ci: retrigger CI after gitea restart (refs #6)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -51,23 +51,34 @@ jobs:
         with:
           dotnet-version: '10.0.x'
       - run: make mutation
-      # Publish the Stryker HTML report. `if: always()` uploads it even when the
+      # Publish the Stryker HTML reports. `if: always()` uploads them even when the
       # ratchet fails — that is exactly when you want to inspect the survivors.
-      # Glob handles Stryker's non-deterministic StrykerOutput/<timestamp>/ dir.
+      # `continue-on-error` keeps the upload best-effort: the mutation *gate* is the
-      # Pinned to @v3 deliberately: @v4 refuses to run on Gitea (GHES guard) —
+      # ratchet (make mutation's exit code), not the report, so a Gitea artifact-backend
-      # see docs/runbooks/gitea-actions-gotchas.md §4.
+      # 500 must not fail the job (gitea-actions-gotchas.md §4). Glob handles Stryker's
+      # non-deterministic StrykerOutput/<timestamp>/ dir. Pinned @v3: @v4's bundled
+      # @actions/artifact hard-aborts on non-github.com (GHES guard) — see the runbook.
       - uses: https://github.com/actions/upload-artifact@v3
         if: always()
+        continue-on-error: true
         with:
           name: acl-mutation-report
           path: services/acl/StrykerOutput/**/reports/mutation-report.html
           if-no-files-found: warn
       - uses: https://github.com/actions/upload-artifact@v3
         if: always()
+        continue-on-error: true
         with:
           name: event-subscriber-mutation-report
           path: services/event-subscriber/StrykerOutput/**/reports/mutation-report.html
           if-no-files-found: warn
+      - uses: https://github.com/actions/upload-artifact@v3
+        if: always()
+        continue-on-error: true
+        with:
+          name: domain-mutation-report
+          path: services/domain/StrykerOutput/**/reports/mutation-report.html
+          if-no-files-found: warn
 
   # One stage for every check that needs the live stack. On the single self-hosted
   # runner jobs run sequentially, so booting OpenZaak once (instead of once per job)
@@ -88,10 +99,12 @@ jobs:
         run: make verify-nrc
       - name: OpenZaak → NRC → Event Subscriber → projection-api
         run: make verify-projection
+      - name: Domain → Flowable → ACL → OpenZaak
+        run: make verify-domain
       # Log dump must precede teardown (which removes the containers).
       - name: Dump container logs on failure
         if: failure()
-        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-init keycloak acl bff projection-db event-subscriber projection-api 2>&1 || true
+        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-db flowable-rest flowable-init keycloak acl bff domain projection-db event-subscriber projection-api 2>&1 || true
       - name: Tear down
         if: always()
         run: make down

Makefile

@@ -10,7 +10,7 @@ COMPOSE    := infra/docker-compose.yml
 # Long-running services with a healthcheck — the smoke polls these for readiness
 # (infra/wait-healthy.sh). One-shot init jobs (oz-init, nrc-init, flowable-init)
 # are not polled; they only need to have run. See docs/runbooks/gitea-actions-gotchas.md.
-WAIT_SVCS  := openzaak nrc-web acl bff event-subscriber projection-api
+WAIT_SVCS  := openzaak nrc-web acl bff domain event-subscriber projection-api
 # Config files (OpenZaak data.yaml, Keycloak realms, Flowable BPMN) are streamed
 # into external named volumes via `docker cp` (infra/seed-config.sh) instead of
 # bind-mounted, because bind mounts don't reach sibling containers on the
@@ -64,12 +64,14 @@ unit:
 ## mutation: run the Stryker.NET ratchet on each service with branching logic (fails below baseline)
 # Stryker is pinned as a local dotnet tool (.config/dotnet-tools.json); `tool restore`
 # makes `make mutation` work from a fresh clone. Each service owns its config + break
-# threshold (the ratchet, CLAUDE.md §5): services/acl/stryker-config.json and
+# threshold (the ratchet, CLAUDE.md §5): services/acl/stryker-config.json,
-# services/event-subscriber/stryker-config.json. Scores never regress below baseline.
+# services/event-subscriber/stryker-config.json and services/domain/stryker-config.json.
+# Scores never regress below baseline.
 mutation:
 	dotnet tool restore
 	cd services/acl && dotnet stryker
 	cd services/event-subscriber && dotnet stryker
+	cd services/domain && dotnet stryker
 
 ## smoke: seed config, bring the whole stack up, wait for health-checked services, tear down
 # SEED populates the external config volumes first (upstream images used verbatim;
@@ -136,6 +138,11 @@ verify-nrc:
 verify-projection:
 	bash infra/run-projection-check.sh
 
+## verify-domain: domain → Flowable → ACL → OpenZaak end-to-end (S-05), against the
+## already-running stack. Recreates the acl service to inject the seeded zaaktype URL.
+verify-domain:
+	bash infra/run-domain-check.sh
+
 ## verify: local mirror of the CI verify-stack job — full stack up once, all checks,
 ## tear down (always). For fast single-concern local iteration use `integration`
 ## (oz-only) or `verify-notifications` (oz+nrc) instead.
@@ -146,7 +153,8 @@ verify:
 	  WAIT_TIMEOUT=420 bash infra/wait-healthy.sh $(WAIT_SVCS) \
 	    && bash infra/run-acl-integration.sh \
 	    && bash infra/run-notification-check.sh \
-	    && bash infra/run-projection-check.sh || rc=$$?; \
+	    && bash infra/run-projection-check.sh \
+	    && bash infra/run-domain-check.sh || rc=$$?; \
 	  docker compose -f $(COMPOSE) down --volumes >/dev/null 2>&1; \
 	  docker volume rm -f $(CFG_VOLS) >/dev/null 2>&1; \
 	  exit $$rc'

docs/architecture/adr-0009-external-task-job-worker.md

@@ -0,0 +1,88 @@
+# ADR-0009: The Domain Service drives Flowable as an external-task job worker
+
+- **Status:** Accepted
+- **Date:** 2026-06-30
+- **Deciders:** Respellion engineering
+- **Relates to:** S-05 (#6); proposal #60; builds on ADR-0001 (loose coupling, §8.1/§8.2), S-03 (#4, the `registratie` BPMN), S-04 (#5, the ACL `OpenZaak` operation)
+
+## Context
+
+S-05 (#6) adds the **BIG Domain Service**. Submitting a registration must: create a
+`Registration` aggregate, **start the Flowable `registratie` process** (S-03), have the
+`OpenZaakAanmaken` task **open a zaak via the ACL** (S-04), and store the resulting zaak URL
+back on the aggregate.
+
+`OpenZaakAanmaken` is a Flowable **external-worker** service task (`flowable:type="external-worker"`,
+topic `OpenZaakAanmaken`). Flowable does not push it anywhere — it parks the job and waits for a
+worker to **acquire and lock** it, do the work, and **complete** it. Two coupling rules constrain
+who may do what:
+
+- **§8.2 — the Workflow Client is the only code that talks to Flowable.** BPMN models never embed
+  OpenZaak knowledge; they ask the Workflow Client to execute external tasks.
+- **§8.1 — the ACL is the only code that talks to ZGW.** The worker opens the zaak *through the ACL*,
+  never by constructing ZGW URLs itself.
+
+This is an ADR-worthy moment (§14): a service boundary is defined and both coupling rules are
+exercised. The open question is *how* the external task is driven.
+
+## Decision
+
+**The Domain Service drives the `OpenZaakAanmaken` task as a hosted external-task job worker
+(PRD §36). Orchestration is eventually consistent, not request-synchronous.**
+
+- **`POST /registrations` is fast and side-effecting only on the domain side.** It creates the
+  `Registration` aggregate in state `INGEDIEND`, persists it, and asks the Workflow Client to start
+  one `registratie` process instance, recording the process-instance id on the aggregate. It returns
+  immediately; it does **not** wait for the zaak to be opened.
+- **A hosted worker polls Flowable for `OpenZaakAanmaken` jobs.** It acquires and locks a job, calls
+  the ACL `OpenZaak` operation (§8.1), attaches the returned zaak URL to the matching aggregate
+  (`Registration.AttachZaak`), and completes the job in Flowable. The process then runs to its end
+  event.
+- **The Workflow Client is the only Flowable client (§8.2).** It lives in the Domain Service's
+  `Infrastructure` layer and speaks Flowable's REST API (start process-instance; acquire/lock/complete
+  external-worker jobs). No other code — not the Application layer, not the BPMN — knows Flowable
+  exists.
+- **The worker *logic* is an Application service over ports**, not Flowable-aware code. `OpenZaakWorker`
+  takes an acquired job (topic + the registration id it carries), calls `IAclClient` and
+  `IRegistrationStore`, and returns the zaak URL to complete with. The **polling loop** is a thin
+  `BackgroundService` in `Infrastructure` that fetches jobs via the Workflow Client and feeds them to
+  the worker. So the orchestration is covered by fast unit tests against fakes; only the REST framing
+  needs a container integration test.
+
+## Scope decisions for the minimal slice
+
+- **Registration persistence is in-memory.** The walking skeleton's *read* path is fed by
+  NRC → Event Subscriber → projection (S-06, #7), not by the domain database. An EF-backed domain
+  store buys nothing the demo needs yet, so it is a documented follow-up; the `IRegistrationStore`
+  port keeps that change additive. (PRD §88 envisions EF Core for the domain DB eventually.)
+- **The aggregate's state machine is minimal:** `INGEDIEND` on submission. Later flows (withdrawal,
+  beoordeling, herregistratie) add states in their own slices — they are out of scope here.
+- **No bsn flows to ZGW yet.** The ACL `OpenZaak` operation already default-fills the ZGW-mandatory
+  fields (ADR-0003) and takes the bsn as its domain payload; the domain hands it through unchanged.
+
+## Consequences
+
+- **Positive:** the submit request is decoupled from ACL/OpenZaak latency; the documented Common
+  Ground pattern (external-task worker) is realised; both coupling rules (§8.1, §8.2) hold with the
+  Flowable knowledge isolated to one Infrastructure class; the orchestration is unit-testable.
+- **Negative / deferred:**
+  - Eventual consistency: immediately after `POST /registrations` the aggregate has no zaak URL yet.
+    Acceptable — the read side is the projection, not the domain store.
+  - In-memory registration state is lost on restart; fine for the skeleton, replaced by an EF store
+    in a follow-up.
+  - The worker polls (no push); poll interval is a tuning knob, not a correctness concern, since
+    Flowable holds the job until completed.
+
+## Alternatives considered
+
+- **Synchronous acquire+complete inside the `POST /registrations` request** — rejected: simpler and
+  deterministic, but couples the submit request to ACL/OpenZaak latency and failure, and is not the
+  external-task worker pattern PRD §36 mandates. It would also make the request fail if OpenZaak is
+  briefly down, instead of the job simply staying parked for the worker to retry.
+- **A standalone Workflow Client service, separate from the Domain Service** — rejected for this
+  slice: the worker needs the domain's aggregate store and the ACL client anyway, and PRD §9 places
+  the Workflow Client inside the Domain Service deployment. A separate process adds a hop and a
+  shared store for no current benefit.
+- **Flowable pushes to a webhook instead of being polled** — rejected: Flowable's external-worker
+  model is pull-based (acquire/lock/complete); a push shim would re-implement it with weaker
+  delivery guarantees.

docs/demo-script.md

@@ -5,6 +5,38 @@ copy-pasteable walkthrough against a local `make up` stack.
 
