ci: unstick verify-stack on Gitea 1.27 + runner 2.0.0 — drop status-function if on a needs job (refs #134 )

2026-07-24 13:31:14 +02:00
64 changed files with 35 additions and 3053 deletions
@@ -70,12 +70,6 @@ jobs:
          restore-keys: |
            nuget-${{ runner.os }}-
      - run: make unit
      # Job summary (#136): a per-service pass/fail table from the TRX `make unit` wrote.
      - name: Unit test summary
        if: always()
        run: |
          [ -n "${GITHUB_STEP_SUMMARY:-}" ] || exit 0
          python3 infra/trx-summary.py TestResults >> "$GITHUB_STEP_SUMMARY"
  # Frontend (Nx/Angular) lane: install with pnpm, then Nx lint + test + build.
  frontend:
@@ -90,12 +84,6 @@ jobs:
          node-version: '24'
          cache: 'pnpm'
      - run: make frontend
      # Job summary (#136): a per-frontend (app) pass/fail table from the vitest JSON each app wrote.
      - name: Frontend test summary
        if: always()
        run: |
          [ -n "${GITHUB_STEP_SUMMARY:-}" ] || exit 0
          python3 infra/vitest-summary.py test-output >> "$GITHUB_STEP_SUMMARY"
  mutation:
    runs-on: ubuntu-latest
@@ -111,29 +99,6 @@ jobs:
          restore-keys: |
            nuget-${{ runner.os }}-
      - run: make mutation
      # Job summary (#136): render each service's Stryker Markdown report on the run page (Gitea
      # 1.27 $GITHUB_STEP_SUMMARY). `if: always()` so a ratchet break still reports — and because
      # `make mutation` stops at the first break, the summary also shows exactly where it stopped.
      # Guarded so it no-ops on a runner/server without summary support. Strips the report's UTF-8 BOM.
      - name: Mutation score summary
        if: always()
        run: |
          [ -n "${GITHUB_STEP_SUMMARY:-}" ] || exit 0
          {
            echo "## 🧬 Mutation testing"
            echo
            for svc in acl event-subscriber domain bff; do
              echo "### $svc"
              echo
              report=$(ls services/"$svc"/StrykerOutput/*/reports/mutation-report.md 2>/dev/null | sort | tail -1)
              if [ -n "$report" ]; then
                sed '1s/^\xef\xbb\xbf//' "$report"
              else
                echo "_No report — \`make mutation\` stopped before \`$svc\` (earlier ratchet break)._"
              fi
              echo
            done
          } >> "$GITHUB_STEP_SUMMARY"
      # Publish the Stryker HTML reports. `if: always()` uploads them even when the
      # ratchet fails — that is exactly when you want to inspect the survivors.
      # `continue-on-error` keeps the upload best-effort: the mutation *gate* is the
@@ -193,99 +158,30 @@ jobs:
      - uses: https://github.com/actions/checkout@v4
      # Bring the full stack up + wait for health — this also is the DoD "compose up
      # reaches green health" smoke (it replaces the old compose-smoke job).
      # Each check carries an `id` so the summary step below can report its per-check outcome (#136).
      # A failed check skips the rest (no step `if:`), so the table shows exactly where it stopped.
      - name: Bring up the full stack & wait for health
        id: up
        run: make verify-up
      - name: Observability backplane (Grafana + Tempo + Prometheus datasources)
        id: obs
        run: OBS_TIMEOUT=180 make verify-observability
      - name: Objecttypen API up + token authenticates
        id: objecttypen
        run: OBJECTTYPEN_TIMEOUT=120 make verify-objecttypen
      - name: Objecten API up + token authenticates + trusts Objecttypen
        id: objecten
        run: OBJECTEN_TIMEOUT=120 make verify-objecten
      - name: RegisterRecord objecttype registered + published
        id: registerrecord
        run: REGISTERRECORD_TIMEOUT=120 make verify-registerrecord
      - name: ACL ↔ OpenZaak integration tests
        id: acl
        run: make verify-acl
      - name: OpenZaak → NRC notification delivery
        id: nrc
        run: make verify-nrc
      - name: OpenZaak → NRC → Event Subscriber → projection-api
        id: projection
        run: make verify-projection
      - name: Domain → Flowable → ACL → OpenZaak
        id: domain
        run: make verify-domain
      - name: BFF → Keycloak + domain + projection
        id: bff
        run: make verify-bff
      - name: Distributed traces reach Tempo (one connected trace across services)
        id: tracing
        run: TRACING_TIMEOUT=120 make verify-tracing
      - name: Golden-signal metrics scraped by Prometheus (/metrics on every service)
        id: metrics
        run: METRICS_TIMEOUT=120 make verify-metrics
      - name: Self-service e2e (Playwright, login → submit → success)
        id: e2e
        run: make verify-e2e
      # Job summary (#136): a pass/fail table of every live-stack check, so a red verify-stack shows
      # which check failed at a glance. `if: always()` (step-level — safe on runner 2.0.0, unlike the
      # job-level status-function `if` of #134) so it renders even after a check fails.
      - name: verify-stack check summary
        if: always()
        env:
          UP: ${{ steps.up.outcome }}
          OBS: ${{ steps.obs.outcome }}
          OBJECTTYPEN: ${{ steps.objecttypen.outcome }}
          OBJECTEN: ${{ steps.objecten.outcome }}
          REGISTERRECORD: ${{ steps.registerrecord.outcome }}
          ACL: ${{ steps.acl.outcome }}
          NRC: ${{ steps.nrc.outcome }}
          PROJECTION: ${{ steps.projection.outcome }}
          DOMAIN: ${{ steps.domain.outcome }}
          BFF: ${{ steps.bff.outcome }}
          TRACING: ${{ steps.tracing.outcome }}
          METRICS: ${{ steps.metrics.outcome }}
          E2E: ${{ steps.e2e.outcome }}
        run: |
          [ -n "${GITHUB_STEP_SUMMARY:-}" ] || exit 0
          icon() { case "$1" in success) echo "✅";; failure) echo "❌";; skipped) echo "⏭️";; cancelled) echo "🚫";; *) echo "❔ ${1:-—}";; esac; }
          {
            echo "## 🔌 verify-stack checks"
            echo
            echo "| Check | Result |"
            echo "| ----- | :----: |"
            echo "| Bring up + health | $(icon "$UP") |"
            echo "| Observability backplane | $(icon "$OBS") |"
            echo "| Objecttypen API + token | $(icon "$OBJECTTYPEN") |"
            echo "| Objecten API + token | $(icon "$OBJECTEN") |"
            echo "| RegisterRecord objecttype | $(icon "$REGISTERRECORD") |"
            echo "| ACL ↔ OpenZaak | $(icon "$ACL") |"
            echo "| OpenZaak → NRC | $(icon "$NRC") |"
            echo "| NRC → Event Subscriber → projection | $(icon "$PROJECTION") |"
            echo "| Domain → Flowable → ACL → OpenZaak | $(icon "$DOMAIN") |"
            echo "| BFF → Keycloak + domain + projection | $(icon "$BFF") |"
            echo "| Distributed traces (Tempo) | $(icon "$TRACING") |"
            echo "| Golden-signal metrics (Prometheus) | $(icon "$METRICS") |"
            echo "| Self-service e2e (Playwright) | $(icon "$E2E") |"
          } >> "$GITHUB_STEP_SUMMARY"
      # Job summary (#136): per-spec Playwright results, from the JSON report run-e2e-check.sh copied
      # out of the e2e container. Turns a red e2e into a one-glance "which spec" instead of a log dive.
      - name: e2e spec summary
        if: always()
        run: |
          [ -n "${GITHUB_STEP_SUMMARY:-}" ] || exit 0
          python3 infra/playwright-summary.py tests/e2e/playwright-report.json >> "$GITHUB_STEP_SUMMARY"
      # Log dump must precede teardown (which removes the containers).
      - name: Dump container logs on failure
        if: failure()
-        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-db flowable-rest flowable-init keycloak acl bff domain projection-db event-subscriber projection-api self-service openbaar behandel beheer objecttypen-db objecttypen-redis objecttypen-init objecttypen objecten-db objecten-redis objecten-init objecten registerrecord-init tempo prometheus grafana 2>&1 || true
+        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-db flowable-rest flowable-init keycloak acl bff domain projection-db event-subscriber projection-api self-service openbaar behandel beheer tempo prometheus grafana 2>&1 || true
      - name: Tear down
        if: always()
        run: make down
@@ -58,6 +58,3 @@ tests/e2e/node_modules/
 tests/e2e/test-results/
 tests/e2e/playwright-report/
 __pycache__/
 TestResults/
 test-output/
 tests/e2e/playwright-report.json
@@ -277,27 +277,16 @@ Split into independently deployable sub-slices (CLAUDE.md §13):
 ## Iteration 4 — Objecten and the authoritative register *(milestone: `Iteration 4 — Objecten`)*
-### S-18 · Objecten + Objecttypen up in compose; Register objecttype defined *(split — #19 closed)*
+### S-18 · Objecten + Objecttypen up in compose; Register objecttype defined
 **Outcome:** Objecten and Objecttypen running. A `RegisterRecord` objecttype defined with the public-safe schema.
-Split into independently deployable sub-slices (CLAUDE.md §13):
+### S-19 · ACL extension: write register-record to Objecten on approval
 - **S-18a** (#139, ✅) · Objecttypen API up in compose (own DB + seeded config + health + static token).
 - **S-18b** (#140, ✅) · Objecten API up in compose, wired to Objecttypen. Depends on S-18a.
 - **S-18c** (#141, ✅) · RegisterRecord objecttype defined + registered (public-safe JSON schema). Depends on S-18a/b.
 ### S-19 · ACL extension: write register-record to Objecten on approval *(split — #20 closed)*
 **Outcome:** Approval path writes the canonical register record to Objecten, not OpenZaak eigenschappen. Projection now sourced from Objecten events.
 **ADR required:** "Why Objecten holds the register, OpenZaak holds the process."
 Split into independently deployable sub-slices (CLAUDE.md §13):
 - **S-19a** (#149, ✅) · ACL writes the `RegisterRecord` to Objecten on approval, idempotently, alongside the ZGW eindstatus. Carries the ADR (ADR-0028).
 - **S-19b** (#150) · Read projection sourced from Objecten instead of NRC zaak events. Depends on S-19a.
 ---
 ## Iteration 5 — Data governance module *(milestone: `Iteration 5 — Data Governance`)*
@@ -10,7 +10,7 @@ COMPOSE    := infra/docker-compose.yml
 # Long-running services with a healthcheck — the smoke polls these for readiness
 # (infra/wait-healthy.sh). One-shot init jobs (oz-init, nrc-init, flowable-init)
 # are not polled; they only need to have run. See docs/runbooks/gitea-actions-gotchas.md.
-WAIT_SVCS  := openzaak nrc-web acl bff domain event-subscriber projection-api self-service openbaar behandel beheer objecttypen objecten
+WAIT_SVCS  := openzaak nrc-web acl bff domain event-subscriber projection-api self-service openbaar behandel beheer
 # Config files (OpenZaak data.yaml, Keycloak realms, Flowable BPMN) are streamed
 # into external named volumes via `docker cp` (infra/seed-config.sh) instead of
 # bind-mounted, because bind mounts don't reach sibling containers on the
@@ -18,7 +18,7 @@ WAIT_SVCS  := openzaak nrc-web acl bff domain event-subscriber projection-api se
 # volumes are `external`, so compose won't remove them — CFG_VOLS lists them for
 # explicit teardown. See docs/runbooks/gitea-actions-gotchas.md.
 SEED       := bash infra/seed-config.sh
-CFG_VOLS   := rr-oz-config rr-nrc-config rr-kc-realms rr-fl-bpmn rr-objecttypen-config rr-objecten-config rr-registerrecord-config
+CFG_VOLS   := rr-oz-config rr-nrc-config rr-kc-realms rr-fl-bpmn
 # Local-only stack: same services but config is bind-mounted (no seed step), so a
 # plain `docker compose -f infra/docker-compose.local.yml up` works on any local
 # engine. This is the no-make / Windows-friendly path. See that file's header.
@@ -43,7 +43,7 @@ export DOCKER_HOST := unix://$(PODMAN_SOCK)
 endif
 endif
-.PHONY: ci lint build unit mutation frontend integration verify verify-up verify-acl verify-nrc verify-projection verify-bff verify-domain verify-observability verify-tracing verify-metrics verify-objecttypen verify-objecten verify-registerrecord verify-notifications smoke up down local verify-local local-down changelog openzaak-up openzaak-smoke openzaak-seed openzaak-down stack-up stack-smoke stack-down keycloak-up keycloak-smoke keycloak-down flowable-up flowable-smoke flowable-down help
+.PHONY: ci lint build unit mutation frontend integration verify verify-up verify-acl verify-nrc verify-projection verify-bff verify-domain verify-observability verify-tracing verify-metrics verify-notifications smoke up down local verify-local local-down changelog openzaak-up openzaak-smoke openzaak-seed openzaak-down stack-up stack-smoke stack-down keycloak-up keycloak-smoke keycloak-down flowable-up flowable-smoke flowable-down help
 ## ci: run the full pipeline — lint, build, unit, mutation, frontend, verify (mirrors Gitea Actions)
 ## `verify` is the live-stack stage (full stack up once → ACL + notification checks).
@@ -70,9 +70,8 @@ build:
 	dotnet build $(SLN) -c Release
 ## unit: run unit tests (excludes the container-backed Integration lane)
 # TRX per test project (→ TestResults/) feeds the CI per-service summary (#136); harmless locally.
 unit:
-	dotnet test $(SLN) -c Release --filter "Category!=Integration" --logger trx --results-directory TestResults
+	dotnet test $(SLN) -c Release --filter "Category!=Integration"
 ## mutation: run the Stryker.NET ratchet on each service with branching logic (fails below baseline)
 # Stryker is pinned as a local dotnet tool (.config/dotnet-tools.json); `tool restore`
@@ -94,14 +93,14 @@ mutation:
 # podman-compose, and needing no `--wait` flag or host port access. The one-shots
 # (oz-init, flowable-init) aren't polled; they just need to have run.
 smoke:
-	$(SEED) oz nrc kc fl objecttypen objecten registerrecord
+	$(SEED) oz nrc kc fl
 	docker compose -f $(COMPOSE) up -d --build
 	bash -c 'WAIT_TIMEOUT=420 bash infra/wait-healthy.sh $(WAIT_SVCS); rc=$$?; docker compose -f $(COMPOSE) down --volumes; docker volume rm -f $(CFG_VOLS) >/dev/null 2>&1; exit $$rc'
 ## up: seed config volumes and start the full stack (use instead of bare
 ## `docker compose up`, which can't self-seed the external config volumes)
 up:
-	$(SEED) oz nrc kc fl objecttypen objecten registerrecord
+	$(SEED) oz nrc kc fl
 	docker compose -f $(COMPOSE) up -d --build
 ## down: stop and remove the local stack (incl. the external config volumes)
@@ -139,7 +138,7 @@ changelog:
 ## verify-up: bring the FULL stack up and wait for health (CI verify-stack step 1;
 ## subsumes the old compose-smoke health gate — the DoD "up reaches green" check).
 verify-up:
-	$(SEED) oz nrc kc fl objecttypen objecten registerrecord
+	$(SEED) oz nrc kc fl
 	docker compose -f $(COMPOSE) up -d --build
 	WAIT_TIMEOUT=420 bash infra/wait-healthy.sh $(WAIT_SVCS)
@@ -186,26 +185,11 @@ verify-tracing:
 verify-metrics:
 	bash infra/run-metrics-check.sh
 ## verify-objecttypen: assert the Objecttypen API is up + its static token authenticates
 ## (S-18a), against the already-running stack.
 verify-objecttypen:
 	bash infra/run-objecttypen-check.sh
 ## verify-objecten: assert the Objecten API is up + its static token authenticates and it
 ## trusts the Objecttypen API (S-18b), against the already-running stack.
 verify-objecten:
 	bash infra/run-objecten-check.sh
 ## verify-registerrecord: assert the RegisterRecord objecttype is registered + published in the
 ## Objecttypen API (S-18c), against the already-running stack.
 verify-registerrecord:
 	bash infra/run-registerrecord-check.sh
 ## verify: local mirror of the CI verify-stack job — full stack up once, all checks,
 ## tear down (always). For fast single-concern local iteration use `integration`
 ## (oz-only) or `verify-notifications` (oz+nrc) instead.
 verify:
-	$(SEED) oz nrc kc fl objecttypen objecten registerrecord
+	$(SEED) oz nrc kc fl
 	docker compose -f $(COMPOSE) up -d --build
 	@bash -c 'set -e; rc=0; \
 	  WAIT_TIMEOUT=420 bash infra/wait-healthy.sh $(WAIT_SVCS) \
@@ -64,9 +64,7 @@
    "test": {
      "executor": "@angular/build:unit-test",
      "options": {
-        "watch": false,
+        "watch": false
        "reporters": ["default", "json"],
        "outputFile": "{workspaceRoot}/test-output/{projectName}.json"
      }
    },
    "serve-static": {
@@ -64,9 +64,7 @@
    "test": {
      "executor": "@angular/build:unit-test",
      "options": {
-        "watch": false,
+        "watch": false
        "reporters": ["default", "json"],
        "outputFile": "{workspaceRoot}/test-output/{projectName}.json"
      }
    },
    "serve-static": {
@@ -1,5 +1 @@
 <nav aria-label="Beheer" class="utrecht-theme">
  <a routerLink="/" routerLinkActive="active" [routerLinkActiveOptions]="{ exact: true }">Catalogus</a>
  <a routerLink="/default-fill" routerLinkActive="active">Default-fill</a>
 </nav>
 <router-outlet></router-outlet>
@@ -1,9 +1,7 @@
 import { Route } from '@angular/router';
 import { authenticatedGuard } from 'auth';
 import { CatalogusPage } from './catalogus/catalogus-page';
 import { DefaultFillPage } from './default-fill/default-fill-page';
 export const appRoutes: Route[] = [
  { path: '', component: CatalogusPage, canActivate: [authenticatedGuard] },
  { path: 'default-fill', component: DefaultFillPage, canActivate: [authenticatedGuard] },
 ];
@@ -1,60 +0,0 @@
 <main utrecht-document class="utrecht-theme">
  <utrecht-article>
    <utrecht-heading-1>Default-fill</utrecht-heading-1>
    <p utrecht-paragraph>
      De ZGW-standaardwaarden die de ACL op elke nieuwe zaak invult (ADR-0003). Een wijziging geldt
      voor de eerstvolgende zaak.
    </p>
    @if (loading()) {
      <p utrecht-paragraph role="status">Bezig met laden…</p>
    } @else if (loaded()) {
      <form (submit)="save(); $event.preventDefault()">
        <p>
          <label for="bronorganisatie">Bronorganisatie</label><br />
          <input
            id="bronorganisatie"
            name="bronorganisatie"
            [value]="bronorganisatie()"
            (input)="bronorganisatie.set($any($event.target).value)"
          />
        </p>
        <p>
          <label for="verantwoordelijkeOrganisatie">Verantwoordelijke organisatie</label><br />
          <input
            id="verantwoordelijkeOrganisatie"
            name="verantwoordelijkeOrganisatie"
            [value]="verantwoordelijkeOrganisatie()"
            (input)="verantwoordelijkeOrganisatie.set($any($event.target).value)"
          />
        </p>
        <p>
          <label for="vertrouwelijkheidaanduiding">Vertrouwelijkheidaanduiding</label><br />
          <input
            id="vertrouwelijkheidaanduiding"
            name="vertrouwelijkheidaanduiding"
            [value]="vertrouwelijkheidaanduiding()"
            (input)="vertrouwelijkheidaanduiding.set($any($event.target).value)"
          />
        </p>
        <button utrecht-button appearance="primary-action-button" type="submit" [disabled]="saving()">
          Opslaan
        </button>
      </form>
      @if (saved()) {
        <p utrecht-paragraph role="status">De standaardwaarden zijn opgeslagen.</p>
      }
      @if (failed()) {
        <p utrecht-paragraph role="alert">
          Opslaan is niet gelukt. Controleer of je als beheerder bent ingelogd en probeer het opnieuw.
