — #123 and #124 build on it.
 **Negative / costs**
 - Three more images built each CI run (kept small; not on the health-gate list).
 - Storage is ephemeral container fs — a demo backplane, not a retention target.
  Object storage for Tempo / remote-write for Prometheus is a later concern.
 ## Coupling rules touched (CLAUDE.md §8)
 None. The stack is passive infrastructure: services *push* OTLP and *expose*
 `/metrics`; nothing in the stack calls into a service or a peer module.
@@ -5,136 +5,6 @@ copy-pasteable walkthrough against a local `make up` stack.
 ---
 ## S-16b — distributed traces across the .NET services (#123, ADR-0023)
 **Outcome:** the five .NET services (BFF, Domain, ACL, projection-api, event-subscriber) now emit
 OpenTelemetry traces — ASP.NET Core + `HttpClient` auto-instrumentation, exported over OTLP to Tempo.
 Because every cross-service call goes through a typed `HttpClient`, the W3C `traceparent` propagates for
 free, so a request is **one connected trace** across the services (bff → domain → acl → openzaak;
 bff → projection-api). `/health` is filtered out. No browser-side instrumentation yet, so the trace
 begins at the BFF; the async Flowable-poll boundary is a separate trace (ADR-0023).
 ```bash
 # 1. Automated (a CI verify-stack step): generate BFF traffic and assert Tempo holds one trace
 #    spanning multiple services.
 make verify-tracing              # → OK — trace <id> spans ['bff', 'projection-api']
 # 2. By hand: drive the stack, then explore traces in Grafana.
 make up
 curl -s localhost:8080/openbaar/register >/dev/null   # BFF → projection-api
 open http://localhost:3000       # Grafana → Explore → Tempo → Search → service.name = bff → open a trace
 ```
 **The path:** each host wires `AddOpenTelemetry().WithTracing(AddAspNetCoreInstrumentation +
 AddHttpClientInstrumentation + AddOtlpExporter)`; `OTEL_SERVICE_NAME` / `OTEL_EXPORTER_OTLP_ENDPOINT`
 come from compose; spans export to **tempo:4317** and render in Grafana against the provisioned Tempo
 datasource.
 ---
 ## S-16a — observability backplane: Tempo + Prometheus + Grafana (#122, ADR-0023)
 **Outcome:** the compose stack now includes a Grafana-native observability backplane — **Tempo** (OTLP
 trace ingest on 4317/4318), **Prometheus**, and **Grafana** with both datasources auto-provisioned.
 Nothing is instrumented yet (traces land in S-16b, metrics + dashboards in S-16c); this slice stands the
 backplane up and proves Grafana can reach both datasources. Config is baked into small built images
 (`infra/observability/`) — no collector, no config-volume seeding.
 ```bash
 # 1. Bring the stack up, then assert the backplane is live (Grafana healthy + Tempo/Prometheus
 #    datasources reachable through Grafana). This is a CI verify-stack step.
 make up
 make verify-observability        # → ✓ Grafana healthy  ✓ Prometheus reachable  ✓ Tempo reachable
 # 2. Or just the backplane, no full stack needed (no external egress):
 docker compose -f infra/docker-compose.yml up -d --build tempo prometheus grafana
 open http://localhost:3000        # Grafana (admin/admin) → Connections → Data sources: Prometheus + Tempo
 open http://localhost:9090        # Prometheus
 ```
 **The path:** services will export OTLP → **Tempo:4317** and expose `/metrics` ← **Prometheus** scrapes;
 **Grafana** (:3000) reads both via provisioned datasources with fixed uids `tempo` / `prometheus`.
 ---
 ## S-17 — herregistratie reminder sweep on a Quartz cron (#18, ADR-0022)
 **Outcome:** an inscription (INGESCHREVEN) now carries the moment it was entered in the register, from
 which its herregistratie deadline is derived (inscription + 5-year validity). A **Quartz.NET** cron job
 in the Domain Service sweeps once a day (03:00, overridable via `Quartz__Cron`): every inscription
 inside the 90-day window before its deadline is flagged `HerregistratieReminderVerstuurd` and logged.
 The sweep is idempotent — a re-fire reminds no one twice — and is a deliberately different mechanism
 from the queue-draining pumps (Quartz fires time-triggered sweeps; pumps drain Flowable queues,
 ADR-0022). There is no outbound notification in v1: the reminder is the flag on the aggregate plus a
 log line.
 ```bash
 # 1. The domain unit tests prove the rule and the sweep end to end (rule → store query → sweep):
 cd services/domain && dotnet test Big.Tests/Big.Tests.csproj \
  --filter "FullyQualifiedName~Herregistratie|FullyQualifiedName~ReminderSweep"
 #    → the reminder is due once the 90-day window opens, not before; a reminded inscription is skipped
 #      on the next sweep; the sweep flags + persists every due inscription and returns their ids.
 # 2. The read model surfaces the deadline once a registration is approved — the field the sweep acts on:
 curl -s localhost:8000/registrations/<id> | jq '{status, herregistratieVoor, herregistratieReminderVerstuurd}'
 #    → after approval: herregistratieVoor is inscription + 5 years; the flag flips true once swept.
 ```
 **The path:** `Registration.Approve(now)` stamps `IngeschrevenOp` → daily Quartz `HerregistratieReminderJob`
 → `HerregistratieReminderSweep` → `IRegistrationStore.FindDueForHerregistratieReminderAsync` (filtered by
 the aggregate's own `HerregistratieReminderDue` rule) → `MarkHerregistratieReminderVerstuurd` + log.
 ---
 ## S-B04 — `make local` completes the whole flow with no manual seeding (#110, ADR-0020)
 **Outcome:** the host-browser stack (`make local`) now self-seeds at bring-up — it publishes the BIG
 zaaktype and wires the ACL to it, deploys the `diploma-eligibility` DMN, and registers the NRC
 abonnement — so a fresh bring-up runs submit → werkbak → openbaar without the manual seeding the
 `verify-*` scripts do for CI. (Previously the process stuck at `OpenZaakAanmaken`, the werkbak stayed
 empty, and the openbaar register showed nothing.)
 ```bash
 # 1. Fresh bring-up (self-seeding init containers: local-seed, nrc-subscribe; DMN in flowable-init).
 make local
 # 2. Assert the whole flow works with no manual seeding — submit opens a zaak, documents route it to
 #    the werkbak, and the reference appears in the openbaar register:
 make verify-local     # → "OK — a fresh local stack completed the flow with no manual seeding ..."
 # 3. Or by hand in the browser: log in at http://localhost:8140 (jan-burger / test123), submit +
 #    upload a PDF, then approve it in the werkbak at http://localhost:8142 (merel-behandelaar /
 #    test123); it shows as INGESCHREVEN in the openbaar register at http://localhost:8141.
 ```
 > The zaaktype is discovered by the ACL itself since S-27 (below); `local-seed`'s `acl.env` now
 > carries only OpenZaak's IP base URL, which the ACL still needs because OpenZaak rejects a
 > single-label host on zaak-create (ADR-0020 + ADR-0021).
 ---
 ## S-27 — ACL resolves its zaaktype by identificatie, not a pinned URL (#113, ADR-0021)
 **Outcome:** the ACL discovers its BIG zaaktype (by `identificatie`) and diploma informatieobjecttype
 (by `omschrijving`) from OpenZaak's Catalogi API, instead of being handed the server-assigned URLs.
 No user-visible behaviour change — the flow runs exactly as before — but no stack captures/injects a
 zaaktype URL any more, and a missing catalogus now fails with a clear message instead of an opaque 400.
 ```bash
 # The live ACL↔OpenZaak integration test proves resolution against a real seeded OpenZaak:
 make verify-acl     # → "resolves the published BIG-REGISTRATIE zaaktype + Diploma informatieobjecttype by business key"
 # End-to-end unchanged (the ACL self-discovers the zaaktype during the flow):
 make verify-local   # local stack — still green, now with no zaaktype-URL injection
 make verify-domain  # CI stack — recreates the ACL pointed only at OpenZaak's IP (no URL to inject)
 ```
 > The ACL still needs its OpenZaak base URL at a URL-valid host (a container IP): OpenZaak's
 > URLValidator rejects a single-label host like `openzaak:8000` on zaak-create. So ADR-0020's base-URL
 > injection stays; only the zaaktype/informatieobjecttype **URL** injection is gone (ADR-0021).
 ---
 ## S-08d — Walking skeleton complete: browser → submit, end-to-end
 **Outcome:** the self-service portal is served in the stack and the full front-of-house happy path
@@ -378,237 +248,3 @@ curl -fsS "http://localhost:8140/openbaar/register?q=$ref" | jq
 > The openbaar register's "Referentie" column and its search now use this reference — the exact value
 > the citizen saw on submit. Asserted end-to-end by the Playwright happy path.
 ## S-12 — Behandel portal: werkbak + beoordeling (#13, ADR-0013)
 A behandelaar now works submitted registrations in a real portal instead of the temporary admin
 endpoint. After a citizen submits (as above), the workflow parks the registration at the Flowable
 `Beoordelen` user task, and it shows up in the **werkbak**. The behandelaar logs in against the
 Keycloak `medewerker` realm and decides — **goedkeuren** (→ INGESCHREVEN via the ACL, per ADR-0011)
 or **afwijzen** — which also completes the Beoordelen task so the process advances.
 ```text
 # 1. Open the behandel portal and log in as a behandelaar (medewerker realm):
 #    http://localhost:8142/   →  merel-behandelaar / test123
 #
 # 2. The werkbak lists the registrations awaiting beoordeling (referentie / bsn / status).
 #    Find the reference from the submit confirmation and click "Goedkeuren" on that row.
 #
 # 3. The row drops off the werkbak (its Beoordelen task is completed) and the openbaar register
 #    (http://localhost:8141/) now shows that reference as INGESCHREVEN.
 ```
 **The path:** behandel portal → BFF `POST /behandel/registrations/{id}/decide` (behandelaar policy,
 `medewerker` realm) → domain applies the decision + completes the Flowable `Beoordelen` task →
 ACL → NRC → event-subscriber → projection → openbaar register shows INGESCHREVEN.
 > The full round-trip — DigiD submit → public INGEDIEND → behandelaar goedkeurt in the werkbak →
 > public INGESCHREVEN — is the Playwright happy path (`tests/e2e/registration.spec.ts`), which now
 > drives the behandel portal in place of the old admin endpoint.
 ## S-11 — Withdrawal: "trek aanvraag in" (#12, ADR-0014)
 A zorgprofessional can withdraw their own still-open registration from the self-service portal. The
 withdrawal is owner-scoped (the BFF forwards the DigiD token's bsn; the domain only lets the owner
 withdraw) and cancels the running workflow via a BPMN message event, so the case leaves the
 behandelaar's werkbak.
 ```text
 # 1. Log in and submit at the self-service portal (http://localhost:8140/, jan-burger / test123),
 #    note the "Referentie" on the confirmation.
 # 2. Click "Trek aanvraag in" → the page confirms the registration is ingetrokken.
 # 3. In the behandel werkbak (http://localhost:8142/, merel-behandelaar) the registration no longer
 #    appears — its Beoordelen task was cancelled.
 ```
 **The path:** self-service → BFF `POST /self-service/registrations/{id}/withdraw` (DigiD, owner-scoped)
 → domain sets INGETROKKEN + correlates the `RegistratieIngetrokken` message to the process → the
 interrupting boundary event ends it → the werkbak drops the case.
 > DigiD submit → trek aanvraag in → ingetrokken is the Playwright happy path
 > (`tests/e2e/withdrawal.spec.ts`); the owner-scoping + workflow cancellation are covered by the
 > `Een registratie intrekken` acceptance scenarios and the domain live check.
 ## S-14 — Beoordeling escalation: 14 days unclaimed → teamlead (#15, ADR-0015)
 A beoordeling a behandelaar does not pick up within 14 days escalates to the teamlead. A
 non-interrupting boundary timer on the `Beoordelen` task fires a `BeoordelingEscaleren` external task;
 the domain's escalation worker reassigns the still-open task's candidate group from `behandelaar` to
 `teamlead`, so it moves from the behandelaar werkbak into the teamlead's. The `Beoordelen` task keeps
 its identity throughout — only who may claim it changes.
 The timer is 14 days, so the demo fires it early through Flowable's management API (exactly what the
 verify-domain check automates):
 ```bash
 # 1. Submit at the self-service portal (http://localhost:8140/, jan-burger / test123). The case
 #    parks at Beoordelen, visible in the behandelaar werkbak (http://localhost:8142/, merel-behandelaar)
 #    but NOT claimed.
 #
 # 2. Find the parked instance and its Beoordelen task, then fire the boundary timer early:
 FL=http://localhost:8090/flowable-rest/service
 PID=$(curl -s -u rest-admin:test -X POST "$FL/query/tasks" -H 'Content-Type: application/json' \
  -d '{"processDefinitionKey":"registratie","taskDefinitionKey":"Beoordelen"}' \
  | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["processInstanceId"])')
 TID=$(curl -s -u rest-admin:test -X POST "$FL/query/tasks" -H 'Content-Type: application/json' \
  -d '{"processDefinitionKey":"registratie","taskDefinitionKey":"Beoordelen"}' \
  | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["id"])')
 TJ=$(curl -s -u rest-admin:test "$FL/management/timer-jobs?processInstanceId=$PID" \
  | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["id"])')
 curl -s -u rest-admin:test -X POST "$FL/management/timer-jobs/$TJ" \
  -H 'Content-Type: application/json' -d '{"action":"move"}'
 AJ=$(curl -s -u rest-admin:test "$FL/management/jobs?processInstanceId=$PID" \
  | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["id"])')
 curl -s -u rest-admin:test -X POST "$FL/management/jobs/$AJ" \
  -H 'Content-Type: application/json' -d '{"action":"execute"}'
 #
 # 3. Within a couple of poll cycles the task's candidate group flips to teamlead:
 curl -s -u rest-admin:test "$FL/runtime/tasks/$TID/identitylinks"   # → [{"group":"teamlead","type":"candidate"}]
 ```
 **The path:** BPMN non-interrupting `P14D` boundary timer on `Beoordelen` → `BeoordelingEscaleren`
 external task → domain escalation worker (`BeoordelingEscalatiePump`) → Workflow Client swaps the task's
 candidate group behandelaar → teamlead (§8.2).
 > Both branches (escalate after 14 days; no-op when completed in time) are covered by the
 > `Een beoordeling escaleren` acceptance scenarios and the Workflow Client unit tests; the timer firing
 > and reassignment are asserted live by the verify-domain check.
 ## S-13 — Diploma-eligibility: foreign diplomas route through CBGV-advies (#14, ADR-0016)
 A registration's diploma origin decides its route. A DMN service task in the registratie
 process evaluates the `diploma-eligibility` decision on the `diplomaOrigin` start variable: a
 **foreign** (Buitenlands) diploma is routed through an extra **CBGV-advies** user task before
 beoordeling; a **domestic** (Binnenlands) one goes straight to beoordeling. The decision lives in the
 DMN, not in code — a beheerder can read and adjust the decision table directly.
 The self-service portal's eIDAS→foreign wiring is a later slice; for now the origin is submitted to
 the domain directly, so the demo drives it through the domain endpoint:
 ```bash
 # 1. Submit a foreign-diploma registration to the domain (note the returned Location/reference):
 DOM=http://localhost:8080   # domain service
 curl -s -i -X POST "$DOM/registrations" -H 'Content-Type: application/json' \
  -d '{"bsn":"123456782","diplomaOrigin":"Buitenlands"}' | grep -i '^location:'
 #
 # 2. Once the zaak is opened, the process first parks at WachtOpDocumenten (S-10a); complete that task
 #    (documents received) — then it parks at the CBGV-advies task (NOT Beoordelen). In Flowable:
 FL=http://localhost:8090/flowable-rest/service
 curl -s -u rest-admin:test -X POST "$FL/query/tasks" -H 'Content-Type: application/json' \
  -d '{"processDefinitionKey":"registratie","taskDefinitionKey":"CBGVAdvies"}' | python3 -m json.tool
 #
 # 3. Complete the CBGV-advies task; the case then advances to the regular Beoordelen task:
 TID=$(curl -s -u rest-admin:test -X POST "$FL/query/tasks" -H 'Content-Type: application/json' \
  -d '{"processDefinitionKey":"registratie","taskDefinitionKey":"CBGVAdvies"}' \
  | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["id"])')
 curl -s -u rest-admin:test -X POST "$FL/runtime/tasks/$TID" \
  -H 'Content-Type: application/json' -d '{"action":"complete"}'
 # A domestic submission (default, or "Binnenlands") skips CBGV-advies and parks straight at Beoordelen.
 ```
 **The path:** domain sets the `diplomaOrigin` start variable → registratie process DMN
 DMN service task sets `route` → exclusive gateway → foreign: `CBGVAdvies` user task → `Beoordelen`;
 domestic: `Beoordelen` directly (§8.2, ADR-0016).
 > The domestic/foreign paths are covered by the `Een diploma op herkomst routeren` acceptance
 > scenarios and unit tests (the origin is carried into the process); the DMN decision and the
 > foreign→CBGV routing are asserted live by the verify-domain check.
 ## S-10a — Document wait + 30-day timeout cancels the registration (#102, ADR-0017)
 After the zaak is opened the registratie process parks at a **WachtOpDocumenten** user task, waiting
 for the citizen's documents (their diploma). Two things can happen:
 - **Documents arrive in time** → the task completes and the process continues to the diploma-eligibility
  routing (S-13) → beoordeling.
 - **30 days pass with no documents** → an interrupting `P30D` boundary timer cancels the wait, runs the
  `RegistratieVerlopen` external task, and the domain expires the registration to the terminal status
  **VERLOPEN** (the case is cancelled).
 The "documents received" trigger is wired end-to-end in S-10a: the self-service page shows a
 **"Documenten aanleveren"** button after submit (portal → BFF → domain → completes the wait). S-10b
 turns that into a real file upload stored in the ZGW Documenten API via the ACL. The timeout branch is
 demonstrated by firing the 30-day timer early via the management API.
 ```bash
 DOM=http://localhost:8080                      # domain service
 FL=http://localhost:8090/flowable-rest/service # flowable-rest
 # 1. Submit a registration; once the zaak is opened it parks at WachtOpDocumenten:
 curl -s -i -X POST "$DOM/registrations" -H 'Content-Type: application/json' \
  -d '{"bsn":"123456782"}' | grep -i '^location:'          # note the /registrations/<id> reference
 WQ='{"processDefinitionKey":"registratie","taskDefinitionKey":"WachtOpDocumenten"}'
 # 2a. Documents-in-time: complete the WachtOpDocumenten task → the process advances to beoordeling.
 TID=$(curl -s -u rest-admin:test -X POST "$FL/query/tasks" -H 'Content-Type: application/json' \
  -d "$WQ" | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["id"])')
 curl -s -u rest-admin:test -X POST "$FL/runtime/tasks/$TID" \
  -H 'Content-Type: application/json' -d '{"action":"complete"}'
 # 2b. Timeout: instead of completing it, fire the 30-day timer early via the management API. Find the
 #     instance's timer job, "move" it to executable; the async executor fires the interrupting event.
 PID=$(curl -s -u rest-admin:test -X POST "$FL/query/tasks" -H 'Content-Type: application/json' \
  -d "$WQ" | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["processInstanceId"])')
 JID=$(curl -s -u rest-admin:test "$FL/management/timer-jobs?processInstanceId=$PID" \
  | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["id"])')
 curl -s -u rest-admin:test -X POST "$FL/management/timer-jobs/$JID" \
  -H 'Content-Type: application/json' -d '{"action":"move"}'
 #     The RegistratieVerlopen worker then expires the aggregate — read it back as VERLOPEN:
 curl -s "$DOM/registrations/<id>"   # → {"status":"Verlopen", ...}
 ```
 **The path:** registratie process parks at `WachtOpDocumenten` → documents received completes it (→
 routing → `Beoordelen`), OR the `P30D` interrupting timer fires → `RegistratieVerlopen` external task
 → domain worker expires the aggregate to `Verlopen` → `endVerlopen` (§8.2, ADR-0017).
 > Both branches are covered by the `Een documenttermijn laten verlopen` acceptance scenarios (worker +
 > aggregate) and unit tests; the wait completion and the 30-day timer firing are asserted live by the
 > verify-domain check.
 ## S-10b — Diploma upload stored in the ZGW Documenten API (#103, ADR-0018)
 The self-service "Documenten aanleveren" action (S-10a) is now a **real file upload**: after submitting,
 the citizen picks a PDF and uploads it. The portal base64-encodes the file client-side and posts it to
 the BFF; the BFF forwards it to the domain, which stores it via the **ACL** as a ZGW
 `enkelvoudiginformatieobject` in the **Documenten (DRC) API** and relates it to the zaak — then completes
 the `WachtOpDocumenten` wait so beoordeling can proceed. Per §8.1 only the ACL talks to ZGW.
 ```bash
 make up
 # 1. Log in as jan-burger / test123, submit, then — once the openbaar register shows the row —
 #    choose a PDF under "Documenten aanleveren" and upload it. The page confirms "aangeleverd".
 open http://localhost:8140
 #
 # 2. Automated: the walking-skeleton e2e now uploads a real PDF before the behandelaar approves.
 make verify-e2e
 #
 # 3. The ACL integration test proves the document is really created in the Documenten API and
 #    related to the zaak (against a live OpenZaak):
 make verify-acl        # → "Storing a diploma creates a real informatieobject related to the zaak"
 ```
 **The path:** portal (base64) → BFF `POST /self-service/registrations/{id}/documents` → domain
 `ProvideDocuments` → ACL `POST /documenten` → ZGW `enkelvoudiginformatieobjecten` +
 `zaakinformatieobjecten`; the wait is then completed and the case advances to Beoordelen (§8.1, ADR-0018).
 ## S-10c — the ZGW zaak is cancelled when the document term lapses (#106)
 When the 30-day document term lapses (S-10a), the domain no longer only marks the aggregate `Verlopen` —
 it now also cancels the **ZGW zaak** through the ACL, so OpenZaak and the register agree. The zaak is set
 to a distinct, non-terminal **`Geannuleerd`** status with a **`Vervallen`** resultaat (as opposed to the
 approval `Afgehandeld` + `Geregistreerd`), resolved by name in the ACL (§8.1, ADR-0019).
 ```bash
 # 1. The ACL integration test proves cancellation records the Geannuleerd status + a resultaat
 #    against a live OpenZaak:
 make verify-acl        # → "Cancelling a zaak records the geannuleerd status and a resultaat"
 #
 # 2. End-to-end: the domain check submits a registration, fires its 30-day timer early, and asserts
 #    the timeout worker both expires the registration (VERLOPEN) and cancels its zaak (Geannuleerd):
 make verify-domain     # → "the timed-out registration's zaak was cancelled to Geannuleerd in OpenZaak"
 ```
 **The path:** Flowable P30D timer → `RegistratieVerlopen` job → domain `ExpireRegistrationWorker` → ACL
 `POST /annuleringen` → ZGW `resultaten` + `statussen` (Geannuleerd); the aggregate then moves to
 `Verlopen`. The ACL cancels the zaak **before** the aggregate is expired, so a failed ZGW call leaves the
 job for redelivery rather than diverging the two (ADR-0019).
@@ -117,53 +117,3 @@ with the submit form (S-08c, #67); any deviation from NL DS will be recorded her
  (id + status); `bsn`/`naam` never leave the BFF. The e2e asserts the bsn never renders.
 - **Loads on open, filters on search.** `RegisterPage` fetches the full register on construction and
  re-queries `/openbaar/register?q=` on search — no client-side filtering, the BFF owns the query.
 ## Behandel portal (S-12, #13)
 The staff portal where a behandelaar works the **werkbak** (registrations awaiting beoordeling) and
 decides each — goedkeuren or afwijzen. `apps/behandel` mirrors `apps/self-service`; the net-new
 frontend work is the medewerker realm auth and the werkbak/decide page. Wiring rationale is in
 **ADR-0013**; this entry records the frontend-specific choices.
 - **Medewerker realm auth, reusing `libs/auth`.** Staff authenticate against the Keycloak
  `medewerker` realm (public client `big-portal`), not `digid`. Rather than fork the auth lib, the
  abstract `AuthService` grew a **`roles`/`hasRole` surface** (empty for realms without roles, e.g.
  `digid`), and a parallel **`MedewerkerAuthService` + `provideMedewerkerAuth`** were added — same
  auth-code + PKCE config, bound to the medewerker realm, reading the nested `realm_access.roles`
  claim. The library's own `authInterceptor` attaches the token to the relative `/behandel/` calls
  (secure route), exactly as self-service does for `/self-service/`.
 - **Roles reach the frontend via a realm mapper.** Keycloak emits realm roles in the access token by
  default but not the ID token/userinfo the SPA reads, so the medewerker `big-portal` client gets a
  **realm-roles protocol mapper** (`realm_access.roles`, added to id + userinfo tokens). The
  **BFF remains the security boundary** (`behandelaar` policy, 401/403 on `/behandel/*`, ADR-0013);
  the frontend role signal is for display/UX, and the werkbak page surfaces a load failure (e.g. a
  403 for a non-behandelaar) rather than swallowing it.
 - **Same-origin via nginx, like the other portals.** The compose `behandel` image serves the built
  app and reverse-proxies `/behandel` to the BFF (relative calls, no CORS). Served on `:8142`,
  health-checked over IPv4 (`127.0.0.1`), depends on Keycloak for the medewerker realm.
 - **Werkbak = decide-and-refresh.** `WerkbakPage` loads `GET /behandel/werkbak` on open and renders a
  row per registration (referentie/bsn/status). Goedkeuren/afwijzen `POST /behandel/registrations/
  {id}/decide` and then reload the werkbak, so the handled item drops off (its Flowable `Beoordelen`
  task is completed). Per-row decide buttons carry an `aria-label` including the reference, so the
  e2e (and screen readers) can target a specific registration in a shared werkbak.
 - **Testing.** Component tests use `@testing-library/angular` with `BffApiV1Service`/`AuthService`
  mocked and the axe WCAG 2.1 AA check; an `app.config.spec` drives the real interceptor + api-client
  to assert the medewerker token attaches to `/behandel/*` (and not to the anonymous openbaar call).
  The full DigiD-submit → behandel-decide → public INGESCHREVEN round-trip is the Playwright happy
  path.
 ## Self-service withdrawal: "trek aanvraag in" (S-11c, #12)
 The submit confirmation grows a **"Trek aanvraag in"** action so a zorgprofessional can withdraw the
 registration they just submitted (`apps/self-service`, on the existing `RegistrationPage`).
 - **Keyed by the reference, owner-scoped at the BFF.** The button calls the generated
  `postSelfServiceRegistrationsIdWithdraw(reference)` with the reference the submit returned. The
  DigiD token (attached by the interceptor) carries the bsn the BFF forwards; the domain only lets
  the owner withdraw (a mismatch is 404). No extra identity is entered in the UI.
 - **Same confirm-and-surface pattern as submit.** A secondary-action button; on success the page
  switches to an ingetrokken confirmation; a failure is surfaced (`role="alert"`) and the action
  stays available to retry — mirroring how submit handles its failure rather than swallowing it.
 - **Testing.** Component tests (`@testing-library/angular`, mocked BFF) cover the button appearing
  after submit, the reference being passed, the ingetrokken confirmation, and the failure path; the
  browser round-trip is `tests/e2e/withdrawal.spec.ts`.