 ---
 
+## S-05 — BIG Domain Service: submit a registration
+
+**Outcome:** submitting a registration starts a Flowable process; the external-task worker
+opens a zaak via the ACL and records it on the aggregate — the upstream half of the skeleton
+that produces the zaak S-06 then projects.
+
+**The path:** domain `POST /registrations` → Flowable `registratie` process → `OpenZaakAanmaken`
+worker → ACL → OpenZaak; `GET /registrations/{id}` shows the opened zaak (ADR-0009).
+
+```bash
+# 1. Bring the full stack up (seeds config, builds our services, waits for health).
+make up
+
+# 2. Drive the full path end-to-end. This also seeds a published BIG zaaktype and points the
+#    ACL at it (the zaak's zaaktype URL is server-assigned, so it isn't known at bring-up).
+make verify-domain      # → "OK — the domain opened a zaak and recorded it on the registration"
+
+# 3. Submit one yourself (domain on host port 8130). Returns 202 + a Location to read back.
+loc=$(curl -fsS -D - -o /dev/null -X POST http://localhost:8130/registrations \
+  -H 'Content-Type: application/json' -d '{"bsn":"123456782"}' | sed -n 's/\r$//; s/^[Ll]ocation: //p')
+
+# 4. The worker opens the zaak off the request path (eventual consistency, ADR-0009); poll
+#    until zaakUrl is filled. (Step 2 must have run first, so the ACL knows the zaaktype.)
+curl -fsS "http://localhost:8130$loc" | jq
+# → { "registrationId": "...", "status": "Ingediend", "zaakUrl": "http://.../zaken/api/v1/zaken/<uuid>" }
+```
+
+> Registration state is in-memory for this slice (ADR-0009); the rebuildable read model is the
+> projection (S-06), fed by the very zaak this flow opens.
+
+---
+
 ## S-06 — Event Subscriber + read projection
 
 **Outcome:** a zaak created in OpenZaak flows through NRC to the Event Subscriber, which

docs/runbooks/gitea-actions-gotchas.md

@@ -14,6 +14,7 @@ those containers share a filesystem — or a `localhost` — breaks.
 | `docker compose up --wait` is unsupported / flaky | poll health with `docker inspect` | `infra/wait-healthy.sh` |
 | `pg_isready` passes before PostGIS is ready | add a `PostGIS_Version()` probe | the db healthchecks |
 | `upload-artifact@v4` fails ("not supported on GHES") | pin `@v3` | `.gitea/workflows/ci.yaml` (`mutation` job) |
+| `upload-artifact@v3` fails with "Artifact service responded with 500" | mark the upload `continue-on-error: true` (server-side; issue #62) | `.gitea/workflows/ci.yaml` (`mutation` job) |
 
 ---
 
@@ -125,6 +126,22 @@ guard. Inputs are the same (`name`, `path`, `if-no-files-found`), so it is a dro
 swap. Do **not** bump to `@v4` until act_runner advertises github.com-compatible
 artifact support.
 
+**Second failure mode — the server's artifact backend returns 500.** Even on the
+correctly-pinned `@v3`, uploads can fail with:
+
+```
+Create Artifact Container - Attempt 5 of 5 failed with error: Artifact service responded with 500
+::error::Create Artifact Container failed: Artifact service responded with 500
+```
+
+This is the **Gitea server's** artifact storage failing (not the action's GHES guard),
+so it is outside the repo's control. Because the `mutation` job's upload steps run with
+`if: always()`, that 500 would fail the job even though the ratchet passed. **Fix:** mark
+the uploads `continue-on-error: true` (issue #62). The mutation *gate* is the Stryker
+ratchet — `make mutation`'s exit code fails the job on a real regression — so the report
+upload is best-effort: when the server's artifact storage is restored, reports publish
+again with no workflow change.
+
 ---
 
 ## 5. A runner process can't reach a service container's published port

infra/docker-compose.yml

@@ -285,7 +285,9 @@ services:
       dockerfile: Dockerfile
     image: register-referentie/acl:dev
     environment:
-      Acl__OpenZaak__BaseUrl: http://openzaak:8000/
+      # Overridable so verify-domain can point the ACL at the same OpenZaak host that
+      # owns the seeded zaaktype URL (host-consistent zaak creation, ADR-0009).
+      Acl__OpenZaak__BaseUrl: ${ACL_OPENZAAK_BASEURL:-http://openzaak:8000/}
       Acl__OpenZaak__ClientId: big-reference-seed
       Acl__OpenZaak__Secret: insecure-dev-secret-change-me
       Acl__Defaults__Bronorganisatie: "517439943"
@@ -306,6 +308,36 @@ services:
         condition: service_healthy
     networks: [cg]
 
+  # ── BIG Domain Service (S-05) ──────────────────────────────────────────────
+  # Orchestrates a registration: POST /registrations creates the aggregate and
+  # starts the registratie Flowable process; a hosted worker acquires the
+  # OpenZaakAanmaken job, opens a zaak via the ACL and completes it (ADR-0009).
+  # Talks only to Flowable (Workflow Client, §8.2) and the ACL (§8.1).
+  domain:
+    build:
+      context: ../services/domain
+      dockerfile: Dockerfile
+    image: register-referentie/domain:dev
+    environment:
+      Flowable__BaseUrl: http://flowable-rest:8080/flowable-rest/
+      Flowable__Username: rest-admin
+      Flowable__Password: test
+      Acl__BaseUrl: http://acl:8080/
+    ports:
+      - "8130:8080"
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
+      interval: 5s
+      timeout: 3s
+      retries: 5
+      start_period: 10s
+    depends_on:
+      acl:
+        condition: service_healthy
+      flowable-init:
+        condition: service_completed_successfully
+    networks: [cg]
+
   # ── BFF ──────────────────────────────────────────────────────────────────
   bff:
     build:

infra/openzaak/seed_catalogus.py

@@ -210,6 +210,10 @@ def main():
     print(f"zaaktypen in BIG: {names}")
     assert "BIG-REGISTRATIE" in names, "BIG-REGISTRATIE not listed"
     state = "published" if PUBLISH else "concept"
+    # Machine-readable line so callers (e.g. infra/run-domain-check.sh) can capture the
+    # zaaktype URL to configure the ACL's default-fill (ADR-0003/0009).
+    zt_url = next(z["url"] for z in zaaktypen if z.get("identificatie") == "BIG-REGISTRATIE")
+    print(f"ZAAKTYPE_URL {zt_url}")
     print(f"OK — BIG catalogus seeded (BIG-REGISTRATIE {state} + bsn eigenschap)")
 
 

infra/run-domain-check.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+#
+# Verify the BIG Domain Service end-to-end (S-05) against an ALREADY-RUNNING full stack:
+# domain → Flowable (start the registratie process + external-task worker) → ACL → OpenZaak.
+# Submits a registration to the domain and asserts the worker opens a zaak in OpenZaak and
+# records its URL on the aggregate (ADR-0009).
+#
+# The seeded zaaktype URL is server-assigned, so it isn't knowable at initial bring-up. This
+# script therefore seeds a published BIG zaaktype and recreates the `acl` service configured to
+# default-fill it — pointing the ACL at the SAME OpenZaak host that owns the URL, so zaak creation
+# is host-consistent (exactly the configuration the ACL integration test proves, ADR-0006). That
+# one recreate aside, the caller owns stack bring-up + teardown.
+#
+# All in-network, reaching services by container IP (a single-label host isn't URL-valid; the
+# runner can't reach published ports — gitea-actions-gotchas.md §5/§6). Plain docker primitives.
+set -euo pipefail
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+root="$(cd "$here/.." && pwd)"
+compose="$root/infra/docker-compose.yml"
+
+ip() { docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$1"; }
+
+oz="$(docker ps -q --filter 'name=[-_]openzaak[-_]' | head -1)"
+dom="$(docker ps -q --filter 'name=domain' | head -1)"
+[ -n "$oz" ] || { echo "ERROR: no running OpenZaak container — bring the stack up first" >&2; exit 1; }
+[ -n "$dom" ] || { echo "ERROR: no running domain container — bring the stack up first" >&2; exit 1; }
+net="$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{"\n"}}{{end}}' "$oz" | head -1)"
+oz_ip="$(ip "$oz")"; dom_ip="$(ip "$dom")"
+oz_base="http://$oz_ip:8000"
+echo ">> openzaak=$oz_ip domain=$dom_ip network=$net"
+
+echo ">> seeding a published BIG zaaktype (idempotent) and capturing its URL"
+sid="$(docker create --network "$net" -e "OZ_BASE=$oz_base" -e OZ_PUBLISH=1 python:3-slim python /seed.py)"
+docker cp "$here/openzaak/seed_catalogus.py" "$sid:/seed.py" >/dev/null
+zt_url="$(docker start -a "$sid" | sed -n 's/^ZAAKTYPE_URL //p' | head -1)"
+docker rm -f "$sid" >/dev/null
+[ -n "$zt_url" ] || { echo "ERROR: seed did not report a ZAAKTYPE_URL" >&2; exit 1; }
+echo ">> zaaktype: $zt_url"
+
+echo ">> recreating the acl service pointed at the seeded zaaktype (host-consistent)"
+ACL_ZAAKTYPE_URL="$zt_url" ACL_OPENZAAK_BASEURL="$oz_base/" docker compose -f "$compose" up -d acl
+WAIT_TIMEOUT="${WAIT_TIMEOUT:-120}" bash "$here/wait-healthy.sh" acl
+
+echo ">> submitting a registration to the domain"
+loc="$(docker run --rm --network "$net" curlimages/curl:latest \
+  -fsS -D - -o /dev/null -X POST "http://$dom_ip:8080/registrations" \
+  -H 'Content-Type: application/json' -d '{"bsn":"123456782"}' \
+  | sed -n 's/\r$//; s/^[Ll]ocation: //p' | head -1)"
+[ -n "$loc" ] || { echo "ERROR: POST /registrations returned no Location" >&2; exit 1; }
+echo ">> registration accepted at $loc"
+
+echo ">> polling the domain until the worker records the opened zaak"
+for _ in $(seq 1 30); do
+  body="$(docker run --rm --network "$net" curlimages/curl:latest \
+    -fsS "http://$dom_ip:8080$loc" 2>/dev/null || true)"
+  if echo "$body" | grep -q '/zaken/api/v1/zaken/'; then
+    echo "OK — the domain opened a zaak and recorded it on the registration:"
+    echo "$body" | cut -c1-300
+    exit 0
+  fi
+  sleep 2
+done
+echo "FAIL — the registration never received a zaak URL" >&2
+echo "--- domain log ---" >&2; docker logs "$dom" 2>&1 | tail -15 >&2
+acl="$(docker ps -q --filter 'name=[-_]acl[-_]' | head -1)"
+[ -n "$acl" ] && { echo "--- acl log ---" >&2; docker logs "$acl" 2>&1 | tail -15 >&2; }
+exit 1

