feat(workflow): document-wait task + 30-day timeout cancellation (S-10a, closes #102) #105

2026-07-20T08:01:01Z

not commented

2026-07-20 08:01:01 +00:00

What & why

S-10a, the workflow/timeout spine of the (split) document-upload slice: the registratie process
now parks at a WachtOpDocumenten user task with an interrupting P30D boundary timer. When
the documents arrive the task completes and the process continues into the diploma routing (S-13) →
Beoordelen; if the 30 days lapse, the timer cancels the wait, runs a RegistratieVerlopen
external-worker task, and the domain expires the aggregate to a new terminal status Verlopen.
Backend only — the real upload trigger (portal → BFF → ACL → Documenten API) is S-10b (#103).

Closes #102

Mechanism recorded in ADR-0017; opened as proposal #104. Mirrors the S-14 escalation
(boundary-timer + external-worker) and S-11 withdrawal (interrupting cancel) patterns.

Definition of Done

Linked Gitea issue (above).
Failing test committed before the implementation (red→green pairs per layer).
Implementation makes the test pass.
Conventional Commits referencing the issue (refs #102).
CI green — all Gitea Actions jobs (pending on this PR).
docker compose up health unaffected (no new services; deploy path unchanged).
Docs updated (ADR-0017, demo-script, BACKLOG split).
ADR added (docs/architecture/adr-0017-document-wait-timeout-cancellation.md).
Demo note in docs/demo-script.md.

Notes for reviewers

Domain (Registration.Expire() + Verlopen), application (ExpireRegistrationWorker),
infra (RegistratieVerlopenProcessor/Pump, IRegistratieVerlopenClient, Flowable
acquire/complete + CompleteDocumentWaitAsync) — the timeout counterpart to the OpenZaak/escalation
worker trios; idempotent per §8.6.
BPMN verified live against a flowable-rest probe: complete WachtOpDocumenten → routes to
Beoordelen; fire the P30D timer → RegistratieVerlopen job (carrying registrationId) + the wait
task cancelled. verify-domain exercises both branches in-stack (completes the wait in every existing
block; fires the timer and asserts Verlopen in a new block).
Scope boundary: on expiry the aggregate goes Verlopen and the process ends, but the ZGW zaak
is not yet set to a cancellation status — that needs a new ACL method + statustype seeding and is
folded into S-10b (noted in ADR-0017).
CompleteDocumentWaitAsync is built and HTTP-tested here but not yet called from a domain endpoint;
S-10b wires the upload trigger to it.

🤖 Generated with Claude Code

## What & why S-10a, the **workflow/timeout spine** of the (split) document-upload slice: the registratie process now parks at a **`WachtOpDocumenten`** user task with an **interrupting `P30D` boundary timer**. When the documents arrive the task completes and the process continues into the diploma routing (S-13) → Beoordelen; if the 30 days lapse, the timer cancels the wait, runs a `RegistratieVerlopen` external-worker task, and the domain expires the aggregate to a new terminal status **`Verlopen`**. Backend only — the real upload trigger (portal → BFF → ACL → Documenten API) is S-10b (#103). Closes #102 Mechanism recorded in **ADR-0017**; opened as proposal #104. Mirrors the S-14 escalation (boundary-timer + external-worker) and S-11 withdrawal (interrupting cancel) patterns. ## Definition of Done - [x] Linked Gitea issue (above). - [x] Failing test committed before the implementation (red→green pairs per layer). - [x] Implementation makes the test pass. - [x] Conventional Commits referencing the issue (`refs #102`). - [x] CI green — all Gitea Actions jobs (pending on this PR). - [x] `docker compose up` health unaffected (no new services; deploy path unchanged). - [x] Docs updated (ADR-0017, demo-script, BACKLOG split). - [x] ADR added (`docs/architecture/adr-0017-document-wait-timeout-cancellation.md`). - [x] Demo note in `docs/demo-script.md`. ## Notes for reviewers - **Domain** (`Registration.Expire()` + `Verlopen`), **application** (`ExpireRegistrationWorker`), **infra** (`RegistratieVerlopenProcessor`/`Pump`, `IRegistratieVerlopenClient`, Flowable acquire/complete + `CompleteDocumentWaitAsync`) — the timeout counterpart to the OpenZaak/escalation worker trios; idempotent per §8.6. - **BPMN** verified live against a `flowable-rest` probe: complete `WachtOpDocumenten` → routes to Beoordelen; fire the P30D timer → `RegistratieVerlopen` job (carrying `registrationId`) + the wait task cancelled. `verify-domain` exercises both branches in-stack (completes the wait in every existing block; fires the timer and asserts `Verlopen` in a new block). - **Scope boundary:** on expiry the aggregate goes `Verlopen` and the process ends, but the ZGW *zaak* is not yet set to a cancellation status — that needs a new ACL method + statustype seeding and is folded into S-10b (noted in ADR-0017). - `CompleteDocumentWaitAsync` is built and HTTP-tested here but not yet called from a domain endpoint; S-10b wires the upload trigger to it. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

not added 11 commits 2026-07-20 08:01:02 +00:00

docs(backlog): split S-10 into S-10a (#102 ) and S-10b (#103 ) (refs #102 ) 67a60e7f63