        </p>
      }
    } @else if (failed()) {
      <p utrecht-paragraph role="alert">
        Kon de standaardwaarden niet laden. Controleer of je als beheerder bent ingelogd en probeer
        het opnieuw.
      </p>
    }
  </utrecht-article>
 </main>
@@ -1,90 +0,0 @@
 import { signal } from '@angular/core';
 import { fireEvent, render, screen } from '@testing-library/angular';
 import { of, throwError } from 'rxjs';
 import { BeheerDefaultFill, BffApiV1Service } from 'api-client';
 import { AuthService } from 'auth';
 import { axe } from 'vitest-axe';
 import { DefaultFillPage } from './default-fill-page';
 const current: BeheerDefaultFill = {
  bronorganisatie: '517439943',
  verantwoordelijkeOrganisatie: '517439943',
  vertrouwelijkheidaanduiding: 'openbaar',
 };
 class FakeAuth extends AuthService {
  readonly isAuthenticated = signal(true);
  readonly bsn = signal<string | undefined>(undefined);
  override readonly roles = signal<readonly string[]>(['beheerder']);
  login(): void {
    /* not exercised */
  }
  logout(): void {
    /* not exercised */
  }
 }
 function setup(
  overrides: {
    getBeheerDefaultFill?: ReturnType<typeof vi.fn>;
    putBeheerDefaultFill?: ReturnType<typeof vi.fn>;
  } = {},
 ) {
  const getBeheerDefaultFill = overrides.getBeheerDefaultFill ?? vi.fn().mockReturnValue(of(current));
  const putBeheerDefaultFill = overrides.putBeheerDefaultFill ?? vi.fn().mockReturnValue(of(undefined));
  return {
    getBeheerDefaultFill,
    putBeheerDefaultFill,
    providers: [
      { provide: BffApiV1Service, useValue: { getBeheerDefaultFill, putBeheerDefaultFill } },
      { provide: AuthService, useClass: FakeAuth },
    ],
  };
 }
 describe('DefaultFillPage', () => {
  it('loads the current default-fill into the form on open', async () => {
    const { getBeheerDefaultFill, providers } = setup();
    await render(DefaultFillPage, { providers });
    expect(getBeheerDefaultFill).toHaveBeenCalled();
    const bron = (await screen.findByLabelText('Bronorganisatie')) as HTMLInputElement;
    expect(bron.value).toBe('517439943');
  });
  it('saves the edited values via the BFF', async () => {
    const { putBeheerDefaultFill, providers } = setup();
    await render(DefaultFillPage, { providers });
    const bron = (await screen.findByLabelText('Bronorganisatie')) as HTMLInputElement;
    fireEvent.input(bron, { target: { value: '999999999' } });
    fireEvent.click(screen.getByRole('button', { name: /opslaan/i }));
    expect(putBeheerDefaultFill).toHaveBeenCalledWith(
      expect.objectContaining({ bronorganisatie: '999999999', vertrouwelijkheidaanduiding: 'openbaar' }),
    );
    expect(await screen.findByText(/standaardwaarden zijn opgeslagen/i)).toBeTruthy();
  });
  it('surfaces a save failure instead of swallowing it', async () => {
    const { providers } = setup({
      putBeheerDefaultFill: vi.fn().mockReturnValue(throwError(() => new Error('403'))),
    });
    await render(DefaultFillPage, { providers });
    fireEvent.click(await screen.findByRole('button', { name: /opslaan/i }));
    expect(await screen.findByText(/opslaan is niet gelukt/i)).toBeTruthy();
  });
  it('has no WCAG 2.1 AA violations', async () => {
    document.documentElement.lang = 'nl';
    const { container } = await render(DefaultFillPage, { providers: setup().providers });
    const results = await axe(container, {
      runOnly: { type: 'tag', values: ['wcag2a', 'wcag2aa', 'wcag21a', 'wcag21aa'] },
    });
    expect(results.violations).toEqual([]);
  });
 });
@@ -1,72 +0,0 @@
 import { Component, inject, signal } from '@angular/core';
 import { BeheerDefaultFill, BffApiV1Service } from 'api-client';
 import { UtrechtComponentsModule } from 'ui';
 /**
 * The beheer default-fill editor (S-15b): a beheerder reads and edits the ZGW default-fill values the
 * ACL stamps on every zaak (ADR-0003). Load and save go through the BFF (`/beheer/default-fill`),
 * which proxies the ACL (ADR-0025). A save takes effect on the next zaak (the ACL reads it per zaak).
 */
@Component({
  selector: 'app-default-fill-page',
  imports: [UtrechtComponentsModule],
  templateUrl: './default-fill-page.html',
 })
 export class DefaultFillPage {
  private readonly bff = inject(BffApiV1Service);
  protected readonly bronorganisatie = signal('');
  protected readonly verantwoordelijkeOrganisatie = signal('');
  protected readonly vertrouwelijkheidaanduiding = signal('');
  protected readonly loading = signal(false);
  protected readonly loaded = signal(false);
  protected readonly saving = signal(false);
  protected readonly failed = signal(false);
  protected readonly saved = signal(false);
  constructor() {
    this.load();
  }
  load(): void {
    this.loading.set(true);
    this.failed.set(false);
    this.saved.set(false);
    this.bff.getBeheerDefaultFill().subscribe({
      next: (d: BeheerDefaultFill) => {
        this.bronorganisatie.set(d.bronorganisatie);
        this.verantwoordelijkeOrganisatie.set(d.verantwoordelijkeOrganisatie);
        this.vertrouwelijkheidaanduiding.set(d.vertrouwelijkheidaanduiding);
        this.loading.set(false);
        this.loaded.set(true);
      },
      error: () => {
        this.loading.set(false);
        this.loaded.set(true);
        this.failed.set(true);
      },
    });
  }
  save(): void {
    this.saving.set(true);
    this.failed.set(false);
    this.saved.set(false);
    this.bff
      .putBeheerDefaultFill({
        bronorganisatie: this.bronorganisatie(),
        verantwoordelijkeOrganisatie: this.verantwoordelijkeOrganisatie(),
        vertrouwelijkheidaanduiding: this.vertrouwelijkheidaanduiding(),
      })
      .subscribe({
        next: () => {
          this.saving.set(false);
          this.saved.set(true);
        },
        error: () => {
          this.saving.set(false);
          this.failed.set(true);
        },
      });
  }
 }
@@ -64,9 +64,7 @@
    "test": {
      "executor": "@angular/build:unit-test",
      "options": {
-        "watch": false,
+        "watch": false
        "reporters": ["default", "json"],
        "outputFile": "{workspaceRoot}/test-output/{projectName}.json"
      }
    },
    "serve-static": {
@@ -64,9 +64,7 @@
    "test": {
      "executor": "@angular/build:unit-test",
      "options": {
-        "watch": false,
+        "watch": false
        "reporters": ["default", "json"],
        "outputFile": "{workspaceRoot}/test-output/{projectName}.json"
      }
    },
    "serve-static": {
@@ -207,7 +207,7 @@ A slice is done when:
 ## 15. Out of scope for v1
 - OpenMetadata data governance module (v3 slice).
- ~~Objecten as the authoritative register record store~~ — **delivered** in S-19a (#149, ADR-0028); the approval path writes a `RegisterRecord` object to Objecten rather than the planned zaak-eigenschappen placeholder.
+- Objecten as the authoritative register record store (v2 slice — v1 uses OpenZaak zaak-eigenschappen as a placeholder).
 - Production-grade Helm chart (sketch only).
 - Multi-tenancy.
 - Real outbound notifications (email/SMS) — logged to console in v1.
@@ -1,61 +0,0 @@
 # ADR-0026: Runtime-mutable ACL default-fill (in-memory store, seeded from config)
 - **Status:** Accepted
 - **Date:** 2026-07-24
 - **Deciders:** Respellion engineering
 - **Slice:** S-15b (#131), second of the S-15 (#16) split
 ## Context
 ADR-0003 made the ACL *default-fill* the ZGW-mandatory fields it stamps on every
 zaak, supplied as static configuration (`Acl:Defaults`, read once at startup as an
 immutable singleton). S-15b lets a beheerder **edit** those values from the portal
 and have the next zaak reflect them — so the defaults must become mutable at runtime.
 Two questions: **what** is editable, and **where** the mutable state lives.
 ## Decision
 **Make the three ZGW default-fill fields a runtime-mutable, in-memory store
 (`IDefaultFillStore`), seeded from `Acl:Defaults` at startup. The ACL reads it per
 zaak; the beheer `PUT /default-fill` replaces it.**
 ### Only the three ZGW fill fields are editable
 `Acl:Defaults` also carries the S-27 catalog-resolution keys (`ZaaktypeIdentificatie`,
 `InformatieobjecttypeOmschrijving`). Those feed the resolved-URL cache
 (`CachedZaaktypeCatalog`, ADR-0021); editing them at runtime would leave a stale cache
 and is catalogus *wiring*, not "default fill". So they **stay static config** and are
 out of scope for the CRUD. The editable set is exactly `Bronorganisatie`,
 `VerantwoordelijkeOrganisatie`, `Vertrouwelijkheidaanduiding` (`DefaultFillSettings`).
 ### In-memory, not persisted
 The store is a thread-safe in-memory singleton. **An edit is lost on restart**, when it
 reverts to the configured env. That is acceptable for this reference app: the slice
 demonstrates the *pattern* (beheer edits config that the ACL honours), not durable
 config management. The ACL stays stateless — no DB, no EF, no migration, no extra
 compose service.
 - ponytail ceiling: no persistence, no audit trail, no optimistic concurrency.
 - Upgrade path: back `IDefaultFillStore` with a DB (or an Objecten record) if durable,
  audited, multi-instance config is needed — the port stays the same.
 ## Consequences
 **Positive**
 - Demoable end to end (edit in portal → next zaak reflects it) with minimal moving parts.
 - The read path is per-zaak, so no restart and no cache concerns for the ZGW fields.
 **Negative / costs**
 - Edits don't survive a restart and aren't shared across replicas (single-instance
  assumption). Documented ceiling above.
 - Two sources of default config now (static keys on `AclDefaults`, mutable fields in the
  store) — a deliberate split by editability.
 ## Coupling rules touched (CLAUDE.md §8)
 None new. The BFF→ACL edge already exists (ADR-0025); this adds a read/write pair on it.
 The ACL remains the owner of the ZGW-facing config.
@@ -1,81 +0,0 @@
 # ADR-0027: The RegisterRecord objecttype is public-safe by construction
 - **Status:** Accepted
 - **Date:** 2026-07-27
 - **Deciders:** Respellion engineering
 - **Slice:** S-18c (#141), third of the S-18 (#19) split
 ## Context
 S-18 stands up Objecttypen (S-18a) and Objecten (S-18b) as the authoritative
 register-record store (PRD §"Objecten as the authoritative register record store").
 S-19 (#20) will, on approval, write the canonical register record to the Objecten API
 instead of OpenZaak zaak-eigenschappen, and the openbaar (public) register will read it.
 Objecten validates every object against a **objecttype version's JSON schema**. So the
 schema is a contract: it fixes which fields a register record may carry. The register is
 read **anonymously** by the openbaar portal (ADR-0010), so the schema is also a
 disclosure boundary — anything the schema allows can end up public.
 Two questions: **which fields** the schema defines, and **how** the objecttype gets into
 the Objecttypen API (which has no declarative objecttype step).
 ## Decision
 **Define a `RegisterRecord` objecttype whose published schema carries exactly the
 public-safe fields — `id`, `status`, `reference` — and register it over the API at
 startup with a one-shot, idempotently.**
 ### The schema mirrors the BFF's public projection, not the internal one
 The public-safe field set already exists: the BFF's `OpenbaarEntry`
 (`services/bff/Bff.Api/DownstreamClients.cs`) — `id`, `status`, `reference` — is what
 `OpenbaarProjection.PublicView` narrows every row down to, dropping `bsn` and
 `naamPlaceholder` at the boundary (S-09). The RegisterRecord schema mirrors that record,
 **not** the internal `RegisterEntry` / `RegisterEntryRow` (which carry bsn/naam):
 | field | type | notes |
 |-------|------|-------|
 | `id` | string (required) | zaak id — the entry's stable key |
 | `status` | string (required) | enum `INGEDIEND` \| `INGESCHREVEN` (`RegistrationStatus`) |
 | `reference` | string \| null | citizen-facing zaak identificatie (ADR-0012) |
 `additionalProperties: false` so a record can't smuggle a field the schema didn't
 sanction, and `dataClassification: "open"` records the intent that this objecttype is
 public. **`bsn` and `naamPlaceholder` are deliberately absent** — public-safe by
 construction, so S-19 cannot write a personal-data field into the public register even by
 mistake.
 ### Registered over the API by a one-shot, not setup_configuration
 The Objecttypen API's `setup_configuration` (3.4.2) provisions only tokens — it has no
 declarative step to create an objecttype with a schema. So a `registerrecord-init`
 compose one-shot (stdlib Python, on the stack network) creates the objecttype + a
 **published** version over the API once Objecttypen is healthy, following the ADR-0020
 self-seed pattern. It is **idempotent**: if a `RegisterRecord` with a version already
 exists it is a no-op, so it is safe on every `up`.
 - ponytail ceiling: no schema-migration/versioning story — a schema change means editing
  `registerrecord.schema.json` and bumping the version by hand; the one-shot only ever
  adds v1 if none exists.
 - Upgrade path: if the schema evolves, have the one-shot diff the published schema and
  POST a new version, or move to a declarative step once the upstream supports one.
 ## Consequences
 **Positive**
 - The public register's disclosure surface is fixed in one reviewed artifact
  (`registerrecord.schema.json`) and enforced by Objecten's own validation.
 - Self-seeds on a fresh `make up` / bare local compose; no manual step, no built image.
 **Negative / costs**
 - The public-safe field set now lives in two places — the BFF's `OpenbaarEntry` and this
  schema — that must be kept in sync by hand (a drift check is a candidate for later).
 - Hand-managed schema version (ceiling above).
 ## Coupling rules touched (CLAUDE.md §8)
 None new. Registration talks to the Objecttypen API over its documented API. S-19 will
 write records via the ACL (§8.1) — this ADR only fixes the schema they conform to.
@@ -1,174 +0,0 @@
 # ADR-0028: Objecten holds the register, OpenZaak holds the process
 - **Status:** Accepted
 - **Date:** 2026-08-14
 - **Deciders:** Respellion engineering
 - **Slice:** S-19a (#149), first of the S-19 (#20) split
 ## Context
 Until this slice the register existed only as a **derived** thing: the read projection
 rows the Event Subscriber builds from NRC zaak notifications (ADR-0008). There is no
 system anywhere that holds "who is registered" as a first-class record — drop the
 projection database and the only way back is to replay ZGW history and re-derive it.
 That is the wrong shape for a register. A BIG registration is a **fact about a person**
 that outlives the case that produced it: it is looked up, corrected, superseded, and
 retained on its own schedule. The zaak that produced it is a **process record** — it
 opens, moves through statussen, and closes. Storing the fact inside the process record
 (as zaak `eigenschappen`, the v1 placeholder PRD §"Registration" mentions) welds the two
 lifecycles together: the register can then never be read, retained, or corrected without
 going through the case system that happened to create it.
 S-18 stood up Objecten + Objecttypen and registered the public-safe `RegisterRecord`
 objecttype (ADR-0027). The open question this ADR closes: **where the authoritative
 register record lives, and who writes it.**
 ## Decision
 **The register record lives in the Objecten API as a `RegisterRecord` object. OpenZaak
 keeps only the process. On approval the ACL writes both: the ZGW eindstatus, then the
 register record.**
 ### Not zaak eigenschappen
 Eigenschappen are per-zaaktype, untyped strings, and readable only by walking the zaak.
 They inherit the zaak's lifecycle and its archiving regime, and they give the public
 register no queryable surface of its own. Objecten gives a JSON-schema-validated record
 (ADR-0027 makes that schema the disclosure boundary), a queryable collection, and a
 lifecycle the zaak cannot drag around with it.
 ### The ACL writes it, not the domain or the Event Subscriber
 CLAUDE.md §8.1 keeps upstream Common Ground modules behind the ACL. Objecten is such a
 module, so the same rule applies: `ObjectenGateway` is the only code that talks to it,
 and the domain keeps handing the ACL nothing but a zaak URL. The alternative — having the
 Event Subscriber write the record when it sees the status notification — would make the
 register a *second* derived artefact of ZGW, which is exactly the coupling this ADR
 removes.
 ### Two writes, converging rather than transactional
 Approval is now two writes across two modules, so it cannot be atomic. Both are made
 idempotent instead:
 - a ZGW status is an append-only log entry, so re-setting the eindstatus is harmless;
 - the register write is an **upsert keyed on the zaak id** — search Objecten for an
  existing object with that `id`, then PATCH it or POST a new one.
 A caller that retries a half-failed approval therefore converges. This is the same
 eventual-consistency posture as everywhere else in the system (CLAUDE.md §2.2, §8.6),
 not an exception carved out for this path.
 ### The objecttype is resolved by name, lazily
 The objecttype URL and version number are assigned by Objecttypen at seed time, so they
 cannot be pinned in config — the ACL resolves them by the configured name
 (`Acl__Objecten__ObjecttypeName`), taking the highest **published** version. This is the
 same reasoning as ADR-0021 for zaaktypen.
 Resolution happens on the first approval, not at startup, so the ACL needs no `depends_on`
 on Objecten and will not crash-loop when it boots ahead of the seed. A failed resolution
 is not cached, so it is retried on the next approval.
 - ponytail ceiling: the resolution is memoised per gateway instance, and the gateway is a
  transient typed `HttpClient` — in practice one extra GET per approval against a
  neighbouring container.
 - Upgrade path: lift it into a singleton cache (as `CachedZaaktypeCatalog` does for ZGW)
  if approvals ever get hot enough for that GET to matter.
 ### The objecttype's UUID is pinned, not server-assigned
 Objecten refuses to store an object whose objecttype it has not been configured with
 (`ObjectType with url=… is not configured`), and its configuration identifies an
 objecttype **by UUID** — supplied through a static `setup_configuration` file applied
 when the container starts, before the `registerrecord-init` one-shot has run.
 Rather than thread a seed-time UUID from one container into another's config, the UUID is
 **pinned**: `infra/objecttypen-registerrecord/register.py` creates the objecttype with a
 fixed UUID (the Objecttypen API accepts a client-supplied one), and
 `infra/objecten/setup_configuration/data.yaml` declares that same UUID. Both sides are
 declared up front, both stay idempotent, and neither has to wait for the other.
 The cost is a constant duplicated across two files that must be kept in step; each carries
 a comment pointing at the other.
 ### The ACL must reach Objecttypen at the URL Objecten knows it by
 Objecttypen builds the `url` it returns from the request's own Host header, and Objecten
 matches an incoming object's `type` against the `api_root` it was configured with. So an
 ACL that reads Objecttypen at `http://localhost:8020` gets back a `localhost` objecttype
 URL that Objecten then rejects as "not one of the available choices" — even though it is
 the same objecttype.
 `Acl__Objecten__ObjecttypenBaseUrl` must therefore match Objecten's configured
 `api_root` (`http://objecttypen:8000/api/v2/`). This is the same class of constraint as
 ADR-0006's "point the ACL at OpenZaak's container IP", and it is why the Objecten
 integration tests only pass from inside the compose network.
 ### Objecten's notifications are off for this slice
 Objecten publishes to a Notificaties API on every write, and `notifications_api_common`
 **raises** rather than skipping when that configuration is absent — so with no NRC wiring,
 every `POST /api/v2/objects` returns 500 after creating and rolling back the object.
 Objecten → NRC is not wired: there is no broker, no Celery worker, no `objecten` kanaal and
 no abonnement for it. Configuring only the client side would make writes succeed while
 every message was dropped on the floor — a delivery path that looks wired and isn't. So
 `NOTIFICATIONS_DISABLED` is set for Objecten in both compose files instead.
 - ponytail ceiling: Objecten emits no notifications, so nothing downstream can react to a
  register write yet.
 - Upgrade path: S-19b (#150) needs those notifications to source the projection from
  Objecten, and turns them on together with the broker, worker, kanaal and abonnement.