mkdocs.yml

@@ -30,6 +30,7 @@ nav:
       - "ADR-0006: ACL integration test provisioning": architecture/adr-0006-integration-test-provisioning.md
       - "ADR-0007: OpenZaak → NRC notification wiring": architecture/adr-0007-notification-wiring.md
       - "ADR-0008: Read projection store": architecture/adr-0008-read-projection-store.md
+      - "ADR-0009: External-task job worker": architecture/adr-0009-external-task-job-worker.md
   - Working in Gitea: gitea-workflow.md
   - Demo script: demo-script.md
   - Runbooks:

register-referentie.slnx

@@ -7,6 +7,13 @@
     <Project Path="services/acl/Acl.IntegrationTests/Acl.IntegrationTests.csproj" />
     <Project Path="services/acl/Acl.Tests/Acl.Tests.csproj" />
   </Folder>
+  <Folder Name="/services/domain/">
+    <Project Path="services/domain/Big.Domain/Big.Domain.csproj" />
+    <Project Path="services/domain/Big.Application/Big.Application.csproj" />
+    <Project Path="services/domain/Big.Infrastructure/Big.Infrastructure.csproj" />
+    <Project Path="services/domain/Big.Api/Big.Api.csproj" />
+    <Project Path="services/domain/Big.Tests/Big.Tests.csproj" />
+  </Folder>
   <Folder Name="/services/bff/">
     <Project Path="services/bff/Bff.Api/Bff.Api.csproj" />
     <Project Path="services/bff/Bff.Tests/Bff.Tests.csproj" />

services/domain/.dockerignore

@@ -0,0 +1,4 @@
+**/bin
+**/obj
+**/*.user
+StrykerOutput

services/domain/Big.Api/Big.Api.csproj

@@ -0,0 +1,14 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+
+  <ItemGroup>
+    <ProjectReference Include="..\Big.Application\Big.Application.csproj" />
+    <ProjectReference Include="..\Big.Infrastructure\Big.Infrastructure.csproj" />
+  </ItemGroup>
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+  </PropertyGroup>
+
+</Project>

services/domain/Big.Api/Program.cs

@@ -0,0 +1,64 @@
+using Big.Application;
+using Big.Domain;
+using Big.Infrastructure;
+
+var builder = WebApplication.CreateBuilder(args);
+
+// Options bound from configuration (compose sets Flowable__* and Acl__* env vars).
+builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
+    .GetSection("Flowable").Get<FlowableOptions>()
+    ?? throw new InvalidOperationException("Missing configuration section 'Flowable'"));
+builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
+    .GetSection("Acl").Get<AclOptions>()
+    ?? throw new InvalidOperationException("Missing configuration section 'Acl'"));
+
+// The in-memory registration store is shared between the submit endpoint and the worker (ADR-0009).
+builder.Services.AddSingleton<IRegistrationStore, InMemoryRegistrationStore>();
+
+// The Workflow Client is one type behind two ports (start side + worker side); both resolve to the
+// same HttpClient-backed implementation — the only code that talks to Flowable (§8.2).
+builder.Services.AddHttpClient<FlowableWorkflowClient>();
+builder.Services.AddTransient<IWorkflowClient>(sp => sp.GetRequiredService<FlowableWorkflowClient>());
+builder.Services.AddTransient<IExternalWorkerClient>(sp => sp.GetRequiredService<FlowableWorkflowClient>());
+builder.Services.AddHttpClient<IAclClient, AclHttpClient>();
+
+builder.Services.AddScoped<SubmitRegistration>();
+builder.Services.AddScoped<OpenZaakWorker>();
+builder.Services.AddScoped<OpenZaakJobProcessor>();
+
+// The hosted external-task job worker polls Flowable and drives OpenZaakAanmaken to completion.
+builder.Services.AddHostedService<OpenZaakJobPump>();
+
+var app = builder.Build();
+
+app.MapGet("/health", () => "Healthy");
+
+// Submit a registration. The aggregate is created (INGEDIEND) and the registratie process started;
+// the zaak is opened later, off the request path, by the worker — so this returns 202 Accepted with
+// a location to read the registration's progress (ADR-0009, eventual consistency).
+app.MapPost("/registrations", async (SubmitRegistrationRequest body, SubmitRegistration submit, CancellationToken ct) =>
+{
+    var id = await submit.HandleAsync(new SubmitRegistrationCommand(body.Bsn), ct);
+    return Results.Accepted($"/registrations/{id}", new RegistrationResponse(id.ToString(), RegistrationStatus.Ingediend.ToString(), null));
+});
+
+// Read a registration. Its zaak URL appears once the worker has opened the zaak (eventually).
+app.MapGet("/registrations/{id}", async (string id, IRegistrationStore store, CancellationToken ct) =>
+{
+    if (!Guid.TryParse(id, out var guid))
+        return Results.NotFound();
+
+    var registration = await store.GetAsync(new RegistrationId(guid), ct);
+    return registration is null
+        ? Results.NotFound()
+        : Results.Ok(new RegistrationResponse(
+            registration.Id.ToString(), registration.Status.ToString(), registration.ZaakUrl?.ToString()));
+});
+
+await app.RunAsync();
+
+public sealed record SubmitRegistrationRequest(string Bsn);
+
+public sealed record RegistrationResponse(string RegistrationId, string Status, string? ZaakUrl);
+
+public partial class Program;

services/domain/Big.Api/appsettings.json

@@ -0,0 +1,9 @@
+{
+  "Logging": {
+    "LogLevel": {
+      "Default": "Information",
+      "Microsoft.AspNetCore": "Warning"
+    }
+  },
+  "AllowedHosts": "*"
+}

services/domain/Big.Application/Big.Application.csproj

@@ -0,0 +1,15 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <!-- The application layer (CLAUDE.md §9): use cases over ports. Depends on Domain only;
+       Infrastructure implements the ports. -->
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\Big.Domain\Big.Domain.csproj" />
+  </ItemGroup>
+
+</Project>

services/domain/Big.Application/OpenZaakWorker.cs

@@ -0,0 +1,36 @@
+using Big.Domain;
+
+namespace Big.Application;
+
+/// <summary>
+/// Handles one acquired <c>OpenZaakAanmaken</c> external-worker job (ADR-0009): load the registration
+/// the job correlates to, open a zaak for it via the ACL (§8.1), attach the zaak to the aggregate, and
+/// return the zaak URL so the caller can complete the Flowable job. Pure application logic over ports —
+/// it knows nothing of Flowable; the polling loop that feeds it jobs lives in Infrastructure.
+/// </summary>
+public sealed class OpenZaakWorker(IRegistrationStore store, IAclClient acl)
+{
+    /// <summary>
+    /// Process the job and return the URL of the (existing or newly opened) zaak. Idempotent: if the
+    /// registration already has a zaak — a job redelivered after its completion was lost — it returns
+    /// that zaak without opening a second one (§8.6, at-least-once delivery). An unknown registration
+    /// is an error: it throws, leaving the job un-completed for Flowable to redeliver.
+    /// </summary>
+    public async Task<Uri> HandleAsync(OpenZaakJob job, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(job);
+
+        var registration = await store.GetAsync(job.RegistrationId, ct)
+            ?? throw new InvalidOperationException(
+                $"No registration {job.RegistrationId} for OpenZaakAanmaken job {job.JobId}.");
+
+        // A redelivered job whose zaak was already opened completes without opening a second one.
+        if (registration.ZaakUrl is not null)
+            return registration.ZaakUrl;
+
+        var zaakUrl = await acl.OpenZaakAsync(registration.Bsn, ct);
+        registration.AttachZaak(zaakUrl);
+        await store.SaveAsync(registration, ct);
+        return zaakUrl;
+    }
+}

services/domain/Big.Application/Ports.cs

@@ -0,0 +1,47 @@
+using Big.Domain;
+
+namespace Big.Application;
+
+/// <summary>
+/// The port to the workflow engine. Implemented by the Workflow Client in Infrastructure — the
+/// <em>only</em> code that talks to Flowable (CLAUDE.md §8.2). The application asks it to start the
+/// registratie process; it never knows Flowable exists.
+/// </summary>
+public interface IWorkflowClient
+{
+    /// <summary>
+    /// Start one <c>registratie</c> process instance for the given registration, carrying the
+    /// registration id so the <c>OpenZaakAanmaken</c> external task can be correlated back to its
+    /// aggregate. Returns the process instance id.
+    /// </summary>
+    Task<string> StartRegistrationProcessAsync(RegistrationId registrationId, CancellationToken ct = default);
+}
+
+/// <summary>
+/// The port to the Anti-Corruption Layer. Implemented in Infrastructure by an HTTP client to the
+/// ACL service — the <em>only</em> code that talks to ZGW (CLAUDE.md §8.1). The domain hands over a
+/// bsn; the ACL default-fills the ZGW-mandatory fields (ADR-0003) and returns the created zaak URL.
+/// </summary>
+public interface IAclClient
+{
+    Task<Uri> OpenZaakAsync(string bsn, CancellationToken ct = default);
+}
+
+/// <summary>
+/// Persistence port for the <see cref="Registration"/> aggregate. In-memory for the minimal slice
+/// (ADR-0009); an EF-backed store is a documented follow-up, and this port keeps that change additive.
+/// </summary>
+public interface IRegistrationStore
+{
+    /// <summary>Insert or update the registration, keyed on its id.</summary>
+    Task SaveAsync(Registration registration, CancellationToken ct = default);
+
+    /// <summary>Load a registration by id, or <c>null</c> if none exists.</summary>
+    Task<Registration?> GetAsync(RegistrationId id, CancellationToken ct = default);
+}
+
+/// <summary>
+/// An acquired <c>OpenZaakAanmaken</c> external-worker job: the Flowable job id (needed to complete
+/// it) and the registration id it carries as a process variable.
+/// </summary>
+public sealed record OpenZaakJob(string JobId, RegistrationId RegistrationId);

services/domain/Big.Application/SubmitRegistration.cs

@@ -0,0 +1,33 @@
+using Big.Domain;
+
+namespace Big.Application;
+
+/// <summary>A zorgprofessional's request to register, in domain language. No ZGW concepts.</summary>
+public sealed record SubmitRegistrationCommand(string Bsn);
+
+/// <summary>
+/// The submit use case: create the <see cref="Registration"/> aggregate (INGEDIEND), persist it,
+/// then start the registratie workflow process and record its instance id. It returns as soon as
+/// the process is started — opening the zaak happens later, off the request path, in the external-task
+/// worker (ADR-0009). Persisting <em>before</em> starting the process closes the race where the worker
+/// acquires the OpenZaakAanmaken job before the aggregate it correlates to exists.
+/// </summary>
+public sealed class SubmitRegistration(IRegistrationStore store, IWorkflowClient workflow)
+{
+    public async Task<RegistrationId> HandleAsync(SubmitRegistrationCommand command, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(command);
+
+        var registration = Registration.Submit(command.Bsn);
+
+        // Persist before starting the process so the worker can correlate the OpenZaakAanmaken
+        // job back to an aggregate that already exists (ADR-0009).
+        await store.SaveAsync(registration, ct);
+
+        var processInstanceId = await workflow.StartRegistrationProcessAsync(registration.Id, ct);
+        registration.RecordProcessStarted(processInstanceId);
+        await store.SaveAsync(registration, ct);
+
+        return registration.Id;
+    }
+}