@@ -14,7 +14,6 @@ All test users share the password **`test123`**.
 | Realm | Mimics | User | Identifying claim |
 |---|---|---|---|
 | `digid` | DigiD (burgers) | `jan-burger` | `bsn` = `123456782` |
 | `digid` | DigiD (burgers) | `sanne-burger` | `bsn` = `231477813` (S-26 resume e2e — its own user so it can leave an open registration) |
 | `eherkenning` | eHerkenning (bedrijven) | `acme-ondernemer` | `kvk` = `12345678` |
 | `eidas` | eIDAS (EU) | `pierre-dupont` | `eidas_id` = `FR/NL/AB-1234-5678` |
 | `medewerker` | Internal staff | `merel-behandelaar` | role `behandelaar` |
@@ -1,12 +1,7 @@
 # LOCAL development stack — runs with a plain `docker compose up`, no make / no
-# external seed step / no bash. Use this on a local engine (Docker Desktop on Windows or
+# seed step / no bash. Use this on a local engine (Docker Desktop on Windows or
 # macOS, or rootless Podman on Linux).
 #
 # Self-seeding (S-B04, #110, ADR-0020): unlike the CI stack — where the verify-* scripts seed the
 # zaaktype and register the NRC abonnement at test time — this stack does that itself, via one-shot
 # init containers (local-seed, nrc-subscribe) + a DMN deploy in flowable-init, so a fresh bring-up
 # completes the whole flow with no manual steps. `make verify-local` asserts it.
 #
 #   docker compose -f infra/docker-compose.local.yml up -d --build         # podman
 #   docker compose -f infra/docker-compose.local.yml up -d --build --wait  # Docker Desktop
 #   docker compose -f infra/docker-compose.local.yml down --volumes
@@ -22,12 +17,7 @@
 #
 # Port map (host):
 #   8000 OpenZaak · 8001 Open Notificaties · 8080 BFF · 8090 Flowable REST
-#   8100 ACL · 8130 Domain · 8180 Keycloak   (all admin: admin / admin — dev only)
+#   8100 ACL · 8180 Keycloak   (all admin: admin / admin — dev only)
 #   8140 self-service portal · 8141 openbaar register · 8142 behandel portal
 #
 # Portal OIDC on the HOST: browse the portals at their 8140/8141/8142 ports and log in via
 # Keycloak on localhost:8180 (KC_HOSTNAME below pins the issuer there; the BFF still validates
 # in-network via keycloak:8080). Test users are in docs/synthetic-data.md.
 services:
@@ -215,12 +205,6 @@ services:
      KEYCLOAK_ADMIN_PASSWORD: admin
      KC_HEALTH_ENABLED: "true"
      KC_HTTP_ENABLED: "true"
      # Pin the frontend/issuer URL to the host-published address so a browser on the host and the
      # tokens it gets both use localhost:8180. KC_HOSTNAME_BACKCHANNEL_DYNAMIC lets in-network
      # callers (the BFF via keycloak:8080) still resolve token/jwks endpoints to their request host,
      # so the BFF validates the localhost:8180 issuer while fetching keys over the compose network.
      KC_HOSTNAME: http://localhost:8180
      KC_HOSTNAME_BACKCHANNEL_DYNAMIC: "true"
    ports:
      - "8180:8080"
    volumes:
@@ -262,79 +246,38 @@ services:
    restart: "no"
    volumes:
      - ../workflows/registratie.bpmn:/work/registratie.bpmn:ro,z
      - ../workflows/diploma-eligibility.dmn:/work/diploma-eligibility.dmn:ro,z
    command:
      - sh
      - -c
      - |
-        svc=http://flowable-rest:8080/flowable-rest/service/repository/deployments
+        base=http://flowable-rest:8080/flowable-rest/service/repository/deployments
-        dmn=http://flowable-rest:8080/flowable-rest/dmn-api/dmn-repository/deployments
+        until curl -sf -u rest-admin:test "$$base" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
-        until curl -sf -u rest-admin:test "$$svc" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
+        if curl -s -u rest-admin:test "$$base?name=registratie" | grep -q '"name":"registratie"'; then
-        # Deploy the DMN to the DMN engine and the BPMN to the process engine as SEPARATE deployments:
+          echo "registratie already deployed; skip"
        # flowable-rest does NOT cascade a .dmn bundled in a process .bar into the DMN engine, so the DMN
        # must go via dmn-api. The registratie process's DMN service task then resolves the decision across
        # deployments by key (S-13, ADR-0016). Without this the WachtOpDocumenten completion 404s on the
        # missing decision and the case never reaches Beoordelen (S-B04). Both steps are idempotent.
        if curl -s -u rest-admin:test "$$dmn" | grep -q '"name":"diploma-eligibility.dmn"'; then
          echo "diploma-eligibility DMN already deployed; skip"
        else
-          curl -sf -u rest-admin:test -F 'file=@/work/diploma-eligibility.dmn;filename=diploma-eligibility.dmn' "$$dmn" >/dev/null && echo "deployed diploma-eligibility DMN"
+          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$base" >/dev/null && echo "deployed registratie"
        fi
        if curl -s -u rest-admin:test "$$svc?name=registratie" | grep -q '"name":"registratie"'; then
          echo "registratie BPMN already deployed; skip"
        else
          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$svc" >/dev/null && echo "deployed registratie BPMN"
        fi
    depends_on:
      flowable-rest:
        condition: service_started
    networks: [cg]
  # ── Local bootstrap: seed the zaaktype + wire the ACL (S-B04, #110, ADR-0020) ─────────────────
  # The zaaktype UUID is assigned by OpenZaak at creation, so it can't be a static value in this
  # file. This one-shot seeds + publishes the BIG zaaktype (and the Diploma informatieobjecttype)
  # and writes their server-assigned URLs into a shared volume as acl.env, which the ACL sources on
  # startup (below). It is the local-stack equivalent of what infra/run-domain-check.sh does for CI.
  # Reaches OpenZaak by its container IP because a single-label host fails OpenZaak's URLValidator.
  local-seed:
    image: docker.io/library/python:3-slim
    restart: "no"
    volumes:
      - ./openzaak/seed_catalogus.py:/work/seed_catalogus.py:ro,z
      - ./local/seed-zaaktype.sh:/work/seed-zaaktype.sh:ro,z
      - seed-env:/out
    command: ["sh", "/work/seed-zaaktype.sh"]
    depends_on:
      openzaak:
        condition: service_healthy
    networks: [cg]
  # ── ACL ──────────────────────────────────────────────────────────────────
  acl:
    build:
      context: ../services/acl
      dockerfile: Dockerfile
    image: register-referentie/acl:dev
    # The ACL discovers its zaaktype + informatieobjecttype URLs from the Catalogi API by the business
    # keys below (S-27, ADR-0021), so no URL is injected. It still needs its OpenZaak BaseUrl pointed at
    # a URL-valid host (OpenZaak rejects a single-label host like `openzaak` on zaak-create), so the
    # local-seed one-shot writes that IP base into seed-env:/seed/acl.env, which the entrypoint sources
    # (set -a) before the app starts. A runtime-generated env file is why we override the entrypoint here
    # rather than use `env_file:` (which compose reads at parse time, before the seed has run).
    entrypoint: ["/bin/sh", "-c", "set -a; . /seed/acl.env; set +a; exec dotnet Acl.Api.dll"]
    environment:
-      Acl__OpenZaak__BaseUrl: http://openzaak:8000/   # placeholder; seed-env/acl.env supplies the IP base
+      Acl__OpenZaak__BaseUrl: http://openzaak:8000/
      Acl__OpenZaak__ClientId: big-reference-seed
      Acl__OpenZaak__Secret: insecure-dev-secret-change-me
      Acl__Defaults__Bronorganisatie: "517439943"
      Acl__Defaults__VerantwoordelijkeOrganisatie: "517439943"
      Acl__Defaults__Vertrouwelijkheidaanduiding: openbaar
-      Acl__Defaults__ZaaktypeIdentificatie: BIG-REGISTRATIE
+      Acl__Defaults__ZaaktypeUrl: ${ACL_ZAAKTYPE_URL:-http://openzaak:8000/catalogi/api/v1/zaaktypen/00000000-0000-0000-0000-000000000000}
      Acl__Defaults__InformatieobjecttypeOmschrijving: Diploma
    ports:
      - "8100:8080"
    volumes:
      - seed-env:/seed:ro
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
      interval: 5s
@@ -344,8 +287,6 @@ services:
    depends_on:
      openzaak:
        condition: service_healthy
      local-seed:
        condition: service_completed_successfully
    networks: [cg]
  # ── BFF ──────────────────────────────────────────────────────────────────
@@ -354,14 +295,6 @@ services:
      context: ../services/bff
      dockerfile: Dockerfile
    image: register-referentie/bff:dev
    environment:
      # Reach Keycloak over the compose network for metadata/keys; the discovered issuer is the
      # host-pinned localhost:8180 (KC_HOSTNAME above), which is what browser tokens carry — so
      # validation matches without the BFF ever needing to resolve localhost:8180 itself.
      Keycloak__Authority: http://keycloak:8080/realms/digid
      Keycloak__MedewerkerAuthority: http://keycloak:8080/realms/medewerker
      Downstream__Domain__BaseUrl: http://domain:8080/
      Downstream__Projection__BaseUrl: http://projection-api:8080/
    ports:
      - "8080:8080"
    healthcheck:
@@ -370,39 +303,6 @@ services:
      timeout: 3s
      retries: 5
      start_period: 10s
    depends_on:
      domain:
        condition: service_healthy
      projection-api:
        condition: service_healthy
      keycloak:
        condition: service_started
    networks: [cg]
  # ── BIG Domain Service (S-05) ─────────────────────────────────────────────
  domain:
    build:
      context: ../services/domain
      dockerfile: Dockerfile
    image: register-referentie/domain:dev
    environment:
      Flowable__BaseUrl: http://flowable-rest:8080/flowable-rest/
      Flowable__Username: rest-admin
      Flowable__Password: test
      Acl__BaseUrl: http://acl:8080/
    ports:
      - "8130:8080"
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s
    depends_on:
      acl:
        condition: service_healthy
      flowable-init:
        condition: service_completed_successfully
    networks: [cg]
  # ── Read projection (S-06) ────────────────────────────────────────────────
@@ -428,10 +328,6 @@ services:
    image: register-referentie/event-subscriber:dev
    environment:
      ConnectionStrings__Projection: Host=projection-db;Database=projection;Username=projection;Password=projection
      # The subscriber enriches the projection with each zaak's reference by asking the ACL — the only
      # code allowed to read ZGW (§8.1, #78). Required: startup throws without it (parity with the
      # canonical compose).
      Acl__BaseUrl: http://acl:8080/
      EventSubscriber__Webhook__AuthToken: ${NOTIFICATION_WEBHOOK_TOKEN:-Bearer big-reference-notifications}
    ports:
      - "8110:8080"
@@ -444,33 +340,6 @@ services:
    depends_on:
      projection-db:
        condition: service_healthy
      acl:
        condition: service_healthy
    networks: [cg]
  # ── Local bootstrap: register the NRC abonnement (S-B04, #110, ADR-0020) ──────────────────────
  # Without a subscription, OpenZaak's notifications reach NRC and are delivered nowhere, so the
  # projection (and the openbaar register) stay empty. This one-shot registers an abonnement on the
  # `zaken` kanaal pointing at the event-subscriber's /notifications callback — the CI equivalent is
  # infra/verify-notification-driver.py. The callback uses the event-subscriber's container IP (a
  # single-label host fails NRC's URLValidator). It is a leaf (nothing depends on it), so it can wait
  # for the event-subscriber without creating a cycle with the ACL bootstrap.
  nrc-subscribe:
    image: docker.io/library/python:3-slim
    restart: "no"
    volumes:
      - ./local/register-abonnement.py:/work/register-abonnement.py:ro,z
    environment:
      NRC_BASE: http://nrc-web:8000
      SINK_HOST: event-subscriber
      SINK_PORT: "8080"
      SINK_AUTH: ${NOTIFICATION_WEBHOOK_TOKEN:-Bearer big-reference-notifications}
    command: ["python", "/work/register-abonnement.py"]
    depends_on:
      nrc-web:
        condition: service_healthy
      event-subscriber:
        condition: service_started
    networks: [cg]
  projection-api:
@@ -493,80 +362,11 @@ services:
        condition: service_healthy
    networks: [cg]
  # ── Portals (S-08/S-09/S-12) ──────────────────────────────────────────────
  # nginx serves each Angular app and reverse-proxies its endpoint group to the BFF (same-origin).
  # The images bake config.json with the compose authority (keycloak:8080), which a HOST browser
  # can't resolve — so here we bind-mount a config.json pointing at the host-published localhost:8180
  # (matching KC_HOSTNAME). openbaar is anonymous and needs no config.
  self-service:
    build:
      context: ..
      dockerfile: apps/self-service/Dockerfile
    image: register-referentie/self-service:dev
    ports:
      - "8140:80"
    volumes:
      - ./local-config/self-service.config.json:/usr/share/nginx/html/config.json:ro,z
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s
    depends_on:
      bff:
        condition: service_healthy
      keycloak:
        condition: service_started
    networks: [cg]
  openbaar:
    build:
      context: ..
      dockerfile: apps/openbaar/Dockerfile
    image: register-referentie/openbaar:dev
    ports:
      - "8141:80"
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s
    depends_on:
      bff:
        condition: service_healthy
    networks: [cg]
  behandel:
    build:
      context: ..
      dockerfile: apps/behandel/Dockerfile
    image: register-referentie/behandel:dev
    ports:
      - "8142:80"
    volumes:
      - ./local-config/behandel.config.json:/usr/share/nginx/html/config.json:ro,z
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s
    depends_on:
      bff:
        condition: service_healthy
      keycloak:
        condition: service_started
    networks: [cg]
 volumes:
  oz-db:
  nrc-db:
  flowable-db:
  projection-db:
  # Carries the seed-generated acl.env (server-assigned zaaktype URLs) from local-seed to the ACL.
  seed-env:
 networks:
  cg:
@@ -15,12 +15,12 @@
 #
 #   docker compose -f infra/docker-compose.yml up -d --build --wait
 #
-# After first boot, seed + publish the BIG catalogus:
+# After first boot, seed the BIG catalogus and note the zaaktype URL:
-#   OZ_PUBLISH=1 python infra/openzaak/seed_catalogus.py
+#   python infra/openzaak/seed_catalogus.py
-# The ACL discovers the zaaktype by identificatie (S-27, ADR-0021), so there is no URL to inject —
+# Then set ACL_ZAAKTYPE_URL in a .env file or your shell and re-up the acl
-# just point its BaseUrl at an OpenZaak host OpenZaak accepts on zaak-create (a container IP; a
+# service:
-# single-label host is rejected):
+#   export ACL_ZAAKTYPE_URL=http://openzaak:8000/catalogi/api/v1/zaaktypen/<uuid>
-#   ACL_OPENZAAK_BASEURL=http://<openzaak-ip>:8000/ docker compose -f infra/docker-compose.yml up -d acl
+#   docker compose -f infra/docker-compose.yml up -d acl
 services:
@@ -259,30 +259,19 @@ services:
  flowable-init:
    image: docker.io/curlimages/curl:latest
    restart: "no"
-    # registratie.bpmn + diploma-eligibility.dmn are streamed into this external volume by
+    # registratie.bpmn is streamed into this external volume by infra/seed-config.sh.
    # infra/seed-config.sh.
    volumes:
      - fl-bpmn:/work:ro
    command:
      - sh
      - -c
      - |
-        svc=http://flowable-rest:8080/flowable-rest/service/repository/deployments
+        base=http://flowable-rest:8080/flowable-rest/service/repository/deployments
-        dmn=http://flowable-rest:8080/flowable-rest/dmn-api/dmn-repository/deployments
+        until curl -sf -u rest-admin:test "$$base" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
-        until curl -sf -u rest-admin:test "$$svc" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
+        if curl -s -u rest-admin:test "$$base?name=registratie" | grep -q '"name":"registratie"'; then
-        # Deploy the DMN to the DMN engine and the BPMN to the process engine as SEPARATE deployments:
+          echo "registratie already deployed; skip"
        # flowable-rest does NOT cascade a .dmn bundled in a process .bar into the DMN engine, so the DMN
        # must go via dmn-api. The process's DMN service task then resolves the decision across deployments
        # by key (S-13, ADR-0016). Both steps are idempotent (skip if already deployed).
        if curl -s -u rest-admin:test "$$dmn" | grep -q '"name":"diploma-eligibility.dmn"'; then
          echo "diploma-eligibility DMN already deployed; skip"
        else
-          curl -sf -u rest-admin:test -F 'file=@/work/diploma-eligibility.dmn;filename=diploma-eligibility.dmn' "$$dmn" >/dev/null && echo "deployed diploma-eligibility DMN"
+          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$base" >/dev/null && echo "deployed registratie"
        fi
        if curl -s -u rest-admin:test "$$svc?name=registratie" | grep -q '"name":"registratie"'; then
          echo "registratie BPMN already deployed; skip"
        else
          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$svc" >/dev/null && echo "deployed registratie BPMN"
        fi
    depends_on:
      flowable-rest:
@@ -296,10 +285,6 @@ services:
      dockerfile: Dockerfile
    image: register-referentie/acl:dev
    environment:
      # OpenTelemetry traces → Tempo (S-16b, ADR-0023).
      OTEL_EXPORTER_OTLP_ENDPOINT: http://tempo:4317
      OTEL_EXPORTER_OTLP_PROTOCOL: grpc
      OTEL_SERVICE_NAME: acl
      # Overridable so verify-domain can point the ACL at the same OpenZaak host that
      # owns the seeded zaaktype URL (host-consistent zaak creation, ADR-0009).
      Acl__OpenZaak__BaseUrl: ${ACL_OPENZAAK_BASEURL:-http://openzaak:8000/}
@@ -308,12 +293,8 @@ services:
      Acl__Defaults__Bronorganisatie: "517439943"
      Acl__Defaults__VerantwoordelijkeOrganisatie: "517439943"
      Acl__Defaults__Vertrouwelijkheidaanduiding: openbaar
-      # The ACL resolves the (server-assigned) zaaktype + diploma informatieobjecttype URLs from the
+      # Override with the real zaaktype URL after running seed_catalogus.py.
-      # Catalogi API by these stable business keys (S-27, ADR-0021) — no URL to capture and inject.
+      Acl__Defaults__ZaaktypeUrl: ${ACL_ZAAKTYPE_URL:-http://openzaak:8000/catalogi/api/v1/zaaktypen/00000000-0000-0000-0000-000000000000}
      # BaseUrl above stays overridable because OpenZaak rejects a single-label host on zaak creation,
      # so verify-domain still points the ACL at OpenZaak's container IP.
      Acl__Defaults__ZaaktypeIdentificatie: BIG-REGISTRATIE
      Acl__Defaults__InformatieobjecttypeOmschrijving: Diploma
    ports:
      - "8100:8080"
    healthcheck:
@@ -338,10 +319,6 @@ services:
      dockerfile: Dockerfile
    image: register-referentie/domain:dev
    environment:
      # OpenTelemetry traces → Tempo (S-16b, ADR-0023).
      OTEL_EXPORTER_OTLP_ENDPOINT: http://tempo:4317
      OTEL_EXPORTER_OTLP_PROTOCOL: grpc
      OTEL_SERVICE_NAME: domain
      Flowable__BaseUrl: http://flowable-rest:8080/flowable-rest/
      Flowable__Username: rest-admin
      Flowable__Password: test
@@ -368,16 +345,10 @@ services:
      dockerfile: Dockerfile
    image: register-referentie/bff:dev
    environment:
      # OpenTelemetry traces → Tempo (S-16b, ADR-0023).
      OTEL_EXPORTER_OTLP_ENDPOINT: http://tempo:4317
      OTEL_EXPORTER_OTLP_PROTOCOL: grpc
      OTEL_SERVICE_NAME: bff
      # The BFF is the portals' only backend; it validates digid tokens and fans out (ADR-0010).
      # Keycloak (start-dev) derives the issuer from the request host, so the BFF authority and the
      # verify token request both use keycloak:8080 to keep the issuer consistent.
      Keycloak__Authority: http://keycloak:8080/realms/digid
      # Behandelaars authenticate against the medewerker realm; the BFF validates it for /behandel/* (S-12c).
      Keycloak__MedewerkerAuthority: http://keycloak:8080/realms/medewerker
      Downstream__Domain__BaseUrl: http://domain:8080/
      Downstream__Projection__BaseUrl: http://projection-api:8080/
    ports:
@@ -424,10 +395,6 @@ services:
      dockerfile: services/event-subscriber/Dockerfile
    image: register-referentie/event-subscriber:dev
    environment:
      # OpenTelemetry traces → Tempo (S-16b, ADR-0023).
      OTEL_EXPORTER_OTLP_ENDPOINT: http://tempo:4317
      OTEL_EXPORTER_OTLP_PROTOCOL: grpc
      OTEL_SERVICE_NAME: event-subscriber
      ConnectionStrings__Projection: Host=projection-db;Database=projection;Username=projection;Password=projection
      # The subscriber enriches the projection with each zaak's reference (identificatie) by asking
      # the ACL — the only code allowed to read ZGW (§8.1, #78).
@@ -457,10 +424,6 @@ services:
      dockerfile: services/projection-api/Dockerfile
    image: register-referentie/projection-api:dev
    environment:
      # OpenTelemetry traces → Tempo (S-16b, ADR-0023).
      OTEL_EXPORTER_OTLP_ENDPOINT: http://tempo:4317
      OTEL_EXPORTER_OTLP_PROTOCOL: grpc
      OTEL_SERVICE_NAME: projection-api
      ConnectionStrings__Projection: Host=projection-db;Database=projection;Username=projection;Password=projection
    ports:
      - "8120:8080"
@@ -521,73 +484,6 @@ services:
        condition: service_healthy
    networks: [cg]
  # The behandel portal: nginx serves the Angular app and reverse-proxies /behandel to the BFF.
  # Behandelaars log in against the Keycloak medewerker realm (ADR-0013; S-12).
  behandel:
    build:
      context: ..
      dockerfile: apps/behandel/Dockerfile
    image: register-referentie/behandel:dev
    ports:
      - "8142:80"
    healthcheck:
      # 127.0.0.1, not localhost: nginx listens on IPv4 only, but localhost resolves to ::1 first.
      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s
    depends_on:
      bff:
        condition: service_healthy
      keycloak:
        condition: service_started
    networks: [cg]
  # ── Observability backplane (S-16a, ADR-0023) ──────────────────────────────
  # Grafana-native stack: Tempo ingests OTLP traces (the .NET services export
  # straight to it — no collector hop, S-16b), Prometheus scrapes service
  # /metrics (S-16c), and Grafana reads both with datasources auto-provisioned.
  # Config is baked into small built images (COPY) rather than streamed into
  # external config volumes like the upstream CG modules — these aren't verbatim
  # peer images, so a built image is the simpler path that still reaches sibling
  # containers on the CI runner. Not in WAIT_SVCS: run-observability-check.sh
  # polls Grafana itself, so no in-image healthcheck tool is needed.
  tempo:
    build:
      context: ./observability/tempo
    image: register-referentie/tempo:dev
    command: ["-config.file=/etc/tempo.yaml"]
    # Cap the backplane's footprint so it can't starve the app stack + the Playwright browser on the
    # memory-tight CI runner (verify-e2e OOM history, commit d5e5fa2). Generous vs idle (~150M).
    mem_limit: 400m
    networks: [cg]
  prometheus:
    build:
      context: ./observability/prometheus
    image: register-referentie/prometheus:dev
    mem_limit: 400m
    ports:
      - "9090:9090"
    networks: [cg]
  grafana:
    build:
      context: ./observability/grafana
    image: register-referentie/grafana:dev
    mem_limit: 512m
    environment:
      GF_SECURITY_ADMIN_USER: admin
      GF_SECURITY_ADMIN_PASSWORD: admin
      GF_AUTH_ANONYMOUS_ENABLED: "true"
    ports:
      - "3000:3000"
    depends_on:
      - tempo
      - prometheus
    networks: [cg]
 volumes:
  oz-db:
  nrc-db:
@@ -35,35 +35,24 @@ services:
        condition: service_healthy
    networks: [cg]
-  # Deploys registratie.bpmn (process engine) and diploma-eligibility.dmn (DMN engine) via the REST
+  # Deploys workflows/registratie.bpmn via the REST API once flowable-rest is up.
-  # API once flowable-rest is up. Idempotent: skips each if already deployed.
+  # Idempotent: skips if a deployment named "registratie" already exists.
  flowable-init:
    image: docker.io/curlimages/curl:latest
    restart: "no"
-    # registratie.bpmn + diploma-eligibility.dmn are streamed into this external volume by
+    # registratie.bpmn is streamed into this external volume by infra/seed-config.sh.
    # infra/seed-config.sh.
    volumes:
      - fl-bpmn:/work:ro
    command:
      - sh
      - -c
      - |
-        svc=http://flowable-rest:8080/flowable-rest/service/repository/deployments
+        base=http://flowable-rest:8080/flowable-rest/service/repository/deployments
-        dmn=http://flowable-rest:8080/flowable-rest/dmn-api/dmn-repository/deployments
+        until curl -sf -u rest-admin:test "$$base" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
-        until curl -sf -u rest-admin:test "$$svc" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
+        if curl -s -u rest-admin:test "$$base?name=registratie" | grep -q '"name":"registratie"'; then
-        # Deploy the DMN to the DMN engine and the BPMN to the process engine as SEPARATE deployments:
+          echo "registratie already deployed; skip"
        # flowable-rest does NOT cascade a .dmn bundled in a process .bar into the DMN engine, so the DMN
        # must go via dmn-api. The process's DMN service task then resolves the decision across deployments
        # by key (S-13, ADR-0016). Both steps are idempotent (skip if already deployed).
        if curl -s -u rest-admin:test "$$dmn" | grep -q '"name":"diploma-eligibility.dmn"'; then
          echo "diploma-eligibility DMN already deployed; skip"
        else
-          curl -sf -u rest-admin:test -F 'file=@/work/diploma-eligibility.dmn;filename=diploma-eligibility.dmn' "$$dmn" >/dev/null && echo "deployed diploma-eligibility DMN"
+          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$base" >/dev/null && echo "deployed registratie"
        fi
        if curl -s -u rest-admin:test "$$svc?name=registratie" | grep -q '"name":"registratie"'; then
          echo "registratie BPMN already deployed; skip"
        else
          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$svc" >/dev/null && echo "deployed registratie BPMN"
        fi
    depends_on:
      flowable-rest:
@@ -38,36 +38,6 @@
      "emailVerified": true,
      "credentials": [{ "type": "password", "value": "test123", "temporary": false }],
      "attributes": { "bsn": ["123456782"] }
    },
    {
      "username": "sanne-burger",
      "enabled": true,
      "firstName": "Sanne",
      "lastName": "Burger",
      "email": "sanne.burger@example.nl",
      "emailVerified": true,
      "credentials": [{ "type": "password", "value": "test123", "temporary": false }],
      "attributes": { "bsn": ["231477813"] }
    },
    {
      "username": "emma-burger",
      "enabled": true,
      "firstName": "Emma",
      "lastName": "Burger",
      "email": "emma.burger@example.nl",
      "emailVerified": true,
      "credentials": [{ "type": "password", "value": "test123", "temporary": false }],
      "attributes": { "bsn": ["231477805"] }
    },
    {
      "username": "lars-burger",
      "enabled": true,
      "firstName": "Lars",
      "lastName": "Burger",
      "email": "lars.burger@example.nl",
      "emailVerified": true,
      "credentials": [{ "type": "password", "value": "test123", "temporary": false }],
      "attributes": { "bsn": ["231477821"] }
    }
  ]
 }
@@ -16,22 +16,7 @@
      "standardFlowEnabled": true,
      "directAccessGrantsEnabled": true,
      "redirectUris": ["*"],
-      "webOrigins": ["*"],
+      "webOrigins": ["*"]
      "protocolMappers": [
        {
          "name": "realm roles",
          "protocol": "openid-connect",
          "protocolMapper": "oidc-usermodel-realm-role-mapper",
          "config": {
            "multivalued": "true",
            "claim.name": "realm_access.roles",
            "jsonType.label": "String",
            "id.token.claim": "true",
            "access.token.claim": "true",
            "userinfo.token.claim": "true"
          }
        }
      ]
    }
  ],
  "users": [
@@ -1,3 +0,0 @@
 {
  "authority": "http://localhost:8180/realms/medewerker"
 }
@@ -1,3 +0,0 @@
 {
  "authority": "http://localhost:8180/realms/digid"
 }
@@ -1,78 +0,0 @@
 #!/usr/bin/env python3
 """Local-stack bootstrap (S-B04, #110, ADR-0020) — register the NRC abonnement.
 Runs as the `nrc-subscribe` init container of infra/docker-compose.local.yml. Registers an
 abonnement on the `zaken` kanaal pointing at the event-subscriber's /notifications callback, so
 OpenZaak's notifications (zaak create + status set) reach the projection — without this the openbaar
 (public) register stays empty. This is what infra/verify-notification-driver.py does for CI (minus
 the test zaak it also creates).
 The callback host is the event-subscriber's resolved **container IP**, not `event-subscriber`, because
 NRC validates callbackUrl with Django's URLValidator (a single-label host is rejected — same reason the
 zaaktype seed uses OpenZaak's IP). Idempotent + restart-safe: it removes any stale /notifications
 abonnement first, then registers one for the current IP. Stdlib only.
 Env: NRC_BASE, SINK_HOST, SINK_PORT, SINK_AUTH, OZ_CLIENT_ID, OZ_SECRET.
 """
 import base64, hashlib, hmac, json, os, socket, sys, time, urllib.error, urllib.request
 NRC = os.environ.get("NRC_BASE", "http://nrc-web:8000").rstrip("/")
 SINK_HOST = os.environ.get("SINK_HOST", "event-subscriber")
 SINK_PORT = os.environ.get("SINK_PORT", "8080")
 SINK_AUTH = os.environ.get("SINK_AUTH", "Bearer big-reference-notifications")
 CID = os.environ.get("OZ_CLIENT_ID", "big-reference-seed")
 SECRET = os.environ.get("OZ_SECRET", "insecure-dev-secret-change-me")
 def token():
    b64 = lambda b: base64.urlsafe_b64encode(b).rstrip(b"=")
    seg = (
        b64(json.dumps({"alg": "HS256", "typ": "JWT"}, separators=(",", ":")).encode())
        + b"."
        + b64(json.dumps(
            {"iss": CID, "iat": int(time.time()), "client_id": CID,
             "user_id": "local-seed", "user_representation": "local-seed"},
            separators=(",", ":")).encode())
    )
    return (seg + b"." + b64(hmac.new(SECRET.encode(), seg, hashlib.sha256).digest())).decode()
 def call(method, url, body=None):
    data = json.dumps(body).encode() if body is not None else None
    req = urllib.request.Request(url, data=data, method=method, headers={
        "Authorization": "Bearer " + token(),
        "Content-Type": "application/json", "Accept": "application/json"})
    try:
        with urllib.request.urlopen(req, timeout=30) as r:
            raw = r.read()
            return r.status, (json.loads(raw) if raw else None)
    except urllib.error.HTTPError as e:
        raw = e.read()
        return e.code, (json.loads(raw) if raw else None)
 def main():
    ip = socket.gethostbyname(SINK_HOST)
    callback = f"http://{ip}:{SINK_PORT}/notifications"
    # Restart-safe: drop any prior /notifications abonnement (its IP may be stale) before creating a
    # fresh one for the current event-subscriber IP.
    status, body = call("GET", f"{NRC}/api/v1/abonnement")
    for ab in (body or []) if status == 200 else []:
        if str(ab.get("callbackUrl", "")).endswith("/notifications"):
            if ab.get("callbackUrl") == callback:
                print(f"abonnement already current: {ab['url']}")
                return
            call("DELETE", ab["url"])
            print(f"removed stale abonnement {ab['url']}")
    status, ab = call("POST", f"{NRC}/api/v1/abonnement", {
        "callbackUrl": callback, "auth": SINK_AUTH,
        "kanalen": [{"naam": "zaken", "filters": {}}]})
    if status != 201:
        sys.exit(f"create abonnement -> {status}: {json.dumps(ab)}")
    print(f"abonnement registered: {ab['url']} -> {callback}")
 if __name__ == "__main__":
    main()
@@ -1,33 +0,0 @@
 #!/bin/sh
 # Local-stack bootstrap (S-B04, #110, ADR-0020) — the "seed zaaktype + wire the ACL" step.
 #
 # Runs as the `local-seed` init container of infra/docker-compose.local.yml. It seeds + publishes
 # the BIG zaaktype (and the Diploma informatieobjecttype) into OpenZaak, then writes the resulting
 # **server-assigned** URLs into /out/acl.env, which the ACL entrypoint sources before starting. This
 # is the local-stack equivalent of what infra/run-domain-check.sh does for CI: the zaaktype UUID is
 # assigned by OpenZaak at creation, so it can't be a static value in the compose file.
 #
 # Why the container IP and not the `openzaak` service name: OpenZaak validates URL query params
 # (e.g. ?catalogus=) with Django's URLValidator, which rejects a single-label host like `openzaak`.
 # Seeding against the resolved IP keeps the seeded URLs valid AND host-consistent with the ACL, which
 # we point at the same IP below. See docs/runbooks/gitea-actions-gotchas.md and ADR-0020.
 set -eu
 oz_ip="$(python3 -c "import socket;print(socket.gethostbyname('openzaak'))")"
 OZ_BASE="http://${oz_ip}:8000"
 export OZ_BASE OZ_PUBLISH=1
 echo ">> seeding + publishing the BIG zaaktype at ${OZ_BASE} (idempotent)"
 out="$(python3 /work/seed_catalogus.py)"
 echo "$out"
 # Sanity-check that the zaaktype was actually published (the ACL discovers it by identificatie, S-27).
 printf '%s\n' "$out" | grep -q '^ZAAKTYPE_URL ' || { echo "ERROR: seed did not publish the zaaktype" >&2; exit 1; }
 # The ACL resolves the zaaktype/informatieobjecttype URLs itself (S-27, ADR-0021); the only value it
 # still needs injected is the OpenZaak base URL at a URL-valid host (the container IP), because OpenZaak
 # rejects a single-label host on zaak-create. The ACL entrypoint sources this.
 cat > /out/acl.env <<EOF
 Acl__OpenZaak__BaseUrl=${OZ_BASE}/
 EOF
 echo ">> wrote /out/acl.env (base=${OZ_BASE}/)"
@@ -1,4 +0,0 @@
 # Grafana with datasources baked in via provisioning (S-16a, ADR-0023).
 # Dashboards (S-16c, #124) are added under provisioning/dashboards later.
 FROM grafana/grafana:11.3.0
 COPY provisioning/ /etc/grafana/provisioning/
@@ -1,17 +0,0 @@
 # Auto-provisioned datasources (S-16a, ADR-0023). Fixed uids so dashboards (S-16c)
 # and the verify-observability check can reference them by a stable id.
 apiVersion: 1
 datasources:
  - name: Prometheus
    uid: prometheus
    type: prometheus
    access: proxy
    url: http://prometheus:9090
    isDefault: true
  - name: Tempo
    uid: tempo
    type: tempo
    access: proxy
    url: http://tempo:3200
@@ -1,2 +0,0 @@
 FROM prom/prometheus:v2.55.1
 COPY prometheus.yml /etc/prometheus/prometheus.yml
@@ -1,10 +0,0 @@
 # Prometheus scrape config (S-16a, ADR-0023). For the backplane slice it scrapes
 # only itself; the .NET services' /metrics scrape targets are added in S-16c
 # (#124) when the services expose metrics.
 global:
  scrape_interval: 15s
 scrape_configs:
  - job_name: prometheus
    static_configs:
      - targets: ['localhost:9090']
@@ -1,4 +0,0 @@
 # Tempo with our config baked in — so it reaches sibling containers on the CI
 # runner without the external-config-volume dance the upstream CG images need.
 FROM grafana/tempo:2.6.1
 COPY tempo.yaml /etc/tempo.yaml
@@ -1,27 +0,0 @@
 # Grafana Tempo — single-binary, all-in-one, local storage (S-16a, ADR-0023).
 # Ingests OTLP directly (services export straight to Tempo; no collector hop).
 # Storage is ephemeral container fs — this is a local/CI demo backplane, not a
 # retention target. ponytail: local backend, swap for object storage if traces
 # must outlive the stack.
 server:
  http_listen_port: 3200
 distributor:
  receivers:
    otlp:
      protocols:
        grpc:
          endpoint: 0.0.0.0:4317
        http:
          endpoint: 0.0.0.0:4318
 ingester:
  max_block_duration: 5m
 storage:
  trace:
    backend: local
    local:
      path: /var/tempo/blocks
    wal:
      path: /var/tempo/wal
@@ -10,7 +10,7 @@ Creates (if absent):
 Auth uses the JWT client provisioned by setup_configuration (see ADR-0002).