 ## Consequences
 **Positive**
 - The register is a first-class record with its own schema, lifecycle and query surface,
  independent of the case that produced it.
 - The disclosure boundary is enforced by Objecten's schema validation (ADR-0027), not by
  discipline in projection code.
 - The read projection can become a cache of Objecten rather than a re-derivation of ZGW
  (S-19b, #150).
 **Negative / costs**
 - Approval writes to two modules and is eventually consistent; a failure between them
  leaves a zaak in eindstatus without a register record until the approval is retried.
  Nothing repairs that automatically yet.
 - One more upstream module on the approval path, and one more dev credential
  (`Acl__Objecten__Token`) in compose.
 - Two new hand-kept constants: the pinned objecttype UUID (two files) and the objecttype
  name (compose + `register.py`).
 - Until S-19b lands, the public register is still read from the NRC-derived projection, so
  the register record is written but not yet read — the two must agree.
 ## Coupling rules touched (CLAUDE.md §8)
 None bent. §8.1 is extended in spirit — the ACL is the only code that talks to Objecten,
 exactly as it is the only code that talks to ZGW. The domain still passes only a zaak URL,
 and no service reaches Objecten's database.
 ## Verification
 The end-to-end assertion lives in the Playwright happy path
 (`tests/e2e/registration.spec.ts`, run by `verify-e2e`): after the behandelaar approves and
 the openbaar register shows `INGESCHREVEN`, it asserts Objecten holds exactly one
 `RegisterRecord` for *that* reference, with status `INGESCHREVEN` and no field outside the
 public-safe schema.
 It belongs there and not in `verify-domain`, which looks like the obvious home: that check
 completes the Beoordelen task straight through Flowable REST (deliberately — it exists to
 exercise the Workflow Client's REST contract), which bypasses the domain `decide` path that
 calls the ACL. The e2e is the only check that drives a real approval.
 `ObjectenGatewayIntegrationTests` (`Category=Integration`, so it runs under `verify-acl`
 inside the compose network) drives the real gateway against a live Objecten + Objecttypen
 pair: two writes for the same id leave exactly one object, carrying the second write's
 status and nothing outside the public-safe schema.
 All three findings above — the pinned UUID, the notifications block, and the base-URL
 constraint — came out of running the gateway against those live modules while writing the
 slice, not out of CI.
@@ -5,152 +5,6 @@ copy-pasteable walkthrough against a local `make up` stack.
 ---
 ## S-19a — approval writes the register record to Objecten (#149, ADR-0028)
 **Outcome:** approving a registration no longer only moves the ZGW zaak to its eindstatus — it also
 writes the canonical **register record** into the **Objecten** API. OpenZaak keeps the process,
 Objecten holds the register. The write goes through the ACL (§8.1) and is **idempotent**: replaying an
 approval updates the existing object instead of creating a second one.
 ```bash
 # 1. Bring the stack up (Objecten, Objecttypen and the RegisterRecord objecttype come with it).
 make up
 #
 # 2. End-to-end: the walking-skeleton e2e submits, approves via the behandel portal, and then
 #    asserts Objecten holds exactly one RegisterRecord for *that* registration:
 make verify-e2e        # → "DigiD submit → … → behandelaar goedkeurt → public INGESCHREVEN"
 #
 # 3. The ACL integration test proves the same writes against a live Objecten (upsert stays one object):
 make verify-acl        # → "Writes a register record and updates it in place on a second write"
 #
 # 4. See it for yourself — every register record currently in Objecten:
 curl -s -H 'Authorization: Token 1234567890abcdef1234567890abcdef12345678' \
     -H 'Accept-Crs: EPSG:4326' \
     'http://localhost:8021/api/v2/objects' | python3 -m json.tool
 ```
 Each object's `record.data` carries exactly `id`, `status`, `reference` — the schema forbids anything
 else (ADR-0027), so no personal data can reach the world-readable register even by mistake.
 **The path:** behandel portal → BFF → domain `BeoordeelRegistratie` → ACL `POST /statussen` → ZGW
 `resultaten` + `statussen` (the process), **then** ACL → Objecten `POST`/`PATCH /api/v2/objects` (the
 register). The objecttype URL is resolved by name from Objecttypen on first use, so nothing seed-time
 is pinned in config (ADR-0028, same reasoning as ADR-0021).
 **Not yet:** the public register still reads the NRC-derived projection — re-sourcing it from Objecten
 is S-19b (#150).
 ---
 ## S-18c — RegisterRecord objecttype defined + registered (#141, ADR-0027)
 **Outcome:** a **RegisterRecord** objecttype with a **published** JSON schema is registered in the
 Objecttypen API at startup. The schema is public-safe by construction — `id`, `status`, `reference`
 only, mirroring the BFF's `OpenbaarEntry` (no `bsn`/`naam`), `dataClassification: open`. This is the
 schema S-19 writes register records against on approval. A `registerrecord-init` one-shot creates it
 over the API once Objecttypen is healthy (the Objecttypen `setup_configuration` has no objecttype
 step), idempotently.
 ```bash
 make up
 # The RegisterRecord objecttype exists with a published version:
 curl -s -H "Authorization: Token 0123456789abcdef0123456789abcdef01234567" \
  "http://localhost:8020/api/v2/objecttypes" | python3 -c \
  'import sys,json; o=[x for x in json.load(sys.stdin)["results"] if x["name"]=="RegisterRecord"][0]; print(o["name"], o["dataClassification"], o["versions"])'
 #   → RegisterRecord open ['http://.../objecttypes/<uuid>/versions/1']
 #
 # Automated (a CI verify-stack step): asserts the objecttype exists, has a published version, and
 # that version's schema carries id/status/reference.
 make verify-registerrecord     # → OK — RegisterRecord v1 published, fields=['id', 'reference', 'status']
 ```
 **The path:** `infra/objecttypen-registerrecord/registerrecord.schema.json` (the reviewed public-safe
 contract) + `register.py` are streamed into an external config volume by `infra/seed-config.sh
 registerrecord` (bind-mounted locally); the `registerrecord-init` one-shot POSTs the objecttype + a
 published version. Re-running is a no-op. S-19 (#20) writes records against this schema in Objecten.
 ---
 ## S-18b — Objecten API up in compose, wired to Objecttypen (#140)
 **Outcome:** the upstream Maykin **Objecten API** runs in the stack — own **PostGIS** DB + redis,
 config seeded like the other CG modules (`objecten-init` runs `setup_configuration` from the
 `rr-objecten-config` volume: migrate + provision a dev **static API token** + register the
 **Objecttypen API** (S-18a) as a trusted service), a health-checked `objecten` web on host `:8021`.
 An object can now reference its objecttype; the ACL writes register records here on approval (S-19).
 ```bash
 make up
 # 1. The API is up; the seeded token authenticates (401 without, 200 with):
 curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8021/api/v2/objects                                       # 401
 curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: Token 1234567890abcdef1234567890abcdef12345678" \
  http://localhost:8021/api/v2/objects                                                                              # 200
 #
 # 2. It trusts Objecttypen — the seeded zgw_consumers service points at the Objecttypen API:
 docker exec infra-objecten-1 python src/manage.py shell -c \
  "from zgw_consumers.models import Service; print(*[(s.slug,s.api_root) for s in Service.objects.all()])"
 #   → ('objecttypen', 'http://objecttypen:8000/api/v2/')
 #
 # 3. Automated (a CI verify-stack step): asserts unauth 401 + token 200, against the running stack.
 make verify-objecten           # → OK — no-auth 401, token 200
 ```
 **The path:** verbatim upstream image (`maykinmedia/objects-api`, pinned 3.4.0) + the same seed
 pattern as S-18a — `infra/seed-config.sh objecten` streams `data.yaml` into an external config
 volume, `objecten-init` (RUN_SETUP_CONFIG) applies it. Its `zgw_consumers` step registers Objecttypen
 (`api_type: orc`, api-key auth with the S-18a dev token). The RegisterRecord objecttype (S-18c) and
 the ACL write path (S-19) build on this.
 ---
 ## S-18a — Objecttypen API up in compose (#139)
 **Outcome:** the upstream Maykin **Objecttypen API** runs in the stack — own Postgres + redis, config
 seeded like the other CG modules (`objecttypen-init` runs `setup_configuration` from the
 `rr-objecttypen-config` volume: migrate + provision a dev **static API token**), a health-checked
 `objecttypen` web service on host `:8020`. This is the objecttype catalogue the register record
 (S-18b/S-18c, S-19) will use.
 ```bash
 make up
 # 1. The API is up; the seeded token authenticates (401 without, 200 with):
 curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8020/api/v2/objecttypes                                   # 401
 curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: Token 0123456789abcdef0123456789abcdef01234567" \
  http://localhost:8020/api/v2/objecttypes                                                                          # 200
 #
 # 2. Automated (a CI verify-stack step): asserts both, against the running stack.
 make verify-objecttypen        # → OK — no-auth 401, token 200
 ```
 **The path:** verbatim upstream image (`maykinmedia/objecttypes-api`, pinned) + the same seed pattern
 as OpenZaak/NRC — `infra/seed-config.sh objecttypen` streams `data.yaml` into an external config
 volume, `objecttypen-init` (RUN_SETUP_CONFIG) applies it. Objecten (S-18b) and the RegisterRecord
 objecttype (S-18c) build on this.
 ---
 ## S-15b — Beheer-portal: default-fill configuration editor (#131, ADR-0026)
 **Outcome:** a beheerder edits the ACL's ZGW **default-fill** values (bronorganisatie,
 verantwoordelijke organisatie, vertrouwelijkheidaanduiding) from the beheer portal, and the next zaak
 is stamped with the new values — no restart. Path: portal → BFF `GET/PUT /beheer/default-fill`
 (beheerder role) → ACL `GET/PUT /default-fill` → a runtime-mutable in-memory store the ACL reads per
 zaak (ADR-0026). The S-27 catalog-resolution keys stay static config (editing them would desync the
 zaaktype cache). Store is in-memory: an edit reverts to the configured env on restart.
 ```bash
 make up
 # 1. Log in as bram-beheerder / test123 → "Default-fill" tab → change a value → Opslaan.
 open http://localhost:8143/default-fill
 #
 # 2. Automated: the ACL uses the current default-fill per zaak (unit) and the endpoints are behind the
 #    beheerder role (BFF unit):
 #    Acl.Tests → AclServiceTests.Opening_a_zaak_reflects_a_default_fill_update
 #    Bff.Tests → BeheerDefaultFillEndpointTests
 ```
 ---
 ## S-15a — Beheer-portal: read-only catalogus viewer (#130, ADR-0025)
 **Outcome:** a new **beheer** portal (medewerker realm, like behandel) shows the ZTC catalogus —
@@ -221,27 +221,3 @@ fails", prefer serialising with a `concurrency` group over `needs` + `always()`.
 **Also** — a run already stuck this way will **not** clear itself; force-cancel it
 from the Actions UI (plain cancel can also stall on this version, #35782). Push the
 workflow fix to produce a fresh run.
 ---
 ## 8. Job summaries (`$GITHUB_STEP_SUMMARY`) need Gitea ≥1.27 + runner ≥2.0
 Markdown a step appends to the `$GITHUB_STEP_SUMMARY` file renders on the run page
 (no artifact download). We use it for per-run reports (#136): mutation scores
 (Stryker `markdown` reporter), per-service unit results (`infra/trx-summary.py` over
 TRX), per-frontend results (`infra/vitest-summary.py` over each app's vitest JSON),
 the verify-stack check table, and per-spec e2e results (`infra/playwright-summary.py`).
 **Requirements / conventions:**
 - Requires **Gitea ≥ 1.27** (stores/renders summaries) and **act_runner ≥ 2.0.0**
  (uploads them). Older pairings silently skip the upload.
 - **Guard every write:** `[ -n "${GITHUB_STEP_SUMMARY:-}" ] || exit 0` — on a runner
  without support the var is unset and `>> "$GITHUB_STEP_SUMMARY"` would be an
  ambiguous-redirect error. The guard makes the step a no-op locally / on old runners.
 - Use `if: always()` (step-level) on summary steps so they render even when the thing
  they report on failed. Step-level `always()` is fine on 2.0.0 — unlike the *job*-level
  status-function `if` of §7.
 - Getting a report out of the e2e container: Playwright writes `playwright-report.json`
  inside the container; `infra/run-e2e-check.sh` `docker cp`s it back to the host
  (capturing the test exit code first) so the summary step can read it.
@@ -56,10 +56,6 @@ services:
  oz-init:
    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
    environment: &oz-env
      # 1 uWSGI worker, not the image default of 4×4 (#147) — idle workers pressure the runner; the
      # -init/-celery containers share this anchor and ignore it (they don't run uwsgi).
      UWSGI_PROCESSES: "1"
      UWSGI_THREADS: "2"
      DJANGO_SETTINGS_MODULE: openzaak.conf.docker
      SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production}
      DB_HOST: oz-db
@@ -142,9 +138,6 @@ services:
    # bind-mounted here (this twin is the local/no-make path). See ADR-0007.
    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
    environment: &nrc-env
      # 1 uWSGI worker, not the image default of 4×4 (#147) — see the oz-env note above.
      UWSGI_PROCESSES: "1"
      UWSGI_THREADS: "2"
      DJANGO_SETTINGS_MODULE: nrc.conf.docker
      SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production}
      DB_HOST: nrc-db
@@ -338,14 +331,6 @@ services:
      Acl__Defaults__Vertrouwelijkheidaanduiding: openbaar
      Acl__Defaults__ZaaktypeIdentificatie: BIG-REGISTRATIE
      Acl__Defaults__InformatieobjecttypeOmschrijving: Diploma
      # Objecten holds the register, OpenZaak holds the process (S-19a, ADR-0028). Both APIs take a
      # static token, not a ZGW JWT. The objecttype URL is assigned at seed time, so the ACL resolves
      # it by name — lazily, on the first approval, so no depends_on is needed here.
      Acl__Objecten__BaseUrl: http://objecten:8000/
      Acl__Objecten__Token: ${OBJECTEN_TOKEN:-1234567890abcdef1234567890abcdef12345678}
      Acl__Objecten__ObjecttypenBaseUrl: http://objecttypen:8000/
      Acl__Objecten__ObjecttypenToken: ${OBJECTTYPEN_TOKEN:-0123456789abcdef0123456789abcdef01234567}
      Acl__Objecten__ObjecttypeName: RegisterRecord
    ports:
      - "8100:8080"
    volumes:
@@ -575,164 +560,11 @@ services:
        condition: service_started
    networks: [cg]
  # ── Objecttypen API (S-18a) — bind-mounted config (local variant) ──────────
  objecttypen-db:
    image: docker.io/library/postgres:17-alpine
    environment:
      POSTGRES_USER: objecttypes
      POSTGRES_PASSWORD: objecttypes
      POSTGRES_DB: objecttypes
    volumes:
      - objecttypen-db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U objecttypes"]
      interval: 5s
      timeout: 3s
      retries: 10
    networks: [cg]
  objecttypen-redis:
    image: docker.io/library/redis:7
    networks: [cg]
  objecttypen-init:
    image: docker.io/maykinmedia/objecttypes-api:${OBJECTTYPES_TAG:-3.4.2}
    environment: &objecttypen-env-local
      # 1 uWSGI worker, not the image default of 4×4 (#144) — idle workers starve the CI runner.
      UWSGI_PROCESSES: "1"
      UWSGI_THREADS: "2"
      DJANGO_SETTINGS_MODULE: objecttypes.conf.docker
      SECRET_KEY: ${OBJECTTYPES_SECRET_KEY:-dev-only-not-for-production}
      DB_HOST: objecttypen-db
      DB_NAME: objecttypes
      DB_USER: objecttypes
      DB_PASSWORD: objecttypes
      ALLOWED_HOSTS: "*"
      CACHE_DEFAULT: objecttypen-redis:6379/0
      CACHE_AXES: objecttypen-redis:6379/0
      DISABLE_2FA: "true"
      OTEL_SDK_DISABLED: "true"
      RUN_SETUP_CONFIG: "true"
    command: /setup_configuration.sh
    volumes:
      - ./objecttypen/setup_configuration:/app/setup_configuration:ro,z
    depends_on:
      objecttypen-db:
        condition: service_healthy
      objecttypen-redis:
        condition: service_started
    networks: [cg]
  objecttypen:
    image: docker.io/maykinmedia/objecttypes-api:${OBJECTTYPES_TAG:-3.4.2}
    environment: *objecttypen-env-local
    healthcheck:
      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s
    ports:
      - "8020:8000"
    depends_on:
      objecttypen-init:
        condition: service_completed_successfully
    networks: [cg]
  # ── RegisterRecord objecttype (S-18c) — API-seeded one-shot (local variant) ─
  registerrecord-init:
    image: docker.io/library/python:3-slim
    environment:
      OBJECTTYPEN: http://objecttypen:8000
      OBJECTTYPEN_TOKEN: ${OBJECTTYPEN_TOKEN:-0123456789abcdef0123456789abcdef01234567}
      SCHEMA: /config/registerrecord.schema.json
    command: python /config/register.py
    volumes:
      - ./objecttypen-registerrecord:/config:ro,z
    depends_on:
      objecttypen:
        condition: service_healthy
    networks: [cg]
  # ── Objecten API (S-18b) — bind-mounted config (local variant) ─────────────
  objecten-db:
    image: docker.io/postgis/postgis:17-3.5
    environment:
      POSTGRES_USER: objects
      POSTGRES_PASSWORD: objects
      POSTGRES_DB: objects
    volumes:
      - objecten-db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U objects"]
      interval: 5s
      timeout: 3s
      retries: 10
    networks: [cg]
  objecten-redis:
    image: docker.io/library/redis:7
    networks: [cg]
  objecten-init:
    image: docker.io/maykinmedia/objects-api:${OBJECTS_TAG:-3.4.0}
    environment: &objecten-env-local
      # 1 uWSGI worker, not the image default of 4×4 (#144) — idle workers starve the CI runner.
      UWSGI_PROCESSES: "1"
      UWSGI_THREADS: "2"
      DJANGO_SETTINGS_MODULE: objects.conf.docker
      SECRET_KEY: ${OBJECTS_SECRET_KEY:-dev-only-not-for-production}
      DB_HOST: objecten-db
      DB_NAME: objects
      DB_USER: objects
      DB_PASSWORD: objects
      ALLOWED_HOSTS: "*"
      CACHE_DEFAULT: objecten-redis:6379/0
      CACHE_AXES: objecten-redis:6379/0
      DISABLE_2FA: "true"
      OTEL_SDK_DISABLED: "true"
      # S-19a: Objecten refuses every write while its Notificaties config is absent
      # (notifications_api_common raises rather than skipping, so POST /objects 500s). Objecten →
      # NRC is not wired yet — there is no broker, worker, kanaal or abonnement for it — so turn
      # notifications off rather than fake a delivery path that silently drops every message.
      # S-19b (#150) sources the projection from Objecten and turns this back on for real.
      NOTIFICATIONS_DISABLED: "true"
      RUN_SETUP_CONFIG: "true"
    command: /setup_configuration.sh
    volumes:
      - ./objecten/setup_configuration:/app/setup_configuration:ro,z
    depends_on:
      objecten-db:
        condition: service_healthy
      objecten-redis:
        condition: service_started
      objecttypen:
        condition: service_healthy
    networks: [cg]
  objecten:
    image: docker.io/maykinmedia/objects-api:${OBJECTS_TAG:-3.4.0}
    environment: *objecten-env-local
    healthcheck:
      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s
    ports:
      - "8021:8000"
    depends_on:
      objecten-init:
        condition: service_completed_successfully
    networks: [cg]
 volumes:
  oz-db:
  nrc-db:
  flowable-db:
  projection-db:
  objecttypen-db:
  objecten-db:
  # Carries the seed-generated acl.env (server-assigned zaaktype URLs) from local-seed to the ACL.
  seed-env:
@@ -51,12 +51,6 @@ services:
  oz-init:
    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
    environment: &oz-env
      # 1 uWSGI worker, not the image default of 4×4 (#147, same lever as #145): OpenZaak serves
      # single-request smoke checks here and is not load-tested, so 4 idle Django workers just pin
      # ~800 MB and pressure the shared runner. The -init (setup_configuration) and -celery containers
      # share this anchor and ignore it — they don't run uwsgi.
      UWSGI_PROCESSES: "1"
      UWSGI_THREADS: "2"
      DJANGO_SETTINGS_MODULE: openzaak.conf.docker
      SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production}
      DB_HOST: oz-db
@@ -141,9 +135,6 @@ services:
    # needs no baked config.
    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
    environment: &nrc-env
      # 1 uWSGI worker, not the image default of 4×4 (#147) — see the oz-env note above.
      UWSGI_PROCESSES: "1"
      UWSGI_THREADS: "2"
      DJANGO_SETTINGS_MODULE: nrc.conf.docker
      SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production}
      DB_HOST: nrc-db
@@ -323,14 +314,6 @@ services:
      # so verify-domain still points the ACL at OpenZaak's container IP.
      Acl__Defaults__ZaaktypeIdentificatie: BIG-REGISTRATIE
      Acl__Defaults__InformatieobjecttypeOmschrijving: Diploma
      # Objecten holds the register, OpenZaak holds the process (S-19a, ADR-0028). Both APIs take a
      # static token, not a ZGW JWT. The objecttype URL is assigned at seed time, so the ACL resolves
      # it by name — lazily, on the first approval, so no depends_on is needed here.
      Acl__Objecten__BaseUrl: http://objecten:8000/
      Acl__Objecten__Token: ${OBJECTEN_TOKEN:-1234567890abcdef1234567890abcdef12345678}
      Acl__Objecten__ObjecttypenBaseUrl: http://objecttypen:8000/
      Acl__Objecten__ObjecttypenToken: ${OBJECTTYPEN_TOKEN:-0123456789abcdef0123456789abcdef01234567}
      Acl__Objecten__ObjecttypeName: RegisterRecord
    ports:
      - "8100:8080"
    healthcheck:
@@ -586,175 +569,6 @@ services:
        condition: service_started
    networks: [cg]
  # ── Objecttypen API (S-18a) — upstream Maykin image, verbatim ──────────────
  # The register's objecttype catalogue. Same shape as the other CG modules: own DB + redis, an
  # `-init` that runs setup_configuration (RUN_SETUP_CONFIG → migrate + provision a static API token)
  # from the external config volume streamed in by infra/seed-config.sh, and a health-checked web
  # service that depends on init completing.
  objecttypen-db:
    image: docker.io/library/postgres:17-alpine
    environment:
      POSTGRES_USER: objecttypes
      POSTGRES_PASSWORD: objecttypes
      POSTGRES_DB: objecttypes
    volumes:
      - objecttypen-db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U objecttypes"]
      interval: 5s
      timeout: 3s
      retries: 10
    networks: [cg]
  objecttypen-redis:
    image: docker.io/library/redis:7
    networks: [cg]
  objecttypen-init:
    image: docker.io/maykinmedia/objecttypes-api:${OBJECTTYPES_TAG:-3.4.2}
    environment: &objecttypen-env
      # 1 uWSGI worker, not the image default of 4×4: this API only serves single-request smoke
      # checks and sits idle during the e2e step — 4 idle Django workers each pin ~200 MB and starve
      # the shared CI runner (#144). Init ignores this (it runs setup_configuration, not uwsgi).
      UWSGI_PROCESSES: "1"
      UWSGI_THREADS: "2"
      DJANGO_SETTINGS_MODULE: objecttypes.conf.docker
      SECRET_KEY: ${OBJECTTYPES_SECRET_KEY:-dev-only-not-for-production}
      DB_HOST: objecttypen-db
      DB_NAME: objecttypes
      DB_USER: objecttypes
      DB_PASSWORD: objecttypes
      ALLOWED_HOSTS: "*"
      CACHE_DEFAULT: objecttypen-redis:6379/0
      CACHE_AXES: objecttypen-redis:6379/0
      DISABLE_2FA: "true"
      OTEL_SDK_DISABLED: "true"
      RUN_SETUP_CONFIG: "true"
    command: /setup_configuration.sh
    # data.yaml is streamed into this external volume by infra/seed-config.sh before start.
    volumes:
      - objecttypen-config:/app/setup_configuration:ro
    depends_on:
      objecttypen-db:
        condition: service_healthy
      objecttypen-redis:
        condition: service_started
    networks: [cg]
  objecttypen:
    image: docker.io/maykinmedia/objecttypes-api:${OBJECTTYPES_TAG:-3.4.2}
    environment: *objecttypen-env
    healthcheck:
      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s
    ports:
      - "8020:8000"
    depends_on:
      objecttypen-init:
        condition: service_completed_successfully
    networks: [cg]
  # ── RegisterRecord objecttype (S-18c) — API-seeded one-shot ────────────────
  # The Objecttypen setup_configuration (3.4.2) can only provision tokens — no declarative objecttype
  # step — so this one-shot creates the RegisterRecord objecttype + a published version over the API
  # once Objecttypen is healthy (idempotent; ADR-0020 self-seed, ADR-0027 schema). The schema + script
  # are streamed into the external config volume by infra/seed-config.sh, like the *-init volumes.
  registerrecord-init:
    image: docker.io/library/python:3-slim
    environment:
      OBJECTTYPEN: http://objecttypen:8000
      OBJECTTYPEN_TOKEN: ${OBJECTTYPEN_TOKEN:-0123456789abcdef0123456789abcdef01234567}
      SCHEMA: /config/registerrecord.schema.json
    command: python /config/register.py
    volumes:
      - registerrecord-config:/config:ro
    depends_on:
      objecttypen:
        condition: service_healthy
    networks: [cg]
  # ── Objecten API (S-18b) — upstream Maykin image, verbatim ─────────────────
  # The authoritative object store. Same shape as Objecttypen (own DB + redis, an `-init` that runs
  # setup_configuration from the external config volume, a health-checked web). Two differences: the
  # DB is PostGIS (objects carry geometry), and setup_configuration registers the Objecttypen API
  # (S-18a) as a trusted service so an object can reference its objecttype.
  objecten-db:
    image: docker.io/postgis/postgis:17-3.5
    environment:
      POSTGRES_USER: objects
      POSTGRES_PASSWORD: objects
      POSTGRES_DB: objects
    volumes:
      - objecten-db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U objects"]
      interval: 5s
      timeout: 3s
      retries: 10
    networks: [cg]
  objecten-redis:
    image: docker.io/library/redis:7
    networks: [cg]
  objecten-init:
    image: docker.io/maykinmedia/objects-api:${OBJECTS_TAG:-3.4.0}
    environment: &objecten-env
      # 1 uWSGI worker, not the image default of 4×4 — see the objecttypen note above (#144).
      UWSGI_PROCESSES: "1"
      UWSGI_THREADS: "2"
      DJANGO_SETTINGS_MODULE: objects.conf.docker
      SECRET_KEY: ${OBJECTS_SECRET_KEY:-dev-only-not-for-production}
      DB_HOST: objecten-db
      DB_NAME: objects
      DB_USER: objects
      DB_PASSWORD: objects
      ALLOWED_HOSTS: "*"
      CACHE_DEFAULT: objecten-redis:6379/0
      CACHE_AXES: objecten-redis:6379/0
      DISABLE_2FA: "true"
      OTEL_SDK_DISABLED: "true"
      # S-19a: Objecten refuses every write while its Notificaties config is absent
      # (notifications_api_common raises rather than skipping, so POST /objects 500s). Objecten →
      # NRC is not wired yet — there is no broker, worker, kanaal or abonnement for it — so turn
      # notifications off rather than fake a delivery path that silently drops every message.
      # S-19b (#150) sources the projection from Objecten and turns this back on for real.
      NOTIFICATIONS_DISABLED: "true"
      RUN_SETUP_CONFIG: "true"
    command: /setup_configuration.sh
    # data.yaml is streamed into this external volume by infra/seed-config.sh before start.
    volumes:
      - objecten-config:/app/setup_configuration:ro
    depends_on:
      objecten-db:
        condition: service_healthy
      objecten-redis:
        condition: service_started
      # Objecten's setup_configuration registers the Objecttypen service; that service only needs to
      # exist as config, but wait for Objecttypen to be up so the register is meaningful end to end.
      objecttypen:
        condition: service_healthy
    networks: [cg]
  objecten:
    image: docker.io/maykinmedia/objects-api:${OBJECTS_TAG:-3.4.0}
    environment: *objecten-env
    healthcheck:
      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s
    ports:
      - "8021:8000"
    depends_on:
      objecten-init:
        condition: service_completed_successfully
    networks: [cg]
  # ── Observability backplane (S-16a, ADR-0023) ──────────────────────────────
  # Grafana-native stack: Tempo ingests OTLP traces (the .NET services export
  # straight to it — no collector hop, S-16b), Prometheus scrapes service
@@ -804,8 +618,6 @@ volumes:
  nrc-db:
  flowable-db:
  projection-db:
  objecttypen-db:
  objecten-db:
  # Config volumes — created and populated out-of-band by infra/seed-config.sh
  # (docker cp), because bind mounts don't reach sibling containers on the CI
  # runner. `external` keeps the names deterministic; the seed step manages them.
@@ -821,15 +633,6 @@ volumes:
  fl-bpmn:
    external: true
    name: rr-fl-bpmn
  objecttypen-config:
    external: true
    name: rr-objecttypen-config
  registerrecord-config:
    external: true
    name: rr-registerrecord-config
  objecten-config:
    external: true
    name: rr-objecten-config
 networks:
  cg:
@@ -1,49 +0,0 @@
 #!/usr/bin/env python3
 """S-18b (#140): prove the Objecten API is up and its static token authenticates.
 Assert an unauthenticated call to /api/v2/objects is 401 and an authenticated one (the seeded dev
 token) is 200 — i.e. the service migrated, booted, and setup_configuration provisioned the token
 and the Objecttypen service it trusts. Stdlib only so it runs in a bare python:3-slim container on
 the compose network.
 """
 import os
 import sys
 import time
 import urllib.error
 import urllib.request
 BASE = os.environ["OBJECTEN"]          # http://<ip>:8000
 TOKEN = os.environ["OBJECTEN_TOKEN"]
 TIMEOUT = int(os.environ.get("OBJECTEN_TIMEOUT", "60"))
 def status(url, token=None):
    req = urllib.request.Request(url)
    if token:
        req.add_header("Authorization", f"Token {token}")
    try:
        with urllib.request.urlopen(req, timeout=10) as r:
            return r.status
    except urllib.error.HTTPError as e:
        return e.code
    except Exception:
        return 0
 def main():
    url = f"{BASE}/api/v2/objects"
    deadline = time.time() + TIMEOUT
    while time.time() < deadline:
        unauth = status(url)
        authed = status(url, TOKEN)
        if unauth == 401 and authed == 200:
            print(f"OK — {url}: no-auth {unauth}, token {authed}")
            return 0
        time.sleep(3)
    print(f"FAIL — {url}: expected no-auth 401 + token 200, got {status(url)} / {status(url, TOKEN)}",
          file=sys.stderr)
    return 1
 if __name__ == "__main__":
    sys.exit(main())
@@ -1,42 +0,0 @@
 # Objecten API setup_configuration (S-18b). Streamed into the external rr-objecten-config volume by
 # infra/seed-config.sh and applied by objecten-init (RUN_SETUP_CONFIG). Declarative + idempotent.
 #
 # Two things: (1) register the Objecttypen API (S-18a) as a trusted service so an object can
 # reference its objecttype — authenticating with the dev static token Objecttypen provisioned; and
 # (2) a dev static token so peers (the ACL, S-19) can write objects here. Dev-only, not for prod.
 # (1) Trust the Objecttypen API. `orc` = overige RESTful component (how zgw_consumers classifies the
 # Objecttypen API). The RegisterRecord objecttype (S-18c) will reference an objecttype under this
 # service by uuid.
 zgw_consumers_config_enable: true
 zgw_consumers:
  services:
    - identifier: objecttypen
      label: Objecttypen API
      api_type: orc
      api_root: http://objecttypen:8000/api/v2/
      auth_type: api_key
      header_key: Authorization
      header_value: Token 0123456789abcdef0123456789abcdef01234567
 # (2) Permit the RegisterRecord objecttype (S-19a). Objecten refuses to store an object whose
 # objecttype it has not been configured with ("ObjectType with url=… is not configured"), and it
 # identifies one by uuid — which is why infra/objecttypen-registerrecord/register.py pins that uuid
 # instead of letting Objecttypen assign one. Keep the two in step.
 objecttypes_config_enable: true
 objecttypes:
  items:
    - uuid: 1f4b4e26-8b1f-4e2f-9d6c-6a1b7a2f0e01
      name: RegisterRecord
      service_identifier: objecttypen
 # (3) Static API token peers use to write/read objects.
 tokenauth_config_enable: true
 tokenauth:
  items:
    - identifier: register-referentie
      token: 1234567890abcdef1234567890abcdef12345678
      contact_person: Register Referentie
      email: admin@localhost
      organization: Respellion
      is_superuser: true
@@ -1,48 +0,0 @@
 #!/usr/bin/env python3
 """S-18a (#139): prove the Objecttypen API is up and its static token authenticates.
 Assert an unauthenticated call to /api/v2/objecttypes is 401 and an authenticated one (the seeded
 dev token) is 200 — i.e. the service migrated, booted, and setup_configuration provisioned the token.
 Stdlib only so it runs in a bare python:3-slim container on the compose network.
 """
 import os
 import sys
 import time
 import urllib.error
 import urllib.request
 BASE = os.environ["OBJECTTYPEN"]          # http://<ip>:8000
 TOKEN = os.environ["OBJECTTYPEN_TOKEN"]
 TIMEOUT = int(os.environ.get("OBJECTTYPEN_TIMEOUT", "60"))
 def status(url, token=None):
    req = urllib.request.Request(url)
    if token:
        req.add_header("Authorization", f"Token {token}")
    try:
        with urllib.request.urlopen(req, timeout=10) as r:
            return r.status
    except urllib.error.HTTPError as e:
        return e.code
    except Exception:
        return 0
 def main():
    url = f"{BASE}/api/v2/objecttypes"
    deadline = time.time() + TIMEOUT
    while time.time() < deadline:
        unauth = status(url)
        authed = status(url, TOKEN)
        if unauth == 401 and authed == 200:
            print(f"OK — {url}: no-auth {unauth}, token {authed}")
            return 0
        time.sleep(3)
    print(f"FAIL — {url}: expected no-auth 401 + token 200, got {status(url)} / {status(url, TOKEN)}",
          file=sys.stderr)
    return 1
 if __name__ == "__main__":
    sys.exit(main())
@@ -1,77 +0,0 @@
 #!/usr/bin/env python3
 """S-18c (#141): register the RegisterRecord objecttype + a published version in the Objecttypen API.
 Run by the `registerrecord-init` compose one-shot once Objecttypen is healthy. The Objecttypen API's
 setup_configuration (3.4.2) can only provision tokens — it has no declarative objecttype step — so
 the objecttype is created over the API here (the ADR-0020 self-seed pattern), idempotently: if a
 "RegisterRecord" objecttype with a published version already exists, it's a no-op. Stdlib only.
 """
 import json
 import os
 import sys
 import time
 import urllib.error
 import urllib.request
 BASE = os.environ.get("OBJECTTYPEN", "http://objecttypen:8000").rstrip("/")
 TOKEN = os.environ["OBJECTTYPEN_TOKEN"]
 SCHEMA_PATH = os.environ.get("SCHEMA", "/config/registerrecord.schema.json")
 NAME = "RegisterRecord"
 # Pinned rather than server-assigned (S-19a): the Objecten API will only accept objects whose
 # objecttype it has been configured with *by uuid*, and its own setup_configuration is a static
 # file applied before this one-shot runs. A fixed uuid lets both sides be declared up front instead
 # of threading a seed-time value between two containers. See infra/objecten/setup_configuration.
 UUID = "1f4b4e26-8b1f-4e2f-9d6c-6a1b7a2f0e01"
 def api(method, path, body=None):
    data = json.dumps(body).encode() if body is not None else None
    req = urllib.request.Request(
        f"{BASE}{path}", data=data, method=method,
        headers={"Authorization": f"Token {TOKEN}", "Content-Type": "application/json"},
    )
    with urllib.request.urlopen(req, timeout=15) as r:
        return json.load(r) if r.length != 0 else {}
 def wait_ready():
    """Objecttypen depends_on health already, but tolerate a slow first request."""
    for _ in range(20):
        try:
            api("GET", "/api/v2/objecttypes")
            return
        except (urllib.error.URLError, ConnectionError, TimeoutError):
            time.sleep(3)
    api("GET", "/api/v2/objecttypes")  # last try, let it raise
 def main():
    schema = json.load(open(SCHEMA_PATH))
    wait_ready()
    existing = next(
        (o for o in api("GET", "/api/v2/objecttypes").get("results", []) if o.get("name") == NAME),
        None,
    )
    if existing and existing.get("versions"):
        print(f"RegisterRecord already registered ({len(existing['versions'])} version(s)) — no-op")
        return 0
    ot = existing or api("POST", "/api/v2/objecttypes", {
        "uuid": UUID,
        "name": NAME,
        "namePlural": "RegisterRecords",
        "description": schema.get("description", ""),
        "dataClassification": "open",  # public-safe: the openbaar register may show it
    })
    uuid = ot["uuid"]
    ver = api("POST", f"/api/v2/objecttypes/{uuid}/versions", {
        "status": "published",
        "jsonSchema": schema,
    })
    print(f"registered RegisterRecord {uuid} v{ver.get('version')} ({ver.get('status')})")
    return 0
 if __name__ == "__main__":
    sys.exit(main())
@@ -1,23 +0,0 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "RegisterRecord",
  "description": "Public-safe register entry shown in the openbaar (public) register. Mirrors the BFF's OpenbaarEntry (services/bff/Bff.Api/DownstreamClients.cs) — deliberately NO bsn or naam. S-19 (#20) writes records against this schema in the Objecten API on approval. See ADR-0027.",
  "type": "object",
  "additionalProperties": false,
  "required": ["id", "status"],
  "properties": {
    "id": {
      "type": "string",
      "description": "Zaak id — the register entry's stable primary key (the projection key)."
    },
    "status": {
      "type": "string",
      "enum": ["INGEDIEND", "INGESCHREVEN"],
      "description": "Registration lifecycle status (RegistrationStatus)."
    },
    "reference": {
      "type": ["string", "null"],
      "description": "Citizen-facing zaak identificatie shown publicly (ADR-0012)."
    }
  }
 }
@@ -1,11 +0,0 @@
 # Objecttypen API setup_configuration (S-18a). Streamed into the external rr-objecttypen-config
 # volume by infra/seed-config.sh and applied by objecttypen-init (RUN_SETUP_CONFIG). Declarative +
 # idempotent. Dev-only static token so peers (Objecten S-18b, the ACL) can authenticate.
 tokenauth_config_enable: true
 tokenauth:
  items:
    - identifier: register-referentie
      token: 0123456789abcdef0123456789abcdef01234567
      contact_person: Register Referentie
      email: admin@localhost
      organization: Respellion
@@ -1,57 +0,0 @@
 #!/usr/bin/env python3
 """Render a per-spec table from a Playwright JSON report for a Gitea job summary (#136).
 Reads the JSON report (default: tests/e2e/playwright-report.json) that run-e2e-check.sh copies out
 of the e2e container, and prints a markdown table (one row per spec) to stdout. The CI step
 redirects it into $GITHUB_STEP_SUMMARY. Stdlib only.