services/domain/Big.Domain/Big.Domain.csproj

@@ -0,0 +1,11 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <!-- The domain layer (CLAUDE.md §9): aggregates, value objects, invariants.
+       Pure C# — no external dependencies, no infrastructure concerns. -->
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+
+</Project>

services/domain/Big.Domain/Registration.cs

@@ -0,0 +1,67 @@
+namespace Big.Domain;
+
+/// <summary>
+/// The Registration aggregate root (CLAUDE.md §2.2): a zorgprofessional's submission to the BIG
+/// register. It owns its lifecycle invariants — it starts <see cref="RegistrationStatus.Ingediend"/>
+/// on submission, remembers the Flowable process that drives it, and records the zaak the ACL opens.
+/// </summary>
+public sealed class Registration
+{
+    private Registration(RegistrationId id, string bsn)
+    {
+        Id = id;
+        Bsn = bsn;
+        Status = RegistrationStatus.Ingediend;
+    }
+
+    public RegistrationId Id { get; }
+
+    /// <summary>The citizen-service number of the submitting zorgprofessional. Handed to the ACL
+    /// as the domain payload; the domain never constructs ZGW concepts from it (§8.1).</summary>
+    public string Bsn { get; }
+
+    public RegistrationStatus Status { get; private set; }
+
+    /// <summary>The Flowable process instance driving this registration, once started.</summary>
+    public string? ProcessInstanceId { get; private set; }
+
+    /// <summary>The zaak the ACL opened for this registration, once the external task has run.</summary>
+    public Uri? ZaakUrl { get; private set; }
+
+    /// <summary>Submit a new registration. It begins in <see cref="RegistrationStatus.Ingediend"/>.</summary>
+    public static Registration Submit(string bsn)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(bsn);
+        return new Registration(RegistrationId.New(), bsn);
+    }
+
+    /// <summary>Record that the registratie workflow process has been started for this registration.</summary>
+    public void RecordProcessStarted(string processInstanceId)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(processInstanceId);
+        ProcessInstanceId = processInstanceId;
+    }
+
+    /// <summary>
+    /// Attach the zaak the ACL opened. The external-task worker may deliver the same job more than
+    /// once (at-least-once), so re-attaching the identical URL is a no-op; a different URL signals a
+    /// genuine conflict and is rejected. The status stays <see cref="RegistrationStatus.Ingediend"/>:
+    /// opening the zaak does not advance the registration's lifecycle in this slice.
+    /// </summary>
+    public void AttachZaak(Uri zaakUrl)
+    {
+        ArgumentNullException.ThrowIfNull(zaakUrl);
+
+        if (ZaakUrl is not null)
+        {
+            if (ZaakUrl != zaakUrl)
+                throw new InvalidOperationException(
+                    $"Registration {Id} already has zaak {ZaakUrl}; cannot attach a different zaak {zaakUrl}.");
+            // Stryker disable once Statement : equivalent — re-assigning the identical URL below is a
+            // no-op, so removing this early return is behaviourally indistinguishable.
+            return;
+        }
+
+        ZaakUrl = zaakUrl;
+    }
+}

services/domain/Big.Domain/RegistrationId.cs

@@ -0,0 +1,15 @@
+namespace Big.Domain;
+
+/// <summary>The identity of a <see cref="Registration"/> aggregate — opaque, server-assigned,
+/// and distinct from the OpenZaak zaak id (which the projection keys on). A value object so the
+/// id can travel as a Flowable process variable and back without ever being a bare string.</summary>
+public readonly record struct RegistrationId(Guid Value)
+{
+    /// <summary>Mint a fresh identity for a newly submitted registration.</summary>
+    public static RegistrationId New() => new(Guid.NewGuid());
+
+    /// <summary>Rehydrate an id carried as a string (e.g. a Flowable process variable).</summary>
+    public static RegistrationId Parse(string value) => new(Guid.Parse(value));
+
+    public override string ToString() => Value.ToString();
+}

services/domain/Big.Domain/RegistrationStatus.cs

@@ -0,0 +1,10 @@
+namespace Big.Domain;
+
+/// <summary>The lifecycle states a <see cref="Registration"/> moves through. The walking
+/// skeleton knows only <see cref="Ingediend"/>; withdrawal, beoordeling and herregistratie
+/// states arrive in their own slices (Iteration 2+).</summary>
+public enum RegistrationStatus
+{
+    /// <summary>Submitted by the zorgprofessional; the registratie process has been started.</summary>
+    Ingediend,
+}

services/domain/Big.Infrastructure/AclHttpClient.cs

@@ -0,0 +1,28 @@
+using System.Net.Http.Json;
+using System.Text.Json.Serialization;
+using Big.Application;
+
+namespace Big.Infrastructure;
+
+/// <summary>
+/// HTTP client to the ACL service — the boundary the domain crosses to open a zaak (§8.1). It POSTs
+/// the bsn to the ACL's <c>/zaken</c> endpoint and returns the created zaak URL; it never constructs
+/// ZGW URLs or talks to OpenZaak itself.
+/// </summary>
+public sealed class AclHttpClient(HttpClient http, AclOptions options) : IAclClient
+{
+    public async Task<Uri> OpenZaakAsync(string bsn, CancellationToken ct = default)
+    {
+        using var response = await http.PostAsJsonAsync(
+            new Uri(options.BaseUrl, "zaken"), new OpenZaakRequest(bsn), ct);
+        response.EnsureSuccessStatusCode();
+
+        var opened = await response.Content.ReadFromJsonAsync<OpenZaakResponse>(ct)
+            ?? throw new InvalidOperationException("The ACL returned an empty zaak response.");
+        return new Uri(opened.ZaakUrl);
+    }
+
+    private sealed record OpenZaakRequest([property: JsonPropertyName("bsn")] string Bsn);
+
+    private sealed record OpenZaakResponse([property: JsonPropertyName("zaakUrl")] string ZaakUrl);
+}

services/domain/Big.Infrastructure/Big.Infrastructure.csproj

@@ -0,0 +1,24 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <!-- The infrastructure layer (CLAUDE.md §9): adapters implementing the Application ports.
+       The Workflow Client (Flowable REST) and the ACL HTTP client live here — the only code
+       that talks to Flowable (§8.2) and to the ACL respectively. -->
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\Big.Application\Big.Application.csproj" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <!-- The external-task job worker is a hosted BackgroundService (ADR-0009); it logs and
+         resolves a per-tick scope. Abstractions only — the host (Api) brings the implementations. -->
+    <PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.0" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.0" />
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.0" />
+  </ItemGroup>
+
+</Project>

services/domain/Big.Infrastructure/FlowableWorkflowClient.cs

@@ -0,0 +1,110 @@
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Big.Application;
+using Big.Domain;
+
+namespace Big.Infrastructure;
+
+/// <summary>
+/// The Workflow Client — the only code that talks to Flowable (§8.2). It starts registratie process
+/// instances and drives the <c>OpenZaakAanmaken</c> external-worker jobs over Flowable's REST API
+/// (start: <c>service/runtime/process-instances</c>; acquire/complete: <c>external-job-api/…</c>).
+/// The REST contract here is the one verified against a live flowable-rest engine (ADR-0009).
+/// </summary>
+public sealed class FlowableWorkflowClient(HttpClient http, FlowableOptions options)
+    : IWorkflowClient, IExternalWorkerClient
+{
+    private const string Topic = "OpenZaakAanmaken";
+    private const string ProcessDefinitionKey = "registratie";
+    private const string RegistrationIdVariable = "registrationId";
+    private const string ZaakUrlVariable = "zaakUrl";
+
+    public async Task<string> StartRegistrationProcessAsync(RegistrationId registrationId, CancellationToken ct = default)
+    {
+        var request = new StartProcessRequest(
+            ProcessDefinitionKey,
+            [new Variable(RegistrationIdVariable, "string", registrationId.ToString())]);
+
+        var created = await PostAsync<StartProcessRequest, ProcessInstance>(
+            "service/runtime/process-instances", request, ct)
+            ?? throw new InvalidOperationException("Flowable returned an empty process-instance response.");
+        return created.Id;
+    }
+
+    public async Task<IReadOnlyList<OpenZaakJob>> AcquireOpenZaakJobsAsync(int maxJobs, CancellationToken ct = default)
+    {
+        var request = new AcquireJobsRequest(Topic, options.LockDuration, maxJobs, options.WorkerId);
+
+        var jobs = await PostAsync<AcquireJobsRequest, List<AcquiredJob>>(
+            "external-job-api/acquire/jobs", request, ct) ?? [];
+
+        return [.. jobs.Select(job => new OpenZaakJob(job.Id, RegistrationId.Parse(job.RegistrationId())))];
+    }
+
+    public async Task CompleteOpenZaakJobAsync(string jobId, Uri zaakUrl, CancellationToken ct = default)
+    {
+        var request = new CompleteJobRequest(
+            options.WorkerId,
+            [new Variable(ZaakUrlVariable, "string", zaakUrl.ToString())]);
+
+        using var response = await SendAsync(
+            $"external-job-api/acquire/jobs/{jobId}/complete", request, ct);
+        response.EnsureSuccessStatusCode();
+    }
+
+    private async Task<TResponse?> PostAsync<TRequest, TResponse>(string path, TRequest body, CancellationToken ct)
+    {
+        using var response = await SendAsync(path, body, ct);
+        response.EnsureSuccessStatusCode();
+        return await response.Content.ReadFromJsonAsync<TResponse>(ct);
+    }
+
+    private Task<HttpResponseMessage> SendAsync<TRequest>(string path, TRequest body, CancellationToken ct)
+    {
+        var message = new HttpRequestMessage(HttpMethod.Post, new Uri(options.BaseUrl, path))
+        {
+            Content = JsonContent.Create(body),
+        };
+        message.Headers.Authorization = new AuthenticationHeaderValue("Basic", BasicCredentials());
+        return http.SendAsync(message, ct);
+    }
+
+    private string BasicCredentials()
+        => Convert.ToBase64String(Encoding.ASCII.GetBytes($"{options.Username}:{options.Password}"));
+
+    private sealed record StartProcessRequest(
+        [property: JsonPropertyName("processDefinitionKey")] string ProcessDefinitionKey,
+        [property: JsonPropertyName("variables")] IReadOnlyList<Variable> Variables);
+
+    private sealed record AcquireJobsRequest(
+        [property: JsonPropertyName("topic")] string Topic,
+        [property: JsonPropertyName("lockDuration")] string LockDuration,
+        [property: JsonPropertyName("numberOfTasks")] int NumberOfTasks,
+        [property: JsonPropertyName("workerId")] string WorkerId);
+
+    private sealed record CompleteJobRequest(
+        [property: JsonPropertyName("workerId")] string WorkerId,
+        [property: JsonPropertyName("variables")] IReadOnlyList<Variable> Variables);
+
+    private sealed record Variable(
+        [property: JsonPropertyName("name")] string Name,
+        [property: JsonPropertyName("type")] string Type,
+        [property: JsonPropertyName("value")] string Value);
+
+    private sealed record ProcessInstance([property: JsonPropertyName("id")] string Id);
+
+    private sealed record AcquiredJob(
+        [property: JsonPropertyName("id")] string Id,
+        [property: JsonPropertyName("variables")] IReadOnlyList<Variable> Variables)
+    {
+        /// <summary>The registration id this job carries as a process variable.</summary>
+        public string RegistrationId() =>
+            // Stryker disable once Linq : equivalent — Single and SingleOrDefault both throw on a job
+            // with no registrationId variable (the only untested branch), so the mutant is indistinguishable.
+            Variables.SingleOrDefault(v => v.Name == "registrationId")?.Value
+            ?? throw new InvalidOperationException($"OpenZaakAanmaken job {Id} carries no registrationId variable.");
+    }
+}

