test(workflow): verify-domain exercises the Beoordelen user task end-to-end (refs #13)

After the worker opens the zaak, the process parks at Beoordelen. The live check now
polls Flowable for the task (werkbak), claims it as merel-behandelaar, completes it
with besluit=goedkeuren, and asserts the process finishes — proving the exact REST
contract (query/claim/complete) the Workflow Client depends on against a real engine.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/run-domain-check.sh

@@ -51,18 +51,65 @@ loc="$(docker run --rm --network "$net" curlimages/curl:latest \
 echo ">> registration accepted at $loc"
 
 echo ">> polling the domain until the worker records the opened zaak"
+zaak_ok=""
 for _ in $(seq 1 30); do
   body="$(docker run --rm --network "$net" curlimages/curl:latest \
     -fsS "http://$dom_ip:8080$loc" 2>/dev/null || true)"
   if echo "$body" | grep -q '/zaken/api/v1/zaken/'; then
     echo "OK — the domain opened a zaak and recorded it on the registration:"
     echo "$body" | cut -c1-300
-    exit 0
+    zaak_ok=1
+    break
   fi
   sleep 2
 done
+if [ -z "$zaak_ok" ]; then
   echo "FAIL — the registration never received a zaak URL" >&2
   echo "--- domain log ---" >&2; docker logs "$dom" 2>&1 | tail -15 >&2
   acl="$(docker ps -q --filter 'name=[-_]acl[-_]' | head -1)"
   [ -n "$acl" ] && { echo "--- acl log ---" >&2; docker logs "$acl" 2>&1 | tail -15 >&2; }
   exit 1
+fi
+
+# ── S-12b: the process now parks at the Beoordelen user task. Exercise the exact Flowable REST
+# contract the Workflow Client uses (query/claim/complete) against the live engine, reaching
+# flowable-rest by container IP (same in-network constraint as above). ──────────────────────────
+fl="$(docker ps -q --filter 'name=flowable-rest' | head -1)"
+[ -n "$fl" ] || { echo "ERROR: no running flowable-rest container" >&2; exit 1; }
+fl_base="http://$(ip "$fl"):8080/flowable-rest/service"
+reg_id="${loc##*/}"
+
+# Extracts the Beoordelen task id for our registration from a Flowable task-query response on stdin.
+task_for_reg() { REG_ID="$reg_id" python3 -c "import os,sys,json
+d=json.load(sys.stdin); rid=os.environ['REG_ID']
+print(next((t['id'] for t in (d.get('data') or [])
+    if any(v.get('name')=='registrationId' and v.get('value')==rid for v in (t.get('processVariables') or []))), ''))"; }
+
+flcurl() { docker run --rm --network "$net" curlimages/curl:latest -fsS -u rest-admin:test "$@"; }
+query='{"processDefinitionKey":"registratie","taskDefinitionKey":"Beoordelen","includeProcessVariables":true}'
+
+echo ">> polling Flowable for the Beoordelen user task (werkbak)"
+task_id=""
+for _ in $(seq 1 30); do
+  resp="$(flcurl -X POST "$fl_base/runtime/tasks/query" -H 'Content-Type: application/json' -d "$query" 2>/dev/null || true)"
+  task_id="$(printf '%s' "$resp" | task_for_reg)"
+  [ -n "$task_id" ] && break
+  sleep 2
+done
+[ -n "$task_id" ] || { echo "FAIL — no Beoordelen task appeared for registration $reg_id" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
+echo ">> Beoordelen task $task_id is waiting"
+
+echo ">> claiming the task as merel-behandelaar"
+flcurl -X POST "$fl_base/runtime/tasks/$task_id" -H 'Content-Type: application/json' \
+  -d '{"action":"claim","assignee":"merel-behandelaar"}' >/dev/null
+
+echo ">> completing the beoordeling (goedkeuren)"
+flcurl -X POST "$fl_base/runtime/tasks/$task_id" -H 'Content-Type: application/json' \
+  -d '{"action":"complete","variables":[{"name":"besluit","type":"string","value":"goedkeuren"}]}' >/dev/null
+
+echo ">> asserting the process finished (no Beoordelen task remains for the registration)"
+resp="$(flcurl -X POST "$fl_base/runtime/tasks/query" -H 'Content-Type: application/json' -d "$query")"
+still="$(printf '%s' "$resp" | task_for_reg)"
+[ -z "$still" ] || { echo "FAIL — Beoordelen task $still still active after completion" >&2; exit 1; }
+echo "OK — behandelaar claimed and completed the Beoordelen task; the registratie process finished"
+exit 0