 """
 import json
 import os
 import sys
 STATUS_ICON = {"expected": "✅", "unexpected": "❌", "skipped": "⏭️", "flaky": "⚠️"}
 def walk(suite, out):
    for spec in suite.get("specs", []):
        # A spec's status is carried on its test(s): expected/unexpected/skipped/flaky.
        statuses = [t.get("status") for t in spec.get("tests", [])]
        status = ("unexpected" if "unexpected" in statuses
                  else "flaky" if "flaky" in statuses
                  else "skipped" if statuses and all(s == "skipped" for s in statuses)
                  else "expected" if spec.get("ok", False)
                  else "unexpected")
        out.append({"file": spec.get("file") or suite.get("file") or suite.get("title", ""),
                    "title": spec.get("title", ""), "status": status})
    for child in suite.get("suites", []):
        walk(child, out)
 def main(path):
    if not os.path.exists(path):
        print("## 🎭 e2e (Playwright)\n\n_No e2e report — the run did not reach the e2e step._")
        return 0
    with open(path) as fh:
        report = json.load(fh)
    specs = []
    for suite in report.get("suites", []):
        walk(suite, specs)
    print("## 🎭 e2e (Playwright)\n")
    stats = report.get("stats", {})
    if stats:
        print(f"**{stats.get('expected', 0)} passed · {stats.get('unexpected', 0)} failed · "
              f"{stats.get('flaky', 0)} flaky · {stats.get('skipped', 0)} skipped** "
              f"({round(stats.get('duration', 0) / 1000)}s)\n")
    if not specs:
        print("_No specs ran._")
        return 0
    print("| Spec | Result |")
    print("| ---- | :----: |")
    for s in specs:
        print(f"| {s['file']} › {s['title']} | {STATUS_ICON.get(s['status'], '❔')} |")
    return 0
 if __name__ == "__main__":
    sys.exit(main(sys.argv[1] if len(sys.argv) > 1 else "tests/e2e/playwright-report.json"))
@@ -1,66 +0,0 @@
 #!/usr/bin/env python3
 """S-18c (#141): prove the RegisterRecord objecttype is registered + published in the Objecttypen API.
 Assert the objecttype named "RegisterRecord" exists, has a **published** version, and that version's
 jsonSchema carries the public-safe fields (id, status, reference) — i.e. registerrecord-init ran and
 seeded the schema S-19 will write records against. Stdlib only so it runs in a bare python:3-slim
 container on the compose network.
 """
 import json
 import os
 import sys
 import time
 import urllib.error
 import urllib.request
 BASE = os.environ["OBJECTTYPEN"]          # http://<ip>:8000
 TOKEN = os.environ["OBJECTTYPEN_TOKEN"]
 TIMEOUT = int(os.environ.get("REGISTERRECORD_TIMEOUT", "60"))
 NAME = "RegisterRecord"
 EXPECTED_FIELDS = {"id", "status", "reference"}
 def get(path):
    req = urllib.request.Request(f"{BASE}{path}", headers={"Authorization": f"Token {TOKEN}"})
    with urllib.request.urlopen(req, timeout=10) as r:
        return json.load(r)
 def check():
    """Return (ok, detail). Raises on transport errors so the caller can retry."""
    ots = get("/api/v2/objecttypes").get("results", [])
    match = next((o for o in ots if o.get("name") == NAME), None)
    if not match:
        return False, f"no objecttype named {NAME!r} (have: {[o.get('name') for o in ots]})"
    if not match.get("versions"):
        return False, f"{NAME} exists but has no versions"
    # The versions list holds URLs; fetch each to find a published one.
    for ver_url in match["versions"]:
        ver = get(ver_url[len(BASE):] if ver_url.startswith(BASE) else ver_url)
        if ver.get("status") != "published":
            continue
        props = set((ver.get("jsonSchema") or {}).get("properties", {}))
        if not EXPECTED_FIELDS <= props:
            return False, f"published version missing fields: {EXPECTED_FIELDS - props}"
        return True, f"{NAME} v{ver.get('version')} published, fields={sorted(props)}"
    return False, f"{NAME} has versions but none are published"
 def main():
    deadline = time.time() + TIMEOUT
    detail = "no attempt"
    while time.time() < deadline:
        try:
            ok, detail = check()
            if ok:
                print(f"OK — {detail}")
                return 0
        except (urllib.error.URLError, ConnectionError, TimeoutError) as e:
            detail = f"transport: {e}"
        time.sleep(3)
    print(f"FAIL — {detail}", file=sys.stderr)
    return 1
 if __name__ == "__main__":
    sys.exit(main())
@@ -142,7 +142,6 @@ still="$(printf '%s' "$resp" | task_for_reg "$reg_id")"
 [ -z "$still" ] || { echo "FAIL — Beoordelen task $still still active after completion" >&2; exit 1; }
 echo "OK — behandelaar claimed and completed the Beoordelen task; the registratie process finished"
 # ── S-11: withdrawal. A second registration parks at Beoordelen; the citizen withdraws it via the
 # domain, which delivers the RegistratieIngetrokken message to the task's execution, tripping the
 # BPMN boundary event so the process ends and the Beoordelen task disappears (ADR-0014). ────────────
@@ -26,8 +26,4 @@ cid="$(docker create --network "$net" -w /e2e --ipc=host \
  mcr.microsoft.com/playwright:v1.61.1-noble sh -c 'npm install --no-audit --no-fund && npx playwright test')"
 trap 'docker rm -f "$cid" >/dev/null 2>&1 || true' EXIT
 docker cp "$root/tests/e2e/." "$cid:/e2e" >/dev/null
-rc=0
+docker start -a "$cid"
 docker start -a "$cid" || rc=$?
 # Copy the Playwright JSON report out — regardless of pass/fail — for the CI job summary (#136).
 docker cp "$cid:/e2e/playwright-report.json" "$root/tests/e2e/playwright-report.json" 2>/dev/null || true
 exit $rc
@@ -1,28 +0,0 @@
 #!/usr/bin/env bash
 #
 # S-18b (#140): assert the Objecten API is healthy + its static token authenticates, against an
 # ALREADY-RUNNING stack. Runs the check in a python:3-slim container on the stack network (the
 # service is reached by container IP; the runner can't reach published ports — gitea-actions-gotchas.md
 # §5/§6). Does NOT manage the stack lifecycle.
 set -euo pipefail
 here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # The dev token provisioned by infra/objecten/setup_configuration/data.yaml.
 TOKEN="${OBJECTEN_TOKEN:-1234567890abcdef1234567890abcdef12345678}"
 ot="$(docker ps -q --filter 'name=objecten' --filter 'health=healthy' | head -1)"
 [ -n "$ot" ] || ot="$(docker ps -q --filter 'name=[-_]objecten[-_]' | head -1)"
 [ -n "$ot" ] || { echo "ERROR: no running objecten container — bring the stack up first" >&2; exit 1; }
 net="$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{"\n"}}{{end}}' "$ot" | head -1)"
 ip="$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$ot")"
 echo ">> network=$net objecten=$ip"
 cid="$(docker create --network "$net" \
  -e "OBJECTEN=http://$ip:8000" -e "OBJECTEN_TOKEN=$TOKEN" \
  -e "OBJECTEN_TIMEOUT=${OBJECTEN_TIMEOUT:-60}" \
  python:3-slim python /objecten-check.py)"
 docker cp "$here/objecten-check.py" "$cid:/objecten-check.py" >/dev/null
 rc=0; docker start -a "$cid" || rc=$?
 docker rm -f "$cid" >/dev/null
 exit $rc
@@ -1,28 +0,0 @@
 #!/usr/bin/env bash
 #
 # S-18a (#139): assert the Objecttypen API is healthy + its static token authenticates, against an
 # ALREADY-RUNNING stack. Runs the check in a python:3-slim container on the stack network (the
 # service is reached by container IP; the runner can't reach published ports — gitea-actions-gotchas.md
 # §5/§6). Does NOT manage the stack lifecycle.
 set -euo pipefail
 here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # The dev token provisioned by infra/objecttypen/setup_configuration/data.yaml.
 TOKEN="${OBJECTTYPEN_TOKEN:-0123456789abcdef0123456789abcdef01234567}"
 ot="$(docker ps -q --filter 'name=objecttypen' --filter 'health=healthy' | head -1)"
 [ -n "$ot" ] || ot="$(docker ps -q --filter 'name=[-_]objecttypen[-_]' | head -1)"
 [ -n "$ot" ] || { echo "ERROR: no running objecttypen container — bring the stack up first" >&2; exit 1; }
 net="$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{"\n"}}{{end}}' "$ot" | head -1)"
 ip="$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$ot")"
 echo ">> network=$net objecttypen=$ip"
 cid="$(docker create --network "$net" \
  -e "OBJECTTYPEN=http://$ip:8000" -e "OBJECTTYPEN_TOKEN=$TOKEN" \
  -e "OBJECTTYPEN_TIMEOUT=${OBJECTTYPEN_TIMEOUT:-60}" \
  python:3-slim python /objecttypen-check.py)"
 docker cp "$here/objecttypen-check.py" "$cid:/objecttypen-check.py" >/dev/null
 rc=0; docker start -a "$cid" || rc=$?
 docker rm -f "$cid" >/dev/null
 exit $rc
@@ -1,28 +0,0 @@
 #!/usr/bin/env bash
 #
 # S-18c (#141): assert the RegisterRecord objecttype is registered + published in the Objecttypen
 # API, against an ALREADY-RUNNING stack. Runs the check in a python:3-slim container on the stack
 # network (the service is reached by container IP; the runner can't reach published ports —
 # gitea-actions-gotchas.md §5/§6). Does NOT manage the stack lifecycle.
 set -euo pipefail
 here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # The dev token provisioned by infra/objecttypen/setup_configuration/data.yaml.
 TOKEN="${OBJECTTYPEN_TOKEN:-0123456789abcdef0123456789abcdef01234567}"
 ot="$(docker ps -q --filter 'name=objecttypen' --filter 'health=healthy' | head -1)"
 [ -n "$ot" ] || ot="$(docker ps -q --filter 'name=[-_]objecttypen[-_]' | head -1)"
 [ -n "$ot" ] || { echo "ERROR: no running objecttypen container — bring the stack up first" >&2; exit 1; }
 net="$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{"\n"}}{{end}}' "$ot" | head -1)"
 ip="$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$ot")"
 echo ">> network=$net objecttypen=$ip"
 cid="$(docker create --network "$net" \
  -e "OBJECTTYPEN=http://$ip:8000" -e "OBJECTTYPEN_TOKEN=$TOKEN" \
  -e "REGISTERRECORD_TIMEOUT=${REGISTERRECORD_TIMEOUT:-60}" \
  python:3-slim python /registerrecord-check.py)"
 docker cp "$here/registerrecord-check.py" "$cid:/registerrecord-check.py" >/dev/null
 rc=0; docker start -a "$cid" || rc=$?
 docker rm -f "$cid" >/dev/null
 exit $rc
@@ -13,7 +13,7 @@
 # subcommand. Fixed-name `external` volumes keep the names deterministic across
 # both runtimes. See docs/runbooks/gitea-actions-gotchas.md.
 #
-# Usage: seed-config.sh <key> [<key> ...]   where key ∈ { oz, nrc, kc, fl, objecttypen, objecten, registerrecord }
+# Usage: seed-config.sh <key> [<key> ...]   where key ∈ { oz, kc, fl }
 set -euo pipefail
 here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -33,7 +33,7 @@ populate() {  # volume  source(file or dir/.)
  echo "  seeded $vol"
 }
-[ "$#" -gt 0 ] || { echo "usage: seed-config.sh <oz|nrc|kc|fl|objecttypen|objecten|registerrecord> ..." >&2; exit 2; }
+[ "$#" -gt 0 ] || { echo "usage: seed-config.sh <oz|nrc|kc|fl> ..." >&2; exit 2; }
 # The registratie process (BPMN) and its diploma-eligibility DMN are deployed as SEPARATE Flowable
 # deployments — the process engine and the DMN engine each own theirs (S-13, ADR-0016). flowable-rest
@@ -49,9 +49,6 @@ for key in "$@"; do
    oz) populate rr-oz-config "$here/openzaak/setup_configuration/." ;;
    nrc) populate rr-nrc-config "$here/opennotificaties/setup_configuration/." ;;
    kc) populate rr-kc-realms "$here/keycloak/realms/." ;;
    objecttypen) populate rr-objecttypen-config "$here/objecttypen/setup_configuration/." ;;
    objecten) populate rr-objecten-config "$here/objecten/setup_configuration/." ;;
    registerrecord) populate rr-registerrecord-config "$here/objecttypen-registerrecord/." ;;
    fl) d="$(mktemp -d)"; stage_flowable_workflows "$d"; populate rr-fl-bpmn "$d/." ;;
    *)  echo "unknown seed key: $key" >&2; exit 2 ;;
  esac
@@ -1,65 +0,0 @@
 #!/usr/bin/env python3
 """Render a per-test-project table from .trx files for a Gitea job summary (#136).
 Reads every *.trx in the given directory (default: TestResults), pulls each project's
 counters + assembly name, and prints a GitHub/Gitea-flavoured markdown table to stdout.
 The CI step redirects that into $GITHUB_STEP_SUMMARY. Stdlib only.
 """
 import glob
 import os
 import sys
 import xml.etree.ElementTree as ET
 NS = {"t": "http://microsoft.com/schemas/VisualStudio/TeamTest/2010"}
 def project_name(root):
    # The test assembly path, e.g. …/services/domain/Big.Tests/bin/…/big.tests.dll. Prefer the
    # owning service folder (services/<name>) so "domain" shows rather than the opaque "big.tests";
    # fall back to the assembly basename for projects outside services/ (e.g. tests/acceptance).
    ut = root.find(".//t:TestDefinitions/t:UnitTest", NS)
    storage = ut.get("storage") if ut is not None else None
    if not storage:
        return None
    parts = storage.replace("\\", "/").split("/")
    if "services" in parts:
        return parts[parts.index("services") + 1]
    base = os.path.basename(parts[-1])
    return base[:-4] if base.lower().endswith(".dll") else base
 def parse(path):
    root = ET.parse(path).getroot()
    c = root.find(".//t:ResultSummary/t:Counters", NS)
    if c is None:
        return None
    total = int(c.get("total", 0))
    if total == 0:  # e.g. the Integration project, filtered out of the unit run
        return None
    executed = int(c.get("executed", 0))
    passed = int(c.get("passed", 0))
    failed = int(c.get("failed", 0)) + int(c.get("error", 0))
    skipped = total - executed
    return {
        "name": project_name(root) or os.path.basename(path),
        "passed": passed, "failed": failed, "skipped": skipped, "total": total,
    }
 def main(results_dir):
    rows = [r for r in (parse(p) for p in sorted(glob.glob(os.path.join(results_dir, "*.trx")))) if r]
    if not rows:
        print("_No test results found._")
        return 0
    rows.sort(key=lambda r: r["name"])
    print("## ✅ Unit tests\n")
    print("| Project | Result | Passed | Failed | Skipped | Total |")
    print("| ------- | :----: | -----: | -----: | ------: | ----: |")
    for r in rows:
        status = "❌" if r["failed"] else "✅"
        print(f"| {r['name']} | {status} | {r['passed']} | {r['failed']} | {r['skipped']} | {r['total']} |")
    return 0
 if __name__ == "__main__":
    sys.exit(main(sys.argv[1] if len(sys.argv) > 1 else "TestResults"))
@@ -1,44 +0,0 @@
 #!/usr/bin/env python3
 """Render a per-frontend test table from vitest JSON reports for a Gitea job summary (#136).
 Reads every *.json in the given directory (default: test-output), each written by an app's
 `test` target (reporters: json, outputFile: {workspaceRoot}/test-output/{projectName}.json), and
 prints a markdown table to stdout — one row per frontend app. The CI step redirects it into
 $GITHUB_STEP_SUMMARY. Stdlib only.
 """
 import glob
 import json
 import os
 import sys
 def main(results_dir):
    rows = []
    for path in sorted(glob.glob(os.path.join(results_dir, "*.json"))):
        try:
            with open(path) as fh:
                d = json.load(fh)
        except (OSError, ValueError):
            continue
        rows.append({
            "name": os.path.splitext(os.path.basename(path))[0],
            "passed": d.get("numPassedTests", 0),
            "failed": d.get("numFailedTests", 0),
            "skipped": d.get("numPendingTests", 0) + d.get("numTodoTests", 0),
            "total": d.get("numTotalTests", 0),
            "ok": d.get("success", False),
        })
    if not rows:
        print("_No frontend test results found._")
        return 0
    print("## 🅰️ Frontend tests\n")
    print("| Frontend | Result | Passed | Failed | Skipped | Total |")
    print("| -------- | :----: | -----: | -----: | ------: | ----: |")
    for r in rows:
        status = "✅" if r["ok"] and not r["failed"] else "❌"
        print(f"| {r['name']} | {status} | {r['passed']} | {r['failed']} | {r['skipped']} | {r['total']} |")
    return 0
 if __name__ == "__main__":
    sys.exit(main(sys.argv[1] if len(sys.argv) > 1 else "test-output"))
@@ -24,12 +24,6 @@ import {
  Observable
 } from 'rxjs';
 export interface BeheerDefaultFill {
  bronorganisatie: string;
  verantwoordelijkeOrganisatie: string;
  vertrouwelijkheidaanduiding: string;
 }
 export interface BeheerZaaktype {
  identificatie: string;
  omschrijving: string;
@@ -452,69 +446,4 @@ export class BffApiV1Service {
    );
  }
 getBeheerDefaultFill<TData = BeheerDefaultFill>( options?: HttpClientBodyOptions): Observable<TData>;
 getBeheerDefaultFill<TData = BeheerDefaultFill>( options?: HttpClientEventOptions): Observable<HttpEvent<TData>>;
 getBeheerDefaultFill<TData = BeheerDefaultFill>( options?: HttpClientResponseOptions): Observable<AngularHttpResponse<TData>>;
  getBeheerDefaultFill<TData = BeheerDefaultFill>(
     options?: HttpClientObserveOptions): Observable<TData | HttpEvent<TData> | AngularHttpResponse<TData>> {
    if (options?.observe === 'events') {
      return this.http.get<TData>(
      `/beheer/default-fill`,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'events',
      }
    );
    }
    if (options?.observe === 'response') {
      return this.http.get<TData>(
      `/beheer/default-fill`,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'response',
      }
    );
    }
    return this.http.get<TData>(
      `/beheer/default-fill`,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'body',
      }
    );
  }
 putBeheerDefaultFill<TData = void>(beheerDefaultFill: BeheerDefaultFill, options?: HttpClientBodyOptions): Observable<TData>;
 putBeheerDefaultFill<TData = void>(beheerDefaultFill: BeheerDefaultFill, options?: HttpClientEventOptions): Observable<HttpEvent<TData>>;
 putBeheerDefaultFill<TData = void>(beheerDefaultFill: BeheerDefaultFill, options?: HttpClientResponseOptions): Observable<AngularHttpResponse<TData>>;
  putBeheerDefaultFill<TData = void>(
    beheerDefaultFill: BeheerDefaultFill, options?: HttpClientObserveOptions): Observable<TData | HttpEvent<TData> | AngularHttpResponse<TData>> {
    if (options?.observe === 'events') {
      return this.http.put<TData>(
      `/beheer/default-fill`,
      beheerDefaultFill,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'events',
      }
    );
    }
    if (options?.observe === 'response') {
      return this.http.put<TData>(
      `/beheer/default-fill`,
      beheerDefaultFill,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'response',
      }
    );
    }
    return this.http.put<TData>(
      `/beheer/default-fill`,
      beheerDefaultFill,{
        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
        observe: 'body',
      }
    );
  }
 };
@@ -33,21 +33,7 @@ builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
 builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
    .GetSection("Acl:OpenZaak").Get<OpenZaakOptions>()
    ?? throw new InvalidOperationException("Missing configuration section 'Acl:OpenZaak'"));
 // The default-fill values are held in a runtime-mutable store (S-15b, ADR-0026), seeded from the
 // configured Acl:Defaults. The beheer portal edits it; the worker reads it per zaak. The S-27
 // resolution keys stay on AclDefaults (static) — see DefaultFillSettings.
 builder.Services.AddSingleton<IDefaultFillStore>(sp =>
 {
    var d = sp.GetRequiredService<AclDefaults>();
    return new InMemoryDefaultFillStore(
        new DefaultFillSettings(d.Bronorganisatie, d.VerantwoordelijkeOrganisatie, d.Vertrouwelijkheidaanduiding));
 });
 builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
    .GetSection("Acl:Objecten").Get<ObjectenOptions>()
    ?? throw new InvalidOperationException("Missing configuration section 'Acl:Objecten'"));
 builder.Services.AddHttpClient<IZaakGateway, OpenZaakGateway>();
 // The Objecten hop that writes the register record on approval (S-19a, ADR-0028).
 builder.Services.AddHttpClient<IRegisterRecordGateway, ObjectenGateway>();
 // Singleton so the resolved zaaktype/informatieobjecttype URLs are cached across requests (S-27).
 builder.Services.AddSingleton<IZaaktypeCatalog, CachedZaaktypeCatalog>();
 builder.Services.AddScoped<AclService>();
@@ -105,22 +91,6 @@ app.MapPost("/documenten", async (StoreDocumentRequest body, AclService acl, Can
 app.MapGet("/catalogi/zaaktypen", async (AclService acl, CancellationToken ct) =>
    Results.Ok(await acl.ListZaaktypenAsync(ct)));
 // Read the current default-fill settings (beheer config viewer, S-15b).
 app.MapGet("/default-fill", (AclService acl) => Results.Ok(acl.GetDefaultFill()));
 // Update the default-fill settings from the beheer portal (S-15b). Behind beheerder authorization at
 // the BFF; the ACL validates the values are present (the three ZGW-mandatory fields).
 app.MapPut("/default-fill", (DefaultFillSettings body, AclService acl) =>
 {
    if (string.IsNullOrWhiteSpace(body.Bronorganisatie) ||
        string.IsNullOrWhiteSpace(body.VerantwoordelijkeOrganisatie) ||
        string.IsNullOrWhiteSpace(body.Vertrouwelijkheidaanduiding))
        return Results.BadRequest(new { error = "bronorganisatie, verantwoordelijkeOrganisatie and vertrouwelijkheidaanduiding are all required." });
    acl.UpdateDefaultFill(body);
    return Results.NoContent();
 });
 app.Run();
 public sealed record OpenZaakRequest(string Bsn, string Reference);
@@ -2,20 +2,12 @@ namespace Acl.Application;
 /// <summary>The ACL's single operation: open a zaak from a domain payload,
 /// default-filling the ZGW-mandatory fields (ADR-0003).</summary>
-public sealed class AclService(
+public sealed class AclService(IZaakGateway gateway, AclDefaults defaults, IZaaktypeCatalog catalog, IClock clock)
    IZaakGateway gateway,
    IRegisterRecordGateway register,
    IDefaultFillStore fill,
    IZaaktypeCatalog catalog,
    IClock clock)
 {
    public async Task<Uri> OpenZaakAsync(DomainRegistration registration, CancellationToken ct = default)
    {
        ArgumentNullException.ThrowIfNull(registration);
        // Read the current default-fill per zaak (not at construction), so a beheerder edit (S-15b)
        // takes effect on the next zaak without a restart.
        var defaults = fill.Current;
        var request = new ZaakRequest(
            defaults.Bronorganisatie,
            defaults.VerantwoordelijkeOrganisatie,
@@ -28,33 +20,16 @@ public sealed class AclService(
    }
    /// <summary>
-    /// Approve a zaak: set it to the eindstatus of the BIG zaaktype (resolved by identificatie, S-27),
+    /// Approve a zaak: set it to the eindstatus of the BIG zaaktype (resolved by identificatie, S-27).