services/domain/Big.Infrastructure/IExternalWorkerClient.cs

@@ -0,0 +1,18 @@
+using Big.Application;
+
+namespace Big.Infrastructure;
+
+/// <summary>
+/// The worker-facing side of the Workflow Client: acquiring and completing Flowable external-worker
+/// jobs (ADR-0009). Kept separate from the Application's <see cref="IWorkflowClient"/> because job
+/// acquisition is a Flowable-specific polling mechanic the application never needs to know about.
+/// Implemented by <see cref="FlowableWorkflowClient"/> — the only code that talks to Flowable (§8.2).
+/// </summary>
+public interface IExternalWorkerClient
+{
+    /// <summary>Acquire and lock up to <paramref name="maxJobs"/> <c>OpenZaakAanmaken</c> jobs.</summary>
+    Task<IReadOnlyList<OpenZaakJob>> AcquireOpenZaakJobsAsync(int maxJobs, CancellationToken ct = default);
+
+    /// <summary>Complete an acquired job, passing the opened zaak URL back into the process.</summary>
+    Task CompleteOpenZaakJobAsync(string jobId, Uri zaakUrl, CancellationToken ct = default);
+}

services/domain/Big.Infrastructure/InMemoryRegistrationStore.cs

@@ -0,0 +1,25 @@
+using System.Collections.Concurrent;
+using Big.Application;
+using Big.Domain;
+
+namespace Big.Infrastructure;
+
+/// <summary>
+/// In-memory <see cref="IRegistrationStore"/> for the minimal slice (ADR-0009). The walking
+/// skeleton's read path is the projection (S-06), not this store, so durable domain persistence is a
+/// documented follow-up. Registered as a singleton so the submit endpoint and the worker share it.
+/// </summary>
+public sealed class InMemoryRegistrationStore : IRegistrationStore
+{
+    private readonly ConcurrentDictionary<RegistrationId, Registration> _byId = new();
+
+    public Task SaveAsync(Registration registration, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(registration);
+        _byId[registration.Id] = registration;
+        return Task.CompletedTask;
+    }
+
+    public Task<Registration?> GetAsync(RegistrationId id, CancellationToken ct = default)
+        => Task.FromResult(_byId.GetValueOrDefault(id));
+}

services/domain/Big.Infrastructure/OpenZaakJobProcessor.cs

@@ -0,0 +1,39 @@
+using Big.Application;
+using Microsoft.Extensions.Logging;
+
+namespace Big.Infrastructure;
+
+/// <summary>
+/// One poll tick of the external-task worker (ADR-0009): acquire the parked <c>OpenZaakAanmaken</c>
+/// jobs, hand each to the <see cref="OpenZaakWorker"/> to open a zaak via the ACL, and complete the
+/// Flowable job with the resulting zaak URL. A job that fails is logged and left un-completed so
+/// Flowable redelivers it (§8.6). Split out from the hosted <see cref="OpenZaakJobPump"/> so the
+/// acquire→process→complete logic is unit-testable without a running host.
+/// </summary>
+public sealed class OpenZaakJobProcessor(
+    IExternalWorkerClient client,
+    OpenZaakWorker worker,
+    ILogger<OpenZaakJobProcessor> logger)
+{
+    /// <summary>Acquire and process up to <paramref name="maxJobs"/> jobs. Returns the number acquired.</summary>
+    public async Task<int> PumpOnceAsync(int maxJobs, CancellationToken ct = default)
+    {
+        var jobs = await client.AcquireOpenZaakJobsAsync(maxJobs, ct);
+
+        foreach (var job in jobs)
+        {
+            try
+            {
+                var zaakUrl = await worker.HandleAsync(job, ct);
+                await client.CompleteOpenZaakJobAsync(job.JobId, zaakUrl, ct);
+            }
+            catch (Exception ex)
+            {
+                // Leave the job un-completed: its lock expires and Flowable redelivers it (§8.6).
+                logger.LogError(ex, "OpenZaakAanmaken job {JobId} failed; leaving it for redelivery.", job.JobId);
+            }
+        }
+
+        return jobs.Count;
+    }
+}

services/domain/Big.Infrastructure/OpenZaakJobPump.cs

@@ -0,0 +1,48 @@
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+
+namespace Big.Infrastructure;
+
+/// <summary>
+/// The hosted polling loop of the external-task job worker (ADR-0009): on an interval it resolves a
+/// scoped <see cref="OpenZaakJobProcessor"/> and asks it to drain the parked <c>OpenZaakAanmaken</c>
+/// jobs. A deliberately thin shell — all acquire/process/complete logic lives in the processor, which
+/// is unit-tested; this class only owns the timer, the per-tick scope, and loop resilience.
+/// </summary>
+public sealed class OpenZaakJobPump(
+    IServiceScopeFactory scopeFactory,
+    FlowableOptions options,
+    ILogger<OpenZaakJobPump> logger) : BackgroundService
+{
+    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
+    {
+        while (!stoppingToken.IsCancellationRequested)
+        {
+            try
+            {
+                using var scope = scopeFactory.CreateScope();
+                var processor = scope.ServiceProvider.GetRequiredService<OpenZaakJobProcessor>();
+                await processor.PumpOnceAsync(options.MaxJobsPerPoll, stoppingToken);
+            }
+            catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
+            {
+                break;
+            }
+            catch (Exception ex)
+            {
+                // A transient fault (e.g. Flowable briefly unreachable) must not kill the loop.
+                logger.LogError(ex, "OpenZaakAanmaken job poll failed; retrying after the poll interval.");
+            }
+
+            try
+            {
+                await Task.Delay(options.PollInterval, stoppingToken);
+            }
+            catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
+            {
+                break;
+            }
+        }
+    }
+}

services/domain/Big.Infrastructure/Options.cs

@@ -0,0 +1,29 @@
+namespace Big.Infrastructure;
+
+/// <summary>Configuration for the Flowable Workflow Client. <see cref="BaseUrl"/> is the flowable-rest
+/// root and must end with a slash (e.g. <c>http://flowable-rest:8080/flowable-rest/</c>) so the
+/// <c>service/…</c> and <c>external-job-api/…</c> sub-paths resolve correctly.</summary>
+public sealed class FlowableOptions
+{
+    public Uri BaseUrl { get; set; } = null!;
+    public string Username { get; set; } = "";
+    public string Password { get; set; } = "";
+
+    /// <summary>The id this worker locks jobs under, so two workers don't process the same job.</summary>
+    public string WorkerId { get; set; } = "big-domain-worker";
+
+    /// <summary>How long an acquired job stays locked to this worker (ISO-8601 duration).</summary>
+    public string LockDuration { get; set; } = "PT5M";
+
+    /// <summary>How many OpenZaakAanmaken jobs to acquire per poll.</summary>
+    public int MaxJobsPerPoll { get; set; } = 5;
+
+    /// <summary>How often the worker polls Flowable for new jobs.</summary>
+    public TimeSpan PollInterval { get; set; } = TimeSpan.FromSeconds(2);
+}
+
+/// <summary>Configuration for the ACL HTTP client. <see cref="BaseUrl"/> is the ACL service root.</summary>
+public sealed class AclOptions
+{
+    public Uri BaseUrl { get; set; } = null!;
+}

services/domain/Big.Tests/AclHttpClientTests.cs

@@ -0,0 +1,44 @@
+using System.Net;
+using Big.Infrastructure;
+
+namespace Big.Tests;
+
+public class AclHttpClientTests
+{
+    private static AclHttpClient Client(StubHandler handler) => new(
+        new HttpClient(handler), new AclOptions { BaseUrl = new("http://acl/") });
+
+    [Fact]
+    public async Task Opens_a_zaak_by_posting_the_bsn_and_returns_the_zaak_url()
+    {
+        var capture = new RequestCapture();
+        var client = Client(capture.Responds(HttpStatusCode.OK,
+            """{"zaakUrl":"http://openzaak/zaken/api/v1/zaken/abc"}"""));
+
+        var url = await client.OpenZaakAsync("123456782");
+
+        Assert.Equal("http://openzaak/zaken/api/v1/zaken/abc", url.ToString());
+        Assert.Equal(HttpMethod.Post, capture.Seen!.Method);
+        Assert.Equal("http://acl/zaken", capture.Seen.RequestUri!.ToString());
+        Assert.Contains("\"bsn\":\"123456782\"", capture.Body);
+    }
+
+    [Fact]
+    public async Task Throws_when_the_acl_rejects_the_request()
+    {
+        var capture = new RequestCapture();
+        var client = Client(capture.Responds(HttpStatusCode.BadGateway));
+
+        await Assert.ThrowsAsync<HttpRequestException>(() => client.OpenZaakAsync("123456782"));
+    }
+
+    [Fact]
+    public async Task Throws_when_the_acl_returns_an_empty_body()
+    {
+        var capture = new RequestCapture();
+        var client = Client(capture.Responds(HttpStatusCode.OK, "null"));
+
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(() => client.OpenZaakAsync("123456782"));
+        Assert.Contains("empty", ex.Message, StringComparison.OrdinalIgnoreCase);
+    }
+}

services/domain/Big.Tests/Big.Tests.csproj

@@ -0,0 +1,27 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Using Include="Xunit" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\Big.Domain\Big.Domain.csproj" />
+    <ProjectReference Include="..\Big.Application\Big.Application.csproj" />
+    <ProjectReference Include="..\Big.Infrastructure\Big.Infrastructure.csproj" />
+  </ItemGroup>
+
+</Project>

services/domain/Big.Tests/CapturingLogger.cs

@@ -0,0 +1,24 @@
+using Microsoft.Extensions.Logging;
+
+namespace Big.Tests;
+
+/// <summary>A minimal <see cref="ILogger{T}"/> that records the level and rendered message of each
+/// entry, so tests can assert that (for example) a failing job was logged.</summary>
+internal sealed class CapturingLogger<T> : ILogger<T>
+{
+    public List<(LogLevel Level, string Message)> Entries { get; } = [];
+
+    public IDisposable BeginScope<TState>(TState state) where TState : notnull => NullScope.Instance;
+
+    public bool IsEnabled(LogLevel logLevel) => true;
+
+    public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception? exception,
+        Func<TState, Exception?, string> formatter)
+        => Entries.Add((logLevel, formatter(state, exception)));
+
+    private sealed class NullScope : IDisposable
+    {
+        public static readonly NullScope Instance = new();
+        public void Dispose() { }
+    }
+}