 Stdlib only — no pip deps. Re-running is safe (matches existing by identifier).
 """
-import base64, hashlib, hmac, json, os, sys, time, urllib.error, urllib.parse, urllib.request
+import base64, hashlib, hmac, json, os, sys, time, urllib.error, urllib.request
 BASE = os.environ.get("OZ_BASE", "http://localhost:8000")
 CLIENT_ID = os.environ.get("OZ_CLIENT_ID", "big-reference-seed")
@@ -77,12 +77,8 @@ def publish_zaaktype(zt):
    Selectielijst `selectielijstklasse` whose procestype matches the zaaktype's
    `selectielijstProcestype`, plus a `resultaattypeomschrijving`.
    """
    # Ontvangen (begin) → Afgehandeld (eind, highest volgnummer). "Geannuleerd" (S-10c) sits between
    # them: a non-terminal status the document-timeout branch sets, so it never displaces the Afgehandeld
    # eindstatus the approval path resolves. Keyed by volgnummer on a fresh catalogus (CI reseeds); a
    # stale local stack must reset its OpenZaak volumes for the renumbering to take effect.
    have_st = {s.get("volgnummer") for s in find(f"/statustypen?zaaktype={zt['url']}&status=alles")}
-    for volgnummer, omschrijving in [(1, "Ontvangen"), (2, "Geannuleerd"), (3, "Afgehandeld")]:
+    for volgnummer, omschrijving in [(1, "Ontvangen"), (2, "Afgehandeld")]:
        if volgnummer not in have_st:
            st, body = api("POST", "/statustypen", {
                "omschrijving": omschrijving, "zaaktype": zt["url"], "volgnummer": volgnummer})
@@ -99,42 +95,25 @@ def publish_zaaktype(zt):
            sys.exit(f"create roltype -> {st}: {json.dumps(body, indent=2)}")
        print("create roltype Aanvrager")
-    # Two resultaattypen, keyed by omschrijving so each is created independently (idempotent):
+    if find(f"/resultaattypen?zaaktype={zt['url']}&status=alles"):
-    #   "Geregistreerd" — the approval outcome (S-09b)
+        print("skip   resultaattype Geregistreerd")
    #   "Vervallen"     — the document-timeout cancellation outcome (S-10c)
    # Both selectielijstklassen must share the zaaktype's selectielijstProcestype, so pick two
    # Selectielijst resultaten from a single procestype and set that procestype on the zaaktype.
    have_rt = {r.get("omschrijving") for r in find(f"/resultaattypen?zaaktype={zt['url']}&status=alles")}
    wanted = [("Geregistreerd", "blijvend_bewaren"), ("Vervallen", "vernietigen")]
    if all(naam in have_rt for naam, _ in wanted):
        print("skip   resultaattypen Geregistreerd + Vervallen")
    else:
-        # Anchor on the procestype of an arbitrary resultaat, then fetch that procestype's resultaten so
+        resultaat = selectielijst("/resultaten?pageSize=1")["results"][0]
        # both klassen validate against the zaaktype's selectielijstProcestype.
        procestype = selectielijst("/resultaten?pageSize=1")["results"][0]["procesType"]
        resultaten = selectielijst(f"/resultaten?procesType={urllib.parse.quote(procestype, safe='')}")["results"]
        if len(resultaten) < len(wanted):
            sys.exit(f"selectielijst procestype has too few resultaten ({len(resultaten)}) for {len(wanted)} resultaattypen")
        omschrijvingen = selectielijst("/resultaattypeomschrijvingen")
-        oms_list = omschrijvingen if isinstance(omschrijvingen, list) else omschrijvingen["results"]
+        oms = (omschrijvingen if isinstance(omschrijvingen, list) else omschrijvingen["results"])[0]["url"]
-
+        # The selectielijstklasse and the zaaktype must share a procestype.
-        st, body = api("PATCH", zt["url"], {"selectielijstProcestype": procestype})
+        st, body = api("PATCH", zt["url"], {"selectielijstProcestype": resultaat["procesType"]})
        if st != 200:
            sys.exit(f"set procestype -> {st}: {json.dumps(body, indent=2)}")
-
+        st, body = api("POST", "/resultaattypen", {
-        for i, (naam, archiefnominatie) in enumerate(wanted):
+            "zaaktype": zt["url"], "omschrijving": "Geregistreerd",
-            if naam in have_rt:
+            "resultaattypeomschrijving": oms, "selectielijstklasse": resultaat["url"],
-                print(f"skip   resultaattype {naam}")
+            "archiefnominatie": "blijvend_bewaren",
-                continue
+            "brondatumArchiefprocedure": {"afleidingswijze": "afgehandeld"},
-            st, body = api("POST", "/resultaattypen", {
+        })
-                "zaaktype": zt["url"], "omschrijving": naam,
+        if st != 201:
-                "resultaattypeomschrijving": oms_list[i]["url"], "selectielijstklasse": resultaten[i]["url"],
+            sys.exit(f"create resultaattype -> {st}: {json.dumps(body, indent=2)}")
-                "archiefnominatie": archiefnominatie,
+        print("create resultaattype Geregistreerd")
                "brondatumArchiefprocedure": {"afleidingswijze": "afgehandeld"},
            })
            if st != 201:
                sys.exit(f"create resultaattype {naam} -> {st}: {json.dumps(body, indent=2)}")
            print(f"create resultaattype {naam}")
    if zt.get("concept", True):
        st, body = api("POST", f"{zt['url']}/publish")
@@ -145,58 +124,6 @@ def publish_zaaktype(zt):
        print("skip   publish (already published)")
 def seed_informatieobjecttype(cat, zt):
    """Create the "Diploma" informatieobjecttype and relate it to the zaaktype (both idempotent).
    A diploma uploaded in S-10b is filed under this informatieobjecttype; OpenZaak only accepts a
    document (and its zaak relation) once the informatieobjecttype is published AND allowed for the
    zaak's zaaktype (a zaaktype-informatieobjecttype relation). Both the relation and this call must run
    while the zaaktype is still a concept, so seed this *before* publishing the zaaktype. Returns the
    informatieobjecttype dict.
    """
    iots = [i for i in find(f"/informatieobjecttypen?catalogus={cat['url']}&status=alles")
            if i.get("omschrijving") == "Diploma"]
    if iots:
        iot = iots[0]
        print(f"skip   informatieobjecttype Diploma ({iot['url']}) concept={iot.get('concept')}")
    else:
        st, iot = api("POST", "/informatieobjecttypen", {
            "catalogus": cat["url"],
            "omschrijving": "Diploma",
            "vertrouwelijkheidaanduiding": "openbaar",
            "informatieobjectcategorie": "diploma",
            "beginGeldigheid": "2026-01-01",
        })
        if st != 201:
            sys.exit(f"create informatieobjecttype -> {st}: {json.dumps(iot, indent=2)}")
        print(f"create informatieobjecttype Diploma ({iot['url']})")
    # Relate it to the zaaktype (must be done while both are concept).
    relations = find(f"/zaaktype-informatieobjecttypen?zaaktype={zt['url']}&status=alles")
    if any(r.get("informatieobjecttype") == iot["url"] for r in relations):
        print("skip   zaaktype-informatieobjecttype Diploma")
    else:
        st, body = api("POST", "/zaaktype-informatieobjecttypen", {
            "zaaktype": zt["url"], "informatieobjecttype": iot["url"],
            "volgnummer": 1, "richting": "inkomend"})
        if st != 201:
            sys.exit(f"relate zaaktype-informatieobjecttype -> {st}: {json.dumps(body, indent=2)}")
        print("create zaaktype-informatieobjecttype Diploma")
    return iot
 def publish_informatieobjecttype(iot):
    """Publish the informatieobjecttype (idempotent) so documents may reference it."""
    if iot.get("concept", True):
        st, body = api("POST", f"{iot['url']}/publish")
        if st != 200:
            sys.exit(f"publish informatieobjecttype -> {st}: {json.dumps(body, indent=2)}")
        print(f"publish informatieobjecttype Diploma ({iot['url']})")
    else:
        print("skip   publish informatieobjecttype (already published)")
 def main():
    # 1. Catalogus
    existing = [c for c in find(f"/catalogussen?domein=BIG") if c.get("domein") == "BIG"]
@@ -271,16 +198,10 @@ def main():
    # schema-mandatory" zaaktype S-01 asks for (ADR-0002). Set OZ_PUBLISH=1 to add
    # those relations and publish — needed so a real zaak POST is accepted, which
    # the ACL integration test (S-04a, #46) exercises. See ADR-0006.
    iot = None
    if PUBLISH:
        # Re-fetch: the bsn-eigenschap branch above may hold a stale concept flag.
        zt = next(z for z in find(f"/zaaktypen?catalogus={cat['url']}&status=alles")
                  if z.get("identificatie") == "BIG-REGISTRATIE")
        # Seed + relate the Diploma informatieobjecttype (S-10b) while the zaaktype is still concept,
        # then publish both. Publish the informatieobjecttype before the zaaktype so the zaaktype's
        # relations reference a published type.
        iot = seed_informatieobjecttype(cat, zt)
        publish_informatieobjecttype(iot)
        publish_zaaktype(zt)
    # 5. Verify the JWT client can list the zaaktype (concepts included).
@@ -293,10 +214,6 @@ def main():
    # zaaktype URL to configure the ACL's default-fill (ADR-0003/0009).
    zt_url = next(z["url"] for z in zaaktypen if z.get("identificatie") == "BIG-REGISTRATIE")
    print(f"ZAAKTYPE_URL {zt_url}")
    # Machine-readable informatieobjecttype URL (S-10b) so callers can configure the ACL's document
    # default-fill. Only emitted when publishing — a concept informatieobjecttype can't back a document.
    if iot is not None:
        print(f"INFORMATIEOBJECTTYPE_URL {iot['url']}")
    print(f"OK — BIG catalogus seeded (BIG-REGISTRATIE {state} + bsn eigenschap)")
@@ -30,18 +30,16 @@ oz_ip="$(ip "$oz")"; dom_ip="$(ip "$dom")"
 oz_base="http://$oz_ip:8000"
 echo ">> openzaak=$oz_ip domain=$dom_ip network=$net"
-echo ">> seeding + publishing a BIG zaaktype (idempotent)"
+echo ">> seeding a published BIG zaaktype (idempotent) and capturing its URL"
 sid="$(docker create --network "$net" -e "OZ_BASE=$oz_base" -e OZ_PUBLISH=1 python:3-slim python /seed.py)"
 docker cp "$here/openzaak/seed_catalogus.py" "$sid:/seed.py" >/dev/null
-seed_out="$(docker start -a "$sid")"
+zt_url="$(docker start -a "$sid" | sed -n 's/^ZAAKTYPE_URL //p' | head -1)"
 docker rm -f "$sid" >/dev/null
-printf '%s\n' "$seed_out" | grep -q '^ZAAKTYPE_URL ' || { echo "ERROR: seed did not publish the zaaktype" >&2; exit 1; }
+[ -n "$zt_url" ] || { echo "ERROR: seed did not report a ZAAKTYPE_URL" >&2; exit 1; }
 echo ">> zaaktype: $zt_url"
-# The ACL resolves the zaaktype + informatieobjecttype by identificatie/omschrijving (S-27, ADR-0021),
+echo ">> recreating the acl service pointed at the seeded zaaktype (host-consistent)"
-# so there is no URL to inject — only the OpenZaak base URL, pointed at the same host's container IP
+ACL_ZAAKTYPE_URL="$zt_url" ACL_OPENZAAK_BASEURL="$oz_base/" docker compose -f "$compose" up -d acl
 # (OpenZaak rejects a single-label host on zaak-create).
 echo ">> recreating the acl service pointed at OpenZaak's IP (it resolves the zaaktype itself, S-27)"
 ACL_OPENZAAK_BASEURL="$oz_base/" docker compose -f "$compose" up -d acl
 WAIT_TIMEOUT="${WAIT_TIMEOUT:-120}" bash "$here/wait-healthy.sh" acl
 echo ">> submitting a registration to the domain"
@@ -81,9 +79,9 @@ fl="$(docker ps -q --filter 'name=flowable-rest' | head -1)"
 fl_base="http://$(ip "$fl"):8080/flowable-rest/service"
 reg_id="${loc##*/}"
-# Extracts the Beoordelen task id for a given registration from a Flowable task-query response on
+# Extracts the Beoordelen task id for our registration from a Flowable task-query response on stdin.
-# stdin. Tolerates an empty/non-JSON body (a transient failure during the poll) by printing nothing.
+# Tolerates an empty/non-JSON body (a transient failure during the poll) by printing nothing.
-task_for_reg() { REG_ID="$1" python3 -c "import os,sys,json
+task_for_reg() { REG_ID="$reg_id" python3 -c "import os,sys,json
 try:
    d=json.load(sys.stdin)
 except Exception:
@@ -95,33 +93,12 @@ print(next((t['id'] for t in (d.get('data') or [])
 flcurl() { docker run --rm --network "$net" curlimages/curl:latest -fsS -u rest-admin:test "$@"; }
 query='{"processDefinitionKey":"registratie","taskDefinitionKey":"Beoordelen","includeProcessVariables":true}'
 wacht_query='{"processDefinitionKey":"registratie","taskDefinitionKey":"WachtOpDocumenten","includeProcessVariables":true}'
 # S-10a: every registration now parks at WachtOpDocumenten first (interrupting P30D timer). Completing
 # that task stands in for the citizen's document upload (wired for real in S-10b), letting the process
 # advance to the diploma routing / Beoordelen so the checks below still hold. The 30-day timeout branch
 # is exercised separately at the end.
 complete_wacht() {  # reg_id
  local rid="$1" wid="" r
  for _ in $(seq 1 30); do
    r="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$wacht_query" 2>/dev/null || true)"
    wid="$(printf '%s' "$r" | task_for_reg "$rid")"
    [ -n "$wid" ] && break
    sleep 2
  done
  [ -n "$wid" ] || { echo "FAIL — no WachtOpDocumenten task appeared for $rid" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
  flcurl -X POST "$fl_base/runtime/tasks/$wid" -H 'Content-Type: application/json' -d '{"action":"complete"}' >/dev/null
  echo ">> completed WachtOpDocumenten for $rid (documents received)"
 }
 echo ">> completing WachtOpDocumenten so the process advances (documents received)"
 complete_wacht "$reg_id"
 echo ">> polling Flowable for the Beoordelen user task (werkbak)"
 task_id=""
 for _ in $(seq 1 30); do
  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query" 2>/dev/null || true)"
-  task_id="$(printf '%s' "$resp" | task_for_reg "$reg_id")"
+  task_id="$(printf '%s' "$resp" | task_for_reg)"
  [ -n "$task_id" ] && break
  sleep 2
 done
@@ -138,261 +115,7 @@ flcurl -X POST "$fl_base/runtime/tasks/$task_id" -H 'Content-Type: application/j
 echo ">> asserting the process finished (no Beoordelen task remains for the registration)"
 resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query")"
-still="$(printf '%s' "$resp" | task_for_reg "$reg_id")"
+still="$(printf '%s' "$resp" | task_for_reg)"
 [ -z "$still" ] || { echo "FAIL — Beoordelen task $still still active after completion" >&2; exit 1; }
 echo "OK — behandelaar claimed and completed the Beoordelen task; the registratie process finished"
 # ── S-11: withdrawal. A second registration parks at Beoordelen; the citizen withdraws it via the
 # domain, which delivers the RegistratieIngetrokken message to the task's execution, tripping the
 # BPMN boundary event so the process ends and the Beoordelen task disappears (ADR-0014). ────────────
 echo ">> submitting a second registration to withdraw"
 loc2="$(docker run --rm --network "$net" curlimages/curl:latest \
  -fsS -D - -o /dev/null -X POST "http://$dom_ip:8080/registrations" \
  -H 'Content-Type: application/json' -d '{"bsn":"123456782"}' \
  | sed -n 's/\r$//; s/^[Ll]ocation: //p' | head -1)"
 [ -n "$loc2" ] || { echo "FAIL — second POST /registrations returned no Location" >&2; exit 1; }
 reg_id2="${loc2##*/}"
 echo ">> second registration $reg_id2"
 complete_wacht "$reg_id2"
 echo ">> polling Flowable for its Beoordelen task"
 task_id2=""
 for _ in $(seq 1 30); do
  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query" 2>/dev/null || true)"
  task_id2="$(printf '%s' "$resp" | task_for_reg "$reg_id2")"
  [ -n "$task_id2" ] && break
  sleep 2
 done
 [ -n "$task_id2" ] || { echo "FAIL — no Beoordelen task appeared for registration $reg_id2" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
 echo ">> Beoordelen task $task_id2 is waiting; withdrawing the registration via the domain"
 # Owner-scoped: the withdraw carries the same bsn the registration was submitted with (S-11c).
 docker run --rm --network "$net" curlimages/curl:latest \
  -fsS -X POST "http://$dom_ip:8080/registrations/$reg_id2/withdraw" \
  -H 'Content-Type: application/json' -d '{"bsn":"123456782"}' >/dev/null
 echo ">> asserting the process was cancelled (no Beoordelen task remains for the registration)"
 gone=""
 for _ in $(seq 1 15); do
  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query" 2>/dev/null || true)"
  still2="$(printf '%s' "$resp" | task_for_reg "$reg_id2")"
  [ -z "$still2" ] && { gone=1; break; }
  sleep 2
 done
 [ -n "$gone" ] || { echo "FAIL — Beoordelen task for $reg_id2 still active after withdrawal" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
 echo "OK — withdrawal cancelled the Beoordelen task; the registratie process ended (ingetrokken)"
 # ── S-13: diploma-eligibility routing. A registration with a FOREIGN diploma must route through the
 # extra CBGVAdvies user task before Beoordelen (the DMN service task sets route=CBGV_ADVIES and the
 # gateway branches, ADR-0016). The domestic DIRECT path is already proven by the first registration
 # above, which parked straight at Beoordelen. ──────────────────────────────────────────────────────
 cbgv_query='{"processDefinitionKey":"registratie","taskDefinitionKey":"CBGVAdvies","includeProcessVariables":true}'
 echo ">> submitting a registration with a foreign diploma"
 locf="$(docker run --rm --network "$net" curlimages/curl:latest \
  -fsS -D - -o /dev/null -X POST "http://$dom_ip:8080/registrations" \
  -H 'Content-Type: application/json' -d '{"bsn":"123456782","diplomaOrigin":"Buitenlands"}' \
  | sed -n 's/\r$//; s/^[Ll]ocation: //p' | head -1)"
 [ -n "$locf" ] || { echo "FAIL — foreign POST /registrations returned no Location" >&2; exit 1; }
 reg_idf="${locf##*/}"
 echo ">> foreign registration $reg_idf"
 complete_wacht "$reg_idf"
 echo ">> polling Flowable for its CBGV-advies task (foreign diplomas route here first)"
 cbgv_task=""
 for _ in $(seq 1 30); do
  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$cbgv_query" 2>/dev/null || true)"
  cbgv_task="$(printf '%s' "$resp" | task_for_reg "$reg_idf")"
  [ -n "$cbgv_task" ] && break
  sleep 2
 done
 [ -n "$cbgv_task" ] || { echo "FAIL — no CBGVAdvies task appeared for the foreign registration $reg_idf" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
 echo ">> CBGVAdvies task $cbgv_task is waiting"
 echo ">> asserting it has NOT reached Beoordelen yet (still awaiting CBGV-advies)"
 resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query")"
 early="$(printf '%s' "$resp" | task_for_reg "$reg_idf")"
 [ -z "$early" ] || { echo "FAIL — foreign registration reached Beoordelen ($early) before CBGV-advies" >&2; exit 1; }
 echo ">> completing the CBGV-advies task"
 flcurl -X POST "$fl_base/runtime/tasks/$cbgv_task" -H 'Content-Type: application/json' -d '{"action":"complete"}' >/dev/null
 echo ">> asserting it now advances to Beoordelen"
 onward=""
 for _ in $(seq 1 15); do
  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query" 2>/dev/null || true)"
  [ -n "$(printf '%s' "$resp" | task_for_reg "$reg_idf")" ] && { onward=1; break; }
  sleep 2
 done
 [ -n "$onward" ] || { echo "FAIL — foreign registration did not reach Beoordelen after CBGV-advies" >&2; exit 1; }
 echo "OK — foreign diploma routed through CBGV-advies, then on to Beoordelen (DMN + gateway)"
 # ── S-14: escalation. A third registration parks at Beoordelen. We fire its 14-day boundary timer
 # early via Flowable's management API (the timer job is moved to executable and run), which routes a
 # parallel token to the BeoordelingEscaleren external task. The domain's escalation worker acquires
 # it and reassigns the still-open Beoordelen task from the behandelaar group to teamlead (ADR-0015). ─
 echo ">> submitting a third registration to escalate"
 loc3="$(docker run --rm --network "$net" curlimages/curl:latest \
  -fsS -D - -o /dev/null -X POST "http://$dom_ip:8080/registrations" \
  -H 'Content-Type: application/json' -d '{"bsn":"123456782"}' \
  | sed -n 's/\r$//; s/^[Ll]ocation: //p' | head -1)"
 [ -n "$loc3" ] || { echo "FAIL — third POST /registrations returned no Location" >&2; exit 1; }
 reg_id3="${loc3##*/}"
 echo ">> third registration $reg_id3"
 # Extracts "<taskId> <processInstanceId>" for a registration from a task-query response on stdin.
 task_and_pid_for_reg() { REG_ID="$1" python3 -c "import os,sys,json
 try:
    d=json.load(sys.stdin)
 except Exception:
    d={}
 rid=os.environ['REG_ID']
 t=next((t for t in (d.get('data') or [])
    if any(v.get('name')=='registrationId' and v.get('value')==rid for v in (t.get('variables') or []))), None)
 print(f\"{t['id']} {t['processInstanceId']}\" if t else '')"; }
 # The candidate groups on a task (space-separated, sorted) from a runtime identitylinks response.
 candidate_groups() { python3 -c "import sys,json
 try:
    links=json.load(sys.stdin)
 except Exception:
    links=[]
 print(' '.join(sorted(l.get('group') or '' for l in links if l.get('type')=='candidate' and l.get('group'))))"; }
 # The first job id in a management jobs/timer-jobs response on stdin.
 first_job_id() { python3 -c "import sys,json
 try:
    d=json.load(sys.stdin)
 except Exception:
    d={}
 print(((d.get('data') or [{}])[0]).get('id',''))"; }
 complete_wacht "$reg_id3"
 echo ">> polling Flowable for its Beoordelen task"
 task_id3=""; pid3=""
 for _ in $(seq 1 30); do
  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query" 2>/dev/null || true)"
  read -r task_id3 pid3 <<<"$(printf '%s' "$resp" | task_and_pid_for_reg "$reg_id3")"
  [ -n "$task_id3" ] && break
  sleep 2
 done
 [ -n "$task_id3" ] || { echo "FAIL — no Beoordelen task appeared for registration $reg_id3" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
 echo ">> Beoordelen task $task_id3 (instance $pid3) is waiting for the behandelaar"
 echo ">> asserting the task starts out claimable by the behandelaar group"
 before="$(flcurl "$fl_base/runtime/tasks/$task_id3/identitylinks" | candidate_groups)"
 [ "$before" = "behandelaar" ] || { echo "FAIL — expected candidate group 'behandelaar', got '$before'" >&2; exit 1; }
 echo ">> firing the 14-day boundary timer early via the management API"
 timer_id="$(flcurl "$fl_base/management/timer-jobs?processInstanceId=$pid3" | first_job_id)"
 [ -n "$timer_id" ] || { echo "FAIL — no timer job found for instance $pid3" >&2; exit 1; }
 # Move the timer job to an executable async job. Flowable's async executor (running in flowable-rest)
 # then picks it up and fires the non-interrupting boundary event. It may run the job before we can
 # look, so executing it explicitly is a best-effort nudge — tolerate the job already being gone.
 flcurl -X POST "$fl_base/management/timer-jobs/$timer_id" -H 'Content-Type: application/json' -d '{"action":"move"}' >/dev/null
 async_id="$(flcurl "$fl_base/management/jobs?processInstanceId=$pid3" 2>/dev/null | first_job_id || true)"
 if [ -n "$async_id" ]; then
  flcurl -X POST "$fl_base/management/jobs/$async_id" -H 'Content-Type: application/json' -d '{"action":"execute"}' >/dev/null 2>&1 || true
 fi
 echo ">> timer fired; the BeoordelingEscaleren token is parked for the domain worker"
 echo ">> polling until the escalation worker reassigns the beoordeling to the teamlead"
 escalated=""
 for _ in $(seq 1 30); do
  groups="$(flcurl "$fl_base/runtime/tasks/$task_id3/identitylinks" 2>/dev/null | candidate_groups || true)"
  [ "$groups" = "teamlead" ] && { escalated=1; break; }
  sleep 2
 done
 [ -n "$escalated" ] || { echo "FAIL — Beoordelen task not reassigned to teamlead (candidate groups: '$groups')" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
 echo "OK — the 14-day timer escalated the still-open Beoordelen task to the teamlead"
 # ── S-10a/S-10c: document timeout. A registration parks at WachtOpDocumenten and — unlike every block
 # above — its documents never arrive. We fire its 30-day boundary timer early via the management API;
 # the INTERRUPTING timer cancels the wait and routes a token to the RegistratieVerlopen external task.
 # The domain's timeout worker acquires it, cancels the ZGW zaak via the ACL (S-10c), and expires the
 # registration to VERLOPEN (ADR-0017). ─────────────────────────────────────────────────────────────
 echo ">> submitting a registration to let its document term lapse"
 locv="$(docker run --rm --network "$net" curlimages/curl:latest \
  -fsS -D - -o /dev/null -X POST "http://$dom_ip:8080/registrations" \
  -H 'Content-Type: application/json' -d '{"bsn":"123456782"}' \
  | sed -n 's/\r$//; s/^[Ll]ocation: //p' | head -1)"
 [ -n "$locv" ] || { echo "FAIL — timeout POST /registrations returned no Location" >&2; exit 1; }
 reg_idv="${locv##*/}"
 echo ">> timeout registration $reg_idv"
 echo ">> polling Flowable for its WachtOpDocumenten task"
 wacht_id=""; pidv=""
 for _ in $(seq 1 30); do
  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$wacht_query" 2>/dev/null || true)"
  read -r wacht_id pidv <<<"$(printf '%s' "$resp" | task_and_pid_for_reg "$reg_idv")"
  [ -n "$wacht_id" ] && break
  sleep 2
 done
 [ -n "$wacht_id" ] || { echo "FAIL — no WachtOpDocumenten task appeared for $reg_idv" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
 echo ">> WachtOpDocumenten task $wacht_id (instance $pidv) is waiting for documents"
 echo ">> firing the 30-day document timer early via the management API"
 timer_idv="$(flcurl "$fl_base/management/timer-jobs?processInstanceId=$pidv" | first_job_id)"
 [ -n "$timer_idv" ] || { echo "FAIL — no timer job found for instance $pidv" >&2; exit 1; }
 # Move the timer job to an executable async job; the async executor fires the interrupting boundary
 # event. It may run before we look, so executing it explicitly is a best-effort nudge (as for S-14).
 flcurl -X POST "$fl_base/management/timer-jobs/$timer_idv" -H 'Content-Type: application/json' -d '{"action":"move"}' >/dev/null
 async_idv="$(flcurl "$fl_base/management/jobs?processInstanceId=$pidv" 2>/dev/null | first_job_id || true)"
 if [ -n "$async_idv" ]; then
  flcurl -X POST "$fl_base/management/jobs/$async_idv" -H 'Content-Type: application/json' -d '{"action":"execute"}' >/dev/null 2>&1 || true
 fi
 echo ">> timer fired; the RegistratieVerlopen token is parked for the domain worker"
 echo ">> polling the domain until the timeout worker expires the registration to VERLOPEN"
 verlopen=""
 for _ in $(seq 1 30); do
  body="$(docker run --rm --network "$net" curlimages/curl:latest -fsS "http://$dom_ip:8080$locv" 2>/dev/null || true)"
  printf '%s' "$body" | grep -qi 'verlopen' && { verlopen=1; break; }
  sleep 2
 done
 [ -n "$verlopen" ] || { echo "FAIL — registration $reg_idv not VERLOPEN after the document timer fired (body: $body)" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
 echo "OK — the 30-day document timer expired the registration to VERLOPEN"
 # S-10c: the worker cancels the ZGW zaak (ACL-first, before it expires the aggregate), so a VERLOPEN
 # registration must carry a zaak whose current status is "Geannuleerd". Read it back from OpenZaak with
 # a ZGW token minted like the seed's client (the same client OpenZaak trusts for this stack).
 zaak_url_v="$(printf '%s' "$body" | grep -oiE 'http://[^"]*/zaken/api/v1/zaken/[a-f0-9-]+' | head -1)"
 [ -n "$zaak_url_v" ] || { echo "FAIL — VERLOPEN registration $reg_idv exposes no zaak URL (body: $body)" >&2; exit 1; }
 echo ">> confirming the zaak $zaak_url_v reached the Geannuleerd status in OpenZaak"
 read_zaak_status() {
  # -i so the heredoc reaches `python -` on the container's stdin (without it the script is empty).
  docker run --rm -i --network "$net" \
    -e OZ_CLIENT_ID="${OZ_CLIENT_ID:-big-reference-seed}" \
    -e OZ_SECRET="${OZ_SECRET:-insecure-dev-secret-change-me}" \
    python:3-slim python - "$1" <<'PY'
 import base64, hashlib, hmac, json, os, sys, time, urllib.request
 cid, sec = os.environ["OZ_CLIENT_ID"], os.environ["OZ_SECRET"]
 b64 = lambda b: base64.urlsafe_b64encode(b).rstrip(b"=")
 def token():
    hdr = {"alg": "HS256", "typ": "JWT"}
    pl = {"iss": cid, "iat": int(time.time()), "client_id": cid, "user_id": "verify", "user_representation": "verify"}
    seg = b64(json.dumps(hdr, separators=(",", ":")).encode()) + b"." + b64(json.dumps(pl, separators=(",", ":")).encode())
    return (seg + b"." + b64(hmac.new(sec.encode(), seg, hashlib.sha256).digest())).decode()
 def get(url):
    req = urllib.request.Request(url, headers={
        "Authorization": "Bearer " + token(), "Accept": "application/json", "Accept-Crs": "EPSG:4326"})
    with urllib.request.urlopen(req, timeout=30) as r:
        return json.loads(r.read())
 zaak = get(sys.argv[1])
 status_url = zaak.get("status")
 if not status_url:
    print(""); sys.exit(0)
 print(get(get(status_url)["statustype"]).get("omschrijving", ""))
 PY
 }
 geannuleerd=""
 for _ in $(seq 1 15); do
  oms="$(read_zaak_status "$zaak_url_v" 2>/dev/null | tr -d '\r' || true)"
  [ "$oms" = "Geannuleerd" ] && { geannuleerd=1; break; }
  sleep 2
 done
 [ -n "$geannuleerd" ] || { echo "FAIL — zaak $zaak_url_v not Geannuleerd after timeout (current status omschrijving: '$oms')" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
 echo "OK — the timed-out registration's zaak was cancelled to Geannuleerd in OpenZaak"