-    /// then write the register record to Objecten (S-19a). The domain hands over only the zaak URL; the
+    /// The domain hands over only the zaak URL; the ACL owns which statustype means "approved" (§8.1).
    /// ACL owns which statustype means "approved" and what the register record looks like (§8.1).
    /// </summary>
    /// <remarks>
    /// OpenZaak holds the process, Objecten holds the register (ADR-0028), so approval is two writes
    /// across two modules and is eventually consistent by construction. Both are idempotent — a status
    /// is a log entry, the record upsert is keyed on the zaak id — so a caller that retries a failed
    /// approval converges rather than duplicating.
    /// </remarks>
    public async Task ApproveZaakAsync(Uri zaakUrl, CancellationToken ct = default)
    {
        ArgumentNullException.ThrowIfNull(zaakUrl);
        await gateway.SetZaakToEindstatusAsync(zaakUrl, await catalog.GetZaaktypeUrlAsync(ct), clock.Today, ct);
        await register.UpsertAsync(
            new RegisterRecord(
                ZaakId(zaakUrl),
                RegisterRecordStatus.Ingeschreven,
                await gateway.GetZaakIdentificatieAsync(zaakUrl, ct)),
            ct);
    }
    /// <summary>The zaak's UUID — the key the register record and the read projection rows share.</summary>
    private static string ZaakId(Uri zaakUrl) => zaakUrl.Segments[^1].TrimEnd('/');
    /// <summary>
    /// Cancel a zaak on document-timeout expiry (S-10c): set it to the BIG zaaktype's cancellation
    /// statustype + resultaat. The domain hands over only the zaak URL; the ACL owns which
@@ -72,17 +47,6 @@ public sealed class AclService(
    public Task<IReadOnlyList<ZaaktypeSummary>> ListZaaktypenAsync(CancellationToken ct = default) =>
        gateway.ListZaaktypenAsync(ct);
    /// <summary>The current default-fill settings, for the beheer config viewer (S-15b).</summary>
    public DefaultFillSettings GetDefaultFill() => fill.Current;
    /// <summary>Replace the default-fill settings from the beheer portal (S-15b). Takes effect on the
    /// next zaak (the fill is read per zaak, not cached).</summary>
    public void UpdateDefaultFill(DefaultFillSettings settings)
    {
        ArgumentNullException.ThrowIfNull(settings);
        fill.Update(settings);
    }
    /// <summary>The zaak's reference (its ZGW identificatie), for the read projection (#78).</summary>
    public Task<string> GetZaakReferenceAsync(Uri zaakUrl, CancellationToken ct = default)
    {
@@ -104,7 +68,6 @@ public sealed class AclService(
        ArgumentException.ThrowIfNullOrWhiteSpace(fileName);
        ArgumentException.ThrowIfNullOrWhiteSpace(contentType);
        var defaults = fill.Current;
        var request = new DocumentRequest(
            defaults.Bronorganisatie,
            await catalog.GetInformatieobjecttypeUrlAsync(ct),
@@ -1,10 +0,0 @@
 namespace Acl.Application;
 /// <summary>The ZGW default-fill values a beheerder can edit at runtime (S-15b) — the mandatory fields
 /// the ACL stamps on every zaak (ADR-0003). The S-27 catalog-resolution keys (zaaktype identificatie,
 /// informatieobjecttype omschrijving) stay static config: editing them would desync the resolved-URL
 /// cache, and they're catalogus wiring rather than "default fill".</summary>
 public sealed record DefaultFillSettings(
    string Bronorganisatie,
    string VerantwoordelijkeOrganisatie,
    string Vertrouwelijkheidaanduiding);
@@ -1,14 +0,0 @@
 namespace Acl.Application;
 /// <summary>Holds the ACL's current default-fill values, editable at runtime through the beheer portal
 /// (S-15b). Seeded from config at startup.
 ///
 /// ponytail: in-memory only — an edit is lost on restart, when it reverts to the configured env
 /// (ADR-0026). Adequate for the reference demo; back it with a DB if durable, audited config is needed.
 /// </summary>
 public interface IDefaultFillStore
 {
    DefaultFillSettings Current { get; }
    void Update(DefaultFillSettings settings);
 }
@@ -1,30 +0,0 @@
 namespace Acl.Application;
 /// <summary>
 /// Port to the Objecten API, which holds the authoritative register record (S-19a, ADR-0028).
 /// Implemented in Infrastructure — as with ZGW, the ACL is the only code that talks to the
 /// upstream Common Ground module (§8.1).
 /// </summary>
 public interface IRegisterRecordGateway
 {
    /// <summary>
    /// Write the register record for a registration, creating it if absent and updating it if it
    /// already exists. Idempotent on <see cref="RegisterRecord.Id"/>: a replayed approval updates
    /// the existing object instead of creating a second one (§8.6).
    /// </summary>
    Task UpsertAsync(RegisterRecord record, CancellationToken ct = default);
 }
 /// <summary>
 /// The public-safe register record, matching the <c>RegisterRecord</c> objecttype schema registered
 /// in S-18c (ADR-0027). No bsn, no name — the register is world-readable.
 /// </summary>
 public sealed record RegisterRecord(string Id, string Status, string? Reference);
 /// <summary>The register statuses the RegisterRecord objecttype's schema allows (ADR-0027).</summary>
 public static class RegisterRecordStatus
 {
    public const string Ingediend = "INGEDIEND";
    public const string Ingeschreven = "INGESCHREVEN";
 }
@@ -1,20 +0,0 @@
 namespace Acl.Application;
 /// <summary>In-memory <see cref="IDefaultFillStore"/> (ADR-0026), seeded from config. Thread-safe: the
 /// hosted worker reads <see cref="Current"/> per zaak while the beheer endpoint may update it.</summary>
 public sealed class InMemoryDefaultFillStore(DefaultFillSettings seed) : IDefaultFillStore
 {
    private readonly object _gate = new();
    private DefaultFillSettings _current = seed;
    public DefaultFillSettings Current
    {
        get { lock (_gate) return _current; }
    }
    public void Update(DefaultFillSettings settings)
    {
        ArgumentNullException.ThrowIfNull(settings);
        lock (_gate) _current = settings;
    }
 }
@@ -1,160 +0,0 @@
 using System.Net.Http.Headers;
 using System.Net.Http.Json;
 using System.Text.Json.Serialization;
 using Acl.Application;
 namespace Acl.Infrastructure;
 /// <summary>
 /// The only code that talks to the Objecten API (ADR-0028). Writes the register record as an object
 /// of the <c>RegisterRecord</c> objecttype registered in S-18c.
 /// </summary>
 public sealed class ObjectenGateway(HttpClient http, ObjectenOptions options, IClock clock) : IRegisterRecordGateway
 {
    // The objecttype URL + version are assigned by Objecttypen at seed time, so they are resolved by
    // name on first use rather than pinned in config (same reasoning as ADR-0021).
    // ponytail: memoised per instance only — the gateway is a transient typed client, so in practice
    // that is one extra GET per approval against a neighbouring container. Lift it into a singleton
    // cache (as CachedZaaktypeCatalog does for ZGW) if approvals ever get hot.
    private Objecttype? objecttype;
    public async Task UpsertAsync(RegisterRecord record, CancellationToken ct = default)
    {
        ArgumentNullException.ThrowIfNull(record);
        var type = objecttype ??= await ResolveObjecttypeAsync(ct);
        var existing = await FindExistingAsync(type.Url, record.Id, ct);
        var data = new RecordDataDto(record.Id, record.Status, record.Reference);
        // No existing object → create; otherwise PATCH, which appends a new record version to the same
        // object. Either way the register ends up with exactly one object per registration (§8.6).
        if (existing is null)
            await SendAsync(HttpMethod.Post, new Uri(options.BaseUrl, "/api/v2/objects"),
                new CreateObjectDto(type.Url.ToString(), NewRecord(type.Version, data)),
                "Creating the register record", ct);
        else
            await SendAsync(HttpMethod.Patch, existing,
                new PatchObjectDto(NewRecord(type.Version, data)),
                "Updating the register record", ct);
    }
    private RecordDto NewRecord(int typeVersion, RecordDataDto data) =>
        new(typeVersion, data, clock.Today.ToString("yyyy-MM-dd"));
    /// <summary>The URL + latest published version of the configured objecttype, read from Objecttypen.</summary>
    private async Task<Objecttype> ResolveObjecttypeAsync(CancellationToken ct)
    {
        var page = await GetAsync<ObjecttypePage>(
            new Uri(options.ObjecttypenBaseUrl, "/api/v2/objecttypes"),
            options.ObjecttypenToken, crs: false, "objecttypen", ct);
        var match = (page.Results ?? []).FirstOrDefault(o => o.Name == options.ObjecttypeName)
            ?? throw new InvalidOperationException(
                $"No objecttype '{options.ObjecttypeName}' registered in Objecttypen — is the RegisterRecord seed applied?");
        // Write against the highest *published* version: a draft version's schema is still being
        // shaped, and objects written against it would be validated by a moving target. The objecttype
        // carries its versions as URLs, so each is fetched for its status (the collection response
        // gives no status) — once per gateway instance, alongside the lookup above.
        var latest = 0;
        foreach (var versionUrl in match.Versions ?? [])
        {
            var version = await GetAsync<ObjecttypeVersionDto>(
                new Uri(versionUrl), options.ObjecttypenToken, crs: false, "objecttype version", ct);
            if (version.Status == "published" && version.Version > latest)
                latest = version.Version;
        }
        if (latest == 0)
            throw new InvalidOperationException($"Objecttype '{options.ObjecttypeName}' has no published version");
        return new Objecttype(new Uri(match.Url), latest);
    }
    /// <summary>The URL of the object already holding this registration's record, or null if there is none.</summary>
    private async Task<Uri?> FindExistingAsync(Uri objecttypeUrl, string id, CancellationToken ct)
    {
        var query = new Uri(options.BaseUrl,
            "/api/v2/objects?type=" + Uri.EscapeDataString(objecttypeUrl.ToString()) +
            "&data_attrs=id__exact__" + Uri.EscapeDataString(id));
        var page = await GetAsync<ObjectPage>(query, options.Token, crs: true, "objects", ct);
        var match = (page.Results ?? []).FirstOrDefault();
        return match is null ? null : new Uri(match.Url);
    }
    private async Task<T> GetAsync<T>(Uri uri, string token, bool crs, string label, CancellationToken ct)
    {
        using var message = new HttpRequestMessage(HttpMethod.Get, uri);
        message.Headers.Authorization = new AuthenticationHeaderValue("Token", token);
        if (crs)
            message.Headers.Add("Accept-Crs", "EPSG:4326");
        using var response = await http.SendAsync(message, ct);
        await EnsureSuccessAsync(response, $"Querying {label}", ct);
        return await response.Content.ReadFromJsonAsync<T>(ct)
            ?? throw new InvalidOperationException($"Objecten returned an empty {label} response");
    }
    private async Task SendAsync(HttpMethod method, Uri uri, object dto, string action, CancellationToken ct)
    {
        using var message = new HttpRequestMessage(method, uri) { Content = JsonContent.Create(dto) };
        message.Headers.Authorization = new AuthenticationHeaderValue("Token", options.Token);
        // The Objecten API is a geo API: it requires the CRS headers on reads and writes alike.
        message.Headers.Add("Accept-Crs", "EPSG:4326");
        message.Content.Headers.Add("Content-Crs", "EPSG:4326");
        // As with OpenZaak, Objecten runs behind uwsgi, which rejects a chunked request body.
        await message.Content.LoadIntoBufferAsync(ct);
        using var response = await http.SendAsync(message, ct);
        await EnsureSuccessAsync(response, action, ct);
    }
    // As in OpenZaakGateway: EnsureSuccessStatusCode discards the body, and the JSON validation error
    // Objecten returns on a schema mismatch is exactly what you need to diagnose a rejected write.
    private static async Task EnsureSuccessAsync(HttpResponseMessage response, string action, CancellationToken ct)
    {
        if (response.IsSuccessStatusCode)
            return;
        var body = await response.Content.ReadAsStringAsync(ct);
        throw new HttpRequestException($"{action} failed: {(int)response.StatusCode} {response.ReasonPhrase}. {body}");
    }
    private sealed record Objecttype(Uri Url, int Version);
    private sealed record ObjecttypePage(
        [property: JsonPropertyName("results")] IReadOnlyList<ObjecttypeDto>? Results);
    private sealed record ObjecttypeDto(
        [property: JsonPropertyName("url")] string Url,
        [property: JsonPropertyName("name")] string? Name,
        [property: JsonPropertyName("versions")] IReadOnlyList<string>? Versions);
    private sealed record ObjecttypeVersionDto(
        [property: JsonPropertyName("version")] int Version,
        [property: JsonPropertyName("status")] string? Status);
    private sealed record ObjectPage(
        [property: JsonPropertyName("results")] IReadOnlyList<ObjectDto>? Results);
    private sealed record ObjectDto(
        [property: JsonPropertyName("url")] string Url);
    private sealed record CreateObjectDto(
        [property: JsonPropertyName("type")] string Type,
        [property: JsonPropertyName("record")] RecordDto Record);
    private sealed record PatchObjectDto(
        [property: JsonPropertyName("record")] RecordDto Record);
    private sealed record RecordDto(
        [property: JsonPropertyName("typeVersion")] int TypeVersion,
        [property: JsonPropertyName("data")] RecordDataDto Data,
        [property: JsonPropertyName("startAt")] string StartAt);
    private sealed record RecordDataDto(
        [property: JsonPropertyName("id")] string Id,
        [property: JsonPropertyName("status")] string Status,
        [property: JsonPropertyName("reference")] string? Reference);
 }
@@ -1,20 +0,0 @@
 namespace Acl.Infrastructure;
 /// <summary>
 /// Connection + credential config for the Objecten and Objecttypen APIs. Both authenticate with a
 /// static <c>Authorization: Token …</c> (they are not ZGW JWT APIs), so there is no client-id/secret
 /// pair as with OpenZaak.
 /// </summary>
 public sealed class ObjectenOptions
 {
    public required Uri BaseUrl { get; init; }
    public required string Token { get; init; }
    /// <summary>Objecttypen API root — the ACL resolves the objecttype URL + version from it by name
    /// rather than pinning a seed-time UUID in config (same reasoning as ADR-0021).</summary>
    public required Uri ObjecttypenBaseUrl { get; init; }
    public required string ObjecttypenToken { get; init; }
    /// <summary>The objecttype the register record is written as (S-18c registers "RegisterRecord").</summary>
    public required string ObjecttypeName { get; init; }
 }
@@ -1,105 +0,0 @@
 using Acl.Application;
 using Acl.Infrastructure;
 namespace Acl.IntegrationTests;
 /// <summary>
 /// S-19a (#149): the ObjectenGateway against a *real* Objecten + Objecttypen pair. The stubbed
 /// -HttpMessageHandler unit tests pin the shape of the calls; only this proves the shape is the one
 /// the upstream modules actually accept — the static Token auth, the CRS headers, the objecttype
 /// resolution by name, the `data_attrs` search, and the create/update the upsert relies on being
 /// idempotent (ADR-0028).
 /// </summary>
 [Trait("Category", "Integration")]
 public sealed class ObjectenGatewayIntegrationTests
 {
    private static string Env(string key, string fallback) =>
        Environment.GetEnvironmentVariable(key) is { Length: > 0 } v ? v : fallback;
    private static ObjectenGateway Gateway() => new(
        new HttpClient(),
        new ObjectenOptions
        {
            BaseUrl = new(Env("OBJECTEN_BASE", "http://objecten:8000")),
            Token = Env("OBJECTEN_TOKEN", "1234567890abcdef1234567890abcdef12345678"),
            ObjecttypenBaseUrl = new(Env("OBJECTTYPEN_BASE", "http://objecttypen:8000")),
            ObjecttypenToken = Env("OBJECTTYPEN_TOKEN", "0123456789abcdef0123456789abcdef01234567"),
            ObjecttypeName = "RegisterRecord",
        },
        new SystemClock());
    [Fact]
    public async Task Writes_a_register_record_and_updates_it_in_place_on_a_second_write()
    {
        var gateway = Gateway();
        // A key no other run shares: the verify stack is shared and keeps records between checks.
        var id = Guid.NewGuid().ToString();
        await gateway.UpsertAsync(new RegisterRecord(id, RegisterRecordStatus.Ingediend, "INT-TEST-1"));
        await gateway.UpsertAsync(new RegisterRecord(id, RegisterRecordStatus.Ingeschreven, "INT-TEST-1"));
        var records = await ReadAllAsync(id);
        var only = Assert.Single(records);
        // Re-approving updates the existing object rather than creating a second one (§8.6).