S-10 (#11) spanned six net-new surfaces incl. a new ZGW boundary — too large
for one slice (§13). S-10a is the workflow/timeout spine (backend); S-10b is
the document-upload vertical (ACL Documenten API + portal). #11 closed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test(domain): a document-wait timeout expires the registration to Verlopen (refs #102 ) f39ec2afa3

RED: Registration.Expire() moves an open registration to a new terminal
Verlopen status, needs no zaak, is idempotent on redelivery, and is rejected
once the registration has been decided or withdrawn.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(domain): Registration.Expire() lapses an open registration to Verlopen (refs #102 ) 11ef26d8cc

Adds the terminal Verlopen status and Expire(), reusing the RequireOpenForDecision
guard so only an INGEDIEND/IN_BEHANDELING registration can lapse; idempotent once
Verlopen.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test(domain): RegistratieVerlopen worker expires the correlated registration (refs #102 ) 5add817c10

RED: ExpireRegistrationWorker loads the registration a RegistratieVerlopen job
correlates to and expires it (idempotent on redelivery, throws on unknown so the
job is redelivered); RegistratieVerlopenProcessor drains the parked jobs and
completes each, leaving a failing one un-completed (§8.6). Mirrors the OpenZaak
and escalation worker/processor pairs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(domain): RegistratieVerlopen worker + processor expire on document timeout (refs #102 ) c536c965de

Adds RegistratieVerlopenJob, IRegistratieVerlopenClient, the ExpireRegistrationWorker
application handler, and the RegistratieVerlopenProcessor drain loop — the timeout
counterpart to the OpenZaak/escalation worker trios.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test(infra): Flowable client acquires/completes RegistratieVerlopen + completes wait task (refs #102 ) 9421aa007a

RED: the Workflow Client posts the RegistratieVerlopen topic and parses the
correlated registration id, completes the expiry job, and (documents-in-time)
completes the WachtOpDocumenten user task in the instance — best-effort no-op if
that task is no longer open.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(infra): Flowable RegistratieVerlopen worker + document-wait completion (refs #102 ) 3f04cb856f

FlowableWorkflowClient implements IRegistratieVerlopenClient (acquire/complete the
RegistratieVerlopen jobs) and CompleteDocumentWaitAsync (complete WachtOpDocumenten,
best-effort). Wires the RegistratieVerlopenProcessor + hosted RegistratieVerlopenPump
into the domain host and excludes the pump from mutation (like the other pumps).
Fakes updated for the new IWorkflowClient member.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(workflow): WachtOpDocumenten wait task + 30-day timeout cancellation (refs #102 ) 9bd71f1e78

Inserts a WachtOpDocumenten user task after OpenZaakAanmaken with an interrupting
P30D boundary timer: "documents received" completes it and the process continues to
the diploma routing; on timeout the RegistratieVerlopen external-worker task runs
and the process ends as verlopen (ADR-0017). Verified live against flowable-rest:
complete -> routes to Beoordelen; timer fire -> RegistratieVerlopen job (carrying
registrationId) + the wait task cancelled.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test(acceptance): document-termijn verloopt (both branches) (refs #102 ) 5180253826

BDD for S-10a: a registration parked at WachtOpDocumenten expires to VERLOPEN when
the 30-day timer fires, and does NOT expire when documents arrive first. Drives the
real RegistratieVerlopenProcessor + ExpireRegistrationWorker against an in-memory
Flowable stand-in, mirroring the escalation feature.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test(infra): verify-domain drives the document wait + 30-day timeout live (refs #102 ) 00c5077fe4

Every registration now parks at WachtOpDocumenten first, so each existing block
completes that task (documents received) before expecting Beoordelen/CBGVAdvies.
Adds a timeout block: a registration whose documents never arrive has its P30D
timer fired via the management-API move idiom, and the domain expires it to VERLOPEN.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs(workflow): ADR-0017 + demo note for the document-wait timeout (refs #102 )

CI / lint (pull_request) Successful in 1m18s

Details

CI / build (pull_request) Successful in 59s

Details

CI / unit (pull_request) Successful in 1m10s

Details

CI / frontend (pull_request) Successful in 2m33s

Details

CI / mutation (pull_request) Successful in 10m22s

Details

CI / verify-stack (pull_request) Failing after 11m24s

Details

d943b54ce8

Records the interrupting P30D WachtOpDocumenten timer, the RegistratieVerlopen
worker, and the new terminal Verlopen status; notes the S-10a/S-10b boundary
(ZGW zaak-close deferred). Demo covers both branches.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

not added the type:slice area:domain area:workflow labels 2026-07-20 08:01:16 +00:00

not added 11 commits 2026-07-20 08:49:18 +00:00

test(domain): providing documents completes the WachtOpDocumenten wait (refs #102 ) 7ceb22d46d