 exit 0
@@ -1,67 +0,0 @@
 #!/usr/bin/env bash
 #
 # Acceptance check for the local stack (S-B04, #110): a fresh `make local` must complete the whole
 # flow with NO manual seeding. Run against an already-up local stack (infra/docker-compose.local.yml)
 # via the host-published ports. It exercises, and thereby covers, the three bring-up gaps the slice
 # fixes:
 #
 #   1. zaaktype seeded + ACL wired  -> a submitted registration opens a zaak (zaakUrl gets filled).
 #   2. diploma-eligibility DMN deployed -> providing documents completes WachtOpDocumenten, routes
 #      through the DMN, and the case lands on Beoordelen (visible in the behandel werkbak).
 #   3. NRC abonnement registered    -> the zaak shows up in the openbaar (public) register.
 #
 # Before the fix this fails at step 1 (ACL points at a placeholder zaaktype -> OpenZaak 400).
 set -euo pipefail
 DOM=${DOM:-http://localhost:8130}     # domain
 BFF=${BFF:-http://localhost:8080}     # bff (openbaar register)
 BSN=${BSN:-123456782}
 # A minimal, valid PDF, base64-encoded (the diploma upload).
 PDF_B64="$(printf '%%PDF-1.4\n1 0 obj<</Type/Catalog>>endobj\ntrailer<</Root 1 0 R>>\n%%%%EOF\n' | base64 | tr -d '\n')"
 echo ">> 1. submit a registration (no manual seeding expected)"
 loc="$(curl -fsS -D - -o /dev/null -X POST "$DOM/registrations" \
  -H 'Content-Type: application/json' -d "{\"bsn\":\"$BSN\"}" \
  | sed -n 's/\r$//; s/^[Ll]ocation: //p' | head -1)"
 [ -n "$loc" ] || { echo "FAIL: POST /registrations returned no Location" >&2; exit 1; }
 id="${loc##*/}"
 echo "   accepted: $id"
 echo ">> 2. poll until the ACL opens the zaak (proves the zaaktype is seeded + wired)"
 zaak=""
 for _ in $(seq 1 30); do
  zaak="$(curl -fsS "$DOM$loc" | python3 -c 'import sys,json;print(json.load(sys.stdin).get("zaakUrl") or "")' 2>/dev/null || true)"
  [ -n "$zaak" ] && break
  sleep 3
 done
 [ -n "$zaak" ] || { echo "FAIL: zaak never opened — ACL zaaktype not wired (gap 1)" >&2; exit 1; }
 echo "   zaak opened: $zaak"
 echo ">> 3. provide documents (proves the diploma-eligibility DMN is deployed)"
 code="$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DOM/registrations/$id/documents" \
  -H 'Content-Type: application/json' \
  -d "{\"bsn\":\"$BSN\",\"contentBase64\":\"$PDF_B64\",\"fileName\":\"diploma.pdf\",\"contentType\":\"application/pdf\"}")"
 [ "$code" = "204" ] || { echo "FAIL: provide documents -> $code (DMN missing routes WachtOpDocumenten to a 404 — gap 2)" >&2; exit 1; }
 echo "   documents accepted (204)"
 echo ">> 4. poll the werkbak until the registration awaits beoordeling (reached Beoordelen)"
 in_werkbak=""
 for _ in $(seq 1 20); do
  in_werkbak="$(curl -fsS "$DOM/behandel/werkbak" | python3 -c "import sys,json;print(any(r.get('registrationId')=='$id' for r in json.load(sys.stdin)))" 2>/dev/null || true)"
  [ "$in_werkbak" = "True" ] && break
  sleep 3
 done
 [ "$in_werkbak" = "True" ] || { echo "FAIL: registration never reached the werkbak (gap 2)" >&2; exit 1; }
 echo "   in the werkbak"
 echo ">> 5. poll the openbaar register until the reference is publicly visible (proves NRC abonnement)"
 public=""
 for _ in $(seq 1 30); do
  public="$(curl -fsS "$BFF/openbaar/register" | python3 -c "import sys,json;print(any(r.get('reference')=='$id' for r in json.load(sys.stdin)))" 2>/dev/null || true)"
  [ "$public" = "True" ] && break
  sleep 3
 done
 [ "$public" = "True" ] || { echo "FAIL: reference never appeared in the openbaar register — NRC abonnement not registered (gap 3)" >&2; exit 1; }
 echo "   visible in the openbaar register"
 echo "OK — a fresh local stack completed the flow with no manual seeding (zaaktype + DMN + abonnement)"
@@ -1,45 +0,0 @@
 #!/usr/bin/env bash
 #
 # S-16a (#122): assert the observability backplane is live against an ALREADY-RUNNING
 # stack. Runs curl INSIDE the compose network (like the other verify checks) because
 # the stack's published ports aren't on the CI runner's localhost — the stack is a set
 # of sibling containers on the host daemon. It asks Grafana to reach its provisioned
 # datasources — Prometheus via its health method, Tempo via the datasource proxy (Tempo's
 # Grafana plugin implements no health method) — so it proves the datasources are wired,
 # not merely that the containers started. Polls, so it tolerates a cold Grafana.
 #
 # Does NOT manage the stack lifecycle (the caller owns bring-up + teardown).
 set -euo pipefail
 TIMEOUT="${OBS_TIMEOUT:-60}"
 AUTH="${GRAFANA_AUTH:-admin:admin}"
 gf="$(docker ps -q --filter 'name=[-_]grafana[-_]' | head -1)"
 [ -n "$gf" ] || { echo "ERROR: no running grafana container — bring the stack up first" >&2; exit 1; }
 net="$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{"\n"}}{{end}}' "$gf" | head -1)"
 gf_ip="$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$gf")"
 base="http://$gf_ip:3000"
 echo ">> grafana=$gf_ip network=$net"
 # Run curl inside a throwaway container on the stack network (reaches services by IP).
 net_curl() { docker run --rm --network "$net" curlimages/curl:latest "$@"; }
 # poll <description> <grep -E pattern> <curl args...>
 poll() {
  local desc="$1" pat="$2"; shift 2
  local deadline=$(( $(date +%s) + TIMEOUT ))
  while :; do
    if net_curl -fsS "$@" 2>/dev/null | grep -Eq "$pat"; then echo "  ✓ $desc"; return 0; fi
    if [ "$(date +%s)" -ge "$deadline" ]; then echo "  ✗ $desc ($*)" >&2; return 1; fi
    sleep 3
  done
 }
 echo "Checking observability backplane at $base ..."
 poll "Grafana is healthy" \
  '"database":[[:space:]]*"ok"' "$base/api/health"
 poll "Prometheus datasource reachable" \
  '"status":[[:space:]]*"OK"' -u "$AUTH" "$base/api/datasources/uid/prometheus/health"
 poll "Tempo datasource reachable (via Grafana proxy)" \
  '"version"' -u "$AUTH" "$base/api/datasources/proxy/uid/tempo/api/status/buildinfo"
 echo "Observability backplane OK."
@@ -1,27 +0,0 @@
 #!/usr/bin/env bash
 #
 # S-16b (#123): assert one connected distributed trace spans the .NET services in Tempo,
 # against an ALREADY-RUNNING full stack. Runs the driver in a python:3-slim container on the
 # stack network (services reached by container IP; the runner can't reach published ports —
 # gitea-actions-gotchas.md §5/§6). Does NOT manage the stack lifecycle.
 set -euo pipefail
 here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ip() { docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$1"; }
 bff="$(docker ps -q --filter 'name=[-_]bff[-_]' | head -1)"
 tempo="$(docker ps -q --filter 'name=[-_]tempo[-_]' | head -1)"
 [ -n "$bff" ] && [ -n "$tempo" ] || { echo "ERROR: bff and/or tempo not running — bring the stack up first" >&2; exit 1; }
 net="$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{"\n"}}{{end}}' "$bff" | head -1)"
 bff_ip="$(ip "$bff")"; tempo_ip="$(ip "$tempo")"
 echo ">> network=$net bff=$bff_ip tempo=$tempo_ip"
 cid="$(docker create --network "$net" \
  -e "BFF=http://$bff_ip:8080" -e "TEMPO=http://$tempo_ip:3200" \
  -e "TRACING_TIMEOUT=${TRACING_TIMEOUT:-90}" \
  python:3-slim python /tracing-check.py)"
 docker cp "$here/tracing-check.py" "$cid:/tracing-check.py" >/dev/null
 rc=0; docker start -a "$cid" || rc=$?
 docker rm -f "$cid" >/dev/null
 exit $rc
@@ -35,21 +35,12 @@ populate() {  # volume  source(file or dir/.)
 [ "$#" -gt 0 ] || { echo "usage: seed-config.sh <oz|nrc|kc|fl> ..." >&2; exit 2; }
 # The registratie process (BPMN) and its diploma-eligibility DMN are deployed as SEPARATE Flowable
 # deployments — the process engine and the DMN engine each own theirs (S-13, ADR-0016). flowable-rest
 # does not cascade a .dmn bundled in a process .bar into the DMN engine, so we seed both raw files and
 # let flowable-init deploy each via its own REST app. We stage them in a temp dir and copy its contents.
 stage_flowable_workflows() {
  local dir="$1"
  cp "$here/../workflows/registratie.bpmn" "$here/../workflows/diploma-eligibility.dmn" "$dir/"
 }
 for key in "$@"; do
  case "$key" in
    oz) populate rr-oz-config "$here/openzaak/setup_configuration/." ;;
    nrc) populate rr-nrc-config "$here/opennotificaties/setup_configuration/." ;;
    kc) populate rr-kc-realms "$here/keycloak/realms/." ;;
-    fl) d="$(mktemp -d)"; stage_flowable_workflows "$d"; populate rr-fl-bpmn "$d/." ;;
+    fl) populate rr-fl-bpmn  "$here/../workflows/registratie.bpmn" ;;
    *)  echo "unknown seed key: $key" >&2; exit 2 ;;
  esac
 done
@@ -1,81 +0,0 @@
 #!/usr/bin/env python3
 """S-16b (#123): prove distributed tracing works end to end.
 Generate anonymous BFF traffic (GET /openbaar/register, which the BFF serves by
 calling projection-api — no auth, no OpenZaak egress), then query Tempo and assert
 that ONE trace contains spans from both `bff` and `projection-api`. That proves the
 services export OTLP to Tempo AND that the W3C traceparent propagates across the
 HttpClient hop, stitching the request into a single connected trace.
 Stdlib only (urllib/json) so it runs in a bare python:3-slim container in-network.
 """
 import json
 import os
 import sys
 import time
 import urllib.error
 import urllib.parse
 import urllib.request
 BFF = os.environ["BFF"]        # http://<bff-ip>:8080
 TEMPO = os.environ["TEMPO"]    # http://<tempo-ip>:3200
 TIMEOUT = int(os.environ.get("TRACING_TIMEOUT", "90"))
 WANT = {"bff", "projection-api"}  # the two services that must share one trace
 def _get(url):
    with urllib.request.urlopen(url, timeout=10) as r:
        return r.read()
 def generate_traffic():
    # A non-2xx still produces spans; only total unreachability of the BFF is fatal.
    for _ in range(3):
        try:
            _get(f"{BFF}/openbaar/register")
        except urllib.error.HTTPError:
            pass
 def search_trace_ids():
    q = urllib.parse.quote('{ resource.service.name = "bff" }')
    try:
        data = json.loads(_get(f"{TEMPO}/api/search?q={q}&limit=50"))
    except Exception:
        return []
    return [t["traceID"] for t in data.get("traces", [])]
 def services_in_trace(trace_id):
    try:
        data = json.loads(_get(f"{TEMPO}/api/traces/{trace_id}"))
    except Exception:
        return set()
    names = set()
    for batch in data.get("batches", []):
        for attr in batch.get("resource", {}).get("attributes", []):
            if attr.get("key") == "service.name":
                names.add(attr.get("value", {}).get("stringValue"))
    return names
 def main():
    deadline = time.time() + TIMEOUT
    generate_traffic()
    seen = set()
    while time.time() < deadline:
        for tid in search_trace_ids():
            names = services_in_trace(tid)
            seen |= names
            if WANT.issubset(names):
                print(f"OK — trace {tid} spans {sorted(names)}")
                return 0
        time.sleep(3)
        generate_traffic()
    print(f"FAIL — no single trace spanned {sorted(WANT)}; services seen: {sorted(seen)}",
          file=sys.stderr)
    return 1
 if __name__ == "__main__":
    sys.exit(main())
@@ -24,15 +24,6 @@ import {
  Observable
 } from 'rxjs';
 export interface CurrentRegistration {
  registrationId: string;
  status: string;
 }
 export interface DecideRequest {
  besluit: string;
 }
 export interface OpenbaarEntry {
  id: string;
  status: string;
@@ -40,25 +31,11 @@ export interface OpenbaarEntry {
  reference: string | null;
 }
 export interface ProvideDocumentsRequest {
  contentBase64: string;
  /** @nullable */
  fileName?: string | null;
  /** @nullable */
  contentType?: string | null;
 }
 export interface SubmitAccepted {
  registrationId: string;
  status: string;
 }
 export interface WerkbakItem {
  registrationId: string;
  bsn: string;
  status: string;
 }
 export type GetOpenbaarRegisterParams = {
 q?: string;
 };
@@ -205,109 +182,6 @@ export class BffApiV1Service {
    );
  }
 getSelfServiceRegistrations<TData = CurrentRegistration | void>( options?: HttpClientBodyOptions): Observable<TData>;
 getSelfServiceRegistrations<TData = CurrentRegistration | void>( options?: HttpClientEventOptions): Observable<HttpEvent<TData>>;
 getSelfServiceRegistrations<TData = CurrentRegistration | void>( options?: HttpClientResponseOptions): Observable<AngularHttpResponse<TData>>;
  getSelfServiceRegistrations<TData = CurrentRegistration | void>(
     options?: HttpClientObserveOptions): Observable<TData | HttpEvent<TData> | AngularHttpResponse<TData>> {
    if (options?.observe === 'events') {
      return this.http.get<TData>(
      `/self-service/registrations`,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'events',
      }
    );
    }
    if (options?.observe === 'response') {
      return this.http.get<TData>(
      `/self-service/registrations`,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'response',
      }
    );
    }
    return this.http.get<TData>(
      `/self-service/registrations`,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'body',
      }
    );
  }
 postSelfServiceRegistrationsIdWithdraw<TData = void>(id: string, options?: HttpClientBodyOptions): Observable<TData>;
 postSelfServiceRegistrationsIdWithdraw<TData = void>(id: string, options?: HttpClientEventOptions): Observable<HttpEvent<TData>>;
 postSelfServiceRegistrationsIdWithdraw<TData = void>(id: string, options?: HttpClientResponseOptions): Observable<AngularHttpResponse<TData>>;
  postSelfServiceRegistrationsIdWithdraw<TData = void>(
    id: string, options?: HttpClientObserveOptions): Observable<TData | HttpEvent<TData> | AngularHttpResponse<TData>> {
    if (options?.observe === 'events') {
      return this.http.post<TData>(
      `/self-service/registrations/${id}/withdraw`,
      undefined,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'events',
      }
    );
    }
    if (options?.observe === 'response') {
      return this.http.post<TData>(
      `/self-service/registrations/${id}/withdraw`,
      undefined,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'response',
      }
    );
    }
    return this.http.post<TData>(
      `/self-service/registrations/${id}/withdraw`,
      undefined,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'body',
      }
    );
  }
 postSelfServiceRegistrationsIdDocuments<TData = void>(id: string,
    provideDocumentsRequest: ProvideDocumentsRequest, options?: HttpClientBodyOptions): Observable<TData>;
 postSelfServiceRegistrationsIdDocuments<TData = void>(id: string,
    provideDocumentsRequest: ProvideDocumentsRequest, options?: HttpClientEventOptions): Observable<HttpEvent<TData>>;
 postSelfServiceRegistrationsIdDocuments<TData = void>(id: string,
    provideDocumentsRequest: ProvideDocumentsRequest, options?: HttpClientResponseOptions): Observable<AngularHttpResponse<TData>>;
  postSelfServiceRegistrationsIdDocuments<TData = void>(
    id: string,
    provideDocumentsRequest: ProvideDocumentsRequest, options?: HttpClientObserveOptions): Observable<TData | HttpEvent<TData> | AngularHttpResponse<TData>> {
    if (options?.observe === 'events') {
      return this.http.post<TData>(
      `/self-service/registrations/${id}/documents`,
      provideDocumentsRequest,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'events',
      }
    );
    }
    if (options?.observe === 'response') {
      return this.http.post<TData>(
      `/self-service/registrations/${id}/documents`,
      provideDocumentsRequest,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'response',
      }
    );
    }
    return this.http.post<TData>(
      `/self-service/registrations/${id}/documents`,
      provideDocumentsRequest,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'body',
      }
    );
  }
 getOpenbaarRegister<TData = OpenbaarEntry[]>(params?: GetOpenbaarRegisterParams, options?: HttpClientBodyOptions): Observable<TData>;
 getOpenbaarRegister<TData = OpenbaarEntry[]>(params?: GetOpenbaarRegisterParams, options?: HttpClientEventOptions): Observable<HttpEvent<TData>>;
 getOpenbaarRegister<TData = OpenbaarEntry[]>(params?: GetOpenbaarRegisterParams, options?: HttpClientResponseOptions): Observable<AngularHttpResponse<TData>>;
@@ -341,73 +215,4 @@ export class BffApiV1Service {
    );
  }
 getBehandelWerkbak<TData = WerkbakItem[]>( options?: HttpClientBodyOptions): Observable<TData>;
 getBehandelWerkbak<TData = WerkbakItem[]>( options?: HttpClientEventOptions): Observable<HttpEvent<TData>>;
 getBehandelWerkbak<TData = WerkbakItem[]>( options?: HttpClientResponseOptions): Observable<AngularHttpResponse<TData>>;
  getBehandelWerkbak<TData = WerkbakItem[]>(
     options?: HttpClientObserveOptions): Observable<TData | HttpEvent<TData> | AngularHttpResponse<TData>> {
    if (options?.observe === 'events') {
      return this.http.get<TData>(
      `/behandel/werkbak`,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'events',
      }
    );
    }
    if (options?.observe === 'response') {
      return this.http.get<TData>(
      `/behandel/werkbak`,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'response',
      }
    );
    }
    return this.http.get<TData>(
      `/behandel/werkbak`,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'body',
      }
    );
  }
 postBehandelRegistrationsIdDecide<TData = void>(id: string,
    decideRequest: DecideRequest, options?: HttpClientBodyOptions): Observable<TData>;
 postBehandelRegistrationsIdDecide<TData = void>(id: string,
    decideRequest: DecideRequest, options?: HttpClientEventOptions): Observable<HttpEvent<TData>>;
 postBehandelRegistrationsIdDecide<TData = void>(id: string,
    decideRequest: DecideRequest, options?: HttpClientResponseOptions): Observable<AngularHttpResponse<TData>>;
  postBehandelRegistrationsIdDecide<TData = void>(
    id: string,
    decideRequest: DecideRequest, options?: HttpClientObserveOptions): Observable<TData | HttpEvent<TData> | AngularHttpResponse<TData>> {
    if (options?.observe === 'events') {
      return this.http.post<TData>(
      `/behandel/registrations/${id}/decide`,
      decideRequest,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'events',
      }
    );
    }
    if (options?.observe === 'response') {
      return this.http.post<TData>(
      `/behandel/registrations/${id}/decide`,
      decideRequest,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'response',
      }
    );
    }
    return this.http.post<TData>(
      `/behandel/registrations/${id}/decide`,
      decideRequest,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'body',
      }
    );
  }
 };
@@ -1,6 +1,4 @@
 export * from './lib/auth.service';
 export * from './lib/digid-auth.service';
 export * from './lib/digid-auth.providers';
 export * from './lib/medewerker-auth.service';
 export * from './lib/medewerker-auth.providers';
 export * from './lib/authenticated.guard';
@@ -1,26 +1,16 @@
-import { signal, Signal } from '@angular/core';
+import { Signal } from '@angular/core';
 /**
 * The portal's view of the signed-in user. An abstraction over the OIDC library so components and
- * guards depend on a small, mockable surface (the real implementations are DigiadAuthService for
+ * guards depend on a small, mockable surface (the real implementation is DigiadAuthService).
 * citizens and MedewerkerAuthService for staff).
 */
 export abstract class AuthService {
-  /** Whether a session is active. */
+  /** Whether a DigiD session is active. */
  abstract readonly isAuthenticated: Signal<boolean>;
-  /** The citizen-service number from the DigiD token, once authenticated (staff have none). */
+  /** The citizen-service number from the DigiD token, once authenticated. */
  abstract readonly bsn: Signal<string | undefined>;
-  /**
+  /** Start the DigiD login (redirects to Keycloak). */
   * The realm roles carried in the token. Empty for realms that don't grant roles (e.g. `digid`);
   * the `medewerker` realm carries `behandelaar`/`teamlead`.
   */
  readonly roles: Signal<readonly string[]> = signal<readonly string[]>([]);
  /** Start login (redirects to Keycloak). */
  abstract login(): void;
  /** End the session. */
  abstract logout(): void;
  /** Whether the signed-in user holds the given realm role. */
  hasRole(role: string): boolean {
    return this.roles().includes(role);
  }
 }
@@ -1,49 +0,0 @@
 import { EnvironmentProviders, makeEnvironmentProviders } from '@angular/core';
 import { LogLevel, provideAuth, withAppInitializerAuthCheck } from 'angular-auth-oidc-client';
 import { AuthService } from './auth.service';
 import { MedewerkerAuthService } from './medewerker-auth.service';
 export interface MedewerkerAuthOptions {
  /** The Keycloak `medewerker` realm issuer, as reachable from the browser. */
  authority: string;
  /** Where Keycloak redirects back to after login (usually the app origin). */
  redirectUrl: string;
  /**
   * Route prefixes whose requests get the bearer token attached. The api-client calls the BFF with
   * **relative** URLs (same-origin via the nginx proxy), so these must be relative path prefixes
   * (e.g. `/behandel/`) — angular-auth-oidc-client matches `req.url.startsWith(route)`, and a
   * relative `req.url` never starts with an absolute origin.
   */
  secureRoutes: string[];
 }
 /**
 * Configure medewerker login (Keycloak `medewerker` realm, public client `big-portal`, auth-code +
 * PKCE) and bind {@link AuthService} to the medewerker-backed implementation. Register
 * {@link authInterceptor} (re-exported from digid-auth.providers) in the app's HttpClient so BFF
 * calls carry the token.
 */
 export function provideMedewerkerAuth(options: MedewerkerAuthOptions): EnvironmentProviders {
  return makeEnvironmentProviders([
    provideAuth(
      {
        config: {
          authority: options.authority,
          redirectUrl: options.redirectUrl,
          postLogoutRedirectUri: options.redirectUrl,
          clientId: 'big-portal',
          scope: 'openid profile',
          responseType: 'code',
          silentRenew: true,
          useRefreshToken: true,
          secureRoutes: options.secureRoutes,
          logLevel: LogLevel.Warn,
        },
      },
      // Run checkAuth() at startup so the login callback (?code=…) is processed before the router
      // and guard run — without it the guard sees "not authenticated" and re-triggers login (loop).
      withAppInitializerAuthCheck(),
    ),
    { provide: AuthService, useClass: MedewerkerAuthService },
  ]);
 }
@@ -1,43 +0,0 @@
 import { TestBed } from '@angular/core/testing';
 import { OidcSecurityService } from 'angular-auth-oidc-client';
 import { of } from 'rxjs';
 import { MedewerkerAuthService } from './medewerker-auth.service';
 function makeService(userData: unknown, authenticated = true) {
  const oidc = {
    isAuthenticated$: of({ isAuthenticated: authenticated }),
    userData$: of({ userData }),
    authorize: vi.fn(),
    logoff: vi.fn(() => of(null)),
  };
  TestBed.configureTestingModule({
    providers: [MedewerkerAuthService, { provide: OidcSecurityService, useValue: oidc }],
  });
  return { svc: TestBed.inject(MedewerkerAuthService), oidc };
 }
 describe('MedewerkerAuthService', () => {
  it('exposes the realm roles carried in the token', () => {
    const { svc } = makeService({ realm_access: { roles: ['behandelaar', 'teamlead'] } });
    expect(svc.roles()).toEqual(['behandelaar', 'teamlead']);
    expect(svc.hasRole('behandelaar')).toBe(true);
    expect(svc.hasRole('beheerder')).toBe(false);
  });
  it('has no roles when the token omits realm_access', () => {
    const { svc } = makeService({ preferred_username: 'merel-behandelaar' });
    expect(svc.roles()).toEqual([]);
    expect(svc.hasRole('behandelaar')).toBe(false);
  });
  it('reflects the OIDC authenticated state', () => {
    const { svc } = makeService({}, true);
    expect(svc.isAuthenticated()).toBe(true);
  });
  it('starts login by delegating to the OIDC library', () => {
    const { svc, oidc } = makeService({});
    svc.login();
    expect(oidc.authorize).toHaveBeenCalledTimes(1);
  });
 });
@@ -1,41 +0,0 @@
 import { inject, Injectable, Signal } from '@angular/core';
 import { toSignal } from '@angular/core/rxjs-interop';
 import { OidcSecurityService } from 'angular-auth-oidc-client';
 import { map } from 'rxjs';
 import { AuthService } from './auth.service';
 /** The subset of the medewerker token the portal reads: Keycloak nests realm roles here. */
 interface MedewerkerClaims {
  realm_access?: { roles?: string[] };
 }
 /** Medewerker-backed AuthService over angular-auth-oidc-client (Keycloak `medewerker` realm). */
@Injectable()
 export class MedewerkerAuthService extends AuthService {
  private readonly oidc = inject(OidcSecurityService);
  readonly isAuthenticated: Signal<boolean> = toSignal(
    this.oidc.isAuthenticated$.pipe(map((result) => result.isAuthenticated)),
    { initialValue: false },
  );
  // Staff have no BSN; the abstract surface keeps this present for the shared guard/interceptor.
  readonly bsn: Signal<string | undefined> = toSignal(this.oidc.userData$.pipe(map(() => undefined)), {
    initialValue: undefined,
  });
  override readonly roles: Signal<readonly string[]> = toSignal(
    this.oidc.userData$.pipe(
      map((data) => (data.userData as MedewerkerClaims | null)?.realm_access?.roles ?? []),
    ),
    { initialValue: [] },
  );
  override login(): void {
    this.oidc.authorize();
  }
  override logout(): void {
    this.oidc.logoff().subscribe();
  }
 }
@@ -5,13 +5,6 @@
    <ProjectReference Include="..\Acl.Infrastructure\Acl.Infrastructure.csproj" />
  </ItemGroup>
  <ItemGroup>
    <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.17.0" />
    <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.17.0" />
    <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.17.0" />
    <PackageReference Include="OpenTelemetry.Instrumentation.Http" Version="1.17.0" />
  </ItemGroup>
  <PropertyGroup>
    <TargetFramework>net10.0</TargetFramework>
    <Nullable>enable</Nullable>
@@ -1,21 +1,8 @@
 using Acl.Application;
 using Acl.Infrastructure;
 using OpenTelemetry.Resources;
 using OpenTelemetry.Trace;
 var builder = WebApplication.CreateBuilder(args);
 // OpenTelemetry tracing (S-16b, ADR-0023): auto-instrument incoming ASP.NET Core requests and
 // outgoing HttpClient calls (the ACL → OpenZaak hop), exported over OTLP to Tempo. Service name +
 // OTLP endpoint come from OTEL_* env (compose); the exporter no-ops when Tempo is unreachable.
 builder.Services.AddOpenTelemetry()
    .ConfigureResource(r => r.AddService(
        builder.Configuration["OTEL_SERVICE_NAME"] ?? builder.Environment.ApplicationName))
    .WithTracing(tracing => tracing
        .AddAspNetCoreInstrumentation(o => o.Filter = ctx => ctx.Request.Path != "/health")
        .AddHttpClientInstrumentation()
        .AddOtlpExporter());
 builder.Services.AddSingleton<IClock, SystemClock>();
 builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
    .GetSection("Acl:Defaults").Get<AclDefaults>()
@@ -24,8 +11,6 @@ builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
    .GetSection("Acl:OpenZaak").Get<OpenZaakOptions>()
    ?? throw new InvalidOperationException("Missing configuration section 'Acl:OpenZaak'"));
 builder.Services.AddHttpClient<IZaakGateway, OpenZaakGateway>();
 // Singleton so the resolved zaaktype/informatieobjecttype URLs are cached across requests (S-27).
 builder.Services.AddSingleton<IZaaktypeCatalog, CachedZaaktypeCatalog>();
 builder.Services.AddScoped<AclService>();
 var app = builder.Build();
@@ -47,14 +32,6 @@ app.MapPost("/statussen", async (SetStatusRequest body, AclService acl, Cancella
    return Results.NoContent();
 });
 // Cancel a zaak on document-timeout expiry (S-10c): set it to its zaaktype's cancellation statustype
 // + resultaat. The domain hands over only the zaak URL; the ACL owns the ZGW resolution (§8.1).
 app.MapPost("/annuleringen", async (CancelZaakRequest body, AclService acl, CancellationToken ct) =>
 {
    await acl.CancelZaakAsync(new Uri(body.ZaakUrl), ct);
    return Results.NoContent();
 });
 // Read a zaak's public-safe reference (its identificatie). The Event Subscriber calls this to enrich
 // the read projection without reading ZGW itself (§8.1, #78).
 app.MapPost("/zaken/reference", async (ZaakReferenceRequest body, AclService acl, CancellationToken ct) =>
@@ -63,25 +40,12 @@ app.MapPost("/zaken/reference", async (ZaakReferenceRequest body, AclService acl
    return Results.Ok(new { reference });
 });
 // Store an uploaded diploma against a zaak (S-10b): the domain sends the file as base64; the ACL
 // creates the ZGW enkelvoudiginformatieobject and relates it to the zaak (§8.1). Returns its URL.
 app.MapPost("/documenten", async (StoreDocumentRequest body, AclService acl, CancellationToken ct) =>
 {
    var url = await acl.StoreDiplomaAsync(
        new Uri(body.ZaakUrl), Convert.FromBase64String(body.ContentBase64), body.FileName, body.ContentType, ct);
    return Results.Ok(new { informatieobjectUrl = url.ToString() });
 });
 app.Run();
 public sealed record OpenZaakRequest(string Bsn, string Reference);
 public sealed record SetStatusRequest(string ZaakUrl);
 public sealed record CancelZaakRequest(string ZaakUrl);
 public sealed record ZaakReferenceRequest(string ZaakUrl);
 public sealed record StoreDocumentRequest(string ZaakUrl, string ContentBase64, string FileName, string ContentType);
 public partial class Program;
@@ -6,12 +6,5 @@ public sealed class AclDefaults
    public required string Bronorganisatie { get; init; }
    public required string VerantwoordelijkeOrganisatie { get; init; }
    public required string Vertrouwelijkheidaanduiding { get; init; }
-
+    public required Uri ZaaktypeUrl { get; init; }
    /// <summary>The BIG zaaktype's stable business key. The ACL resolves the (server-assigned) zaaktype
    /// URL from this via the Catalogi API instead of being handed a pinned URL (S-27, ADR-0021).</summary>
    public required string ZaaktypeIdentificatie { get; init; }
    /// <summary>The omschrijving of the informatieobjecttype an uploaded diploma is filed under (S-10b);
    /// resolved to a URL by the Catalogi API, like <see cref="ZaaktypeIdentificatie"/>.</summary>
    public required string InformatieobjecttypeOmschrijving { get; init; }
 }
@@ -2,9 +2,9 @@ namespace Acl.Application;
 /// <summary>The ACL's single operation: open a zaak from a domain payload,
 /// default-filling the ZGW-mandatory fields (ADR-0003).</summary>
-public sealed class AclService(IZaakGateway gateway, AclDefaults defaults, IZaaktypeCatalog catalog, IClock clock)
+public sealed class AclService(IZaakGateway gateway, AclDefaults defaults, IClock clock)
 {
-    public async Task<Uri> OpenZaakAsync(DomainRegistration registration, CancellationToken ct = default)
+    public Task<Uri> OpenZaakAsync(DomainRegistration registration, CancellationToken ct = default)
    {
        ArgumentNullException.ThrowIfNull(registration);
@@ -12,34 +12,22 @@ public sealed class AclService(IZaakGateway gateway, AclDefaults defaults, IZaak
            defaults.Bronorganisatie,
            defaults.VerantwoordelijkeOrganisatie,
            defaults.Vertrouwelijkheidaanduiding,
-            await catalog.GetZaaktypeUrlAsync(ct),
+            defaults.ZaaktypeUrl,
            clock.Today,
            registration.Reference);
-        return await gateway.OpenZaakAsync(request, ct);
+        return gateway.OpenZaakAsync(request, ct);
    }
    /// <summary>
-    /// Approve a zaak: set it to the eindstatus of the BIG zaaktype (resolved by identificatie, S-27).