services/domain/Big.Tests/Fakes.cs

@@ -0,0 +1,61 @@
+using Big.Application;
+using Big.Domain;
+
+namespace Big.Tests;
+
+/// <summary>An in-memory <see cref="IRegistrationStore"/> for the application-layer tests. Upserts
+/// keyed on the registration id, mirroring the production store (kept distinct from the production
+/// <c>InMemoryRegistrationStore</c> so tests can seed and inspect save counts).</summary>
+internal sealed class FakeRegistrationStore : IRegistrationStore
+{
+    private readonly Dictionary<RegistrationId, Registration> _byId = [];
+
+    public int SaveCount { get; private set; }
+
+    public Task SaveAsync(Registration registration, CancellationToken ct = default)
+    {
+        SaveCount++;
+        _byId[registration.Id] = registration;
+        return Task.CompletedTask;
+    }
+
+    public Task<Registration?> GetAsync(RegistrationId id, CancellationToken ct = default)
+        => Task.FromResult(_byId.GetValueOrDefault(id));
+
+    public void Seed(Registration registration) => _byId[registration.Id] = registration;
+}
+
+/// <summary>A fake Workflow Client that records the registration it was asked to start a process for
+/// and returns a fixed process-instance id. An optional callback runs at start time, letting a test
+/// assert ordering (e.g. that the registration was persisted before the process started).</summary>
+internal sealed class FakeWorkflowClient(string processInstanceId = "proc-1", Action<RegistrationId>? onStart = null)
+    : IWorkflowClient
+{
+    public RegistrationId? StartedFor { get; private set; }
+
+    public Task<string> StartRegistrationProcessAsync(RegistrationId registrationId, CancellationToken ct = default)
+    {
+        onStart?.Invoke(registrationId);
+        StartedFor = registrationId;
+        return Task.FromResult(processInstanceId);
+    }
+}
+
+/// <summary>A fake ACL client that records the bsn it was asked to open a zaak for and returns a
+/// fixed zaak URL.</summary>
+internal sealed class FakeAclClient(Uri? zaakUrl = null) : IAclClient
+{
+    public static readonly Uri DefaultZaakUrl = new("http://openzaak/zaken/api/v1/zaken/abc");
+
+    private readonly Uri _zaakUrl = zaakUrl ?? DefaultZaakUrl;
+
+    public string? OpenedForBsn { get; private set; }
+    public int CallCount { get; private set; }
+
+    public Task<Uri> OpenZaakAsync(string bsn, CancellationToken ct = default)
+    {
+        CallCount++;
+        OpenedForBsn = bsn;
+        return Task.FromResult(_zaakUrl);
+    }
+}

services/domain/Big.Tests/FlowableWorkflowClientTests.cs

@@ -0,0 +1,139 @@
+using System.Net;
+using System.Text;
+using Big.Domain;
+using Big.Infrastructure;
+
+namespace Big.Tests;
+
+public class FlowableWorkflowClientTests
+{
+    private static readonly Uri Base = new("http://flowable/flowable-rest/");
+
+    private static FlowableWorkflowClient Client(StubHandler handler) => new(
+        new HttpClient(handler),
+        new FlowableOptions { BaseUrl = Base, Username = "rest-admin", Password = "test", WorkerId = "worker-x" });
+
+    private static string DecodeBasic(HttpRequestMessage request)
+        => Encoding.ASCII.GetString(Convert.FromBase64String(request.Headers.Authorization!.Parameter!));
+
+    [Fact]
+    public async Task Start_posts_the_registration_id_variable_and_returns_the_instance_id()
+    {
+        var capture = new RequestCapture();
+        var client = Client(capture.Responds(HttpStatusCode.Created, """{"id":"pi-1"}"""));
+        var rid = RegistrationId.New();
+
+        var pid = await client.StartRegistrationProcessAsync(rid);
+
+        Assert.Equal("pi-1", pid);
+        Assert.Equal(HttpMethod.Post, capture.Seen!.Method);
+        Assert.Equal("http://flowable/flowable-rest/service/runtime/process-instances",
+            capture.Seen.RequestUri!.ToString());
+        Assert.Equal("Basic", capture.Seen.Headers.Authorization!.Scheme);
+        Assert.Equal("rest-admin:test", DecodeBasic(capture.Seen));
+        Assert.Contains("\"processDefinitionKey\":\"registratie\"", capture.Body);
+        Assert.Contains("\"name\":\"registrationId\"", capture.Body);
+        Assert.Contains("\"type\":\"string\"", capture.Body);
+        Assert.Contains($"\"value\":\"{rid}\"", capture.Body);
+    }
+
+    [Fact]
+    public async Task Start_uses_the_configured_worker_credentials_and_defaults()
+    {
+        var capture = new RequestCapture();
+        // Only BaseUrl set — the worker id and (empty) credentials must come from the defaults.
+        var client = new FlowableWorkflowClient(
+            new HttpClient(capture.Responds(HttpStatusCode.OK, "[]")),
+            new FlowableOptions { BaseUrl = Base });
+
+        await client.AcquireOpenZaakJobsAsync(1);
+
+        Assert.Equal(":", DecodeBasic(capture.Seen!));
+        Assert.Contains("\"workerId\":\"big-domain-worker\"", capture.Body);
+        Assert.Contains("\"lockDuration\":\"PT5M\"", capture.Body);
+    }
+
+    [Fact]
+    public async Task Acquire_posts_the_topic_and_parses_jobs_with_their_registration_id()
+    {
+        var rid = RegistrationId.New();
+        var capture = new RequestCapture();
+        var client = Client(capture.Responds(HttpStatusCode.OK,
+            $$"""[{"id":"job-1","variables":[{"name":"registrationId","type":"string","value":"{{rid}}"}]}]"""));
+
+        var jobs = await client.AcquireOpenZaakJobsAsync(3);
+
+        var job = Assert.Single(jobs);
+        Assert.Equal("job-1", job.JobId);
+        Assert.Equal(rid, job.RegistrationId);
+        Assert.Equal("http://flowable/flowable-rest/external-job-api/acquire/jobs",
+            capture.Seen!.RequestUri!.ToString());
+        Assert.Contains("\"topic\":\"OpenZaakAanmaken\"", capture.Body);
+        Assert.Contains("\"numberOfTasks\":3", capture.Body);
+        Assert.Contains("\"workerId\":\"worker-x\"", capture.Body);
+        Assert.Contains("\"lockDuration\":\"PT5M\"", capture.Body);
+    }
+
+    [Theory]
+    [InlineData("[]")]
+    [InlineData("null")]
+    public async Task Acquire_returns_empty_when_flowable_has_no_parked_jobs(string body)
+    {
+        var capture = new RequestCapture();
+        var client = Client(capture.Responds(HttpStatusCode.OK, body));
+
+        var jobs = await client.AcquireOpenZaakJobsAsync(1);
+
+        Assert.NotNull(capture.Seen);
+        Assert.Empty(jobs);
+    }
+
+    [Fact]
+    public async Task Acquire_throws_when_a_job_carries_no_registration_id()
+    {
+        var capture = new RequestCapture();
+        var client = Client(capture.Responds(HttpStatusCode.OK, """[{"id":"job-1","variables":[]}]"""));
+
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(() => client.AcquireOpenZaakJobsAsync(1));
+        Assert.Contains("job-1", ex.Message);
+        Assert.Contains("registrationId", ex.Message);
+    }
+
+    [Fact]
+    public async Task Complete_posts_the_zaak_url_variable_to_the_job_complete_endpoint()
+    {
+        var capture = new RequestCapture();
+        var client = Client(capture.Responds(HttpStatusCode.NoContent));
+
+        await client.CompleteOpenZaakJobAsync("job-1", new Uri("http://openzaak/zaken/api/v1/zaken/abc"));
+
+        Assert.NotNull(capture.Seen);
+        Assert.Equal(HttpMethod.Post, capture.Seen!.Method);
+        Assert.Equal("http://flowable/flowable-rest/external-job-api/acquire/jobs/job-1/complete",
+            capture.Seen.RequestUri!.ToString());
+        Assert.Contains("\"workerId\":\"worker-x\"", capture.Body);
+        Assert.Contains("\"name\":\"zaakUrl\"", capture.Body);
+        Assert.Contains("\"type\":\"string\"", capture.Body);
+        Assert.Contains("\"value\":\"http://openzaak/zaken/api/v1/zaken/abc\"", capture.Body);
+    }
+
+    [Fact]
+    public async Task Start_throws_when_flowable_rejects_the_request()
+    {
+        var capture = new RequestCapture();
+        var client = Client(capture.Responds(HttpStatusCode.InternalServerError));
+
+        await Assert.ThrowsAsync<HttpRequestException>(
+            () => client.StartRegistrationProcessAsync(RegistrationId.New()));
+    }
+
+    [Fact]
+    public async Task Complete_throws_when_flowable_rejects_the_request()
+    {
+        var capture = new RequestCapture();
+        var client = Client(capture.Responds(HttpStatusCode.InternalServerError));
+
+        await Assert.ThrowsAsync<HttpRequestException>(
+            () => client.CompleteOpenZaakJobAsync("job-1", new Uri("http://openzaak/zaken/api/v1/zaken/abc")));
+    }
+}

services/domain/Big.Tests/HttpStubs.cs

@@ -0,0 +1,30 @@
+using System.Net;
+
+namespace Big.Tests;
+
+/// <summary>A test double for <see cref="HttpMessageHandler"/> that records the last request and
+/// returns a scripted response — the same approach the ACL gateway tests use.</summary>
+internal sealed class StubHandler(Func<HttpRequestMessage, Task<HttpResponseMessage>> onSend) : HttpMessageHandler
+{
+    protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken ct)
+        => onSend(request);
+}
+
+/// <summary>Captures the request a client sent, including the (buffered) body.</summary>
+internal sealed class RequestCapture
+{
+    public HttpRequestMessage? Seen { get; private set; }
+    public string? Body { get; private set; }
+
+    /// <summary>A handler that records the request, then replies with <paramref name="status"/> and
+    /// <paramref name="json"/>.</summary>
+    public StubHandler Responds(HttpStatusCode status, string? json = null) => new(async req =>
+    {
+        Seen = req;
+        Body = req.Content is null ? null : await req.Content.ReadAsStringAsync();
+        var response = new HttpResponseMessage(status);
+        if (json is not null)
+            response.Content = new StringContent(json, System.Text.Encoding.UTF8, "application/json");
+        return response;
+    });
+}