RED: the ProvideDocuments use case completes the document wait via the Workflow
Client, owner-scoped by the caller's bsn (a different bsn is NotFound), and is
best-effort when no process was started yet — mirroring WithdrawRegistration.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(domain): ProvideDocuments completes the wait + POST /registrations/{id}/documents (refs #102 ) c21becd5b9

The provide-documents use case completes the WachtOpDocumenten task via the
Workflow Client (owner-scoped by bsn, best-effort), exposed as an owner-scoped
domain endpoint. This is the trigger that unblocks the process; the real file
upload + ZGW storage lands in S-10b.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test(bff): self-service documents endpoint forwards id + bsn to the domain (refs #102 ) 771450d46d

RED: POST /self-service/registrations/{id}/documents requires a digid token, takes
the bsn from the token, forwards to the domain, and relays the domain's 404 for an
unknown/not-owned registration. Adds the IDomainClient.ProvideDocumentsAsync port +
client + fake; the endpoint itself follows.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(bff): POST /self-service/registrations/{id}/documents (S-10a) (refs #102 ) 404454d270

Authenticated self-service endpoint that takes the bsn from the DigiD token,
forwards "documenten aanleveren" to the domain, and relays 404 for an unknown or
not-owned registration. Regenerates the committed openapi.json.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test(portal): self-service offers 'documenten aanleveren' after submit (refs #102 ) cf1c77489d

RED: after submitting, a "Documenten aanleveren" action posts to the BFF keyed by
the reference and the page confirms; a failure surfaces an alert and keeps the
action. Regenerates the api-client from the updated BFF spec.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test(domain): timeout worker no-ops on an already-resolved registration (refs #102 ) 0d1e2825e5

RED: if the citizen withdrew while parked at WachtOpDocumenten, the RegistratieVerlopen
job finds a terminal (INGETROKKEN) aggregate; the worker must no-op and let the job
complete, not throw into a redelivery loop.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(domain): timeout worker skips an already-resolved registration (refs #102 ) 07139324a3

Expire only a still-open (INGEDIEND/IN_BEHANDELING) registration; an already
resolved one (expired, or withdrawn/decided while it waited) is left untouched so
the job completes without violating the aggregate invariant (§8.6). Closes the
S-10a/S-11 race where a withdrawal-while-waiting would loop the expiry job.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(portal): 'Documenten aanleveren' action on the self-service page (refs #102 ) 2b60f8e51f

After submitting, the zorgprofessional supplies their documents; the page posts to
the BFF keyed by the reference and confirms ("Uw documenten zijn aangeleverd"), with
a surfaced failure + retry. The registration e2e provides documents before the
behandelaar step, since the process now parks at WachtOpDocumenten first.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs(workflow): S-10a owns the document-provision trigger (ADR-0017, demo) (refs #102 ) 5402bc179c

Records why the provision trigger (domain + BFF + portal 'Documenten aanleveren')
lives in S-10a — the WachtOpDocumenten gate would otherwise leave the e2e red — and
narrows S-10b to the real ZGW document storage. Notes the withdrawal-while-waiting
follow-up.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs(backlog): S-10a includes the provision trigger; S-10b is real ZGW storage (refs #102 ) 990db61ba7

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test(acceptance): CapturingDomainClient implements ProvideDocumentsAsync (refs #102 )

CI / unit (pull_request) Successful in 1m10s

Details

CI / lint (pull_request) Successful in 1m22s

Details

CI / build (pull_request) Successful in 1m2s

Details

CI / frontend (pull_request) Successful in 2m42s

Details

CI / mutation (pull_request) Successful in 5m28s

Details

CI / verify-stack (pull_request) Failing after 15m47s

Details

8d936ffdaa

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

not added 1 commit 2026-07-20 09:22:11 +00:00

test(e2e): provide documents on the live self-service tab after the zaak opens (refs #102 )

CI / lint (pull_request) Successful in 1m20s

Details

CI / build (pull_request) Successful in 1m2s

Details

CI / unit (pull_request) Successful in 1m12s

Details

CI / frontend (pull_request) Successful in 2m35s

Details

CI / mutation (pull_request) Successful in 5m15s

Details

CI / verify-stack (pull_request) Successful in 7m54s

Details

5f77dae587

The process only parks at WachtOpDocumenten once the OpenZaak worker has opened the
zaak, so providing documents immediately after submit raced the wait and no-op'd.
Check the openbaar INGEDIEND row on a second page (proving the zaak is open, hence
the process is at the wait) while the self-service tab keeps its submitted state,
then provide documents there — unblocking the werkbak.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

not merged commit 4777ff2b1d into main

2026-07-20 09:42:03 +00:00

not referenced this issue from a commit

2026-07-20 09:42:05 +00:00

feat(workflow): document-wait task + 30-day timeout cancellation (S-10a, closes #102) (#105)

not referenced this pull request

2026-07-20 09:42:52 +00:00

ADR: document-wait timeout cancellation (S-10a) — Verlopen status + interrupting P30D timer worker #104

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: eho/register-referentie#105