+    /// Approve a zaak: set it to the eindstatus of the configured BIG zaaktype (ADR-0003 default). The
-    /// The domain hands over only the zaak URL; the ACL owns which statustype means "approved" (§8.1).
+    /// domain hands over only the zaak URL; the ACL owns which statustype means "approved" (§8.1).
    /// </summary>
-    public async Task ApproveZaakAsync(Uri zaakUrl, CancellationToken ct = default)
+    public Task ApproveZaakAsync(Uri zaakUrl, CancellationToken ct = default)
    {
        ArgumentNullException.ThrowIfNull(zaakUrl);
-        await gateway.SetZaakToEindstatusAsync(zaakUrl, await catalog.GetZaaktypeUrlAsync(ct), clock.Today, ct);
+        return gateway.SetZaakToEindstatusAsync(zaakUrl, defaults.ZaaktypeUrl, clock.Today, ct);
    }
    /// <summary>
    /// Cancel a zaak on document-timeout expiry (S-10c): set it to the BIG zaaktype's cancellation
    /// statustype + resultaat. The domain hands over only the zaak URL; the ACL owns which
    /// statustype/resultaat means "cancelled" (§8.1).
    /// </summary>
    public async Task CancelZaakAsync(Uri zaakUrl, CancellationToken ct = default)
    {
        ArgumentNullException.ThrowIfNull(zaakUrl);
        await gateway.SetZaakToCancellationStatusAsync(zaakUrl, await catalog.GetZaaktypeUrlAsync(ct), clock.Today, ct);
    }
    /// <summary>The zaak's reference (its ZGW identificatie), for the read projection (#78).</summary>
@@ -49,33 +37,4 @@ public sealed class AclService(IZaakGateway gateway, AclDefaults defaults, IZaak
        return gateway.GetZaakIdentificatieAsync(zaakUrl, ct);
    }
    /// <summary>
    /// Store an uploaded diploma against the zaak (S-10b): default-fill the ZGW-mandatory document
    /// fields (informatieobjecttype, bronorganisatie, vertrouwelijkheidaanduiding, taal, creatiedatum)
    /// and hand the file to the gateway, which creates the informatieobject and relates it to the zaak.
    /// The domain supplies only the zaak, the bytes, and the file's name/type (§8.1).
    /// </summary>
    public async Task<Uri> StoreDiplomaAsync(Uri zaakUrl, byte[] content, string fileName, string contentType, CancellationToken ct = default)
    {
        ArgumentNullException.ThrowIfNull(zaakUrl);
        ArgumentNullException.ThrowIfNull(content);
        ArgumentException.ThrowIfNullOrWhiteSpace(fileName);
        ArgumentException.ThrowIfNullOrWhiteSpace(contentType);
        var request = new DocumentRequest(
            defaults.Bronorganisatie,
            await catalog.GetInformatieobjecttypeUrlAsync(ct),
            defaults.Vertrouwelijkheidaanduiding,
            zaakUrl,
            clock.Today,
            Titel: "Diploma",
            Auteur: "zorgprofessional",
            Taal: "nld",
            Bestandsnaam: fileName,
            Formaat: contentType,
            Inhoud: content);
        return await gateway.StoreDocumentAsync(request, ct);
    }
 }
@@ -1,46 +0,0 @@
 namespace Acl.Application;
 /// <summary>Resolves the zaaktype + diploma-informatieobjecttype URLs from the Catalogi API on first
 /// use and caches them for the process lifetime (S-27, ADR-0021). Lazy (not at startup) so the ACL
 /// never crash-loops when it boots before the catalogus is seeded/published; a <em>failed</em>
 /// resolution is not cached, so it is retried on the next call (e.g. once the zaaktype is published).
 /// A process restart re-resolves.</summary>
 public sealed class CachedZaaktypeCatalog(IZaakGateway gateway, AclDefaults defaults) : IZaaktypeCatalog
 {
    private readonly SemaphoreSlim gate = new(1, 1);
    private Uri? zaaktype;
    private Uri? informatieobjecttype;
    public Task<Uri> GetZaaktypeUrlAsync(CancellationToken ct = default) =>
        ResolveOnceAsync(
            () => zaaktype, value => zaaktype = value,
            () => gateway.ResolveZaaktypeUrlAsync(defaults.ZaaktypeIdentificatie, ct), ct);
    public Task<Uri> GetInformatieobjecttypeUrlAsync(CancellationToken ct = default) =>
        ResolveOnceAsync(
            () => informatieobjecttype, value => informatieobjecttype = value,
            () => gateway.ResolveInformatieobjecttypeUrlAsync(defaults.InformatieobjecttypeOmschrijving, ct), ct);
    // Double-checked, single-flight resolution: return the cache if set; otherwise resolve under the
    // gate and cache only on success (a throw leaves the cache empty so the next call retries).
    private async Task<Uri> ResolveOnceAsync(Func<Uri?> read, Action<Uri> store, Func<Task<Uri>> resolve, CancellationToken ct)
    {
        if (read() is { } cached)
            return cached;
        await gate.WaitAsync(ct);
        try
        {
            if (read() is { } existing)
                return existing;
            var resolved = await resolve();
            store(resolved);
            return resolved;
        }
        finally
        {
            gate.Release();
        }
    }
 }
@@ -1,17 +0,0 @@
 namespace Acl.Application;
 /// <summary>The fully default-filled diploma document the gateway will create in the ZGW Documenten
 /// API and relate to the zaak (S-10b). <see cref="Inhoud"/> is the raw file content; the gateway
 /// base64-encodes it into the ZGW <c>inhoud</c> field.</summary>
 public sealed record DocumentRequest(
    string Bronorganisatie,
    Uri Informatieobjecttype,
    string Vertrouwelijkheidaanduiding,
    Uri Zaak,
    DateOnly Creatiedatum,
    string Titel,
    string Auteur,
    string Taal,
    string Bestandsnaam,
    string Formaat,
    byte[] Inhoud);
@@ -13,31 +13,7 @@ public interface IZaakGateway
    /// </summary>
    Task SetZaakToEindstatusAsync(Uri zaakUrl, Uri zaaktypeUrl, DateOnly datumStatusGezet, CancellationToken ct = default);
    /// <summary>
    /// Set the given zaak to the <em>cancellation</em> statustype ("Geannuleerd") and record the
    /// matching cancellation resultaat ("Vervallen") — the ZGW translation of "the 30-day document term
    /// lapsed" (S-10c). Distinct from <see cref="SetZaakToEindstatusAsync"/> (approval): the gateway
    /// resolves both the cancellation statustype and resultaattype from the catalogus by their
    /// omschrijving, POSTs the resultaat then the status, dated <paramref name="datumStatusGezet"/>.
    /// </summary>
    Task SetZaakToCancellationStatusAsync(Uri zaakUrl, Uri zaaktypeUrl, DateOnly datumStatusGezet, CancellationToken ct = default);
    /// <summary>Read the zaak's <c>identificatie</c> — the public-safe reference the register shows.
    /// The Event Subscriber calls this through the ACL rather than reading ZGW itself (§8.1, #78).</summary>
    Task<string> GetZaakIdentificatieAsync(Uri zaakUrl, CancellationToken ct = default);
    /// <summary>
    /// Store a diploma document (S-10b): create an <c>enkelvoudiginformatieobject</c> in the ZGW
    /// Documenten API and relate it to the zaak via a <c>zaakinformatieobject</c>. Returns the URL of
    /// the created informatieobject.
    /// </summary>
    Task<Uri> StoreDocumentAsync(DocumentRequest request, CancellationToken ct = default);
    /// <summary>Resolve the URL of the published zaaktype with the given <paramref name="identificatie"/>
    /// from the Catalogi API (S-27). Throws if no published zaaktype matches.</summary>
    Task<Uri> ResolveZaaktypeUrlAsync(string identificatie, CancellationToken ct = default);
    /// <summary>Resolve the URL of the published informatieobjecttype with the given
    /// <paramref name="omschrijving"/> from the Catalogi API (S-27). Throws if none matches.</summary>
    Task<Uri> ResolveInformatieobjecttypeUrlAsync(string omschrijving, CancellationToken ct = default);
 }
@@ -1,12 +0,0 @@
 namespace Acl.Application;
 /// <summary>Supplies the ACL's zaaktype + diploma-informatieobjecttype URLs, resolved from OpenZaak's
 /// Catalogi API by their stable business keys (<see cref="AclDefaults.ZaaktypeIdentificatie"/> /
 /// <see cref="AclDefaults.InformatieobjecttypeOmschrijving"/>) rather than pinned in config (S-27,
 /// ADR-0021). Implementations resolve lazily on first use and cache the result.</summary>
 public interface IZaaktypeCatalog
 {
    Task<Uri> GetZaaktypeUrlAsync(CancellationToken ct = default);
    Task<Uri> GetInformatieobjecttypeUrlAsync(CancellationToken ct = default);
 }
@@ -8,12 +8,6 @@ namespace Acl.Infrastructure;
 /// <summary>The only code that talks to OpenZaak's Zaken API (ADR-0001).</summary>
 public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) : IZaakGateway
 {
    // The ACL owns which ZGW statustype/resultaat carries each domain outcome (§8.1). These
    // omschrijvingen match the seeded BIG catalogus (infra/openzaak/seed_catalogus.py).
    private const string GeregistreerdResultaat = "Geregistreerd";   // approval outcome
    private const string GeannuleerdStatus = "Geannuleerd";          // document-timeout cancellation status (S-10c)
    private const string VervallenResultaat = "Vervallen";           // document-timeout cancellation outcome (S-10c)
    public async Task<Uri> OpenZaakAsync(ZaakRequest request, CancellationToken ct = default)
    {
        ArgumentNullException.ThrowIfNull(request);
@@ -54,9 +48,7 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
        ArgumentNullException.ThrowIfNull(zaaktypeUrl);
        var eindstatus = await ResolveEindstatusAsync(zaaktypeUrl, ct);
-        // Resolve the approval resultaat by name: once S-10c adds the Vervallen resultaattype, taking
+        var resultaattype = await ResolveResultaattypeAsync(zaaktypeUrl, ct);
        // the first would be ambiguous (the Zaken API does not guarantee order).
        var resultaattype = await ResolveResultaattypeByOmschrijvingAsync(zaaktypeUrl, GeregistreerdResultaat, ct);
        // OpenZaak refuses to set a zaak's eindstatus unless the zaak has a resultaat
        // ("resultaat-does-not-exist"), so record the resultaat first, then the status.
@@ -70,27 +62,6 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
            "Setting the zaak status", ct);
    }
    public async Task SetZaakToCancellationStatusAsync(Uri zaakUrl, Uri zaaktypeUrl, DateOnly datumStatusGezet, CancellationToken ct = default)
    {
        ArgumentNullException.ThrowIfNull(zaakUrl);
        ArgumentNullException.ThrowIfNull(zaaktypeUrl);
        // Distinct from approval: resolve the cancellation statustype + resultaat by name (Geannuleerd
        // is a non-terminal statustype, so it is never the eindstatus the approval path resolves).
        var cancellationStatus = await ResolveStatustypeByOmschrijvingAsync(zaaktypeUrl, GeannuleerdStatus, ct);
        var cancellationResultaat = await ResolveResultaattypeByOmschrijvingAsync(zaaktypeUrl, VervallenResultaat, ct);
        // As with approval, OpenZaak wants the resultaat recorded before the status.
        await PostAsync("/zaken/api/v1/resultaten",
            new ResultaatDto(zaakUrl.ToString(), cancellationResultaat.ToString()),
            "Setting the zaak cancellation resultaat", ct);
        await PostAsync("/zaken/api/v1/statussen",
            new StatusDto(zaakUrl.ToString(), cancellationStatus.ToString(),
                datumStatusGezet.ToDateTime(TimeOnly.MinValue, DateTimeKind.Utc).ToString("yyyy-MM-ddTHH:mm:ssZ")),
            "Setting the zaak cancellation status", ct);
    }
    public async Task<string> GetZaakIdentificatieAsync(Uri zaakUrl, CancellationToken ct = default)
    {
        ArgumentNullException.ThrowIfNull(zaakUrl);
@@ -109,81 +80,6 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
        return zaak.Identificatie;
    }
    public async Task<Uri> StoreDocumentAsync(DocumentRequest request, CancellationToken ct = default)
    {
        ArgumentNullException.ThrowIfNull(request);
        // 1. Create the enkelvoudiginformatieobject in the Documenten API (not a geo API — no CRS).
        var created = await PostForUrlAsync(
            "/documenten/api/v1/enkelvoudiginformatieobjecten",
            new EnkelvoudigInformatieobjectDto(
                request.Bronorganisatie,
                request.Creatiedatum.ToString("yyyy-MM-dd"),
                request.Titel,
                request.Auteur,
                request.Taal,
                request.Informatieobjecttype.ToString(),
                Convert.ToBase64String(request.Inhoud),
                request.Bestandsnaam,
                request.Inhoud.Length,
                request.Vertrouwelijkheidaanduiding,
                request.Formaat,
                "definitief",
                // No usage-rights restrictions apply. Left null, OpenZaak rejects closing the related
                // zaak with "indicatiegebruiksrecht-unset"; false records the deliberate "none" answer.
                false),
            "Creating the informatieobject", ct);
        // 2. Relate it to the zaak (Zaken API — no CRS).
        await PostAsync("/zaken/api/v1/zaakinformatieobjecten",
            new ZaakInformatieobjectDto(request.Zaak.ToString(), created.ToString()),
            "Relating the informatieobject to the zaak", ct);
        return created;
    }
    public async Task<Uri> ResolveZaaktypeUrlAsync(string identificatie, CancellationToken ct = default)
    {
        ArgumentException.ThrowIfNullOrWhiteSpace(identificatie);
        // The published zaaktype with this identificatie; status=definitief excludes concepts.
        var page = await GetAsync<ZaaktypePage>(
            "/catalogi/api/v1/zaaktypen?status=definitief&identificatie=" + Uri.EscapeDataString(identificatie),
            "zaaktypen", ct);
        var match = (page.Results ?? []).FirstOrDefault()
            ?? throw new InvalidOperationException(
                $"No published zaaktype with identificatie '{identificatie}' found in OpenZaak — is the BIG catalogus seeded and published?");
        return new Uri(match.Url);
    }
    public async Task<Uri> ResolveInformatieobjecttypeUrlAsync(string omschrijving, CancellationToken ct = default)
    {
        ArgumentException.ThrowIfNullOrWhiteSpace(omschrijving);
        // The informatieobjecttypen collection has no omschrijving filter, so match client-side over the
        // published ones.
        var page = await GetAsync<InformatieobjecttypePage>(
            "/catalogi/api/v1/informatieobjecttypen?status=definitief", "informatieobjecttypen", ct);
        var match = (page.Results ?? []).FirstOrDefault(i => i.Omschrijving == omschrijving)
            ?? throw new InvalidOperationException(
                $"No published informatieobjecttype '{omschrijving}' found in OpenZaak — is the BIG catalogus seeded and published?");
        return new Uri(match.Url);
    }
    // GETs an absolute-by-path ZGW resource with auth (no CRS — catalogi is not a geo API).
    private async Task<T> GetAsync<T>(string pathAndQuery, string label, CancellationToken ct)
    {
        using var message = new HttpRequestMessage(HttpMethod.Get, new Uri(options.BaseUrl, pathAndQuery));
        message.Headers.Authorization =
            new AuthenticationHeaderValue("Bearer", ZgwToken.Mint(options.ClientId, options.Secret));
        using var response = await http.SendAsync(message, ct);
        await EnsureSuccessAsync(response, $"Querying {label}", ct);
        return await response.Content.ReadFromJsonAsync<T>(ct)
            ?? throw new InvalidOperationException($"OpenZaak returned an empty {label} response");
    }
    // POSTs a non-geo ZGW resource (resultaat/status — no CRS headers). Buffers the body so uwsgi gets
    // a Content-Length instead of a chunked body (as with zaak-create).
    private async Task PostAsync(string path, object dto, string action, CancellationToken ct)
@@ -200,26 +96,6 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
        await EnsureSuccessAsync(response, action, ct);
    }
    // POSTs a non-geo ZGW resource and returns the created resource's URL (as PostAsync, but reads back
    // the `url` of the created object). Buffers the body so uwsgi gets a Content-Length.
    private async Task<Uri> PostForUrlAsync(string path, object dto, string action, CancellationToken ct)
    {
        using var message = new HttpRequestMessage(HttpMethod.Post, new Uri(options.BaseUrl, path))
        {
            Content = JsonContent.Create(dto),
        };
        message.Headers.Authorization =
            new AuthenticationHeaderValue("Bearer", ZgwToken.Mint(options.ClientId, options.Secret));
        await message.Content.LoadIntoBufferAsync(ct);
        using var response = await http.SendAsync(message, ct);
        await EnsureSuccessAsync(response, action, ct);
        var created = await response.Content.ReadFromJsonAsync<CreatedDto>(ct)
            ?? throw new InvalidOperationException($"OpenZaak returned an empty response for {action}");
        return new Uri(created.Url);
    }
    // EnsureSuccessStatusCode discards the response body; ZGW returns a JSON problem detail on 400 that
    // is essential for diagnosing a rejected request, so surface it in the exception.
    private static async Task EnsureSuccessAsync(HttpResponseMessage response, string action, CancellationToken ct)
@@ -245,23 +121,13 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
        return new Uri(eindstatus.Url);
    }
-    /// <summary>Resolve a specific statustype from the catalogus by its omschrijving (e.g. "Geannuleerd").</summary>
+    /// <summary>Resolve the zaaktype's resultaattype from the catalogus (the seed defines one).</summary>
-    private async Task<Uri> ResolveStatustypeByOmschrijvingAsync(Uri zaaktypeUrl, string omschrijving, CancellationToken ct)
+    private async Task<Uri> ResolveResultaattypeAsync(Uri zaaktypeUrl, CancellationToken ct)
    {
        var page = await GetCatalogusAsync<StatustypePage>("statustypen", zaaktypeUrl, "statustypen", ct);
        var match = (page.Results ?? []).FirstOrDefault(s => s.Omschrijving == omschrijving)
            ?? throw new InvalidOperationException($"No '{omschrijving}' statustype found for zaaktype {zaaktypeUrl}");
        return new Uri(match.Url);
    }
    /// <summary>Resolve a specific resultaattype from the catalogus by its omschrijving (the seed defines
    /// "Geregistreerd" for approval and "Vervallen" for a document-timeout cancellation).</summary>
    private async Task<Uri> ResolveResultaattypeByOmschrijvingAsync(Uri zaaktypeUrl, string omschrijving, CancellationToken ct)
    {
        var page = await GetCatalogusAsync<ResultaattypePage>("resultaattypen", zaaktypeUrl, "resultaattypen", ct);
-        var match = (page.Results ?? []).FirstOrDefault(r => r.Omschrijving == omschrijving)
+        var resultaattype = (page.Results ?? []).FirstOrDefault()
-            ?? throw new InvalidOperationException($"No '{omschrijving}' resultaattype found for zaaktype {zaaktypeUrl}");
+            ?? throw new InvalidOperationException($"No resultaattypen found for zaaktype {zaaktypeUrl}");
-        return new Uri(match.Url);
+        return new Uri(resultaattype.Url);
    }
    // GETs a catalogus collection filtered by zaaktype (status=alles includes concept + published).
@@ -305,8 +171,7 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
    private sealed record StatustypeDto(
        [property: JsonPropertyName("url")] string Url,
        [property: JsonPropertyName("volgnummer")] int Volgnummer,
-        [property: JsonPropertyName("isEindstatus")] bool IsEindstatus,
+        [property: JsonPropertyName("isEindstatus")] bool IsEindstatus);
        [property: JsonPropertyName("omschrijving")] string? Omschrijving);
    private sealed record ResultaatDto(
        [property: JsonPropertyName("zaak")] string Zaak,
@@ -316,42 +181,5 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
        [property: JsonPropertyName("results")] IReadOnlyList<ResultaattypeDto>? Results);
    private sealed record ResultaattypeDto(
        [property: JsonPropertyName("url")] string Url,
        [property: JsonPropertyName("omschrijving")] string? Omschrijving);
    private sealed record CreatedDto(
        [property: JsonPropertyName("url")] string Url);
    private sealed record EnkelvoudigInformatieobjectDto(
        [property: JsonPropertyName("bronorganisatie")] string Bronorganisatie,
        [property: JsonPropertyName("creatiedatum")] string Creatiedatum,
        [property: JsonPropertyName("titel")] string Titel,
        [property: JsonPropertyName("auteur")] string Auteur,
        [property: JsonPropertyName("taal")] string Taal,
        [property: JsonPropertyName("informatieobjecttype")] string Informatieobjecttype,
        [property: JsonPropertyName("inhoud")] string Inhoud,
        [property: JsonPropertyName("bestandsnaam")] string Bestandsnaam,
        [property: JsonPropertyName("bestandsomvang")] int Bestandsomvang,
        [property: JsonPropertyName("vertrouwelijkheidaanduiding")] string Vertrouwelijkheidaanduiding,
        [property: JsonPropertyName("formaat")] string Formaat,
        [property: JsonPropertyName("status")] string Status,
        [property: JsonPropertyName("indicatieGebruiksrecht")] bool IndicatieGebruiksrecht);
    private sealed record ZaakInformatieobjectDto(
        [property: JsonPropertyName("zaak")] string Zaak,
        [property: JsonPropertyName("informatieobject")] string Informatieobject);
    private sealed record ZaaktypePage(
        [property: JsonPropertyName("results")] IReadOnlyList<ZaaktypeDto>? Results);
    private sealed record ZaaktypeDto(
        [property: JsonPropertyName("url")] string Url,
        [property: JsonPropertyName("identificatie")] string? Identificatie);
    private sealed record InformatieobjecttypePage(
        [property: JsonPropertyName("results")] IReadOnlyList<InformatieobjecttypeDto>? Results);
    private sealed record InformatieobjecttypeDto(
        [property: JsonPropertyName("url")] string Url,
        [property: JsonPropertyName("omschrijving")] string? Omschrijving);
 }
@@ -77,18 +77,6 @@ public sealed class OpenZaakFixture : IDisposable
        return JsonDocument.Parse(json).RootElement.Clone();
    }
    /// <summary>The URL of the published "Diploma" informatieobjecttype (S-10b), or null when the
    /// stack has not been seeded with OZ_PUBLISH=1. `status=definitief` returns published types only.</summary>
    public async Task<Uri?> FindPublishedDiplomaInformatieobjecttypeAsync(CancellationToken ct = default)
    {
        var query = new Uri(BaseUrl, "/catalogi/api/v1/informatieobjecttypen?status=definitief");
        var page = await GetJsonAsync(query, ct);
        foreach (var iot in page.GetProperty("results").EnumerateArray())
            if (iot.TryGetProperty("omschrijving", out var o) && o.GetString() == "Diploma")
                return new Uri(iot.GetProperty("url").GetString()!);
        return null;
    }
    /// <summary>The zaaktype's eindstatus (terminal statustype) URL — the one an approval sets.</summary>
    public async Task<Uri> FindEindstatustypeAsync(Uri zaaktypeUrl, CancellationToken ct = default)
    {
@@ -114,19 +102,6 @@ public sealed class OpenZaakFixture : IDisposable
        return fallback ?? throw new InvalidOperationException($"No statustypen for zaaktype {zaaktypeUrl}");
    }
    /// <summary>Resolve a statustype by its omschrijving (e.g. the S-10c "Geannuleerd" cancellation status).</summary>
    public async Task<Uri> FindStatustypeByOmschrijvingAsync(Uri zaaktypeUrl, string omschrijving, CancellationToken ct = default)
    {
        var query = new Uri(BaseUrl,
            "/catalogi/api/v1/statustypen?status=alles&zaaktype=" + Uri.EscapeDataString(zaaktypeUrl.ToString()));
        var page = await GetJsonAsync(query, ct);
        foreach (var st in page.GetProperty("results").EnumerateArray())
            if (st.TryGetProperty("omschrijving", out var o) && o.GetString() == omschrijving)
                return new Uri(st.GetProperty("url").GetString()!);
        throw new InvalidOperationException($"No '{omschrijving}' statustype for zaaktype {zaaktypeUrl}");
    }
    // A ZGW (vng-api-common) HS256 JWT, mirroring the seed's client. Minted here
    // rather than reusing Acl.Infrastructure's internal minter to keep that internal.
    private string MintToken()
@@ -74,119 +74,4 @@ public sealed class OpenZaakGatewayIntegrationTests(OpenZaakFixture stack)
        var eindstatustype = await stack.FindEindstatustypeAsync(zaaktype!);
        Assert.Equal(eindstatustype.ToString(), status.GetProperty("statustype").GetString());
    }
    [Fact]
    public async Task Cancelling_a_zaak_records_the_geannuleerd_status_and_a_resultaat()
    {
        var zaaktype = await stack.FindPublishedBigZaaktypeAsync();
        Assert.True(zaaktype is not null,
            "No published BIG-REGISTRATIE zaaktype found in OpenZaak — bring the stack up and " +
            "seed it with OZ_PUBLISH=1 (`make integration` does this).");
        var gateway = new OpenZaakGateway(stack.Http, stack.Options);
        var zaakUrl = await gateway.OpenZaakAsync(new ZaakRequest(
            Bronorganisatie: "517439943",
            VerantwoordelijkeOrganisatie: "517439943",
            Vertrouwelijkheidaanduiding: "openbaar",
            Zaaktype: zaaktype!,
            Startdatum: DateOnly.FromDateTime(DateTime.UtcNow),
            Identificatie: Guid.NewGuid().ToString()));
        await gateway.SetZaakToCancellationStatusAsync(zaakUrl, zaaktype!, DateOnly.FromDateTime(DateTime.UtcNow));
        // The zaak's current status is the Geannuleerd statustype — distinct from the approval eindstatus.
        var zaak = await stack.GetZaakAsync(zaakUrl);
        var statusUrl = zaak.GetProperty("status").GetString();
        Assert.False(string.IsNullOrEmpty(statusUrl), "the cancelled zaak has no current status");
        var status = await stack.GetJsonAsync(new Uri(statusUrl!));
        var geannuleerd = await stack.FindStatustypeByOmschrijvingAsync(zaaktype!, "Geannuleerd");
        Assert.Equal(geannuleerd.ToString(), status.GetProperty("statustype").GetString());
        // ...and a resultaat is recorded (OpenZaak requires it before a closing/terminal status).