services/domain/Big.Tests/InMemoryRegistrationStoreTests.cs

@@ -0,0 +1,44 @@
+using Big.Domain;
+using Big.Infrastructure;
+
+namespace Big.Tests;
+
+public class InMemoryRegistrationStoreTests
+{
+    [Fact]
+    public async Task Saves_and_reads_back_a_registration_by_id()
+    {
+        var store = new InMemoryRegistrationStore();
+        var registration = Registration.Submit("123456782");
+
+        await store.SaveAsync(registration);
+
+        var loaded = await store.GetAsync(registration.Id);
+        Assert.NotNull(loaded);
+        Assert.Equal(registration.Id, loaded.Id);
+        Assert.Null(await store.GetAsync(RegistrationId.New()));
+    }
+
+    [Fact]
+    public async Task Saving_the_same_id_upserts()
+    {
+        var store = new InMemoryRegistrationStore();
+        var registration = Registration.Submit("123456782");
+        await store.SaveAsync(registration);
+
+        registration.AttachZaak(new Uri("http://openzaak/zaken/api/v1/zaken/abc"));
+        await store.SaveAsync(registration);
+
+        var loaded = await store.GetAsync(registration.Id);
+        Assert.NotNull(loaded);
+        Assert.Equal("http://openzaak/zaken/api/v1/zaken/abc", loaded.ZaakUrl!.ToString());
+    }
+
+    [Fact]
+    public async Task Saving_a_null_registration_is_rejected()
+    {
+        var store = new InMemoryRegistrationStore();
+
+        await Assert.ThrowsAsync<ArgumentNullException>(() => store.SaveAsync(null!));
+    }
+}

services/domain/Big.Tests/OpenZaakJobProcessorTests.cs

@@ -0,0 +1,83 @@
+using Big.Application;
+using Big.Domain;
+using Big.Infrastructure;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+
+namespace Big.Tests;
+
+public class OpenZaakJobProcessorTests
+{
+    /// <summary>A fake external-worker client: scripts the jobs to acquire and records completions.</summary>
+    private sealed class FakeExternalWorkerClient(params OpenZaakJob[] jobs) : IExternalWorkerClient
+    {
+        public int AcquireCount { get; private set; }
+        public List<(string JobId, Uri ZaakUrl)> Completed { get; } = [];
+
+        public Task<IReadOnlyList<OpenZaakJob>> AcquireOpenZaakJobsAsync(int maxJobs, CancellationToken ct = default)
+        {
+            AcquireCount++;
+            return Task.FromResult<IReadOnlyList<OpenZaakJob>>(jobs.Take(maxJobs).ToList());
+        }
+
+        public Task CompleteOpenZaakJobAsync(string jobId, Uri zaakUrl, CancellationToken ct = default)
+        {
+            Completed.Add((jobId, zaakUrl));
+            return Task.CompletedTask;
+        }
+    }
+
+    private static OpenZaakJobProcessor Processor(IExternalWorkerClient client, IRegistrationStore store, FakeAclClient acl)
+        => new(client, new OpenZaakWorker(store, acl), NullLogger<OpenZaakJobProcessor>.Instance);
+
+    [Fact]
+    public async Task Acquires_a_job_opens_the_zaak_and_completes_it()
+    {
+        var registration = Registration.Submit("123456782");
+        var store = new FakeRegistrationStore();
+        store.Seed(registration);
+        var client = new FakeExternalWorkerClient(new OpenZaakJob("job-1", registration.Id));
+        var acl = new FakeAclClient();
+
+        var acquired = await Processor(client, store, acl).PumpOnceAsync(5);
+
+        Assert.Equal(1, acquired);
+        var completed = Assert.Single(client.Completed);
+        Assert.Equal("job-1", completed.JobId);
+        Assert.Equal(FakeAclClient.DefaultZaakUrl, completed.ZaakUrl);
+        Assert.Equal(FakeAclClient.DefaultZaakUrl, (await store.GetAsync(registration.Id))!.ZaakUrl);
+    }
+
+    [Fact]
+    public async Task A_failing_job_is_left_uncompleted_for_flowable_to_redeliver()
+    {
+        var store = new FakeRegistrationStore();
+        var acl = new FakeAclClient();
+        // The job correlates to a registration that is not in the store, so the worker throws.
+        var client = new FakeExternalWorkerClient(new OpenZaakJob("job-1", RegistrationId.New()));
+        var logger = new CapturingLogger<OpenZaakJobProcessor>();
+        var processor = new OpenZaakJobProcessor(client, new OpenZaakWorker(store, acl), logger);
+
+        var acquired = await processor.PumpOnceAsync(5);
+
+        Assert.Equal(1, acquired);
+        Assert.Empty(client.Completed);
+        // The failure is logged (and the job left for redelivery), not swallowed silently.
+        var error = Assert.Single(logger.Entries, e => e.Level == LogLevel.Error);
+        Assert.Contains("job-1", error.Message);
+    }
+
+    [Fact]
+    public async Task Does_nothing_but_poll_when_there_are_no_jobs()
+    {
+        var store = new FakeRegistrationStore();
+        var acl = new FakeAclClient();
+        var client = new FakeExternalWorkerClient();
+
+        var acquired = await Processor(client, store, acl).PumpOnceAsync(5);
+
+        Assert.Equal(0, acquired);
+        Assert.Equal(1, client.AcquireCount);
+        Assert.Empty(client.Completed);
+    }
+}

services/domain/Big.Tests/OpenZaakWorkerTests.cs

@@ -0,0 +1,70 @@
+using Big.Application;
+using Big.Domain;
+
+namespace Big.Tests;
+
+public class OpenZaakWorkerTests
+{
+    private static Registration Submitted(string bsn = "123456782")
+    {
+        var registration = Registration.Submit(bsn);
+        registration.RecordProcessStarted("proc-1");
+        return registration;
+    }
+
+    [Fact]
+    public async Task Handling_a_job_opens_a_zaak_via_the_acl_and_attaches_it()
+    {
+        var registration = Submitted();
+        var store = new FakeRegistrationStore();
+        store.Seed(registration);
+        var acl = new FakeAclClient();
+        var worker = new OpenZaakWorker(store, acl);
+
+        var zaakUrl = await worker.HandleAsync(new OpenZaakJob("job-1", registration.Id));
+
+        Assert.Equal(FakeAclClient.DefaultZaakUrl, zaakUrl);
+        Assert.Equal("123456782", acl.OpenedForBsn);
+        var saved = await store.GetAsync(registration.Id);
+        Assert.Equal(FakeAclClient.DefaultZaakUrl, saved!.ZaakUrl);
+        Assert.Equal(1, store.SaveCount);
+    }
+
+    [Fact]
+    public async Task Handling_a_null_job_is_rejected()
+    {
+        var worker = new OpenZaakWorker(new FakeRegistrationStore(), new FakeAclClient());
+
+        await Assert.ThrowsAsync<ArgumentNullException>(() => worker.HandleAsync(null!));
+    }
+
+    [Fact]
+    public async Task Handling_a_job_for_an_unknown_registration_throws_and_opens_no_zaak()
+    {
+        var store = new FakeRegistrationStore();
+        var acl = new FakeAclClient();
+        var worker = new OpenZaakWorker(store, acl);
+
+        var job = new OpenZaakJob("job-1", RegistrationId.New());
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(() => worker.HandleAsync(job));
+        Assert.Contains(job.RegistrationId.ToString(), ex.Message);
+        Assert.Equal(0, acl.CallCount);
+    }
+
+    [Fact]
+    public async Task Handling_a_redelivered_job_is_idempotent_and_does_not_open_a_second_zaak()
+    {
+        var registration = Submitted();
+        var store = new FakeRegistrationStore();
+        store.Seed(registration);
+        var acl = new FakeAclClient();
+        var worker = new OpenZaakWorker(store, acl);
+        var job = new OpenZaakJob("job-1", registration.Id);
+
+        var first = await worker.HandleAsync(job);
+        var second = await worker.HandleAsync(job);
+
+        Assert.Equal(first, second);
+        Assert.Equal(1, acl.CallCount);
+    }
+}

services/domain/Big.Tests/RegistrationTests.cs

@@ -0,0 +1,90 @@
+using Big.Domain;
+
+namespace Big.Tests;
+
+public class RegistrationTests
+{
+    [Fact]
+    public void Submitting_a_registration_starts_in_ingediend()
+    {
+        var registration = Registration.Submit("123456782");
+
+        Assert.Equal(RegistrationStatus.Ingediend, registration.Status);
+        Assert.Equal("123456782", registration.Bsn);
+        Assert.NotEqual(Guid.Empty, registration.Id.Value);
+        Assert.Null(registration.ZaakUrl);
+        Assert.Null(registration.ProcessInstanceId);
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData(null)]
+    public void Submitting_without_a_bsn_is_rejected(string? bsn)
+        => Assert.ThrowsAny<ArgumentException>(() => Registration.Submit(bsn!));
+
+    [Fact]
+    public void Recording_the_started_process_keeps_its_instance_id()
+    {
+        var registration = Registration.Submit("123456782");
+
+        registration.RecordProcessStarted("proc-42");
+
+        Assert.Equal("proc-42", registration.ProcessInstanceId);
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData(null)]
+    public void Recording_an_empty_process_instance_id_is_rejected(string? processInstanceId)
+    {
+        var registration = Registration.Submit("123456782");
+
+        Assert.ThrowsAny<ArgumentException>(() => registration.RecordProcessStarted(processInstanceId!));
+    }
+
+    [Fact]
+    public void Attaching_a_zaak_records_its_url_and_keeps_the_status_ingediend()
+    {
+        var registration = Registration.Submit("123456782");
+        var zaak = new Uri("http://openzaak/zaken/api/v1/zaken/abc");
+
+        registration.AttachZaak(zaak);
+
+        Assert.Equal(zaak, registration.ZaakUrl);
+        Assert.Equal(RegistrationStatus.Ingediend, registration.Status);
+    }
+
+    [Fact]
+    public void Attaching_a_null_zaak_is_rejected()
+    {
+        var registration = Registration.Submit("123456782");
+
+        Assert.Throws<ArgumentNullException>(() => registration.AttachZaak(null!));
+    }
+
+    [Fact]
+    public void Re_attaching_the_same_zaak_is_idempotent()
+    {
+        var registration = Registration.Submit("123456782");
+        var zaak = new Uri("http://openzaak/zaken/api/v1/zaken/abc");
+
+        registration.AttachZaak(zaak);
+        registration.AttachZaak(zaak);
+
+        Assert.Equal(zaak, registration.ZaakUrl);
+    }
+
+    [Fact]
+    public void Attaching_a_conflicting_zaak_is_rejected()
+    {
+        var registration = Registration.Submit("123456782");
+        registration.AttachZaak(new Uri("http://openzaak/zaken/api/v1/zaken/abc"));
+
+        var ex = Assert.Throws<InvalidOperationException>(
+            () => registration.AttachZaak(new Uri("http://openzaak/zaken/api/v1/zaken/other")));
+        Assert.Contains("/zaken/abc", ex.Message);
+        Assert.Contains("/zaken/other", ex.Message);
+    }
+}