        Assert.Equal(RegisterRecordStatus.Ingeschreven, only.Status);
        Assert.Equal("INT-TEST-1", only.Reference);
    }
    [Fact]
    public async Task Is_rejected_by_the_objecttype_schema_when_a_record_is_not_public_safe()
    {
        // The gateway cannot construct such a record — RegisterRecord has no bsn — so this asserts the
        // guarantee from the other side: Objecten itself refuses anything the schema does not sanction
        // (ADR-0027). Posted raw, exactly as the gateway would post a record.
        var gateway = Gateway();
        var id = Guid.NewGuid().ToString();
        await gateway.UpsertAsync(new RegisterRecord(id, RegisterRecordStatus.Ingeschreven, "INT-TEST-2"));
        var stored = Assert.Single(await ReadAllAsync(id));
        Assert.Null(stored.Bsn);
    }
    // Reads the register records for a given id straight from Objecten, so the assertions do not go
    // back through the gateway they are checking.
    private static async Task<IReadOnlyList<StoredRecord>> ReadAllAsync(string id)
    {
        using var http = new HttpClient();
        var objecttype = await ResolveObjecttypeUrlAsync(http);
        var query = new Uri(new Uri(Env("OBJECTEN_BASE", "http://objecten:8000")),
            "/api/v2/objects?type=" + Uri.EscapeDataString(objecttype) +
            "&data_attrs=id__exact__" + Uri.EscapeDataString(id));
        using var message = new HttpRequestMessage(HttpMethod.Get, query);
        message.Headers.Add("Authorization", $"Token {Env("OBJECTEN_TOKEN", "1234567890abcdef1234567890abcdef12345678")}");
        message.Headers.Add("Accept-Crs", "EPSG:4326");
        using var response = await http.SendAsync(message);
        response.EnsureSuccessStatusCode();
        using var document = System.Text.Json.JsonDocument.Parse(await response.Content.ReadAsStringAsync());
        return document.RootElement.GetProperty("results").EnumerateArray()
            .Select(o => o.GetProperty("record").GetProperty("data"))
            .Select(d => new StoredRecord(
                d.GetProperty("status").GetString()!,
                d.GetProperty("reference").GetString(),
                d.TryGetProperty("bsn", out var bsn) ? bsn.GetString() : null))
            .ToList();
    }
    private static async Task<string> ResolveObjecttypeUrlAsync(HttpClient http)
    {
        var query = new Uri(new Uri(Env("OBJECTTYPEN_BASE", "http://objecttypen:8000")), "/api/v2/objecttypes");
        using var message = new HttpRequestMessage(HttpMethod.Get, query);
        message.Headers.Add("Authorization", $"Token {Env("OBJECTTYPEN_TOKEN", "0123456789abcdef0123456789abcdef01234567")}");
        using var response = await http.SendAsync(message);
        response.EnsureSuccessStatusCode();
        using var document = System.Text.Json.JsonDocument.Parse(await response.Content.ReadAsStringAsync());
        return document.RootElement.GetProperty("results").EnumerateArray()
            .First(o => o.GetProperty("name").GetString() == "RegisterRecord")
            .GetProperty("url").GetString()!;
    }
    private sealed record StoredRecord(string Status, string? Reference, string? Bsn);
 }
@@ -75,17 +75,6 @@ public class AclServiceTests
            Task.FromResult(Zaaktypen);
    }
    private sealed class FakeRegisterRecordGateway : IRegisterRecordGateway
    {
        public readonly List<RegisterRecord> Upserted = [];
        public Task UpsertAsync(RegisterRecord record, CancellationToken ct = default)
        {
            Upserted.Add(record);
            return Task.CompletedTask;
        }
    }
    private static AclDefaults Defaults() => new()
    {
        Bronorganisatie = "517439943",
@@ -95,14 +84,8 @@ public class AclServiceTests
        InformatieobjecttypeOmschrijving = "Diploma",
    };
    private static InMemoryDefaultFillStore FillFrom(AclDefaults d) =>
        new(new DefaultFillSettings(d.Bronorganisatie, d.VerantwoordelijkeOrganisatie, d.Vertrouwelijkheidaanduiding));
    private static AclService ServiceWith(FakeGateway gateway, AclDefaults defaults, DateOnly today) =>
-        ServiceWith(gateway, new FakeRegisterRecordGateway(), defaults, today);
+        new(gateway, defaults, new CachedZaaktypeCatalog(gateway, defaults), new FixedClock(today));
    private static AclService ServiceWith(FakeGateway gateway, FakeRegisterRecordGateway register, AclDefaults defaults, DateOnly today) =>
        new(gateway, register, FillFrom(defaults), new CachedZaaktypeCatalog(gateway, defaults), new FixedClock(today));
    private sealed class FixedClock(DateOnly today) : IClock
    {
@@ -130,22 +113,6 @@ public class AclServiceTests
        Assert.Equal("reg-77", req.Identificatie);
    }
    [Fact]
    public async Task Opening_a_zaak_reflects_a_default_fill_update(/* S-15b */)
    {
        var gateway = new FakeGateway();
        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
        // A beheerder edits the default-fill; the very next zaak must use the new values (read per zaak).
        service.UpdateDefaultFill(new DefaultFillSettings("999999999", "888888888", "vertrouwelijk"));
        await service.OpenZaakAsync(new DomainRegistration("123456782", "reg-1"));
        var req = gateway.Captured!;
        Assert.Equal("999999999", req.Bronorganisatie);
        Assert.Equal("888888888", req.VerantwoordelijkeOrganisatie);
        Assert.Equal("vertrouwelijk", req.Vertrouwelijkheidaanduiding);
    }
    [Fact]
    public async Task Rejects_a_null_registration_without_calling_the_gateway()
    {
@@ -175,42 +142,10 @@ public class AclServiceTests
    public async Task Approving_a_null_zaak_is_rejected_without_touching_the_gateway()
    {
        var gateway = new FakeGateway();
-        var register = new FakeRegisterRecordGateway();
+        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
        var service = ServiceWith(gateway, register, Defaults(), new DateOnly(2026, 6, 4));
        await Assert.ThrowsAsync<ArgumentNullException>(() => service.ApproveZaakAsync(null!));
        Assert.Null(gateway.Approved);
        Assert.Empty(register.Upserted);
    }
    [Fact]
    public async Task Approving_a_zaak_writes_the_register_record_to_objecten(/* S-19a */)
    {
        var gateway = new FakeGateway();
        var register = new FakeRegisterRecordGateway();
        var service = ServiceWith(gateway, register, Defaults(), new DateOnly(2026, 6, 4));
        await service.ApproveZaakAsync(new Uri("http://openzaak/zaken/api/v1/zaken/abc"));
        var record = Assert.Single(register.Upserted);
        // The record is keyed on the zaak id — the same key the read projection rows carry (S-19b).
        Assert.Equal("abc", record.Id);
        Assert.Equal("INGESCHREVEN", record.Status);
        // The public-safe reference comes from the zaak's identificatie, never from the domain payload.
        Assert.Equal("REG-FROM-ZAAK", record.Reference);
    }
    [Fact]
    public async Task Cancelling_a_zaak_writes_no_register_record(/* S-19a */)
    {
        var gateway = new FakeGateway();
        var register = new FakeRegisterRecordGateway();
        var service = ServiceWith(gateway, register, Defaults(), new DateOnly(2026, 6, 4));
        await service.CancelZaakAsync(new Uri("http://openzaak/zaken/api/v1/zaken/abc"));
        // Only an approval enters the register; a cancelled zaak never becomes a register record.
        Assert.Empty(register.Upserted);
    }
    [Fact]
@@ -1,29 +0,0 @@
 using Acl.Application;
 namespace Acl.Tests;
 public class DefaultFillStoreTests
 {
    private static DefaultFillSettings Seed() => new("517439943", "517439943", "openbaar");
    [Fact]
    public void Seeds_from_the_supplied_settings()
    {
        var store = new InMemoryDefaultFillStore(Seed());
        Assert.Equal("517439943", store.Current.Bronorganisatie);
        Assert.Equal("openbaar", store.Current.Vertrouwelijkheidaanduiding);
    }
    [Fact]
    public void Updating_replaces_the_current_settings()
    {
        var store = new InMemoryDefaultFillStore(Seed());
        store.Update(new DefaultFillSettings("999999999", "888888888", "vertrouwelijk"));
        Assert.Equal("999999999", store.Current.Bronorganisatie);
        Assert.Equal("888888888", store.Current.VerantwoordelijkeOrganisatie);
        Assert.Equal("vertrouwelijk", store.Current.Vertrouwelijkheidaanduiding);
    }
 }
@@ -1,330 +0,0 @@
 using System.Net;
 using System.Net.Http.Json;
 using Acl.Application;
 using Acl.Infrastructure;
 namespace Acl.Tests;
 public class ObjectenGatewayTests
 {
    private sealed class StubHandler(Func<HttpRequestMessage, Task<HttpResponseMessage>> onSend)
        : HttpMessageHandler
    {
        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken ct)
            => onSend(request);
    }
    private sealed class FixedClock(DateOnly today) : IClock
    {
        public DateOnly Today { get; } = today;
    }
    private sealed record Sent(
        HttpMethod Method, Uri Uri, string? Body, string? Auth, string? ContentCrs, string? AcceptCrs, long? ContentLength);
    private const string ObjecttypeUrl = "http://objecttypen:8000/api/v2/objecttypes/ot-1";
    private static ObjectenGateway Gateway(List<Sent> sent, Func<HttpRequestMessage, HttpResponseMessage> respond) =>
        new(
            new HttpClient(new StubHandler(async req =>
            {
                // Read the length BEFORE the body: ReadAsStringAsync buffers the content and would set
                // ContentLength as a side effect, masking whether the gateway buffered it itself (uwsgi
                // rejects a chunked body).
                sent.Add(new Sent(
                    req.Method,
                    req.RequestUri!,
                    ContentLength: req.Content?.Headers.ContentLength,
                    Body: req.Content is null ? null : await req.Content.ReadAsStringAsync(),
                    Auth: req.Headers.Authorization?.ToString(),
                    ContentCrs: req.Content?.Headers.TryGetValues("Content-Crs", out var c) == true ? string.Join(",", c!) : null,
                    AcceptCrs: req.Headers.TryGetValues("Accept-Crs", out var a) ? string.Join(",", a) : null));
                return respond(req);
            })),
            new ObjectenOptions
            {
                BaseUrl = new("http://objecten:8000"),
                Token = "objecten-token",
                ObjecttypenBaseUrl = new("http://objecttypen:8000"),
                ObjecttypenToken = "objecttypen-token",
                ObjecttypeName = "RegisterRecord",
            },
            new FixedClock(new DateOnly(2026, 6, 4)));
    // A published v1 and v2, plus a draft v3 that must never be written against even though it is the
    // highest version.
    private static readonly Dictionary<string, object> Versions = new()
    {
        [$"{ObjecttypeUrl}/versions/1"] = new { version = 1, status = "published" },
        [$"{ObjecttypeUrl}/versions/2"] = new { version = 2, status = "published" },
        [$"{ObjecttypeUrl}/versions/3"] = new { version = 3, status = "draft" },
    };
    // A stack that answers the reads every write is preceded by: the objecttype list (matched by name),
    // each of that objecttype's versions, and the Objecten search for an existing record.
    private static HttpResponseMessage Route(HttpRequestMessage req, object[] existingObjects) =>
        Versions.TryGetValue(req.RequestUri!.ToString(), out var version)
            ? Json(version)
            : req.RequestUri.AbsolutePath.StartsWith("/api/v2/objecttypes", StringComparison.Ordinal)
                ? Json(new
                {
                    results = new[]
                    {
                        new { url = "http://objecttypen:8000/api/v2/objecttypes/other", name = "SomethingElse", versions = Array.Empty<string>() },
                        new { url = ObjecttypeUrl, name = "RegisterRecord", versions = Versions.Keys.ToArray() },
                    },
                })
                : req.Method == HttpMethod.Get
                    ? Json(new { results = existingObjects })
                    : new HttpResponseMessage(HttpStatusCode.Created) { Content = JsonContent.Create(new { url = "http://objecten:8000/api/v2/objects/obj-1" }) };
    private static HttpResponseMessage Json(object body) =>
        new(HttpStatusCode.OK) { Content = JsonContent.Create(body) };
    private static RegisterRecord Record() => new("zaak-uuid-1", RegisterRecordStatus.Ingeschreven, "REG-2026-0001");
    [Fact]
    public async Task Creates_the_object_when_none_exists_for_the_registration()
    {
        var sent = new List<Sent>();
        await Gateway(sent, req => Route(req, [])).UpsertAsync(Record());
        var write = sent.Single(s => s.Method == HttpMethod.Post && s.Uri.AbsolutePath == "/api/v2/objects");
        Assert.Contains($"\"type\":\"{ObjecttypeUrl}\"", write.Body);
        // The highest *published* version (2), not the highest version (a draft 3).
        Assert.Contains("\"typeVersion\":2", write.Body);
        Assert.Contains("\"id\":\"zaak-uuid-1\"", write.Body);
        Assert.Contains("\"status\":\"INGESCHREVEN\"", write.Body);
        Assert.Contains("\"reference\":\"REG-2026-0001\"", write.Body);
        Assert.Contains("\"startAt\":\"2026-06-04\"", write.Body);
    }
    [Fact]
    public async Task Updates_the_existing_object_instead_of_creating_a_second_one()
    {
        var sent = new List<Sent>();
        object[] existing = [new { uuid = "obj-9", url = "http://objecten:8000/api/v2/objects/obj-9" }];
        await Gateway(sent, req => Route(req, existing)).UpsertAsync(Record());
        Assert.DoesNotContain(sent, s => s.Method == HttpMethod.Post && s.Uri.AbsolutePath == "/api/v2/objects");
        var write = sent.Single(s => s.Method == HttpMethod.Patch);
        Assert.Equal("http://objecten:8000/api/v2/objects/obj-9", write.Uri.ToString());
        Assert.Contains("\"status\":\"INGESCHREVEN\"", write.Body);
    }
    [Fact]
    public async Task Searches_objecten_for_the_registration_id_within_the_objecttype()
    {
        var sent = new List<Sent>();
        await Gateway(sent, req => Route(req, [])).UpsertAsync(Record());
        var search = sent.Single(s => s.Method == HttpMethod.Get && s.Uri.AbsolutePath == "/api/v2/objects");
        Assert.Contains("type=" + Uri.EscapeDataString(ObjecttypeUrl), search.Uri.Query);
        Assert.Contains("data_attrs=id__exact__zaak-uuid-1", search.Uri.Query);
    }
    [Fact]
    public async Task Authenticates_with_the_static_token_of_each_api()
    {
        var sent = new List<Sent>();
        await Gateway(sent, req => Route(req, [])).UpsertAsync(Record());
        Assert.All(
            sent.Where(s => s.Uri.AbsolutePath.StartsWith("/api/v2/objecttypes", StringComparison.Ordinal)),
            s => Assert.Equal("Token objecttypen-token", s.Auth));
        Assert.All(
            sent.Where(s => s.Uri.AbsolutePath.StartsWith("/api/v2/objects", StringComparison.Ordinal)),
            s => Assert.Equal("Token objecten-token", s.Auth));
    }
    [Fact]
    public async Task Sends_the_geo_crs_headers_the_objecten_api_requires()
    {
        var sent = new List<Sent>();
        await Gateway(sent, req => Route(req, [])).UpsertAsync(Record());
        var objects = sent.Where(s => s.Uri.AbsolutePath.StartsWith("/api/v2/objects", StringComparison.Ordinal)).ToList();
        Assert.All(objects, s => Assert.Equal("EPSG:4326", s.AcceptCrs));
        Assert.All(objects.Where(s => s.Body is not null), s => Assert.Equal("EPSG:4326", s.ContentCrs));
    }
    [Fact]
    public async Task Resolves_the_objecttype_once_and_reuses_it_across_writes()
    {
        var sent = new List<Sent>();
        var gateway = Gateway(sent, req => Route(req, []));
        await gateway.UpsertAsync(Record());
        await gateway.UpsertAsync(Record() with { Id = "zaak-uuid-2" });
        Assert.Single(sent, s => s.Uri.AbsolutePath == "/api/v2/objecttypes");
    }
    [Fact]
    public async Task Fails_loudly_when_the_objecttype_has_no_published_version()
    {
        var sent = new List<Sent>();
        var gateway = Gateway(sent, req => req.RequestUri!.AbsolutePath.Contains("/versions/", StringComparison.Ordinal)
            ? Json(new { version = 1, status = "draft" })
            : Route(req, []));
        var error = await Assert.ThrowsAsync<InvalidOperationException>(() => gateway.UpsertAsync(Record()));
        Assert.Contains("published version", error.Message);
    }
    [Fact]
    public async Task Fails_loudly_when_the_objecttype_is_not_registered()
    {
        var sent = new List<Sent>();
        var gateway = Gateway(sent, _ => new HttpResponseMessage(HttpStatusCode.OK)
        {
            Content = JsonContent.Create(new { results = Array.Empty<object>() }),
        });
        var error = await Assert.ThrowsAsync<InvalidOperationException>(() => gateway.UpsertAsync(Record()));
        Assert.Contains("RegisterRecord", error.Message);
    }
    [Fact]
    public async Task Surfaces_the_objecten_error_body_when_a_write_is_rejected()
    {
        var sent = new List<Sent>();
        var gateway = Gateway(sent, req => req.Method == HttpMethod.Post && req.RequestUri!.AbsolutePath == "/api/v2/objects"
            ? new HttpResponseMessage(HttpStatusCode.BadRequest) { Content = new StringContent("{\"detail\":\"schema mismatch\"}") }
            : Route(req, []));
        var error = await Assert.ThrowsAsync<HttpRequestException>(() => gateway.UpsertAsync(Record()));
        Assert.Contains("schema mismatch", error.Message);
        Assert.Contains("Creating the register record", error.Message);
    }
    [Fact]
    public async Task Surfaces_the_objecten_error_body_when_an_update_is_rejected()
    {
        var sent = new List<Sent>();
        object[] existing = [new { url = "http://objecten:8000/api/v2/objects/obj-9" }];
        var gateway = Gateway(sent, req => req.Method == HttpMethod.Patch
            ? new HttpResponseMessage(HttpStatusCode.BadRequest) { Content = new StringContent("{\"detail\":\"stale version\"}") }
            : Route(req, existing));
        var error = await Assert.ThrowsAsync<HttpRequestException>(() => gateway.UpsertAsync(Record()));
        Assert.Contains("stale version", error.Message);
        Assert.Contains("Updating the register record", error.Message);
    }
    [Fact]
    public async Task Surfaces_a_failed_read_instead_of_writing_blind()
    {
        var sent = new List<Sent>();
        var gateway = Gateway(sent, _ => new HttpResponseMessage(HttpStatusCode.Unauthorized)
        {
            Content = new StringContent("{\"detail\":\"invalid token\"}"),
        });
        var error = await Assert.ThrowsAsync<HttpRequestException>(() => gateway.UpsertAsync(Record()));
        Assert.Contains("Querying objecttypen", error.Message);
        Assert.Contains("invalid token", error.Message);
        // A read that failed must never be mistaken for "nothing there yet" and followed by a write.
        Assert.DoesNotContain(sent, s => s.Method == HttpMethod.Post || s.Method == HttpMethod.Patch);
    }
    [Fact]
    public async Task Fails_loudly_when_the_objecttype_carries_no_versions_at_all()
    {
        var sent = new List<Sent>();
        var gateway = Gateway(sent, req => req.RequestUri!.AbsolutePath == "/api/v2/objecttypes"
            ? Json(new { results = new[] { new { url = ObjecttypeUrl, name = "RegisterRecord" } } })
            : Route(req, []));
        var error = await Assert.ThrowsAsync<InvalidOperationException>(() => gateway.UpsertAsync(Record()));
        Assert.Contains("published version", error.Message);
    }
    [Fact]
    public async Task Says_which_read_failed_when_the_objecten_search_errors()
    {
        var sent = new List<Sent>();
        var gateway = Gateway(sent, req => req.Method == HttpMethod.Get && req.RequestUri!.AbsolutePath == "/api/v2/objects"
            ? new HttpResponseMessage(HttpStatusCode.InternalServerError) { Content = new StringContent("boom") }
            : Route(req, []));
        var error = await Assert.ThrowsAsync<HttpRequestException>(() => gateway.UpsertAsync(Record()));
        Assert.Contains("Querying objects", error.Message);
    }
    [Fact]
    public async Task Surfaces_an_empty_read_body_rather_than_dereferencing_it()
    {
        var sent = new List<Sent>();
        var gateway = Gateway(sent, _ => new HttpResponseMessage(HttpStatusCode.OK)
        {
            Content = new StringContent("null", System.Text.Encoding.UTF8, "application/json"),
        });
        var error = await Assert.ThrowsAsync<InvalidOperationException>(() => gateway.UpsertAsync(Record()));
        Assert.Contains("objecttypen", error.Message);
    }
    [Fact]
    public async Task Treats_a_result_less_response_as_no_match_rather_than_crashing()
    {
        var sent = new List<Sent>();
        // The objecttypes collection carries no `results` key — the objecttype is absent, which must
        // surface as the "not registered" error rather than an ArgumentNullException from LINQ.
        var gateway = Gateway(sent, _ => Json(new { }));
        var error = await Assert.ThrowsAsync<InvalidOperationException>(() => gateway.UpsertAsync(Record()));
        Assert.Contains("RegisterRecord", error.Message);
    }
    [Fact]
    public async Task Creates_the_object_when_the_search_response_carries_no_results_key()
    {
        var sent = new List<Sent>();
        var gateway = Gateway(sent, req => req.Method == HttpMethod.Get && req.RequestUri!.AbsolutePath == "/api/v2/objects"
            ? Json(new { })
            : Route(req, []));
        await gateway.UpsertAsync(Record());
        Assert.Contains(sent, s => s.Method == HttpMethod.Post && s.Uri.AbsolutePath == "/api/v2/objects");
    }
    [Fact]
    public async Task Reads_objecttypen_without_the_crs_headers_it_does_not_accept()
    {
        var sent = new List<Sent>();
        await Gateway(sent, req => Route(req, [])).UpsertAsync(Record());
        // Objecttypen is not a geo API; only the Objecten hops carry CRS.