        Assert.False(string.IsNullOrEmpty(zaak.GetProperty("resultaat").GetString()),
            "the cancelled zaak has no resultaat");
    }
    [Fact]
    public async Task Storing_a_diploma_creates_a_real_informatieobject_related_to_the_zaak()
    {
        var zaaktype = await stack.FindPublishedBigZaaktypeAsync();
        Assert.True(zaaktype is not null,
            "No published BIG-REGISTRATIE zaaktype found — seed the stack with OZ_PUBLISH=1.");
        var informatieobjecttype = await stack.FindPublishedDiplomaInformatieobjecttypeAsync();
        Assert.True(informatieobjecttype is not null,
            "No published Diploma informatieobjecttype found — seed the stack with OZ_PUBLISH=1.");
        var gateway = new OpenZaakGateway(stack.Http, stack.Options);
        var zaakUrl = await gateway.OpenZaakAsync(new ZaakRequest(
            Bronorganisatie: "517439943",
            VerantwoordelijkeOrganisatie: "517439943",
            Vertrouwelijkheidaanduiding: "openbaar",
            Zaaktype: zaaktype!,
            Startdatum: DateOnly.FromDateTime(DateTime.UtcNow),
            Identificatie: Guid.NewGuid().ToString()));
        var content = System.Text.Encoding.UTF8.GetBytes("%PDF-1.4 synthetic diploma\n");
        var documentUrl = await gateway.StoreDocumentAsync(new DocumentRequest(
            Bronorganisatie: "517439943",
            Informatieobjecttype: informatieobjecttype!,
            Vertrouwelijkheidaanduiding: "openbaar",
            Zaak: zaakUrl,
            Creatiedatum: DateOnly.FromDateTime(DateTime.UtcNow),
            Titel: "Diploma",
            Auteur: "zorgprofessional",
            Taal: "nld",
            Bestandsnaam: "diploma.pdf",
            Formaat: "application/pdf",
            Inhoud: content));
        // The gateway returns the canonical informatieobject URL...
        Assert.StartsWith(
            new Uri(stack.BaseUrl, "/documenten/api/v1/enkelvoudiginformatieobjecten/").ToString(),
            documentUrl.ToString());
        // ...the document is really persisted with the default-filled fields...
        var doc = await stack.GetJsonAsync(documentUrl);
        Assert.Equal("diploma.pdf", doc.GetProperty("bestandsnaam").GetString());
        Assert.Equal(informatieobjecttype.ToString(), doc.GetProperty("informatieobjecttype").GetString());
        Assert.Equal(content.Length, doc.GetProperty("bestandsomvang").GetInt32());
        // indicatieGebruiksrecht is recorded as "no restrictions"; left null, OpenZaak would refuse to
        // close the zaak this document is related to (the S-10b regression that broke the e2e flow).
        Assert.False(doc.GetProperty("indicatieGebruiksrecht").GetBoolean());
        // ...and it is related to the zaak (a zaakinformatieobject links the two).
        var relations = await stack.GetJsonAsync(new Uri(stack.BaseUrl,
            "/zaken/api/v1/zaakinformatieobjecten?informatieobject=" + Uri.EscapeDataString(documentUrl.ToString())));
        Assert.Contains(relations.EnumerateArray(),
            r => r.GetProperty("zaak").GetString() == zaakUrl.ToString());
    }
    [Fact]
    public async Task Resolves_the_published_zaaktype_and_diploma_informatieobjecttype_by_business_key()
    {
        var expectedZaaktype = await stack.FindPublishedBigZaaktypeAsync();
        Assert.True(expectedZaaktype is not null,
            "No published BIG-REGISTRATIE zaaktype found — seed the stack with OZ_PUBLISH=1.");
        var expectedInformatieobjecttype = await stack.FindPublishedDiplomaInformatieobjecttypeAsync();
        Assert.True(expectedInformatieobjecttype is not null,
            "No published Diploma informatieobjecttype found — seed the stack with OZ_PUBLISH=1.");
        var gateway = new OpenZaakGateway(stack.Http, stack.Options);
        // The ACL discovers both URLs from the live Catalogi API by their stable business keys (S-27),
        // matching what the fixture found independently — no pinned URL needed.
        Assert.Equal(expectedZaaktype, await gateway.ResolveZaaktypeUrlAsync("BIG-REGISTRATIE"));
        Assert.Equal(expectedInformatieobjecttype, await gateway.ResolveInformatieobjecttypeUrlAsync("Diploma"));
    }
    [Fact]
    public async Task Resolving_an_unknown_zaaktype_identificatie_throws_a_clear_error()
    {
        var gateway = new OpenZaakGateway(stack.Http, stack.Options);
        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
            () => gateway.ResolveZaaktypeUrlAsync("NO-SUCH-ZAAKTYPE"));
        Assert.Contains("NO-SUCH-ZAAKTYPE", ex.Message);
    }
 }
@@ -6,12 +6,6 @@ public class AclServiceTests
 {
    private sealed class FakeGateway : IZaakGateway
    {
        // The URLs the catalogus resolves the configured identificatie/omschrijving to (S-27).
        public Uri ResolvedZaaktype { get; } = new("http://openzaak/catalogi/api/v1/zaaktypen/big");
        public Uri ResolvedInformatieobjecttype { get; } = new("http://openzaak/catalogi/api/v1/informatieobjecttypen/dip");
        public string? ResolvedByIdentificatie;
        public string? ResolvedByOmschrijving;
        public ZaakRequest? Captured;
        public Uri Result { get; } = new("http://openzaak/zaken/api/v1/zaken/abc");
@@ -29,14 +23,6 @@ public class AclServiceTests
            return Task.CompletedTask;
        }
        public (Uri Zaak, Uri Zaaktype, DateOnly Datum)? Cancelled;
        public Task SetZaakToCancellationStatusAsync(Uri zaakUrl, Uri zaaktypeUrl, DateOnly datumStatusGezet, CancellationToken ct = default)
        {
            Cancelled = (zaakUrl, zaaktypeUrl, datumStatusGezet);
            return Task.CompletedTask;
        }
        public Uri? ReadReferenceFor;
        public Task<string> GetZaakIdentificatieAsync(Uri zaakUrl, CancellationToken ct = default)
@@ -44,27 +30,6 @@ public class AclServiceTests
            ReadReferenceFor = zaakUrl;
            return Task.FromResult("REG-FROM-ZAAK");
        }
        public DocumentRequest? StoredDocument;
        public Uri DocumentResult { get; } = new("http://openzaak/documenten/api/v1/enkelvoudiginformatieobjecten/doc-1");
        public Task<Uri> StoreDocumentAsync(DocumentRequest request, CancellationToken ct = default)
        {
            StoredDocument = request;
            return Task.FromResult(DocumentResult);
        }
        public Task<Uri> ResolveZaaktypeUrlAsync(string identificatie, CancellationToken ct = default)
        {
            ResolvedByIdentificatie = identificatie;
            return Task.FromResult(ResolvedZaaktype);
        }
        public Task<Uri> ResolveInformatieobjecttypeUrlAsync(string omschrijving, CancellationToken ct = default)
        {
            ResolvedByOmschrijving = omschrijving;
            return Task.FromResult(ResolvedInformatieobjecttype);
        }
    }
    private static AclDefaults Defaults() => new()
@@ -72,23 +37,26 @@ public class AclServiceTests
        Bronorganisatie = "517439943",
        VerantwoordelijkeOrganisatie = "517439943",
        Vertrouwelijkheidaanduiding = "openbaar",
-        ZaaktypeIdentificatie = "BIG-REGISTRATIE",
+        ZaaktypeUrl = new("http://openzaak/catalogi/api/v1/zaaktypen/big"),
        InformatieobjecttypeOmschrijving = "Diploma",
    };
    private static AclService ServiceWith(FakeGateway gateway, AclDefaults defaults, DateOnly today) =>
        new(gateway, defaults, new CachedZaaktypeCatalog(gateway, defaults), new FixedClock(today));
    private sealed class FixedClock(DateOnly today) : IClock
    {
        public DateOnly Today { get; } = today;
    }
    [Fact]
-    public async Task Opening_a_zaak_default_fills_zgw_fields_and_uses_the_resolved_zaaktype()
+    public async Task Opening_a_zaak_default_fills_zgw_fields_and_returns_the_zaak_url()
    {
        var gateway = new FakeGateway();
-        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
+        var defaults = new AclDefaults
        {
            Bronorganisatie = "517439943",
            VerantwoordelijkeOrganisatie = "517439943",
            Vertrouwelijkheidaanduiding = "openbaar",
            ZaaktypeUrl = new("http://openzaak/catalogi/api/v1/zaaktypen/big"),
        };
        var service = new AclService(gateway, defaults, new FixedClock(new DateOnly(2026, 6, 4)));
        var url = await service.OpenZaakAsync(new DomainRegistration("123456782", "reg-77"));
@@ -97,9 +65,7 @@ public class AclServiceTests
        Assert.Equal("517439943", req.Bronorganisatie);
        Assert.Equal("517439943", req.VerantwoordelijkeOrganisatie);
        Assert.Equal("openbaar", req.Vertrouwelijkheidaanduiding);
-        // The zaaktype is resolved from the configured identificatie, not a pinned URL (S-27).
+        Assert.Equal(defaults.ZaaktypeUrl, req.Zaaktype);
        Assert.Equal("BIG-REGISTRATIE", gateway.ResolvedByIdentificatie);
        Assert.Equal(gateway.ResolvedZaaktype, req.Zaaktype);
        Assert.Equal(new DateOnly(2026, 6, 4), req.Startdatum);
        // The registration reference becomes the zaak identificatie (#78).
        Assert.Equal("reg-77", req.Identificatie);
@@ -109,24 +75,32 @@ public class AclServiceTests
    public async Task Rejects_a_null_registration_without_calling_the_gateway()
    {
        var gateway = new FakeGateway();
-        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
+        var defaults = new AclDefaults
        {
            Bronorganisatie = "517439943",
            VerantwoordelijkeOrganisatie = "517439943",
            Vertrouwelijkheidaanduiding = "openbaar",
            ZaaktypeUrl = new("http://openzaak/catalogi/api/v1/zaaktypen/big"),
        };
        var service = new AclService(gateway, defaults, new FixedClock(new DateOnly(2026, 6, 4)));
        await Assert.ThrowsAsync<ArgumentNullException>(() => service.OpenZaakAsync(null!));
        Assert.Null(gateway.Captured);
    }
    [Fact]
-    public async Task Approving_a_zaak_sets_it_to_its_resolved_zaaktypes_eindstatus_dated_today()
+    public async Task Approving_a_zaak_sets_it_to_its_zaaktypes_eindstatus_dated_today()
    {
        var gateway = new FakeGateway();
-        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
+        var defaults = Defaults();
        var service = new AclService(gateway, defaults, new FixedClock(new DateOnly(2026, 6, 4)));
        var zaak = new Uri("http://openzaak/zaken/api/v1/zaken/abc");
        await service.ApproveZaakAsync(zaak);
        Assert.NotNull(gateway.Approved);
        Assert.Equal(zaak, gateway.Approved!.Value.Zaak);
-        Assert.Equal(gateway.ResolvedZaaktype, gateway.Approved.Value.Zaaktype);
+        Assert.Equal(defaults.ZaaktypeUrl, gateway.Approved.Value.Zaaktype);
        Assert.Equal(new DateOnly(2026, 6, 4), gateway.Approved.Value.Datum);
    }
@@ -134,80 +108,17 @@ public class AclServiceTests
    public async Task Approving_a_null_zaak_is_rejected_without_touching_the_gateway()
    {
        var gateway = new FakeGateway();
-        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
+        var service = new AclService(gateway, Defaults(), new FixedClock(new DateOnly(2026, 6, 4)));
        await Assert.ThrowsAsync<ArgumentNullException>(() => service.ApproveZaakAsync(null!));
        Assert.Null(gateway.Approved);
    }
    [Fact]
    public async Task Cancelling_a_zaak_sets_it_to_the_cancellation_status_dated_today()
    {
        var gateway = new FakeGateway();
        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
        var zaak = new Uri("http://openzaak/zaken/api/v1/zaken/abc");
        await service.CancelZaakAsync(zaak);
        Assert.NotNull(gateway.Cancelled);
        Assert.Equal(zaak, gateway.Cancelled!.Value.Zaak);
        Assert.Equal(gateway.ResolvedZaaktype, gateway.Cancelled.Value.Zaaktype);
        Assert.Equal(new DateOnly(2026, 6, 4), gateway.Cancelled.Value.Datum);
        // Cancellation must not touch the approval path.
        Assert.Null(gateway.Approved);
    }
    [Fact]
    public async Task Cancelling_a_null_zaak_is_rejected_without_touching_the_gateway()
    {
        var gateway = new FakeGateway();
        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
        await Assert.ThrowsAsync<ArgumentNullException>(() => service.CancelZaakAsync(null!));
        Assert.Null(gateway.Cancelled);
    }
    [Fact]
    public async Task Storing_a_diploma_default_fills_the_document_fields_and_uses_the_resolved_informatieobjecttype()
    {
        var gateway = new FakeGateway();
        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
        var zaak = new Uri("http://openzaak/zaken/api/v1/zaken/abc");
        var url = await service.StoreDiplomaAsync(zaak, [1, 2, 3], "diploma.pdf", "application/pdf");
        Assert.Equal(gateway.DocumentResult, url);
        var req = gateway.StoredDocument!;
        Assert.Equal(zaak, req.Zaak);
        // The informatieobjecttype is resolved from the configured omschrijving (S-27).
        Assert.Equal("Diploma", gateway.ResolvedByOmschrijving);
        Assert.Equal(gateway.ResolvedInformatieobjecttype, req.Informatieobjecttype);
        Assert.Equal("517439943", req.Bronorganisatie);
        Assert.Equal("openbaar", req.Vertrouwelijkheidaanduiding);
        Assert.Equal(new DateOnly(2026, 6, 4), req.Creatiedatum);
        Assert.Equal("nld", req.Taal);
        Assert.Equal("diploma.pdf", req.Bestandsnaam);
        Assert.Equal("application/pdf", req.Formaat);
        Assert.Equal(new byte[] { 1, 2, 3 }, req.Inhoud);
    }
    [Fact]
    public async Task Storing_a_diploma_rejects_null_or_blank_arguments()
    {
        var service = ServiceWith(new FakeGateway(), Defaults(), new DateOnly(2026, 6, 4));
        var zaak = new Uri("http://openzaak/zaken/api/v1/zaken/abc");
        await Assert.ThrowsAsync<ArgumentNullException>(() => service.StoreDiplomaAsync(null!, [1], "d.pdf", "application/pdf"));
        await Assert.ThrowsAsync<ArgumentNullException>(() => service.StoreDiplomaAsync(zaak, null!, "d.pdf", "application/pdf"));
        await Assert.ThrowsAnyAsync<ArgumentException>(() => service.StoreDiplomaAsync(zaak, [1], " ", "application/pdf"));
        await Assert.ThrowsAnyAsync<ArgumentException>(() => service.StoreDiplomaAsync(zaak, [1], "d.pdf", " "));
    }
    [Fact]
    public async Task Reading_a_zaak_reference_returns_the_zaaks_identificatie()
    {
        var gateway = new FakeGateway();
-        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
+        var service = new AclService(gateway, Defaults(), new FixedClock(new DateOnly(2026, 6, 4)));
        var zaak = new Uri("http://openzaak/zaken/api/v1/zaken/abc");
        var reference = await service.GetZaakReferenceAsync(zaak);
@@ -220,7 +131,7 @@ public class AclServiceTests
    public async Task Reading_a_null_zaak_reference_is_rejected()
    {
        var gateway = new FakeGateway();
-        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
+        var service = new AclService(gateway, Defaults(), new FixedClock(new DateOnly(2026, 6, 4)));
        await Assert.ThrowsAsync<ArgumentNullException>(() => service.GetZaakReferenceAsync(null!));
        Assert.Null(gateway.ReadReferenceFor);
@@ -173,8 +173,7 @@ public class OpenZaakGatewayTests
    private sealed class OzRoutes
    {
        public string StatustypenJson { get; init; } = StatustypenPage(withEindstatusFlag: true);
-        public string ResultaattypenJson { get; init; } =
+        public string ResultaattypenJson { get; init; } = """{"results":[{"url":"http://openzaak/catalogi/api/v1/resultaattypen/1"}]}""";
            """{"results":[{"url":"http://openzaak/catalogi/api/v1/resultaattypen/1","omschrijving":"Geregistreerd"}]}""";
        public HttpStatusCode StatustypenStatus { get; init; } = HttpStatusCode.OK;
        public HttpStatusCode ResultaattypenStatus { get; init; } = HttpStatusCode.OK;
        public HttpStatusCode ResultaatPostStatus { get; init; } = HttpStatusCode.Created;
@@ -252,138 +251,6 @@ public class OpenZaakGatewayTests
        Assert.True(status.Length > 0);
    }
    [Fact]
    public async Task Approving_selects_the_geregistreerd_resultaat_by_name_when_several_exist()
    {
        // Once S-10c adds a second resultaattype (Vervallen), picking the first is ambiguous — the
        // Zaken API does not guarantee order. Approval must resolve its resultaat by omschrijving.
        var rec = new Recorder();
        var twoResultaattypen = """
            {"results":[
              {"url":"http://openzaak/catalogi/api/v1/resultaattypen/vervallen","omschrijving":"Vervallen"},
              {"url":"http://openzaak/catalogi/api/v1/resultaattypen/geregistreerd","omschrijving":"Geregistreerd"}
            ]}
            """;
        await Gateway(ApprovalStub(rec, new OzRoutes { ResultaattypenJson = twoResultaattypen }))
            .SetZaakToEindstatusAsync(new Uri(ZaakUrl), Zaaktype, new DateOnly(2026, 6, 4));
        Assert.Contains("\"resultaattype\":\"http://openzaak/catalogi/api/v1/resultaattypen/geregistreerd\"",
            rec.Sent("/resultaten").Body);
    }
    // --- SetZaakToCancellationStatusAsync (document-timeout cancellation / S-10c) ---
    // A catalogus with the three statustypen S-10c seeds (Geannuleerd is non-terminal, below the
    // Afgehandeld eindstatus) and both resultaattypen. Cancellation must resolve "Geannuleerd" and
    // "Vervallen" by omschrijving, never the approval pair.
    private const string CancellationStatustypenJson = """
        {"results":[
          {"url":"http://openzaak/catalogi/api/v1/statustypen/ontvangen","volgnummer":1,"omschrijving":"Ontvangen","isEindstatus":false},
          {"url":"http://openzaak/catalogi/api/v1/statustypen/geannuleerd","volgnummer":2,"omschrijving":"Geannuleerd","isEindstatus":false},
          {"url":"http://openzaak/catalogi/api/v1/statustypen/afgehandeld","volgnummer":3,"omschrijving":"Afgehandeld","isEindstatus":true}
        ]}
        """;
    private const string CancellationResultaattypenJson = """
        {"results":[
          {"url":"http://openzaak/catalogi/api/v1/resultaattypen/geregistreerd","omschrijving":"Geregistreerd"},
          {"url":"http://openzaak/catalogi/api/v1/resultaattypen/vervallen","omschrijving":"Vervallen"}
        ]}
        """;
    [Fact]
    public async Task Cancelling_records_the_vervallen_resultaat_then_the_geannuleerd_status_against_the_zaak()
    {
        var rec = new Recorder();
        await Gateway(ApprovalStub(rec, new OzRoutes
        {
            StatustypenJson = CancellationStatustypenJson,
            ResultaattypenJson = CancellationResultaattypenJson,
        })).SetZaakToCancellationStatusAsync(new Uri(ZaakUrl), Zaaktype, new DateOnly(2026, 6, 4));
        // Resultaat precedes status (OpenZaak requires a resultaat before a closing/terminal status).
        Assert.True(rec.IndexOf("/resultaten") < rec.IndexOf("/statussen"));
        var resultaat = rec.Sent("/resultaten");
        Assert.Contains("\"zaak\":\"" + ZaakUrl + "\"", resultaat.Body);
        // The cancellation resultaat (Vervallen) is chosen by name — not the approval one (Geregistreerd).
        Assert.Contains("\"resultaattype\":\"http://openzaak/catalogi/api/v1/resultaattypen/vervallen\"", resultaat.Body);
        var status = rec.Sent("/statussen");
        Assert.Contains("\"zaak\":\"" + ZaakUrl + "\"", status.Body);
        // The Geannuleerd statustype is chosen by name — not the Afgehandeld eindstatus (approval).
        Assert.Contains("\"statustype\":\"http://openzaak/catalogi/api/v1/statustypen/geannuleerd\"", status.Body);
        Assert.Contains("\"datumStatusGezet\":\"2026-06-04T00:00:00Z\"", status.Body);
    }
    [Fact]
    public async Task Cancelling_throws_when_the_zaaktype_has_no_geannuleerd_statustype()
    {
        var rec = new Recorder();
        var ex = await Assert.ThrowsAsync<InvalidOperationException>(() =>
            Gateway(ApprovalStub(rec, new OzRoutes
            {
                // Only the approval statustypen — no "Geannuleerd".
                StatustypenJson = StatustypenPage(withEindstatusFlag: true),
                ResultaattypenJson = CancellationResultaattypenJson,
            })).SetZaakToCancellationStatusAsync(new Uri(ZaakUrl), Zaaktype, new DateOnly(2026, 6, 4)));
        Assert.Contains("Geannuleerd", ex.Message);
    }
    [Fact]
    public async Task Cancelling_rejects_a_null_zaak_without_calling_openzaak()
    {
        var handler = new StubHandler(_ => throw new InvalidOperationException("should not be sent"));
        await Assert.ThrowsAsync<ArgumentNullException>(() =>
            Gateway(handler).SetZaakToCancellationStatusAsync(null!, Zaaktype, new DateOnly(2026, 6, 4)));
    }
    [Fact]
    public async Task Cancelling_rejects_a_null_zaaktype_without_calling_openzaak()
    {
        var handler = new StubHandler(_ => throw new InvalidOperationException("should not be sent"));
        await Assert.ThrowsAsync<ArgumentNullException>(() =>
            Gateway(handler).SetZaakToCancellationStatusAsync(new Uri(ZaakUrl), null!, new DateOnly(2026, 6, 4)));
    }
    [Fact]
    public async Task Cancelling_surfaces_the_failure_when_recording_the_resultaat_is_rejected()
    {
        var rec = new Recorder();
        var ex = await Assert.ThrowsAsync<HttpRequestException>(() =>
            Gateway(ApprovalStub(rec, new OzRoutes
            {
                StatustypenJson = CancellationStatustypenJson,
                ResultaattypenJson = CancellationResultaattypenJson,
                ResultaatPostStatus = HttpStatusCode.BadRequest,
            })).SetZaakToCancellationStatusAsync(new Uri(ZaakUrl), Zaaktype, new DateOnly(2026, 6, 4)));
        Assert.Contains("cancellation resultaat", ex.Message);
        // It fails on the resultaat, before it ever posts the status.
        Assert.Equal(-1, rec.IndexOf("/statussen"));
    }
    [Fact]
    public async Task Cancelling_surfaces_the_failure_when_recording_the_status_is_rejected()
    {
        var rec = new Recorder();
        var ex = await Assert.ThrowsAsync<HttpRequestException>(() =>
            Gateway(ApprovalStub(rec, new OzRoutes
            {
                StatustypenJson = CancellationStatustypenJson,
                ResultaattypenJson = CancellationResultaattypenJson,
                StatusPostStatus = HttpStatusCode.BadRequest,
            })).SetZaakToCancellationStatusAsync(new Uri(ZaakUrl), Zaaktype, new DateOnly(2026, 6, 4)));
        Assert.Contains("cancellation status", ex.Message);
    }
    [Fact]
    public async Task Approving_falls_back_to_the_highest_volgnummer_when_no_eindstatus_is_flagged()
    {
@@ -458,7 +325,7 @@ public class OpenZaakGatewayTests
            Gateway(ApprovalStub(rec, new OzRoutes { ResultaattypenJson = "{}" }))
                .SetZaakToEindstatusAsync(new Uri(ZaakUrl), Zaaktype, new DateOnly(2026, 6, 4)));
-        Assert.Contains("'Geregistreerd' resultaattype", ex.Message);
+        Assert.Contains("No resultaattypen found", ex.Message);
        // Resolved the eindstatus + queried resultaattypen, but posted nothing.
        Assert.Equal(-1, rec.IndexOf("/resultaten"));
        Assert.Equal(-1, rec.IndexOf("/statussen"));
@@ -565,263 +432,4 @@ public class OpenZaakGatewayTests
        b64 = (b64.Length % 4) switch { 2 => b64 + "==", 3 => b64 + "=", _ => b64 };
        return Encoding.UTF8.GetString(Convert.FromBase64String(b64));
    }
    // --- StoreDocumentAsync (diploma upload / S-10b) ---
    private static readonly Uri Informatieobjecttype =
        new("http://openzaak/catalogi/api/v1/informatieobjecttypen/dip");
    private static DocumentRequest SampleDocument(byte[]? inhoud = null) => new(
        Bronorganisatie: "517439943",
        Informatieobjecttype: Informatieobjecttype,
        Vertrouwelijkheidaanduiding: "openbaar",
        Zaak: new Uri(ZaakUrl),
        Creatiedatum: new DateOnly(2026, 6, 4),
        Titel: "Diploma",
        Auteur: "zorgprofessional",
        Taal: "nld",
        Bestandsnaam: "diploma.pdf",
        Formaat: "application/pdf",
        Inhoud: inhoud ?? [1, 2, 3, 4]);
    // Routes the two document calls: POST /enkelvoudiginformatieobjecten (documenten) then
    // POST /zaakinformatieobjecten (zaken).
    private static StubHandler DocumentStub(Recorder rec) => new(async req =>
    {
        rec.Requests.Add(req);
        rec.ContentLengths.Add(req.Content?.Headers.ContentLength);
        rec.Bodies.Add(req.Content is null ? null : await req.Content.ReadAsStringAsync());
        return req.RequestUri!.ToString().Contains("/enkelvoudiginformatieobjecten")
            ? Json(HttpStatusCode.Created, """{"url":"http://openzaak/documenten/api/v1/enkelvoudiginformatieobjecten/doc-1"}""")
            : Json(HttpStatusCode.Created, """{"url":"http://openzaak/zaken/api/v1/zaakinformatieobjecten/rel-1"}""");
    });
    [Fact]
    public async Task Storing_a_document_creates_the_informatieobject_then_relates_it_to_the_zaak()
    {
        var rec = new Recorder();
        var url = await Gateway(DocumentStub(rec)).StoreDocumentAsync(SampleDocument([10, 20, 30]));
        Assert.Equal("http://openzaak/documenten/api/v1/enkelvoudiginformatieobjecten/doc-1", url.ToString());
        // 1. Create the enkelvoudiginformatieobject in the Documenten API.
        var create = rec.Sent("/enkelvoudiginformatieobjecten");
        Assert.Equal(HttpMethod.Post, create.Request.Method);
        Assert.Equal("http://openzaak/documenten/api/v1/enkelvoudiginformatieobjecten",
            create.Request.RequestUri!.ToString());
        Assert.Equal("Bearer", create.Request.Headers.Authorization!.Scheme);
        Assert.Contains("\"bronorganisatie\":\"517439943\"", create.Body);
        Assert.Contains("\"informatieobjecttype\":\"http://openzaak/catalogi/api/v1/informatieobjecttypen/dip\"", create.Body);
        Assert.Contains("\"creatiedatum\":\"2026-06-04\"", create.Body);
        Assert.Contains("\"titel\":\"Diploma\"", create.Body);
        Assert.Contains("\"auteur\":\"zorgprofessional\"", create.Body);
        Assert.Contains("\"taal\":\"nld\"", create.Body);
        Assert.Contains("\"bestandsnaam\":\"diploma.pdf\"", create.Body);
        Assert.Contains("\"formaat\":\"application/pdf\"", create.Body);
        Assert.Contains("\"vertrouwelijkheidaanduiding\":\"openbaar\"", create.Body);
        Assert.Contains("\"status\":\"definitief\"", create.Body);
        // indicatieGebruiksrecht must be set explicitly (false = no usage restrictions); left null,
        // OpenZaak refuses to close the zaak this document is related to ("indicatiegebruiksrecht-unset").
        Assert.Contains("\"indicatieGebruiksrecht\":false", create.Body);
        // The file content is base64-encoded into `inhoud`, with its byte length in `bestandsomvang`.
        Assert.Contains($"\"inhoud\":\"{Convert.ToBase64String([10, 20, 30])}\"", create.Body);
        Assert.Contains("\"bestandsomvang\":3", create.Body);
        // 2. Relate that informatieobject to the zaak (Zaken API — no CRS).
        var relate = rec.Sent("/zaakinformatieobjecten");
        Assert.Equal(HttpMethod.Post, relate.Request.Method);
        Assert.Equal("http://openzaak/zaken/api/v1/zaakinformatieobjecten",
            relate.Request.RequestUri!.ToString());
        Assert.Contains($"\"zaak\":\"{ZaakUrl}\"", relate.Body);
        Assert.Contains("\"informatieobject\":\"http://openzaak/documenten/api/v1/enkelvoudiginformatieobjecten/doc-1\"", relate.Body);
    }
    [Fact]
    public async Task Storing_a_document_buffers_the_body_and_sends_no_crs_headers()
    {
        // uwsgi rejects a chunked body (Content-Length must be present); the Documenten API is not a
        // geo API, so no CRS headers (unlike the Zaken zaak-create).
        var rec = new Recorder();
        await Gateway(DocumentStub(rec)).StoreDocumentAsync(SampleDocument());
        var create = rec.Sent("/enkelvoudiginformatieobjecten");
        Assert.NotNull(create.Length);
        Assert.True(create.Length > 0);
        Assert.False(create.Request.Headers.Contains("Accept-Crs"));
        Assert.False(create.Request.Content!.Headers.Contains("Content-Crs"));
    }
    [Fact]
    public async Task Storing_a_document_surfaces_an_openzaak_rejection()
    {
        var handler = new StubHandler(_ =>
            Task.FromResult(new HttpResponseMessage(HttpStatusCode.BadRequest)
            {
                Content = new StringContent("""{"detail":"bad"}""", Encoding.UTF8, "application/json"),
            }));
        var ex = await Assert.ThrowsAsync<HttpRequestException>(
            () => Gateway(handler).StoreDocumentAsync(SampleDocument()));
        Assert.Contains("bad", ex.Message);
    }
    [Fact]
    public async Task Storing_a_document_rejects_a_null_request()
    {
        var handler = new StubHandler(_ => throw new InvalidOperationException("should not be sent"));
        await Assert.ThrowsAsync<ArgumentNullException>(() => Gateway(handler).StoreDocumentAsync(null!));
    }
    // ── Catalogi resolution by business key (S-27) ────────────────────────────────────────────────
    [Fact]
    public async Task Resolves_the_published_zaaktype_url_by_identificatie()
    {
        HttpRequestMessage? seen = null;
        var handler = new StubHandler(req =>
        {
            seen = req;
            return Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
            {
                Content = JsonContent.Create(new
                {
                    results = new[] { new { url = "http://openzaak/catalogi/api/v1/zaaktypen/big", identificatie = "BIG-REGISTRATIE" } },
                }),
            });
        });
        var url = await Gateway(handler).ResolveZaaktypeUrlAsync("BIG-REGISTRATIE");
        Assert.Equal("http://openzaak/catalogi/api/v1/zaaktypen/big", url.ToString());
        Assert.Equal(HttpMethod.Get, seen!.Method);
        // Filters to the published zaaktype with that identificatie, and authenticates.
