test(domain): mutation baseline 90 (achieved 97.7%) + CI/Makefile wiring (refs #6)

Stryker.NET config for the domain service (break 90, the repo's ratchet floor),
excluding the OpenZaakJobPump hosted-shell from mutation. Hardened the unit tests
to kill survivors — Basic-credential value, variable types, null/failure response
paths, option defaults, guard clauses, save counts and log output — leaving only
two documented equivalent mutants (Stryker-disabled). make mutation runs the domain
ratchet and CI uploads its report alongside the others.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/domain/Big.Tests/FlowableWorkflowClientTests.cs

@@ -1,4 +1,5 @@
 using System.Net;
+using System.Text;
 using Big.Domain;
 using Big.Infrastructure;
 
@@ -12,6 +13,9 @@ public class FlowableWorkflowClientTests
         new HttpClient(handler),
         new FlowableOptions { BaseUrl = Base, Username = "rest-admin", Password = "test", WorkerId = "worker-x" });
 
+    private static string DecodeBasic(HttpRequestMessage request)
+        => Encoding.ASCII.GetString(Convert.FromBase64String(request.Headers.Authorization!.Parameter!));
+
     [Fact]
     public async Task Start_posts_the_registration_id_variable_and_returns_the_instance_id()
     {
@@ -26,11 +30,29 @@ public class FlowableWorkflowClientTests
         Assert.Equal("http://flowable/flowable-rest/service/runtime/process-instances",
             capture.Seen.RequestUri!.ToString());
         Assert.Equal("Basic", capture.Seen.Headers.Authorization!.Scheme);
+        Assert.Equal("rest-admin:test", DecodeBasic(capture.Seen));
         Assert.Contains("\"processDefinitionKey\":\"registratie\"", capture.Body);
         Assert.Contains("\"name\":\"registrationId\"", capture.Body);
+        Assert.Contains("\"type\":\"string\"", capture.Body);
         Assert.Contains($"\"value\":\"{rid}\"", capture.Body);
     }
 
+    [Fact]
+    public async Task Start_uses_the_configured_worker_credentials_and_defaults()
+    {
+        var capture = new RequestCapture();
+        // Only BaseUrl set — the worker id and (empty) credentials must come from the defaults.
+        var client = new FlowableWorkflowClient(
+            new HttpClient(capture.Responds(HttpStatusCode.OK, "[]")),
+            new FlowableOptions { BaseUrl = Base });
+
+        await client.AcquireOpenZaakJobsAsync(1);
+
+        Assert.Equal(":", DecodeBasic(capture.Seen!));
+        Assert.Contains("\"workerId\":\"big-domain-worker\"", capture.Body);
+        Assert.Contains("\"lockDuration\":\"PT5M\"", capture.Body);
+    }
+
     [Fact]
     public async Task Acquire_posts_the_topic_and_parses_jobs_with_their_registration_id()
     {
@@ -52,11 +74,13 @@ public class FlowableWorkflowClientTests
         Assert.Contains("\"lockDuration\":\"PT5M\"", capture.Body);
     }
 
-    [Fact]
-    public async Task Acquire_returns_empty_when_flowable_has_no_parked_jobs()
+    [Theory]
+    [InlineData("[]")]
+    [InlineData("null")]
+    public async Task Acquire_returns_empty_when_flowable_has_no_parked_jobs(string body)
     {
         var capture = new RequestCapture();
-        var client = Client(capture.Responds(HttpStatusCode.OK, "[]"));
+        var client = Client(capture.Responds(HttpStatusCode.OK, body));
 
         var jobs = await client.AcquireOpenZaakJobsAsync(1);
 
@@ -64,6 +88,17 @@ public class FlowableWorkflowClientTests
         Assert.Empty(jobs);
     }
 
+    [Fact]
+    public async Task Acquire_throws_when_a_job_carries_no_registration_id()
+    {
+        var capture = new RequestCapture();
+        var client = Client(capture.Responds(HttpStatusCode.OK, """[{"id":"job-1","variables":[]}]"""));
+
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(() => client.AcquireOpenZaakJobsAsync(1));
+        Assert.Contains("job-1", ex.Message);
+        Assert.Contains("registrationId", ex.Message);
+    }
+
     [Fact]
     public async Task Complete_posts_the_zaak_url_variable_to_the_job_complete_endpoint()
     {
@@ -78,6 +113,7 @@ public class FlowableWorkflowClientTests
             capture.Seen.RequestUri!.ToString());
         Assert.Contains("\"workerId\":\"worker-x\"", capture.Body);
         Assert.Contains("\"name\":\"zaakUrl\"", capture.Body);
+        Assert.Contains("\"type\":\"string\"", capture.Body);
         Assert.Contains("\"value\":\"http://openzaak/zaken/api/v1/zaken/abc\"", capture.Body);
     }
 
@@ -90,4 +126,14 @@ public class FlowableWorkflowClientTests
         await Assert.ThrowsAsync<HttpRequestException>(
             () => client.StartRegistrationProcessAsync(RegistrationId.New()));
     }
+
+    [Fact]
+    public async Task Complete_throws_when_flowable_rejects_the_request()
+    {
+        var capture = new RequestCapture();
+        var client = Client(capture.Responds(HttpStatusCode.InternalServerError));
+
+        await Assert.ThrowsAsync<HttpRequestException>(
+            () => client.CompleteOpenZaakJobAsync("job-1", new Uri("http://openzaak/zaken/api/v1/zaken/abc")));
+    }
 }