services/domain/Big.Tests/SubmitRegistrationTests.cs

@@ -0,0 +1,66 @@
+using Big.Application;
+using Big.Domain;
+
+namespace Big.Tests;
+
+public class SubmitRegistrationTests
+{
+    [Fact]
+    public async Task Submitting_persists_an_ingediend_registration_and_starts_the_process()
+    {
+        var store = new FakeRegistrationStore();
+        var workflow = new FakeWorkflowClient(processInstanceId: "proc-42");
+        var handler = new SubmitRegistration(store, workflow);
+
+        var id = await handler.HandleAsync(new SubmitRegistrationCommand("123456782"));
+
+        var saved = await store.GetAsync(id);
+        Assert.NotNull(saved);
+        Assert.Equal("123456782", saved.Bsn);
+        Assert.Equal(RegistrationStatus.Ingediend, saved.Status);
+        Assert.Equal("proc-42", saved.ProcessInstanceId);
+        Assert.Equal(id, workflow.StartedFor);
+        Assert.Null(saved.ZaakUrl);
+        // Persisted twice: once before starting the process, once after recording the instance id.
+        Assert.Equal(2, store.SaveCount);
+    }
+
+    [Fact]
+    public async Task Rejects_a_null_command_without_touching_the_store_or_workflow()
+    {
+        var store = new FakeRegistrationStore();
+        var workflow = new FakeWorkflowClient();
+        var handler = new SubmitRegistration(store, workflow);
+
+        await Assert.ThrowsAsync<ArgumentNullException>(() => handler.HandleAsync(null!));
+        Assert.Equal(0, store.SaveCount);
+        Assert.Null(workflow.StartedFor);
+    }
+
+    [Fact]
+    public async Task Submitting_persists_the_registration_before_starting_the_process()
+    {
+        // The worker correlates the OpenZaakAanmaken job back to the aggregate by id, so the
+        // aggregate must already be persisted when the process starts (ADR-0009).
+        var store = new FakeRegistrationStore();
+        Registration? visibleAtStart = null;
+        var workflow = new FakeWorkflowClient(onStart: id => visibleAtStart = store.GetAsync(id).Result);
+        var handler = new SubmitRegistration(store, workflow);
+
+        await handler.HandleAsync(new SubmitRegistrationCommand("123456782"));
+
+        Assert.NotNull(visibleAtStart);
+    }
+
+    [Fact]
+    public async Task Submitting_without_a_bsn_is_rejected_and_starts_no_process()
+    {
+        var store = new FakeRegistrationStore();
+        var workflow = new FakeWorkflowClient();
+        var handler = new SubmitRegistration(store, workflow);
+
+        await Assert.ThrowsAnyAsync<ArgumentException>(
+            () => handler.HandleAsync(new SubmitRegistrationCommand("")));
+        Assert.Null(workflow.StartedFor);
+    }
+}

services/domain/Big.slnx

@@ -0,0 +1,7 @@
+<Solution>
+  <Project Path="Big.Domain/Big.Domain.csproj" />
+  <Project Path="Big.Application/Big.Application.csproj" />
+  <Project Path="Big.Infrastructure/Big.Infrastructure.csproj" />
+  <Project Path="Big.Api/Big.Api.csproj" />
+  <Project Path="Big.Tests/Big.Tests.csproj" />
+</Solution>

services/domain/Dockerfile

@@ -0,0 +1,34 @@
+# Multi-stage build for the BIG Domain Service (.NET 10).
+# Build context is services/domain (see infra/docker-compose.yml).
+FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
+WORKDIR /src
+
+# Restore first (cached unless .csproj files change).
+COPY Big.Api/Big.Api.csproj Big.Api/
+COPY Big.Application/Big.Application.csproj Big.Application/
+COPY Big.Infrastructure/Big.Infrastructure.csproj Big.Infrastructure/
+COPY Big.Domain/Big.Domain.csproj Big.Domain/
+RUN dotnet restore Big.Api/Big.Api.csproj
+
+COPY Big.Api/ Big.Api/
+COPY Big.Application/ Big.Application/
+COPY Big.Infrastructure/ Big.Infrastructure/
+COPY Big.Domain/ Big.Domain/
+RUN dotnet publish Big.Api/Big.Api.csproj -c Release -o /app/publish /p:UseAppHost=false
+
+FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtime
+WORKDIR /app
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends curl \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=build /app/publish .
+
+ENV ASPNETCORE_URLS=http://+:8080
+EXPOSE 8080
+
+HEALTHCHECK --interval=5s --timeout=3s --start-period=10s --retries=5 \
+    CMD curl -fsS http://localhost:8080/health || exit 1
+
+ENTRYPOINT ["dotnet", "Big.Api.dll"]

services/domain/stryker-config.json

@@ -0,0 +1,15 @@
+{
+  "stryker-config": {
+    "solution": "Big.slnx",
+    "test-projects": ["Big.Tests/Big.Tests.csproj"],
+    "reporters": ["progress", "html"],
+    "mutate": [
+      "!**/OpenZaakJobPump.cs"
+    ],
+    "thresholds": {
+      "high": 95,
+      "low": 90,
+      "break": 90
+    }
+  }
+}

tests/acceptance/Acceptance.csproj

@@ -19,6 +19,7 @@
     <ProjectReference Include="..\..\services\acl\Acl.Application\Acl.Application.csproj" />
     <ProjectReference Include="..\..\services\acl\Acl.Infrastructure\Acl.Infrastructure.csproj" />
     <ProjectReference Include="..\..\services\event-subscriber\EventSubscriber.Application\EventSubscriber.Application.csproj" />
+    <ProjectReference Include="..\..\services\domain\Big.Application\Big.Application.csproj" />
   </ItemGroup>
 
 </Project>

tests/acceptance/Features/RegistratieIndienen.feature

@@ -0,0 +1,18 @@
+# language: en
+# Drives S-05 (#6). A zorgprofessional submits a registration; the Domain Service starts the
+# registratie process and, via the external-task worker, opens a zaak through the ACL and records
+# it on the aggregate (ADR-0009). This scenario exercises the use cases against in-memory stand-ins
+# for the Workflow Client and the ACL; real Flowable + ACL + OpenZaak delivery is verified by the
+# live-stack check (verify-domain).
+Feature: Een registratie indienen
+  Als zorgprofessional wil ik mijn registratie indienen
+  zodat er een registratieproces start en een zaak wordt geopend.
+
+  Scenario: Indienen start het registratieproces en opent een zaak
+    Given a zorgprofessional submits a registration for BSN "123456782"
+    When the domain service handles the submission
+    Then a registratie process is started for the registration
+    And the registration has status "INGEDIEND"
+    When the OpenZaakAanmaken external task is handled for the registration
+    Then a zaak is opened via the ACL for BSN "123456782"
+    And the zaak is recorded on the registration

tests/acceptance/Steps/RegistratieIndienenSteps.cs

@@ -0,0 +1,54 @@
+using Acceptance.Support;
+using Big.Application;
+using Big.Domain;
+using Reqnroll;
+using Xunit;
+
+namespace Acceptance.Steps;
+
+/// <summary>Bindings for <c>RegistratieIndienen.feature</c> (S-05). Drives the SubmitRegistration
+/// and OpenZaakWorker use cases against in-memory ports; one instance per scenario.</summary>
+[Binding]
+public sealed class RegistratieIndienenSteps
+{
+    private readonly InMemoryWorkflowClient _workflow = new();
+    private readonly InMemoryAclClient _acl = new();
+    private readonly InMemoryRegistrationStore _store = new();
+    private string _bsn = "";
+    private RegistrationId _id;
+
+    [Given("a zorgprofessional submits a registration for BSN \"(.*)\"")]
+    public void GivenAZorgprofessionalSubmitsARegistration(string bsn) => _bsn = bsn;
+
+    [When("the domain service handles the submission")]
+    public async Task WhenTheDomainServiceHandlesTheSubmission()
+        => _id = await new SubmitRegistration(_store, _workflow).HandleAsync(new SubmitRegistrationCommand(_bsn));
+
+    [Then("a registratie process is started for the registration")]
+    public void ThenARegistratieProcessIsStarted()
+        => Assert.Equal(_id, _workflow.StartedFor);
+
+    [Then("the registration has status \"(.*)\"")]
+    public async Task ThenTheRegistrationHasStatus(string expected)
+    {
+        var registration = await _store.GetAsync(_id);
+        Assert.NotNull(registration);
+        Assert.Equal(expected, registration.Status.ToString().ToUpperInvariant());
+        Assert.Equal(InMemoryWorkflowClient.StartedProcessInstanceId, registration.ProcessInstanceId);
+    }
+
+    [When("the OpenZaakAanmaken external task is handled for the registration")]
+    public async Task WhenTheExternalTaskIsHandled()
+        => await new OpenZaakWorker(_store, _acl).HandleAsync(new OpenZaakJob("job-acc-1", _id));
+
+    [Then("a zaak is opened via the ACL for BSN \"(.*)\"")]
+    public void ThenAZaakIsOpenedViaTheAcl(string bsn)
+        => Assert.Equal(bsn, _acl.OpenedForBsn);
+
+    [Then("the zaak is recorded on the registration")]
+    public async Task ThenTheZaakIsRecordedOnTheRegistration()
+    {
+        var registration = await _store.GetAsync(_id);
+        Assert.Equal(InMemoryAclClient.OpenedZaakUrl, registration!.ZaakUrl);
+    }
+}

tests/acceptance/Support/InMemoryDomainPorts.cs

@@ -0,0 +1,50 @@
+using Big.Application;
+using Big.Domain;
+
+namespace Acceptance.Support;
+
+/// <summary>An in-memory Workflow Client for the domain acceptance scenario: it records which
+/// registration a process was started for and returns a fixed instance id. The acceptance test
+/// drives the use case without a running Flowable (live verification is the verify-domain check).</summary>
+public sealed class InMemoryWorkflowClient : IWorkflowClient
+{
+    public const string StartedProcessInstanceId = "proc-acc-1";
+
+    public RegistrationId? StartedFor { get; private set; }
+
+    public Task<string> StartRegistrationProcessAsync(RegistrationId registrationId, CancellationToken ct = default)
+    {
+        StartedFor = registrationId;
+        return Task.FromResult(StartedProcessInstanceId);
+    }
+}
+
+/// <summary>An in-memory ACL stand-in: records the bsn it opened a zaak for and returns a fixed URL,
+/// so the scenario verifies the domain crosses the ACL boundary (§8.1) without a running OpenZaak.</summary>
+public sealed class InMemoryAclClient : IAclClient
+{
+    public static readonly Uri OpenedZaakUrl = new("http://openzaak/zaken/api/v1/zaken/acc-zaak");
+
+    public string? OpenedForBsn { get; private set; }
+
+    public Task<Uri> OpenZaakAsync(string bsn, CancellationToken ct = default)
+    {
+        OpenedForBsn = bsn;
+        return Task.FromResult(OpenedZaakUrl);
+    }
+}
+
+/// <summary>An in-memory registration store for the domain acceptance scenario.</summary>
+public sealed class InMemoryRegistrationStore : IRegistrationStore
+{
+    private readonly Dictionary<RegistrationId, Registration> _byId = [];
+
+    public Task SaveAsync(Registration registration, CancellationToken ct = default)
+    {
+        _byId[registration.Id] = registration;
+        return Task.CompletedTask;
+    }
+
+    public Task<Registration?> GetAsync(RegistrationId id, CancellationToken ct = default)
+        => Task.FromResult(_byId.GetValueOrDefault(id));
+}