        Assert.Contains("/catalogi/api/v1/zaaktypen", seen.RequestUri!.ToString());
        Assert.Contains("status=definitief", seen.RequestUri!.Query);
        Assert.Contains("identificatie=BIG-REGISTRATIE", seen.RequestUri!.Query);
        Assert.Equal("Bearer", seen.Headers.Authorization!.Scheme);
    }
    [Fact]
    public async Task Resolving_a_zaaktype_throws_a_clear_error_when_none_is_published()
    {
        var handler = new StubHandler(_ => Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
        {
            Content = JsonContent.Create(new { results = Array.Empty<object>() }),
        }));
        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
            () => Gateway(handler).ResolveZaaktypeUrlAsync("BIG-REGISTRATIE"));
        Assert.Contains("BIG-REGISTRATIE", ex.Message);
    }
    [Fact]
    public async Task Resolves_the_informatieobjecttype_url_by_omschrijving()
    {
        HttpRequestMessage? seen = null;
        var handler = new StubHandler(req =>
        {
            seen = req;
            return Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
            {
                Content = JsonContent.Create(new
                {
                    results = new[]
                    {
                        new { url = "http://openzaak/catalogi/api/v1/informatieobjecttypen/other", omschrijving = "Overig" },
                        new { url = "http://openzaak/catalogi/api/v1/informatieobjecttypen/dip", omschrijving = "Diploma" },
                    },
                }),
            });
        });
        var url = await Gateway(handler).ResolveInformatieobjecttypeUrlAsync("Diploma");
        // Queries the published informatieobjecttypen collection, and matches on omschrijving (not position).
        Assert.Contains("/catalogi/api/v1/informatieobjecttypen", seen!.RequestUri!.ToString());
        Assert.Contains("status=definitief", seen.RequestUri!.Query);
        Assert.Equal("http://openzaak/catalogi/api/v1/informatieobjecttypen/dip", url.ToString());
    }
    [Fact]
    public async Task Resolving_a_zaaktype_throws_when_the_response_carries_no_results()
    {
        // No "results" property → the page's Results is null; the gateway must treat that as "none
        // found" (not dereference null).
        var handler = new StubHandler(_ => Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
        {
            Content = JsonContent.Create(new { count = 0 }),
        }));
        await Assert.ThrowsAsync<InvalidOperationException>(
            () => Gateway(handler).ResolveZaaktypeUrlAsync("BIG-REGISTRATIE"));
    }
    [Fact]
    public async Task Resolving_an_informatieobjecttype_throws_when_the_response_carries_no_results()
    {
        var handler = new StubHandler(_ => Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
        {
            Content = JsonContent.Create(new { count = 0 }),
        }));
        await Assert.ThrowsAsync<InvalidOperationException>(
            () => Gateway(handler).ResolveInformatieobjecttypeUrlAsync("Diploma"));
    }
    [Fact]
    public async Task Resolving_a_zaaktype_surfaces_a_non_success_catalogi_response()
    {
        var handler = new StubHandler(_ => Task.FromResult(new HttpResponseMessage(HttpStatusCode.InternalServerError)
        {
            Content = new StringContent("boom"),
        }));
        var ex = await Assert.ThrowsAsync<HttpRequestException>(
            () => Gateway(handler).ResolveZaaktypeUrlAsync("BIG-REGISTRATIE"));
        // The error names the resource being queried and includes OpenZaak's body.
        Assert.Contains("zaaktypen", ex.Message);
        Assert.Contains("boom", ex.Message);
    }
    [Fact]
    public async Task Resolving_an_informatieobjecttype_surfaces_a_non_success_catalogi_response()
    {
        var handler = new StubHandler(_ => Task.FromResult(new HttpResponseMessage(HttpStatusCode.InternalServerError)
        {
            Content = new StringContent("boom"),
        }));
        var ex = await Assert.ThrowsAsync<HttpRequestException>(
            () => Gateway(handler).ResolveInformatieobjecttypeUrlAsync("Diploma"));
        Assert.Contains("informatieobjecttypen", ex.Message);
    }
    [Fact]
    public async Task Resolving_an_informatieobjecttype_throws_when_no_omschrijving_matches()
    {
        var handler = new StubHandler(_ => Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
        {
            Content = JsonContent.Create(new
            {
                results = new[] { new { url = "http://openzaak/catalogi/api/v1/informatieobjecttypen/other", omschrijving = "Overig" } },
            }),
        }));
        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
            () => Gateway(handler).ResolveInformatieobjecttypeUrlAsync("Diploma"));
        Assert.Contains("Diploma", ex.Message);
    }
    [Fact]
    public async Task Resolving_rejects_a_blank_business_key_without_calling_openzaak()
    {
        var handler = new StubHandler(_ => throw new InvalidOperationException("should not be sent"));
        await Assert.ThrowsAnyAsync<ArgumentException>(() => Gateway(handler).ResolveZaaktypeUrlAsync(" "));
        await Assert.ThrowsAnyAsync<ArgumentException>(() => Gateway(handler).ResolveInformatieobjecttypeUrlAsync(" "));
    }
 }
@@ -1,92 +0,0 @@
 using Acl.Application;
 namespace Acl.Tests;
 public class ZaaktypeCatalogTests
 {
    // A gateway that only supports resolution; the other members are unused here.
    private sealed class ResolvingGateway : IZaakGateway
    {
        public int ZaaktypeCalls;
        public int InformatieobjecttypeCalls;
        public string? LastIdentificatie;
        public string? LastOmschrijving;
        public int ThrowZaaktypeTimes;
        public Uri ZaaktypeUrl { get; } = new("http://openzaak/catalogi/api/v1/zaaktypen/big");
        public Uri InformatieobjecttypeUrl { get; } = new("http://openzaak/catalogi/api/v1/informatieobjecttypen/dip");
        public Task<Uri> ResolveZaaktypeUrlAsync(string identificatie, CancellationToken ct = default)
        {
            ZaaktypeCalls++;
            LastIdentificatie = identificatie;
            if (ZaaktypeCalls <= ThrowZaaktypeTimes)
                throw new InvalidOperationException("no published zaaktype yet");
            return Task.FromResult(ZaaktypeUrl);
        }
        public Task<Uri> ResolveInformatieobjecttypeUrlAsync(string omschrijving, CancellationToken ct = default)
        {
            InformatieobjecttypeCalls++;
            LastOmschrijving = omschrijving;
            return Task.FromResult(InformatieobjecttypeUrl);
        }
        public Task<Uri> OpenZaakAsync(ZaakRequest request, CancellationToken ct = default) => throw new NotSupportedException();
        public Task SetZaakToEindstatusAsync(Uri z, Uri zt, DateOnly d, CancellationToken ct = default) => throw new NotSupportedException();
        public Task SetZaakToCancellationStatusAsync(Uri z, Uri zt, DateOnly d, CancellationToken ct = default) => throw new NotSupportedException();
        public Task<string> GetZaakIdentificatieAsync(Uri z, CancellationToken ct = default) => throw new NotSupportedException();
        public Task<Uri> StoreDocumentAsync(DocumentRequest r, CancellationToken ct = default) => throw new NotSupportedException();
    }
    private static AclDefaults Defaults() => new()
    {
        Bronorganisatie = "517439943",
        VerantwoordelijkeOrganisatie = "517439943",
        Vertrouwelijkheidaanduiding = "openbaar",
        ZaaktypeIdentificatie = "BIG-REGISTRATIE",
        InformatieobjecttypeOmschrijving = "Diploma",
    };
    [Fact]
    public async Task Resolves_the_zaaktype_and_informatieobjecttype_by_their_configured_business_keys()
    {
        var gateway = new ResolvingGateway();
        var catalog = new CachedZaaktypeCatalog(gateway, Defaults());
        Assert.Equal(gateway.ZaaktypeUrl, await catalog.GetZaaktypeUrlAsync());
        Assert.Equal(gateway.InformatieobjecttypeUrl, await catalog.GetInformatieobjecttypeUrlAsync());
        Assert.Equal("BIG-REGISTRATIE", gateway.LastIdentificatie);
        Assert.Equal("Diploma", gateway.LastOmschrijving);
    }
    [Fact]
    public async Task Caches_the_resolved_urls_so_the_gateway_is_hit_once()
    {
        var gateway = new ResolvingGateway();
        var catalog = new CachedZaaktypeCatalog(gateway, Defaults());
        for (var i = 0; i < 3; i++)
        {
            await catalog.GetZaaktypeUrlAsync();
            await catalog.GetInformatieobjecttypeUrlAsync();
        }
        Assert.Equal(1, gateway.ZaaktypeCalls);
        Assert.Equal(1, gateway.InformatieobjecttypeCalls);
    }
    [Fact]
    public async Task Does_not_cache_a_failed_resolution_so_it_is_retried()
    {
        // The zaaktype is not published yet on the first call; the catalog must retry (not cache the
        // failure) so a later call succeeds once it is published.
        var gateway = new ResolvingGateway { ThrowZaaktypeTimes = 1 };
        var catalog = new CachedZaaktypeCatalog(gateway, Defaults());
        await Assert.ThrowsAsync<InvalidOperationException>(() => catalog.GetZaaktypeUrlAsync());
        var url = await catalog.GetZaaktypeUrlAsync();
        Assert.Equal(gateway.ZaaktypeUrl, url);
        Assert.Equal(2, gateway.ZaaktypeCalls);
    }
 }
@@ -10,10 +10,6 @@
    <!-- OIDC/JWT validation of Keycloak-issued tokens (ADR-0010) and OpenAPI generation. -->
    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.8" />
    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.8" />
    <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.17.0" />
    <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.17.0" />
    <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.17.0" />
    <PackageReference Include="OpenTelemetry.Instrumentation.Http" Version="1.17.0" />
  </ItemGroup>
 </Project>
@@ -5,10 +5,6 @@ namespace Bff.Api;
 /// <summary>What the self-service submit returns to the portal (the domain's registration id + status).</summary>
 public sealed record SubmitAccepted(string RegistrationId, string Status);
 /// <summary>The caller's current open registration, for resuming the self-service portal after a
 /// refresh (S-26): the reference (registration id) + its status.</summary>
 public sealed record CurrentRegistration(string RegistrationId, string Status);
 /// <summary>A projection row as the projection-api serves it. <c>Bsn</c>/<c>NaamPlaceholder</c> are
 /// read but never surfaced by the openbaar endpoint (public-safe filtering, ADR-0010/S-09).
 /// <c>Reference</c> is the public-safe citizen reference (the zaak identificatie, #78).</summary>
@@ -17,35 +13,10 @@ public sealed record ProjectionEntry(string Id, string Status, string? Reference
 /// <summary>A public-safe openbaar register row — only non-sensitive fields leave the BFF.</summary>
 public sealed record OpenbaarEntry(string Id, string Status, string? Reference);
 /// <summary>A behandelaar's werkbak row: a registration awaiting beoordeling, with the bsn + status a
 /// behandelaar sees (staff view — reached only behind medewerker/behandelaar authorization, S-12c).</summary>
 public sealed record WerkbakItem(string RegistrationId, string Bsn, string Status);
 /// <summary>Port to the Domain Service (§8.3: the BFF is the portals' only backend; it fans out).</summary>
 public interface IDomainClient
 {
    Task<SubmitAccepted> SubmitRegistrationAsync(string bsn, CancellationToken ct = default);
    /// <summary>The caller's current open registration (resume after refresh, S-26), or <c>null</c>
    /// when they have none in flight. Owner-scoped by <paramref name="bsn"/>.</summary>
    Task<CurrentRegistration?> GetCurrentRegistrationAsync(string bsn, CancellationToken ct = default);
    /// <summary>Withdraw the caller's own registration ("trek aanvraag in"). Owner-scoped by
    /// <paramref name="bsn"/>. Returns <c>false</c> when the domain reports the registration is
    /// unknown or not the caller's (404), so the BFF can relay a 404 rather than a 500.</summary>
    Task<bool> WithdrawRegistrationAsync(string registrationId, string bsn, CancellationToken ct = default);
    /// <summary>Provide (upload) the diploma the caller's own registration is waiting for ("documenten
    /// aanleveren"). The file is carried base64-encoded. Owner-scoped by <paramref name="bsn"/>. Returns
    /// <c>false</c> when the domain reports the registration is unknown or not the caller's (404).</summary>
    Task<bool> ProvideDocumentsAsync(
        string registrationId, string bsn, string contentBase64, string? fileName, string? contentType, CancellationToken ct = default);
    /// <summary>The behandelaar's werkbak — registrations awaiting beoordeling.</summary>
    Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default);
    /// <summary>Apply a behandelaar's decision (<c>goedkeuren</c>/<c>afwijzen</c>) to a registration.</summary>
    Task DecideAsync(string registrationId, string besluit, CancellationToken ct = default);
 }
 /// <summary>Port to the read projection.</summary>
@@ -66,52 +37,6 @@ public sealed class DomainClient(HttpClient http) : IDomainClient
        return new SubmitAccepted(dto.RegistrationId, dto.Status);
    }
    public async Task<CurrentRegistration?> GetCurrentRegistrationAsync(string bsn, CancellationToken ct = default)
    {
        using var response = await http.GetAsync($"registrations/current?bsn={Uri.EscapeDataString(bsn)}", ct);
        // The domain 404s when the citizen has no open registration — that's "none", not an error.
        if (response.StatusCode == System.Net.HttpStatusCode.NotFound)
            return null;
        response.EnsureSuccessStatusCode();
        var dto = await response.Content.ReadFromJsonAsync<DomainResponse>(ct)
            ?? throw new InvalidOperationException("The Domain Service returned an empty registration response.");
        return new CurrentRegistration(dto.RegistrationId, dto.Status);
    }
    public async Task<bool> WithdrawRegistrationAsync(string registrationId, string bsn, CancellationToken ct = default)
    {
        using var response = await http.PostAsJsonAsync(
            $"registrations/{registrationId}/withdraw", new { bsn }, ct);
        // The domain 404s an unknown or not-owned registration; relay that rather than fail hard.
        if (response.StatusCode == System.Net.HttpStatusCode.NotFound)
            return false;
        response.EnsureSuccessStatusCode();
        return true;
    }
    public async Task<bool> ProvideDocumentsAsync(
        string registrationId, string bsn, string contentBase64, string? fileName, string? contentType, CancellationToken ct = default)
    {
        using var response = await http.PostAsJsonAsync(
            $"registrations/{registrationId}/documents",
            new { bsn, contentBase64, fileName, contentType }, ct);
        // The domain 404s an unknown or not-owned registration; relay that rather than fail hard.
        if (response.StatusCode == System.Net.HttpStatusCode.NotFound)
            return false;
        response.EnsureSuccessStatusCode();
        return true;
    }
    public async Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default)
        => await http.GetFromJsonAsync<List<WerkbakItem>>("behandel/werkbak", ct) ?? [];
    public async Task DecideAsync(string registrationId, string besluit, CancellationToken ct = default)
    {
        using var response = await http.PostAsJsonAsync(
            $"registrations/{registrationId}/decide", new { besluit }, ct);
        response.EnsureSuccessStatusCode();
    }
    private sealed record DomainResponse(string RegistrationId, string Status, string? ZaakUrl);
 }
@@ -1,31 +1,11 @@
 using System.Security.Claims;
 using System.Text.Json;
 using System.Text.Json.Serialization;
 using Bff.Api;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
 using OpenTelemetry.Resources;
 using OpenTelemetry.Trace;
 var builder = WebApplication.CreateBuilder(args);
 // OpenTelemetry tracing (S-16b, ADR-0023): auto-instrument incoming ASP.NET Core requests and
 // outgoing HttpClient calls (BFF → Domain, BFF → projection-api), exported over OTLP to Tempo, so a
 // portal request is one connected trace across the services. Service name + OTLP endpoint come from
 // OTEL_* env (compose); the exporter no-ops when Tempo is unreachable. /health is filtered out.
 builder.Services.AddOpenTelemetry()
    .ConfigureResource(r => r.AddService(
        builder.Configuration["OTEL_SERVICE_NAME"] ?? builder.Environment.ApplicationName))
    .WithTracing(tracing => tracing
        .AddAspNetCoreInstrumentation(o => o.Filter = ctx => ctx.Request.Path != "/health")
        .AddHttpClientInstrumentation()
        .AddOtlpExporter());
 var keycloakAuthority = builder.Configuration["Keycloak:Authority"]
    ?? throw new InvalidOperationException("Missing configuration 'Keycloak:Authority'");
 // Behandelaars authenticate against a *different* Keycloak realm (medewerker) than citizens (digid),
 // so the BFF validates a second issuer for the behandel endpoints (ADR-0013).
 var medewerkerAuthority = builder.Configuration["Keycloak:MedewerkerAuthority"]
    ?? throw new InvalidOperationException("Missing configuration 'Keycloak:MedewerkerAuthority'");
 var domainBaseUrl = builder.Configuration["Downstream:Domain:BaseUrl"]
    ?? throw new InvalidOperationException("Missing configuration 'Downstream:Domain:BaseUrl'");
 var projectionBaseUrl = builder.Configuration["Downstream:Projection:BaseUrl"]
@@ -39,28 +19,8 @@ builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        options.Authority = keycloakAuthority;
        options.RequireHttpsMetadata = false;
        options.TokenValidationParameters.ValidateAudience = false;
    })
    // The medewerker realm — behandel endpoints only. On validation we lift Keycloak's realm roles
    // (the nested realm_access.roles claim) into role claims so authorization policies can require them.
    .AddJwtBearer(BehandelAuth.Scheme, options =>
    {
        options.Authority = medewerkerAuthority;
        options.RequireHttpsMetadata = false;
        options.TokenValidationParameters.ValidateAudience = false;
        options.Events = new JwtBearerEvents
        {
            OnTokenValidated = context =>
            {
                BehandelAuth.AddRealmRoles(context.Principal);
                return Task.CompletedTask;
            },
        };
    });
-builder.Services.AddAuthorization(options =>
+builder.Services.AddAuthorization();
    options.AddPolicy(BehandelAuth.Policy, policy => policy
        .AddAuthenticationSchemes(BehandelAuth.Scheme)
        .RequireAuthenticatedUser()
        .RequireRole(BehandelAuth.BehandelaarRole)));
 // The BFF is the portals' only backend; it fans out to the domain and projection (§8.3).
 builder.Services.AddHttpClient<IDomainClient, DomainClient>(c => c.BaseAddress = new Uri(domainBaseUrl));
@@ -100,64 +60,6 @@ app.MapPost("/self-service/registrations", async (ClaimsPrincipal user, IDomainC
    .Produces(StatusCodes.Status400BadRequest)
    .Produces(StatusCodes.Status401Unauthorized);
 // Self-service resume (S-26): the signed-in zorgprofessional's current open registration, so the
 // portal can restore its reference + actions after a page refresh. The bsn comes from the DigiD token;
 // 204 when the citizen has none in flight (so the portal shows the submit form).
 app.MapGet("/self-service/registrations", async (ClaimsPrincipal user, IDomainClient domain, CancellationToken ct) =>
 {
    var bsn = user.FindFirstValue("bsn");
    if (string.IsNullOrWhiteSpace(bsn))
        return Results.BadRequest("The token carries no bsn claim.");
    var current = await domain.GetCurrentRegistrationAsync(bsn, ct);
    return current is null ? Results.NoContent() : Results.Ok(current);
 })
    .RequireAuthorization()
    .Produces<CurrentRegistration>(StatusCodes.Status200OK)
    .Produces(StatusCodes.Status204NoContent)
    .Produces(StatusCodes.Status400BadRequest)
    .Produces(StatusCodes.Status401Unauthorized);
 // Self-service withdrawal (S-11): the signed-in zorgprofessional withdraws their own registration.
 // The bsn comes from the DigiD token and is forwarded to the domain, which owner-scopes the action;
 // a registration that is unknown or not the caller's comes back 404 (ownership is not revealed).
 app.MapPost("/self-service/registrations/{id}/withdraw", async (string id, ClaimsPrincipal user, IDomainClient domain, CancellationToken ct) =>
 {
    var bsn = user.FindFirstValue("bsn");
    if (string.IsNullOrWhiteSpace(bsn))
        return Results.BadRequest("The token carries no bsn claim.");
    var withdrawn = await domain.WithdrawRegistrationAsync(id, bsn, ct);
    return withdrawn ? Results.NoContent() : Results.NotFound();
 })
    .RequireAuthorization()
    .Produces(StatusCodes.Status204NoContent)
    .Produces(StatusCodes.Status400BadRequest)
    .Produces(StatusCodes.Status401Unauthorized)
    .Produces(StatusCodes.Status404NotFound);
 // Self-service provide-documents (S-10a): the signed-in zorgprofessional supplies the documents their
 // registration is waiting for ("documenten aanleveren"). The bsn comes from the DigiD token and is
 // forwarded to the domain, which owner-scopes the action and completes the WachtOpDocumenten task; a
 // registration that is unknown or not the caller's comes back 404. The real file upload + ZGW storage
 // is S-10b — this is the trigger that unblocks the process.
 app.MapPost("/self-service/registrations/{id}/documents", async (string id, ProvideDocumentsRequest body, ClaimsPrincipal user, IDomainClient domain, CancellationToken ct) =>
 {
    var bsn = user.FindFirstValue("bsn");
    if (string.IsNullOrWhiteSpace(bsn))
        return Results.BadRequest("The token carries no bsn claim.");
    if (string.IsNullOrWhiteSpace(body?.ContentBase64))
        return Results.BadRequest("A document is required.");
    var provided = await domain.ProvideDocumentsAsync(id, bsn, body.ContentBase64, body.FileName, body.ContentType, ct);
    return provided ? Results.NoContent() : Results.NotFound();
 })
    .RequireAuthorization()
    .Produces(StatusCodes.Status204NoContent)
    .Produces(StatusCodes.Status400BadRequest)
    .Produces(StatusCodes.Status401Unauthorized)
    .Produces(StatusCodes.Status404NotFound);
 // Openbaar register: an anonymous public lookup that exposes only public-safe fields (S-09).
 app.MapGet("/openbaar/register", async (string? q, IProjectionClient projection, CancellationToken ct) =>
 {
@@ -166,83 +68,7 @@ app.MapGet("/openbaar/register", async (string? q, IProjectionClient projection,
 })
    .Produces<IReadOnlyList<OpenbaarEntry>>(StatusCodes.Status200OK);
 // Behandelaar's werkbak: registrations awaiting beoordeling. Reached only with a medewerker-realm
 // token carrying the behandelaar role; the BFF proxies the domain's werkbak (staff view, ADR-0013).
 app.MapGet("/behandel/werkbak", async (IDomainClient domain, CancellationToken ct) =>
    Results.Ok(await domain.GetWerkbakAsync(ct)))
    .RequireAuthorization(BehandelAuth.Policy)
    .Produces<IReadOnlyList<WerkbakItem>>(StatusCodes.Status200OK)
    .Produces(StatusCodes.Status401Unauthorized)
    .Produces(StatusCodes.Status403Forbidden);
 // A behandelaar's beoordeling on a registration (goedkeuren/afwijzen). Forwarded to the domain, which
 // applies the decision and completes the workflow task (ADR-0013). Same medewerker/behandelaar gate.
 app.MapPost("/behandel/registrations/{id}/decide",
    async (string id, DecideRequest body, IDomainClient domain, CancellationToken ct) =>
    {
        if (!BehandelAuth.IsKnownBesluit(body.Besluit))
            return Results.BadRequest(new { error = $"Unknown besluit '{body.Besluit}'. Expected 'goedkeuren' or 'afwijzen'." });
        await domain.DecideAsync(id, body.Besluit, ct);
        return Results.NoContent();
    })
    .RequireAuthorization(BehandelAuth.Policy)
    .Produces(StatusCodes.Status204NoContent)
    .Produces(StatusCodes.Status400BadRequest)
    .Produces(StatusCodes.Status401Unauthorized)
    .Produces(StatusCodes.Status403Forbidden);
 app.Run();
 /// <summary>The behandelaar's decision on a registration.</summary>
 public sealed record DecideRequest(string Besluit);
 /// <summary>A diploma upload from the self-service portal — the file base64-encoded client-side, with
 /// its name and MIME type. The bsn is taken from the DigiD token, not this body.</summary>
 public sealed record ProvideDocumentsRequest(string ContentBase64, string? FileName = null, string? ContentType = null);
 // Behandel (medewerker-realm) authentication + authorization wiring (ADR-0013).
 internal static class BehandelAuth
 {
    public const string Scheme = "medewerker";
    public const string Policy = "behandelaar";
    public const string BehandelaarRole = "behandelaar";
    /// <summary>The beoordeling vocabulary the BFF accepts (case-insensitive); an unknown besluit is a
    /// 400 without troubling the domain. Mirrors the domain's <c>BeoordelingsBesluit</c>.</summary>
    public static bool IsKnownBesluit(string? besluit) =>
        string.Equals(besluit, "goedkeuren", StringComparison.OrdinalIgnoreCase) ||
        string.Equals(besluit, "afwijzen", StringComparison.OrdinalIgnoreCase);
    /// <summary>Lift Keycloak's realm roles (the nested <c>realm_access.roles</c> claim) onto the
    /// principal as role claims, so <c>RequireRole</c> can authorize on them.</summary>
    public static void AddRealmRoles(ClaimsPrincipal? principal)
    {
        if (principal?.Identity is not ClaimsIdentity identity)
            return;
        var realmAccess = principal.FindFirst("realm_access")?.Value;
        if (string.IsNullOrWhiteSpace(realmAccess))
            return;
        // A malformed realm_access claim must not fail authentication (a throw here becomes a 401);
        // it simply yields no roles, so the authorization policy answers 403.
        string[] roles;
        try
        {
            roles = JsonSerializer.Deserialize<RealmAccess>(realmAccess)?.Roles ?? [];
        }
        catch (JsonException)
        {
            return;
        }
        foreach (var role in roles)
            identity.AddClaim(new Claim(identity.RoleClaimType, role));
    }
    private sealed record RealmAccess([property: JsonPropertyName("roles")] string[] Roles);
 }
 // Exposed so the test host (WebApplicationFactory<Program>) can boot the app.
 public partial class Program;
@@ -7,8 +7,7 @@
  },
  "AllowedHosts": "*",
  "Keycloak": {
-    "Authority": "http://localhost:8180/realms/digid",
+    "Authority": "http://localhost:8180/realms/digid"
    "MedewerkerAuthority": "http://localhost:8180/realms/medewerker"
  },
  "Downstream": {
    "Domain": { "BaseUrl": "http://localhost:8130/" },
@@ -1,114 +0,0 @@
 using System.Net;
 using System.Net.Http.Headers;
 using System.Net.Http.Json;
 using Bff.Api;
 namespace Bff.Tests;
 /// <summary>
 /// The behandel werkbak endpoint (S-12c): reached only with a medewerker-realm token that carries the
 /// <c>behandelaar</c> role. A missing token is 401; an authenticated medewerker without the role is
 /// 403; a behandelaar gets the werkbak (staff view, incl. bsn).
 /// </summary>
 public class BehandelEndpointTests
 {
    private static HttpRequestMessage Werkbak(string? bearer)
    {
        var request = new HttpRequestMessage(HttpMethod.Get, "/behandel/werkbak");
        if (bearer is not null)
            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
        return request;
    }
    [Fact]
    public async Task Rejects_the_werkbak_without_a_token()
    {
        using var factory = new BffFactory();
        var response = await factory.CreateClient().SendAsync(Werkbak(bearer: null));
        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
    }
    [Fact]
    public async Task Rejects_a_medewerker_without_the_behandelaar_role()
    {
        using var factory = new BffFactory();
        var response = await factory.CreateClient().SendAsync(Werkbak(TestTokens.Medewerker("teamlead")));
        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
    }
    [Fact]
    public async Task Serves_the_werkbak_to_a_behandelaar()
    {
        using var factory = new BffFactory();
        factory.Domain.Werkbak.Add(new WerkbakItem("reg-1", "123456782", "InBehandeling"));
        var response = await factory.CreateClient().SendAsync(Werkbak(TestTokens.Medewerker("behandelaar")));
        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
        var items = await response.Content.ReadFromJsonAsync<List<WerkbakItem>>();
        var item = Assert.Single(items!);
        Assert.Equal("reg-1", item.RegistrationId);
        Assert.Equal("123456782", item.Bsn);
    }
    private static HttpRequestMessage Decide(string? bearer, string id = "reg-1", string besluit = "goedkeuren")
    {
        var request = new HttpRequestMessage(HttpMethod.Post, $"/behandel/registrations/{id}/decide")
        {
            Content = JsonContent.Create(new { besluit }),
        };
        if (bearer is not null)
            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
        return request;
    }
    [Fact]
    public async Task Rejects_a_decision_without_a_token()
    {
        using var factory = new BffFactory();
        var response = await factory.CreateClient().SendAsync(Decide(bearer: null));
        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
        Assert.Null(factory.Domain.Decided);
    }
    [Fact]
    public async Task Rejects_a_decision_from_a_medewerker_without_the_behandelaar_role()
    {
        using var factory = new BffFactory();
        var response = await factory.CreateClient().SendAsync(Decide(TestTokens.Medewerker("teamlead")));
        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
        Assert.Null(factory.Domain.Decided);
    }
    [Fact]
    public async Task Forwards_a_behandelaar_decision_to_the_domain()
    {
        using var factory = new BffFactory();
        var response = await factory.CreateClient()
            .SendAsync(Decide(TestTokens.Medewerker("behandelaar"), id: "reg-42", besluit: "afwijzen"));
        Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
        Assert.Equal(("reg-42", "afwijzen"), factory.Domain.Decided);
    }
    [Fact]
    public async Task Rejects_an_unknown_besluit_without_calling_the_domain()
    {
        using var factory = new BffFactory();
        var response = await factory.CreateClient()
            .SendAsync(Decide(TestTokens.Medewerker("behandelaar"), besluit: "misschien"));
        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
        Assert.Null(factory.Domain.Decided);
    }
 }
@@ -5,7 +5,6 @@ using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Mvc.Testing;
 using Microsoft.AspNetCore.TestHost;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.IdentityModel.Protocols;
 using Microsoft.IdentityModel.Protocols.OpenIdConnect;
 using Microsoft.IdentityModel.Tokens;
@@ -24,34 +23,9 @@ internal sealed class BffFactory : WebApplicationFactory<Program>
    public FakeDomainClient Domain { get; } = new();
    public FakeProjectionClient Projection { get; } = new();
    private static void ValidateWithTestKey(IServiceCollection services, string scheme) =>
        services.Configure<JwtBearerOptions>(scheme, options =>
        {
            // Validate locally against the test key and NEVER reach out for OIDC metadata. A static
            // configuration manager guarantees this regardless of Configure/PostConfigure ordering —
            // clearing Authority alone left the medewerker scheme fetching metadata under CI timing
            // (2s hang → 401), because JwtBearer's PostConfigure could still build a ConfigurationManager.
            options.Authority = null;
            options.MetadataAddress = null!;
            options.RequireHttpsMetadata = false;
            options.Configuration = new OpenIdConnectConfiguration();
            options.ConfigurationManager =
                new StaticConfigurationManager<OpenIdConnectConfiguration>(new OpenIdConnectConfiguration());
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = false,
                ValidateAudience = false,
                ValidateLifetime = true,
                ValidateIssuerSigningKey = true,
                IssuerSigningKey = TestSigningKey,
                ClockSkew = TimeSpan.Zero,
            };
        });
    protected override void ConfigureWebHost(IWebHostBuilder builder)
    {
        builder.UseSetting("Keycloak:Authority", "https://keycloak.invalid/realms/digid");
        builder.UseSetting("Keycloak:MedewerkerAuthority", "https://keycloak.invalid/realms/medewerker");
        builder.UseSetting("Downstream:Domain:BaseUrl", "http://domain.invalid/");
        builder.UseSetting("Downstream:Projection:BaseUrl", "http://projection.invalid/");
@@ -60,11 +34,23 @@ internal sealed class BffFactory : WebApplicationFactory<Program>
            services.AddSingleton<IDomainClient>(Domain);
            services.AddSingleton<IProjectionClient>(Projection);
-            // Both realms validate locally against the test key (no live Keycloak). The medewerker
+            services.Configure<JwtBearerOptions>(JwtBearerDefaults.AuthenticationScheme, options =>
-            // scheme keeps its OnTokenValidated role-lifting from Program.cs — only the validation
+            {
-            // parameters are swapped here.