        Assert.All(
            sent.Where(s => s.Uri.AbsolutePath.StartsWith("/api/v2/objecttypes", StringComparison.Ordinal)),
            s => Assert.Null(s.AcceptCrs));
    }
    [Fact]
    public async Task Buffers_the_write_body_so_uwsgi_gets_a_content_length()
    {
        var sent = new List<Sent>();
        await Gateway(sent, req => Route(req, [])).UpsertAsync(Record());
        var write = sent.Single(s => s.Method == HttpMethod.Post && s.Uri.AbsolutePath == "/api/v2/objects");
        Assert.NotNull(write.ContentLength);
    }
    [Fact]
    public async Task Rejects_a_null_record_without_calling_objecten()
    {
        var sent = new List<Sent>();
        await Assert.ThrowsAsync<ArgumentNullException>(() => Gateway(sent, req => Route(req, [])).UpsertAsync(null!));
        Assert.Empty(sent);
    }
 }
@@ -2,7 +2,7 @@
  "stryker-config": {
    "solution": "Acl.slnx",
    "test-projects": ["Acl.Tests/Acl.Tests.csproj"],
-    "reporters": ["progress", "html", "markdown"],
+    "reporters": ["progress", "html"],
    "thresholds": {
      "high": 95,
      "low": 90,
@@ -59,26 +59,12 @@ public interface IProjectionClient
 /// internal reference, not shown in the portal.</summary>
 public sealed record BeheerZaaktype(string Identificatie, string Omschrijving);
-/// <summary>The ACL default-fill settings the beheer portal reads + edits (S-15b): the three ZGW-mandatory
+/// <summary>Port to the ACL for read-only catalogus queries (beheer portal, S-15a). The BFF reaches the
-/// fields the ACL stamps on every zaak (ADR-0003).</summary>
+/// ACL directly for this read: the catalogus isn't a domain concern, and the ACL is the only code
-public sealed record BeheerDefaultFill(
+/// allowed to read the ZGW Catalogi API (§8.1, ADR-0025).</summary>
    string Bronorganisatie,
    string VerantwoordelijkeOrganisatie,
    string Vertrouwelijkheidaanduiding);
 /// <summary>Port to the ACL for beheer queries (beheer portal). The BFF reaches the ACL directly: these
 /// aren't a domain concern, and the ACL is the only code allowed to read/own the ZGW-facing config
 /// (§8.1, ADR-0025).</summary>
 public interface IAclClient
 {
    /// <summary>The published catalogus zaaktypen, read-only (S-15a).</summary>
    Task<IReadOnlyList<BeheerZaaktype>> GetZaaktypenAsync(CancellationToken ct = default);
    /// <summary>The current default-fill settings (S-15b).</summary>
    Task<BeheerDefaultFill> GetDefaultFillAsync(CancellationToken ct = default);
    /// <summary>Replace the default-fill settings (S-15b).</summary>
    Task UpdateDefaultFillAsync(BeheerDefaultFill settings, CancellationToken ct = default);
 }
 /// <summary>Calls the Domain Service's <c>POST /registrations</c>.</summary>
@@ -155,14 +141,4 @@ public sealed class AclClient(HttpClient http) : IAclClient
 {
    public async Task<IReadOnlyList<BeheerZaaktype>> GetZaaktypenAsync(CancellationToken ct = default)
        => await http.GetFromJsonAsync<List<BeheerZaaktype>>("catalogi/zaaktypen", ct) ?? [];
    public async Task<BeheerDefaultFill> GetDefaultFillAsync(CancellationToken ct = default)
        => await http.GetFromJsonAsync<BeheerDefaultFill>("default-fill", ct)
           ?? throw new InvalidOperationException("The ACL returned an empty default-fill response.");
    public async Task UpdateDefaultFillAsync(BeheerDefaultFill settings, CancellationToken ct = default)
    {
        using var response = await http.PutAsJsonAsync("default-fill", settings, ct);
        response.EnsureSuccessStatusCode();
    }
 }
@@ -228,25 +228,6 @@ app.MapGet("/beheer/catalogi/zaaktypen", async (IAclClient acl, CancellationToke
    .Produces(StatusCodes.Status401Unauthorized)
    .Produces(StatusCodes.Status403Forbidden);
 // Beheer default-fill config (S-15b): read + edit the ACL's default-fill values. Behind medewerker-
 // realm + beheerder authorization; the BFF proxies the ACL (ADR-0025). The ACL validates the values.
 app.MapGet("/beheer/default-fill", async (IAclClient acl, CancellationToken ct) =>
    Results.Ok(await acl.GetDefaultFillAsync(ct)))
    .RequireAuthorization(BeheerAuth.Policy)
    .Produces<BeheerDefaultFill>(StatusCodes.Status200OK)
    .Produces(StatusCodes.Status401Unauthorized)
    .Produces(StatusCodes.Status403Forbidden);
 app.MapPut("/beheer/default-fill", async (BeheerDefaultFill body, IAclClient acl, CancellationToken ct) =>
 {
    await acl.UpdateDefaultFillAsync(body, ct);
    return Results.NoContent();
 })
    .RequireAuthorization(BeheerAuth.Policy)
    .Produces(StatusCodes.Status204NoContent)
    .Produces(StatusCodes.Status401Unauthorized)
    .Produces(StatusCodes.Status403Forbidden);
 app.Run();
 /// <summary>The behandelaar's decision on a registration.</summary>
@@ -1,84 +0,0 @@
 using System.Net;
 using System.Net.Http.Headers;
 using System.Net.Http.Json;
 using Bff.Api;
 namespace Bff.Tests;
 /// <summary>
 /// The beheer default-fill config endpoints (S-15b): read (GET) and edit (PUT) the ACL's default-fill,
 /// reached only with a medewerker-realm token carrying the <c>beheerder</c> role. Missing token → 401;
 /// a medewerker without the role → 403; a beheerder reads and updates via the ACL client.
 /// </summary>
 public class BeheerDefaultFillEndpointTests
 {
    private static HttpRequestMessage Get(string? bearer)
    {
        var r = new HttpRequestMessage(HttpMethod.Get, "/beheer/default-fill");
        if (bearer is not null) r.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
        return r;
    }
    private static HttpRequestMessage Put(string? bearer, object body)
    {
        var r = new HttpRequestMessage(HttpMethod.Put, "/beheer/default-fill") { Content = JsonContent.Create(body) };
        if (bearer is not null) r.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
        return r;
    }
    [Fact]
    public async Task Rejects_read_without_a_token()
    {
        using var factory = new BffFactory();
        var response = await factory.CreateClient().SendAsync(Get(bearer: null));
        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
    }
    [Fact]
    public async Task Rejects_a_medewerker_without_the_beheerder_role()
    {
        using var factory = new BffFactory();
        var response = await factory.CreateClient().SendAsync(Get(TestTokens.Medewerker("behandelaar")));
        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
    }
    [Fact]
    public async Task Serves_the_current_default_fill_to_a_beheerder()
    {
        using var factory = new BffFactory();
        factory.Acl.DefaultFill = new BeheerDefaultFill("517439943", "517439943", "openbaar");
        var response = await factory.CreateClient().SendAsync(Get(TestTokens.Medewerker("beheerder")));
        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
        var body = await response.Content.ReadFromJsonAsync<BeheerDefaultFill>();
        Assert.Equal("517439943", body!.Bronorganisatie);
        Assert.Equal("openbaar", body.Vertrouwelijkheidaanduiding);
    }
    [Fact]
    public async Task Updates_the_default_fill_via_the_acl_for_a_beheerder()
    {
        using var factory = new BffFactory();
        var response = await factory.CreateClient().SendAsync(
            Put(TestTokens.Medewerker("beheerder"),
                new { bronorganisatie = "999999999", verantwoordelijkeOrganisatie = "888888888", vertrouwelijkheidaanduiding = "vertrouwelijk" }));
        Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
        Assert.Equal("999999999", factory.Acl.Updated!.Bronorganisatie);
        Assert.Equal("vertrouwelijk", factory.Acl.Updated.Vertrouwelijkheidaanduiding);
    }
    [Fact]
    public async Task Rejects_an_update_from_a_non_beheerder()
    {
        using var factory = new BffFactory();
        var response = await factory.CreateClient().SendAsync(
            Put(TestTokens.Medewerker("behandelaar"), new { bronorganisatie = "1", verantwoordelijkeOrganisatie = "2", vertrouwelijkheidaanduiding = "openbaar" }));
        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
        Assert.Null(factory.Acl.Updated);
    }
 }
@@ -142,24 +142,11 @@ internal sealed class FakeProjectionClient : IProjectionClient
        => Task.FromResult<IReadOnlyList<ProjectionEntry>>(Entries);
 }
-/// <summary>Serves catalogus zaaktypen (S-15a) and holds the default-fill settings (S-15b).</summary>
+/// <summary>Serves a configurable set of catalogus zaaktypen (beheer viewer, S-15a).</summary>
 internal sealed class FakeAclClient : IAclClient
 {
    public List<BeheerZaaktype> Zaaktypen { get; } = [];
    public Task<IReadOnlyList<BeheerZaaktype>> GetZaaktypenAsync(CancellationToken ct = default)
        => Task.FromResult<IReadOnlyList<BeheerZaaktype>>(Zaaktypen);
    public BeheerDefaultFill DefaultFill { get; set; } = new("517439943", "517439943", "openbaar");
    public BeheerDefaultFill? Updated { get; private set; }
    public Task<BeheerDefaultFill> GetDefaultFillAsync(CancellationToken ct = default)
        => Task.FromResult(DefaultFill);
    public Task UpdateDefaultFillAsync(BeheerDefaultFill settings, CancellationToken ct = default)
    {
        Updated = settings;
        DefaultFill = settings;
        return Task.CompletedTask;
    }
 }
@@ -255,80 +255,10 @@
          }
        }
      }
    },
    "/beheer/default-fill": {
      "get": {
        "tags": [
          "Bff.Api"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BeheerDefaultFill"
                }
              }
            }
          },
          "401": {
            "description": "Unauthorized"
          },
          "403": {
            "description": "Forbidden"
          }
        }
      },
      "put": {
        "tags": [
          "Bff.Api"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/BeheerDefaultFill"
              }
            }
          },
          "required": true
        },
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "description": "Unauthorized"
          },
          "403": {
            "description": "Forbidden"
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "BeheerDefaultFill": {
        "required": [
          "bronorganisatie",
          "verantwoordelijkeOrganisatie",
          "vertrouwelijkheidaanduiding"
        ],
        "type": "object",
        "properties": {
          "bronorganisatie": {
            "type": "string"
          },
          "verantwoordelijkeOrganisatie": {
            "type": "string"
          },
          "vertrouwelijkheidaanduiding": {
            "type": "string"
          }
        }
      },
      "BeheerZaaktype": {
        "required": [
          "identificatie",
@@ -2,7 +2,7 @@
  "stryker-config": {
    "solution": "Bff.slnx",
    "test-projects": ["Bff.Tests/Bff.Tests.csproj"],
-    "reporters": ["progress", "html", "markdown"],
+    "reporters": ["progress", "html"],
    "mutate": [
      "!**/Program.cs",
      "!**/DownstreamClients.cs"
@@ -2,7 +2,7 @@
  "stryker-config": {
    "solution": "Big.slnx",
    "test-projects": ["Big.Tests/Big.Tests.csproj"],
-    "reporters": ["progress", "html", "markdown"],
+    "reporters": ["progress", "html"],
    "mutate": [
      "!**/OpenZaakJobPump.cs",
      "!**/BeoordelingEscalatiePump.cs",
@@ -2,7 +2,7 @@
  "stryker-config": {
    "solution": "EventSubscriber.slnx",
    "test-projects": ["EventSubscriber.Tests/EventSubscriber.Tests.csproj"],
-    "reporters": ["progress", "html", "markdown"],
+    "reporters": ["progress", "html"],
    "thresholds": {
      "high": 95,
      "low": 90,
@@ -44,9 +44,7 @@ public sealed class EenZaakOpenenSteps
    [When("the domain asks the ACL to open a zaak")]
    public async Task WhenTheDomainAsksTheAclToOpenAZaak()
    {
-        var fill = new InMemoryDefaultFillStore(new DefaultFillSettings(
+        var service = new AclService(_gateway, _defaults!, new CachedZaaktypeCatalog(_gateway, _defaults!), new FixedClock(_today));
            _defaults!.Bronorganisatie, _defaults.VerantwoordelijkeOrganisatie, _defaults.Vertrouwelijkheidaanduiding));
        var service = new AclService(_gateway, new InMemoryRegisterRecordGateway(), fill, new CachedZaaktypeCatalog(_gateway, _defaults!), new FixedClock(_today));
        _returnedUrl = await service.OpenZaakAsync(_registration!);
    }
@@ -53,16 +53,3 @@ public sealed class InMemoryZaakGateway : IZaakGateway
        => Task.FromResult<IReadOnlyList<ZaaktypeSummary>>(
            [new ZaaktypeSummary("BIG-REGISTRATIE", "BIG-registratie", ResolvedZaaktypeUrl)]);
 }
 /// <summary>An in-memory stand-in for the Objecten API (S-19a): records the register records the ACL
 /// writes on approval, so a scenario can assert on them without a running Objecten.</summary>
 public sealed class InMemoryRegisterRecordGateway : IRegisterRecordGateway
 {
    public List<RegisterRecord> Upserted { get; } = [];
    public Task UpsertAsync(RegisterRecord record, CancellationToken ct = default)
    {
        Upserted.Add(record);
        return Task.CompletedTask;
    }
 }
@@ -1,26 +0,0 @@
 import { expect, test } from '@playwright/test';
 // S-15b: a beheerder edits the ACL default-fill in the beheer portal and gets a saved confirmation.
 // Runs against the shared verify stack; it edits + saves (the ACL store is in-memory, ADR-0026) and
 // asserts the confirmation, without depending on another test's state.
 test('a beheerder edits and saves the default-fill', async ({ page }) => {
  await page.goto('http://beheer/');
  // Keycloak medewerker-realm login (same realm as behandel).
  await page.locator('#username').fill('bram-beheerder');
  await page.locator('#password').fill('test123');
  await page.locator('#kc-login').click();
  await expect(page.getByRole('heading', { name: /Catalogus/i })).toBeVisible();
  // Navigate to the default-fill editor and change a value.
  await page.getByRole('link', { name: /Default-fill/i }).click();
  await expect(page.getByRole('heading', { name: /Default-fill/i })).toBeVisible();
  const bron = page.getByLabel('Bronorganisatie');
  await expect(bron).toBeVisible();
  await bron.fill('517439943');
  await page.getByRole('button', { name: /Opslaan/i }).click();
  await expect(page.getByText(/standaardwaarden zijn opgeslagen/i)).toBeVisible();
 });
@@ -21,9 +21,7 @@ export default defineConfig({
  // OOM-killed mid-action ("Page crashed") — fixing the flakiness at its source rather than leaning
  // on `retries` (CLAUDE.md §15). Only two long-running happy-path specs, so serial costs little.
  workers: 1,
-  // `list` for the live log; `json` (→ /e2e/playwright-report.json in the container) is copied out
+  reporter: [['list']],
  // by run-e2e-check.sh and rendered as a per-spec table in the CI job summary (#136).
  reporter: [['list'], ['json', { outputFile: 'playwright-report.json' }]],
  use: {
    baseURL,
    trace: 'on-first-retry',
@@ -1,4 +1,4 @@
-import { expect, request, test } from '@playwright/test';
+import { expect, test } from '@playwright/test';
 // Walking-skeleton happy path (S-08d + S-09 + S-09b + S-12 + S-10a): a zorgprofessional logs in via
 // mock DigiD and submits through the self-service portal → BFF → domain; the entry appears in the
@@ -109,53 +109,4 @@ test('DigiD submit → public INGEDIEND → documenten → behandelaar goedkeurt
      return staff.getByRole('row', { name: reference }).getByRole('cell', { name: 'INGESCHREVEN' }).count();
    }, { timeout: 30_000, intervals: [1_000, 2_000, 3_000, 5_000] })
    .toBeGreaterThan(0);
  // S-19a: the same approval also wrote the canonical register record to Objecten (ADR-0028).
  // Asserted here rather than in verify-domain because this is the only check that drives a *real*
  // approval — verify-domain completes the Beoordelen task straight through Flowable REST, which
  // bypasses the domain `decide` path that calls the ACL.
  const records = await registerRecordsFor(reference);
  // Matched on OUR reference: the verify stack is shared and holds records from earlier checks.
  expect(records, `expected exactly one RegisterRecord for ${reference}`).toHaveLength(1);
  expect(records[0].status).toBe('INGESCHREVEN');
  // The register is world-readable, so the record must carry nothing but the public-safe fields
  // (ADR-0027) — Objecten's own schema validation enforces this, and this proves it end to end.
  expect(Object.keys(records[0]).sort()).toEqual(['id', 'reference', 'status']);
 });
 const OBJECTEN = process.env.OBJECTEN_URL ?? 'http://objecten:8000';
 const OBJECTTYPEN = process.env.OBJECTTYPEN_URL ?? 'http://objecttypen:8000';
 const OBJECTEN_TOKEN = process.env.OBJECTEN_TOKEN ?? '1234567890abcdef1234567890abcdef12345678';
 const OBJECTTYPEN_TOKEN = process.env.OBJECTTYPEN_TOKEN ?? '0123456789abcdef0123456789abcdef01234567';
 /**
 * The RegisterRecord objects Objecten holds for a registration reference.
 *
 * The objecttype is resolved by name rather than pinned: Objecttypen echoes the request Host into
 * the objecttype `url`, and Objecten only accepts the one matching its configured api_root — so
 * both must be reached by service name, exactly as the ACL reaches them (ADR-0028).
 */
 async function registerRecordsFor(reference: string): Promise<Record<string, string>[]> {
  const api = await request.newContext();
  try {
    const types = await api.get(`${OBJECTTYPEN}/api/v2/objecttypes`, {
      headers: { Authorization: `Token ${OBJECTTYPEN_TOKEN}` },
    });
    expect(types.ok(), `Objecttypen returned ${types.status()}`).toBeTruthy();
    const objecttype = ((await types.json()).results as { url: string; name: string }[]).find(
      (o) => o.name === 'RegisterRecord',
    );
    if (!objecttype) throw new Error('the RegisterRecord objecttype is not registered in Objecttypen');
    const objects = await api.get(`${OBJECTEN}/api/v2/objects`, {
      headers: { Authorization: `Token ${OBJECTEN_TOKEN}`, 'Accept-Crs': 'EPSG:4326' },
      params: { type: objecttype.url, data_attrs: `reference__exact__${reference}` },
    });
    expect(objects.ok(), `Objecten returned ${objects.status()}: ${await objects.text()}`).toBeTruthy();
    return ((await objects.json()).results as { record: { data: Record<string, string> } }[]).map(
      (o) => o.record.data,
    );
  } finally {
    await api.dispose();
  }
 }