+                // Validate locally against the test key; never reach out for OIDC metadata.
-            ValidateWithTestKey(services, JwtBearerDefaults.AuthenticationScheme);
+                options.Authority = null;
-            ValidateWithTestKey(services, "medewerker");
+                options.MetadataAddress = null!;
                options.RequireHttpsMetadata = false;
                options.Configuration = new OpenIdConnectConfiguration();
                options.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuer = false,
                    ValidateAudience = false,
                    ValidateLifetime = true,
                    ValidateIssuerSigningKey = true,
                    IssuerSigningKey = TestSigningKey,
                    ClockSkew = TimeSpan.Zero,
                };
            });
        });
    }
 }
@@ -74,60 +60,12 @@ internal sealed class FakeDomainClient : IDomainClient
 {
    public string? SubmittedBsn { get; private set; }
    public SubmitAccepted Result { get; set; } = new("reg-123", "Ingediend");
    public List<WerkbakItem> Werkbak { get; } = [];
    public Task<SubmitAccepted> SubmitRegistrationAsync(string bsn, CancellationToken ct = default)
    {
        SubmittedBsn = bsn;
        return Task.FromResult(Result);
    }
    public string? CurrentQueriedBsn { get; private set; }
    /// <summary>The current open registration the fake domain returns (null → the citizen has none in
    /// flight, so the BFF replies 204). Tests set this to exercise resume.</summary>
    public CurrentRegistration? Current { get; set; }
    public Task<CurrentRegistration?> GetCurrentRegistrationAsync(string bsn, CancellationToken ct = default)
    {
        CurrentQueriedBsn = bsn;
        return Task.FromResult(Current);
    }
    public (string RegistrationId, string Bsn)? Withdrawn { get; private set; }
    /// <summary>Whether the fake domain reports the withdrawal as done (true → 204) or not-found/not-owned
    /// (false → 404). Tests set this to exercise the relay.</summary>
    public bool WithdrawSucceeds { get; set; } = true;
    public Task<bool> WithdrawRegistrationAsync(string registrationId, string bsn, CancellationToken ct = default)
    {
        Withdrawn = (registrationId, bsn);
        return Task.FromResult(WithdrawSucceeds);
    }
    public (string RegistrationId, string Bsn, string ContentBase64, string? FileName, string? ContentType)? DocumentsProvidedFor { get; private set; }
    /// <summary>Whether the fake domain reports the provide-documents as done (true → 204) or
    /// not-found/not-owned (false → 404). Tests set this to exercise the relay.</summary>
    public bool ProvideDocumentsSucceeds { get; set; } = true;
    public Task<bool> ProvideDocumentsAsync(string registrationId, string bsn, string contentBase64, string? fileName, string? contentType, CancellationToken ct = default)
    {
        DocumentsProvidedFor = (registrationId, bsn, contentBase64, fileName, contentType);
        return Task.FromResult(ProvideDocumentsSucceeds);
    }
    public (string RegistrationId, string Besluit)? Decided { get; private set; }
    public Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default)
        => Task.FromResult<IReadOnlyList<WerkbakItem>>(Werkbak);
    public Task DecideAsync(string registrationId, string besluit, CancellationToken ct = default)
    {
        Decided = (registrationId, besluit);
        return Task.CompletedTask;
    }
 }
 /// <summary>Serves a configurable set of projection rows.</summary>
@@ -1,7 +1,6 @@
 using System.Net;
 using System.Net.Http.Headers;
 using System.Net.Http.Json;
 using Bff.Api;
 namespace Bff.Tests;
@@ -72,149 +71,5 @@ public class SelfServiceEndpointTests
        Assert.Equal("reg-123", body!.RegistrationId);
    }
    private static HttpRequestMessage Withdraw(string? bearer, string id = "reg-123")
    {
        var request = new HttpRequestMessage(HttpMethod.Post, $"/self-service/registrations/{id}/withdraw");
        if (bearer is not null)
            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
        return request;
    }
    [Fact]
    public async Task Rejects_a_withdrawal_without_a_token()
    {
        using var factory = new BffFactory();
        var response = await factory.CreateClient().SendAsync(Withdraw(bearer: null));
        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
        Assert.Null(factory.Domain.Withdrawn);
    }
    [Fact]
    public async Task Withdraws_the_callers_registration_forwarding_the_id_and_bsn()
    {
        using var factory = new BffFactory();
        var response = await factory.CreateClient().SendAsync(Withdraw(TestTokens.Valid("123456782"), "reg-9"));
        Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
        Assert.Equal(("reg-9", "123456782"), factory.Domain.Withdrawn);
    }
    [Fact]
    public async Task Relays_not_found_when_the_registration_is_unknown_or_not_the_callers()
    {
        using var factory = new BffFactory();
        factory.Domain.WithdrawSucceeds = false;
        var response = await factory.CreateClient().SendAsync(Withdraw(TestTokens.Valid("123456782")));
        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
    }
    private static HttpRequestMessage ProvideDocuments(string? bearer, string id = "reg-123")
    {
        var request = new HttpRequestMessage(HttpMethod.Post, $"/self-service/registrations/{id}/documents")
        {
            // The portal base64-encodes the file client-side and posts it as JSON (S-10b); the bsn is
            // never in the body — it comes from the DigiD token.
            Content = JsonContent.Create(new
            {
                contentBase64 = Convert.ToBase64String([1, 2, 3]),
                fileName = "diploma.pdf",
                contentType = "application/pdf",
            }),
        };
        if (bearer is not null)
            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
        return request;
    }
    [Fact]
    public async Task Rejects_providing_documents_without_a_token()
    {
        using var factory = new BffFactory();
        var response = await factory.CreateClient().SendAsync(ProvideDocuments(bearer: null));
        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
        Assert.Null(factory.Domain.DocumentsProvidedFor);
    }
    [Fact]
    public async Task Provides_documents_for_the_callers_registration_forwarding_id_bsn_and_file()
    {
        using var factory = new BffFactory();
        var response = await factory.CreateClient().SendAsync(ProvideDocuments(TestTokens.Valid("123456782"), "reg-9"));
        Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
        var provided = factory.Domain.DocumentsProvidedFor;
        Assert.NotNull(provided);
        Assert.Equal("reg-9", provided!.Value.RegistrationId);
        Assert.Equal("123456782", provided.Value.Bsn);
        Assert.Equal(Convert.ToBase64String([1, 2, 3]), provided.Value.ContentBase64);
        Assert.Equal("diploma.pdf", provided.Value.FileName);
    }
    [Fact]
    public async Task Relays_not_found_providing_documents_for_an_unknown_or_not_owned_registration()
    {
        using var factory = new BffFactory();
        factory.Domain.ProvideDocumentsSucceeds = false;
        var response = await factory.CreateClient().SendAsync(ProvideDocuments(TestTokens.Valid("123456782")));
        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
    }
    private static HttpRequestMessage Current(string? bearer)
    {
        var request = new HttpRequestMessage(HttpMethod.Get, "/self-service/registrations");
        if (bearer is not null)
            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
        return request;
    }
    [Fact]
    public async Task Rejects_the_current_registration_lookup_without_a_token()
    {
        using var factory = new BffFactory();
        var response = await factory.CreateClient().SendAsync(Current(bearer: null));
        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
    }
    [Fact]
    public async Task Returns_no_content_when_the_caller_has_no_open_registration()
    {
        using var factory = new BffFactory();
        factory.Domain.Current = null;
        var response = await factory.CreateClient().SendAsync(Current(TestTokens.Valid("123456782")));
        Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
        Assert.Equal("123456782", factory.Domain.CurrentQueriedBsn);
    }
    [Fact]
    public async Task Returns_the_callers_current_registration_when_one_is_open()
    {
        using var factory = new BffFactory();
        factory.Domain.Current = new CurrentRegistration("reg-77", "Ingediend");
        var response = await factory.CreateClient().SendAsync(Current(TestTokens.Valid("123456782")));
        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
        Assert.Equal("123456782", factory.Domain.CurrentQueriedBsn);
        var body = await response.Content.ReadFromJsonAsync<CurrentRegistrationDto>();
        Assert.Equal("reg-77", body!.RegistrationId);
        Assert.Equal("Ingediend", body.Status);
    }
    private sealed record SubmitAcceptedDto(string RegistrationId, string Status);
    private sealed record CurrentRegistrationDto(string RegistrationId, string Status);
 }
@@ -17,22 +17,6 @@ internal static class TestTokens
        new SymmetricSecurityKey(Encoding.UTF8.GetBytes("a-different-signing-key-256-bits-long-indeed-yes!")),
        expired: false);
    /// <summary>A medewerker-realm token carrying the given realm roles under <c>realm_access.roles</c>
    /// (Keycloak's shape), signed with the valid test key. Used to exercise behandel authorization.</summary>
    public static string Medewerker(params string[] roles)
    {
        var handler = new JsonWebTokenHandler();
        return handler.CreateToken(new SecurityTokenDescriptor
        {
            Claims = new Dictionary<string, object>
            {
                ["realm_access"] = new Dictionary<string, object> { ["roles"] = roles },
            },
            Expires = DateTime.UtcNow.AddMinutes(30),
            SigningCredentials = new SigningCredentials(BffFactory.TestSigningKey, SecurityAlgorithms.HmacSha256),
        });
    }
    private static string Create(string bsn, SymmetricSecurityKey key, bool expired)
    {
        var handler = new JsonWebTokenHandler();
@@ -28,104 +28,6 @@
            "description": "Unauthorized"
          }
        }
      },
      "get": {
        "tags": [
          "Bff.Api"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CurrentRegistration"
                }
              }
            }
          },
          "204": {
            "description": "No Content"
          },
          "400": {
            "description": "Bad Request"
          },
          "401": {
            "description": "Unauthorized"
          }
        }
      }
    },
    "/self-service/registrations/{id}/withdraw": {
      "post": {
        "tags": [
          "Bff.Api"
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "No Content"
          },
          "400": {
            "description": "Bad Request"
          },
          "401": {
            "description": "Unauthorized"
          },
          "404": {
            "description": "Not Found"
          }
        }
      }
    },
    "/self-service/registrations/{id}/documents": {
      "post": {
        "tags": [
          "Bff.Api"
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ProvideDocumentsRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "204": {
            "description": "No Content"
          },
          "400": {
            "description": "Bad Request"
          },
          "401": {
            "description": "Unauthorized"
          },
          "404": {
            "description": "Not Found"
          }
        }
      }
    },
    "/openbaar/register": {
@@ -158,105 +60,10 @@
          }
        }
      }
    },
    "/behandel/werkbak": {
      "get": {
        "tags": [
          "Bff.Api"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "content": {
              "application/json": {
                "schema": {
                  "type": "array",
                  "items": {
                    "$ref": "#/components/schemas/WerkbakItem"
                  }
                }
              }
            }
          },
          "401": {
            "description": "Unauthorized"
          },
          "403": {
            "description": "Forbidden"
          }
        }
      }
    },
    "/behandel/registrations/{id}/decide": {
      "post": {
        "tags": [
          "Bff.Api"
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DecideRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "204": {
            "description": "No Content"
          },
          "400": {
            "description": "Bad Request"
          },
          "401": {
            "description": "Unauthorized"
          },
          "403": {
            "description": "Forbidden"
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "CurrentRegistration": {
        "required": [
          "registrationId",
          "status"
        ],
        "type": "object",
        "properties": {
          "registrationId": {
            "type": "string"
          },
          "status": {
            "type": "string"
          }
        }
      },
      "DecideRequest": {
        "required": [
          "besluit"
        ],
        "type": "object",
        "properties": {
          "besluit": {
            "type": "string"
          }
        }
      },
      "OpenbaarEntry": {
        "required": [
          "id",
@@ -279,29 +86,6 @@
          }
        }
      },
      "ProvideDocumentsRequest": {
        "required": [
          "contentBase64"
        ],
        "type": "object",
        "properties": {
          "contentBase64": {
            "type": "string"
          },
          "fileName": {
            "type": [
              "null",
              "string"
            ]
          },
          "contentType": {
            "type": [
              "null",
              "string"
            ]
          }
        }
      },
      "SubmitAccepted": {
        "required": [
          "registrationId",
@@ -316,25 +100,6 @@
            "type": "string"
          }
        }
      },
      "WerkbakItem": {
        "required": [
          "registrationId",
          "bsn",
          "status"
        ],
        "type": "object",
        "properties": {
          "registrationId": {
            "type": "string"
          },
          "bsn": {
            "type": "string"
          },
          "status": {
            "type": "string"
          }
        }
      }
    }
  },
@@ -5,14 +5,6 @@
    <ProjectReference Include="..\Big.Infrastructure\Big.Infrastructure.csproj" />
  </ItemGroup>
  <ItemGroup>
    <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.17.0" />
    <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.17.0" />
    <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.17.0" />
    <PackageReference Include="OpenTelemetry.Instrumentation.Http" Version="1.17.0" />
    <PackageReference Include="Quartz.Extensions.Hosting" Version="3.18.2" />
  </ItemGroup>
  <PropertyGroup>
    <TargetFramework>net10.0</TargetFramework>
    <Nullable>enable</Nullable>
@@ -1,25 +1,9 @@
 using Big.Application;
 using Big.Domain;
 using Big.Infrastructure;
 using OpenTelemetry.Resources;
 using OpenTelemetry.Trace;
 using Quartz;
 var builder = WebApplication.CreateBuilder(args);
 // OpenTelemetry tracing (S-16b, ADR-0023): auto-instrument incoming ASP.NET Core requests and
 // outgoing HttpClient calls, exported over OTLP to Tempo, so a request is one connected trace across
 // the services. Service name + OTLP endpoint come from OTEL_* env (compose); the exporter no-ops
 // harmlessly when Tempo is unreachable (e.g. a service run standalone). /health is filtered out so
 // liveness polls don't flood the traces.
 builder.Services.AddOpenTelemetry()
    .ConfigureResource(r => r.AddService(
        builder.Configuration["OTEL_SERVICE_NAME"] ?? builder.Environment.ApplicationName))
    .WithTracing(tracing => tracing
        .AddAspNetCoreInstrumentation(o => o.Filter = ctx => ctx.Request.Path != "/health")
        .AddHttpClientInstrumentation()
        .AddOtlpExporter());
 // Options bound from configuration (compose sets Flowable__* and Acl__* env vars).
 builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
    .GetSection("Flowable").Get<FlowableOptions>()
@@ -31,54 +15,22 @@ builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
 // The in-memory registration store is shared between the submit endpoint and the worker (ADR-0009).
 builder.Services.AddSingleton<IRegistrationStore, InMemoryRegistrationStore>();
 // The system clock, injected wherever a use case needs "now" (e.g. stamping the inscription moment
 // on approval, S-17). Injected as TimeProvider so tests can substitute a fixed clock.
 builder.Services.AddSingleton(TimeProvider.System);
 // The Workflow Client is one type behind two ports (start side + worker side); both resolve to the
 // same HttpClient-backed implementation — the only code that talks to Flowable (§8.2).
 builder.Services.AddHttpClient<FlowableWorkflowClient>();
 builder.Services.AddTransient<IWorkflowClient>(sp => sp.GetRequiredService<FlowableWorkflowClient>());
 builder.Services.AddTransient<IExternalWorkerClient>(sp => sp.GetRequiredService<FlowableWorkflowClient>());
 builder.Services.AddTransient<IUserTaskClient>(sp => sp.GetRequiredService<FlowableWorkflowClient>());
 builder.Services.AddTransient<IBeoordelingEscalatieClient>(sp => sp.GetRequiredService<FlowableWorkflowClient>());
 builder.Services.AddTransient<IRegistratieVerlopenClient>(sp => sp.GetRequiredService<FlowableWorkflowClient>());
 builder.Services.AddHttpClient<IAclClient, AclHttpClient>();
 builder.Services.AddScoped<SubmitRegistration>();
 builder.Services.AddScoped<ApproveRegistration>();
 builder.Services.AddScoped<BeoordeelRegistratie>();
 builder.Services.AddScoped<WithdrawRegistration>();
 builder.Services.AddScoped<ProvideDocuments>();
 builder.Services.AddScoped<Werkbak>();
 builder.Services.AddScoped<OpenZaakWorker>();
 builder.Services.AddScoped<OpenZaakJobProcessor>();
 builder.Services.AddScoped<BeoordelingEscalatieProcessor>();
 builder.Services.AddScoped<ExpireRegistrationWorker>();
 builder.Services.AddScoped<RegistratieVerlopenProcessor>();
 builder.Services.AddScoped<HerregistratieReminderSweep>();
 // The hosted external-task job worker polls Flowable and drives OpenZaakAanmaken to completion.
 builder.Services.AddHostedService<OpenZaakJobPump>();
 // The escalation worker polls the BeoordelingEscaleren jobs the 14-day timer parks and reassigns
 // each overdue beoordeling to the teamlead (S-14).
 builder.Services.AddHostedService<BeoordelingEscalatiePump>();
 // The document-timeout worker polls the RegistratieVerlopen jobs the 30-day timer on WachtOpDocumenten
 // parks and expires each lapsed registration to VERLOPEN (S-10a, ADR-0017).
 builder.Services.AddHostedService<RegistratieVerlopenPump>();
 // The herregistratie reminder sweep runs on a daily cron via Quartz.NET (S-17, ADR-0022) — a
 // time-triggered fleet sweep, deliberately a different mechanism from the queue-draining pumps above.
 // The cron is overridable with Quartz__Cron; it defaults to 03:00 daily.
 builder.Services.AddQuartz(q =>
 {
    var jobKey = new JobKey("herregistratie-reminder");
    q.AddJob<HerregistratieReminderJob>(jobKey);
    q.AddTrigger(t => t
        .ForJob(jobKey)
        .WithCronSchedule(builder.Configuration["Quartz:Cron"] ?? "0 0 3 * * ?"));
 });
 builder.Services.AddQuartzHostedService(o => o.WaitForJobsToComplete = true);
 var app = builder.Build();
@@ -89,12 +41,7 @@ app.MapGet("/health", () => "Healthy");
 // a location to read the registration's progress (ADR-0009, eventual consistency).
 app.MapPost("/registrations", async (SubmitRegistrationRequest body, SubmitRegistration submit, CancellationToken ct) =>
 {
-    // Diploma origin defaults to domestic; a foreign (eIDAS) submission passes "Buitenlands" so the
+    var id = await submit.HandleAsync(new SubmitRegistrationCommand(body.Bsn), ct);
    // workflow's DMN routes it through CBGV-advies (S-13). An unknown value is a bad request.
    if (!Enum.TryParse<DiplomaOrigin>(body.DiplomaOrigin, ignoreCase: true, out var origin) && body.DiplomaOrigin is not null)
        return Results.BadRequest(new { error = $"Unknown diplomaOrigin '{body.DiplomaOrigin}'. Expected 'Binnenlands' or 'Buitenlands'." });
    var id = await submit.HandleAsync(new SubmitRegistrationCommand(body.Bsn, origin), ct);
    return Results.Accepted($"/registrations/{id}", new RegistrationResponse(id.ToString(), RegistrationStatus.Ingediend.ToString(), null));
 });
@@ -126,70 +73,7 @@ app.MapPost("/registrations/{id}/decide", async (string id, DecideRequest body,
    return Results.NoContent();
 });
 // Withdraw a registration (S-11): the zorgprofessional pulls their own still-open submission back,
 // advancing it to INGETROKKEN and cancelling its workflow. Owner-scoped by the caller's bsn (the BFF
 // forwards it from the DigiD token, S-11c); a registration that is unknown or not the caller's is
 // 404 (indistinguishable, so ownership isn't leaked). Idempotent.
 app.MapPost("/registrations/{id}/withdraw", async (string id, WithdrawRequest body, WithdrawRegistration withdraw, CancellationToken ct) =>
 {
    if (!Guid.TryParse(id, out var guid))
        return Results.NotFound();
    if (string.IsNullOrWhiteSpace(body?.Bsn))
        return Results.BadRequest(new { error = "A bsn is required to withdraw a registration." });
    var outcome = await withdraw.HandleAsync(new WithdrawRegistrationCommand(new RegistrationId(guid), body.Bsn), ct);
    return outcome == WithdrawOutcome.Withdrawn ? Results.NoContent() : Results.NotFound();
 });
 // Provide documents (S-10a): the zorgprofessional supplies the documents their registration is parked
 // waiting for, completing the WachtOpDocumenten task so the process advances to beoordeling (ADR-0017).
 // Owner-scoped by the caller's bsn (the BFF forwards it from the DigiD token); unknown or not-the-
 // caller's is 404 (indistinguishable). Idempotent — completing an already-left wait is a no-op. The
 // real file upload + ZGW storage is S-10b; this endpoint is the trigger that unblocks the process.
 app.MapPost("/registrations/{id}/documents", async (string id, ProvideDocumentsRequest body, ProvideDocuments provide, CancellationToken ct) =>
 {
    if (!Guid.TryParse(id, out var guid))
        return Results.NotFound();
    if (string.IsNullOrWhiteSpace(body?.Bsn))
        return Results.BadRequest(new { error = "A bsn is required to provide documents." });
    if (string.IsNullOrWhiteSpace(body.ContentBase64))
        return Results.BadRequest(new { error = "A document is required." });
    byte[] content;
    try { content = Convert.FromBase64String(body.ContentBase64); }
    catch (FormatException) { return Results.BadRequest(new { error = "The document content is not valid base64." }); }
    var command = new ProvideDocumentsCommand(
        new RegistrationId(guid), body.Bsn, content,
        body.FileName ?? "diploma.pdf", body.ContentType ?? "application/pdf");
    var outcome = await provide.HandleAsync(command, ct);
    return outcome == ProvideDocumentsOutcome.Accepted ? Results.NoContent() : Results.NotFound();
 });
 // The behandelaar's werkbak (S-12): the registrations awaiting beoordeling, read from the open
 // Beoordelen user tasks (§8.2) and enriched with bsn + status. The BFF proxies this behind
 // medewerker-realm + behandelaar-role authorization; the domain trusts its callers (§8.3).
 app.MapGet("/behandel/werkbak", async (Werkbak werkbak, CancellationToken ct) =>
    Results.Ok(await werkbak.GetAsync(ct)));
 // Read a registration. Its zaak URL appears once the worker has opened the zaak (eventually).
 // The citizen's current open registration, looked up by bsn — lets the self-service portal resume
 // after a refresh (S-26). The BFF forwards the bsn from the DigiD token; the domain trusts its
 // callers (§8.3). 404 when the citizen has none in flight.
 app.MapGet("/registrations/current", async (string bsn, IRegistrationStore store, CancellationToken ct) =>
 {
    if (string.IsNullOrWhiteSpace(bsn))
        return Results.BadRequest("A bsn is required.");
    var registration = await store.FindOpenByBsnAsync(bsn, ct);
    return registration is null
        ? Results.NotFound()
        : Results.Ok(new RegistrationResponse(
            registration.Id.ToString(), registration.Status.ToString(), registration.ZaakUrl?.ToString()));
 });
 app.MapGet("/registrations/{id}", async (string id, IRegistrationStore store, CancellationToken ct) =>
 {
    if (!Guid.TryParse(id, out var guid))
@@ -199,25 +83,15 @@ app.MapGet("/registrations/{id}", async (string id, IRegistrationStore store, Ca
    return registration is null
        ? Results.NotFound()
        : Results.Ok(new RegistrationResponse(
-            registration.Id.ToString(), registration.Status.ToString(), registration.ZaakUrl?.ToString(),
+            registration.Id.ToString(), registration.Status.ToString(), registration.ZaakUrl?.ToString()));
            registration.HerregistratieVoor?.ToString("O"), registration.HerregistratieReminderVerstuurd));
 });
 await app.RunAsync();
-public sealed record SubmitRegistrationRequest(string Bsn, string? DiplomaOrigin = null);
+public sealed record SubmitRegistrationRequest(string Bsn);
 public sealed record DecideRequest(string Besluit);
-public sealed record WithdrawRequest(string Bsn);
+public sealed record RegistrationResponse(string RegistrationId, string Status, string? ZaakUrl);
 public sealed record ProvideDocumentsRequest(string Bsn, string ContentBase64, string? FileName = null, string? ContentType = null);
 public sealed record RegistrationResponse(
    string RegistrationId,
    string Status,
    string? ZaakUrl,
    string? HerregistratieVoor = null,
    bool HerregistratieReminderVerstuurd = false);
 public partial class Program;
@@ -12,7 +12,7 @@ public sealed record ApproveRegistrationCommand(RegistrationId RegistrationId);
 /// zaak status is the projection's source of truth (it flows back over NRC); the aggregate transition
 /// keeps the domain's own view consistent.
 /// </summary>
-public sealed class ApproveRegistration(IRegistrationStore store, IAclClient acl, TimeProvider clock)
+public sealed class ApproveRegistration(IRegistrationStore store, IAclClient acl)
 {
    public async Task HandleAsync(ApproveRegistrationCommand command, CancellationToken ct = default)
    {
@@ -30,7 +30,7 @@ public sealed class ApproveRegistration(IRegistrationStore store, IAclClient acl
                $"Registration {command.RegistrationId} has no zaak yet; it cannot be approved.");
        await acl.ApproveZaakAsync(registration.ZaakUrl, ct);
-        registration.Approve(clock.GetUtcNow());
+        registration.Approve();
        await store.SaveAsync(registration, ct);
    }
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
notandClaude Opus 4.8	94a506cbfc	fix(workflow): read task query variables from 'variables', not 'processVariables' (refs #13 ) CI / lint (pull_request) Successful in 1m28s Details CI / unit (pull_request) Successful in 1m34s Details CI / frontend (pull_request) Successful in 2m24s Details CI / mutation (pull_request) Successful in 6m3s Details CI / verify-stack (pull_request) Successful in 7m43s Details CI / build (pull_request) Successful in 1m8s Details Flowable's POST query/tasks returns the included process variables under the key 'variables' (the request opts in via includeProcessVariables). The client DTO, its unit test, and the live-check parser all looked for 'processVariables', so the werkbak never matched a task's registrationId and verify-domain timed out. Verified by driving a real Flowable instance end-to-end locally: start -> complete external job -> the Beoordelen task carries registrationId under 'variables'. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-15 10:29:43 +02:00
notandClaude Opus 4.8	c53354cd22	fix(workflow): query Flowable tasks at service/query/tasks, not runtime/tasks/query (refs #13 ) CI / build (pull_request) Successful in 1m14s Details CI / unit (pull_request) Successful in 1m17s Details CI / frontend (pull_request) Successful in 2m41s Details CI / mutation (pull_request) Successful in 5m9s Details CI / verify-stack (pull_request) Failing after 7m53s Details CI / lint (pull_request) Successful in 1m17s Details The task-query endpoint is service/query/tasks; the wrong path 404'd, so verify-domain's werkbak poll got an empty body and the JSON parser aborted the check. Correct the path in the Workflow Client (and its unit test) and make the live-check parser tolerant of a transient empty/non-JSON body so the poll retries instead of crashing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-15 09:57:11 +02:00
notandClaude Opus 4.8	57b8755f9d	test(workflow): cover the besluit variable type + start empty-body throw (refs #13 ) CI / lint (pull_request) Successful in 1m14s Details CI / build (pull_request) Successful in 58s Details CI / unit (pull_request) Successful in 1m5s Details CI / frontend (pull_request) Successful in 2m12s Details CI / mutation (pull_request) Successful in 4m59s Details CI / verify-stack (pull_request) Failing after 6m39s Details Kills two mutation survivors: assert the complete besluit variable's type, and add the missing start empty-response case (the pre-existing baseline survivor). Domain mutation score reaches 100%. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-15 09:24:53 +02:00
notandClaude Opus 4.8	3d561deb05	test(workflow): verify-domain exercises the Beoordelen user task end-to-end (refs #13 ) After the worker opens the zaak, the process parks at Beoordelen. The live check now polls Flowable for the task (werkbak), claims it as merel-behandelaar, completes it with besluit=goedkeuren, and asserts the process finishes — proving the exact REST contract (query/claim/complete) the Workflow Client depends on against a real engine. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-15 09:21:35 +02:00
notandClaude Opus 4.8	5db55eebf4	feat(workflow): add the Beoordelen behandelaar user task to registratie.bpmn (refs #13 ) After OpenZaakAanmaken the process now parks at a Beoordelen user task (candidate group behandelaar) until the behandelaar claims and completes it. registrationId rides along as a process variable so the werkbak correlates each task to its aggregate. The walking skeleton is unaffected: the temporary /approve path sets the zaak status directly; wiring the decision to complete this task lands in S-12c/d. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-15 09:19:19 +02:00
notandClaude Opus 4.8	efd1c06b99	feat(workflow): user-task client for beoordeling — werkbak, claim, complete (refs #13 ) Adds the IUserTaskClient port and implements it on the Workflow Client (the only code that talks to Flowable, §8.2): query open Beoordelen tasks (werkbak) with their registrationId, claim a task for a behandelaar, and complete it carrying the besluit into the process. Registered in DI for later wiring (S-12c). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-15 09:18:03 +02:00
notandClaude Opus 4.8	57cc3637c9	test(workflow): user-task client — werkbak query, claim, complete beoordeling (refs #13 ) Red — GetOpenBeoordelingenAsync/ClaimAsync/CompleteBeoordelingAsync do not exist yet. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-15 09:16:46 +02:00
		`@@ -1,2 +0,0 @@`
			`/* NL Design System theme — Utrecht design tokens (docs/frontend-decisions.md). */`
			`@import '@utrecht/design-tokens/dist/index.css';`
		`@@ -1,2 +0,0 @@`
			`FROM prom/prometheus:v2.55.1`
			`COPY prometheus.yml /etc/prometheus/prometheus.yml`