feat(workflow): Flowable up with registratie.bpmn external task (closes #4)

Add infra/flowable/docker-compose.yml (flowable-rest on Postgres, host :8090)
and workflows/registratie.bpmn — a minimal "Registratie ontvangen" process:
start -> external-worker task OpenZaakAanmaken -> end. A flowable-init
container deploys the model via the REST API on boot (idempotent: skips if
already deployed).

Add `make flowable-up/flowable-smoke/flowable-down`; flowable-smoke runs
infra/flowable/verify.py, which starts an instance and asserts it parks on
the OpenZaakAanmaken external task, then cleans up. Runbook included.

Verified clean-slate: down --volumes -> `make flowable-smoke` deploys on
boot, starts an instance, and confirms it waits at OpenZaakAanmaken.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Makefile

@@ -5,7 +5,7 @@
 # `make ci` locally runs exactly what the pipeline runs — no drift. Until a
 # self-hosted runner is registered, `make ci` is the gate (see docs/runbooks/ci.md).
 
-SLN        := register-referentie.slnx
+SLN        := services/bff/Bff.slnx
 COMPOSE    := infra/docker-compose.yml
 HEALTH_URL := http://localhost:8080/health
 OZ_COMPOSE  := infra/openzaak/docker-compose.yml

docs/architecture/adr-0003-default-fill.md

@@ -1,44 +0,0 @@
-# ADR-0003: ACL default-fill strategy
-
-- **Status:** Accepted
-- **Date:** 2026-06-04
-- **Deciders:** Respellion engineering
-- **Relates to:** S-04 (#5); builds on ADR-0001 (loose coupling)
-
-## Context
-
-The ACL is the only code that talks to ZGW APIs (ADR-0001 / CLAUDE.md §8.1). When the
-domain asks it to "open a zaak", the domain payload is intentionally free of ZGW
-specifics — it carries domain facts (e.g. the registrant's BSN), not OpenZaak fields. But
-OpenZaak's `POST /zaken` requires ZGW-mandatory fields: `bronorganisatie`,
-`verantwoordelijkeOrganisatie`, `startdatum`, `vertrouwelijkheidaanduiding`, and a
-`zaaktype` URL. Something has to supply those, and it must not leak into the domain.
-
-## Decision
-
-**The ACL default-fills the ZGW-mandatory zaak fields; the domain never sees them.**
-
-- `bronorganisatie`, `verantwoordelijkeOrganisatie`, `vertrouwelijkheidaanduiding`, and the
-  `zaaktype` URL come from **ACL configuration** (`AclDefaults` options) — not hardcoded,
-  not from the domain. This keeps them operationally manageable (the beheer portal will
-  edit them in S-15) and environment-specific (the seeded BIG zaaktype URL differs per env).
-- `startdatum` is derived from an injected **clock** (today's date), so it is
-  deterministic in tests.
-- The mapping from domain payload → ZGW `ZaakRequest` lives entirely inside the ACL
-  (`Application` builds the request from payload + defaults; `Infrastructure` serialises and
-  POSTs it). No other service constructs ZGW payloads or URLs.
-
-## Consequences
-
-- **Positive:** the domain stays ZGW-agnostic; ZGW knowledge is in one named place; defaults
-  are config (testable, env-specific, later editable via the beheer portal).
-- **Cost:** the ACL must be configured per environment (the seeded zaaktype URL, the
-  organisation RSINs). Missing/invalid config fails fast at the ACL boundary.
-- **Follow-ups:** mapping the BSN onto the zaak (eigenschap/rol), status transitions, and
-  documents are explicitly out of scope for S-04 and get their own slices.
-
-## Alternatives considered
-
-- **Defaults in the domain payload** — rejected: leaks ZGW concerns into the domain,
-  violating ADR-0001.
-- **Hardcoded defaults in code** — rejected: not env-specific, not operationally editable.

register-referentie.slnx

@@ -1,13 +0,0 @@
-<Solution>
-  <Folder Name="/services/" />
-  <Folder Name="/services/acl/">
-    <Project Path="services/acl/Acl.Api/Acl.Api.csproj" />
-    <Project Path="services/acl/Acl.Application/Acl.Application.csproj" />
-    <Project Path="services/acl/Acl.Infrastructure/Acl.Infrastructure.csproj" />
-    <Project Path="services/acl/Acl.Tests/Acl.Tests.csproj" />
-  </Folder>
-  <Folder Name="/services/bff/">
-    <Project Path="services/bff/Bff.Api/Bff.Api.csproj" />
-    <Project Path="services/bff/Bff.Tests/Bff.Tests.csproj" />
-  </Folder>
-</Solution>

services/acl/Acl.Api/Acl.Api.csproj

@@ -1,14 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk.Web">
-
-  <ItemGroup>
-    <ProjectReference Include="..\Acl.Application\Acl.Application.csproj" />
-    <ProjectReference Include="..\Acl.Infrastructure\Acl.Infrastructure.csproj" />
-  </ItemGroup>
-
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <Nullable>enable</Nullable>
-    <ImplicitUsings>enable</ImplicitUsings>
-  </PropertyGroup>
-
-</Project>

services/acl/Acl.Api/Program.cs

@@ -1,31 +0,0 @@
-using Acl.Application;
-using Acl.Infrastructure;
-
-var builder = WebApplication.CreateBuilder(args);
-
-builder.Services.AddSingleton<IClock, SystemClock>();
-builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
-    .GetSection("Acl:Defaults").Get<AclDefaults>()
-    ?? throw new InvalidOperationException("Missing configuration section 'Acl:Defaults'"));
-builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
-    .GetSection("Acl:OpenZaak").Get<OpenZaakOptions>()
-    ?? throw new InvalidOperationException("Missing configuration section 'Acl:OpenZaak'"));
-builder.Services.AddHttpClient<IZaakGateway, OpenZaakGateway>();
-builder.Services.AddScoped<AclService>();
-
-var app = builder.Build();
-
-app.MapGet("/health", () => "Healthy");
-
-// The ACL's single operation, exposed as a service endpoint.
-app.MapPost("/zaken", async (OpenZaakRequest body, AclService acl, CancellationToken ct) =>
-{
-    var zaakUrl = await acl.OpenZaakAsync(new DomainRegistration(body.Bsn), ct);
-    return Results.Ok(new { zaakUrl = zaakUrl.ToString() });
-});
-
-app.Run();
-
-public sealed record OpenZaakRequest(string Bsn);
-
-public partial class Program;

services/acl/Acl.Api/Properties/launchSettings.json

@@ -1,23 +0,0 @@
-{
-  "$schema": "https://json.schemastore.org/launchsettings.json",
-  "profiles": {
-    "http": {
-      "commandName": "Project",
-      "dotnetRunMessages": true,
-      "launchBrowser": true,
-      "applicationUrl": "http://localhost:5041",
-      "environmentVariables": {
-        "ASPNETCORE_ENVIRONMENT": "Development"
-      }
-    },
-    "https": {
-      "commandName": "Project",
-      "dotnetRunMessages": true,
-      "launchBrowser": true,
-      "applicationUrl": "https://localhost:7260;http://localhost:5041",
-      "environmentVariables": {
-        "ASPNETCORE_ENVIRONMENT": "Development"
-      }
-    }
-  }
-}

services/acl/Acl.Api/appsettings.Development.json

@@ -1,8 +0,0 @@
-{
-  "Logging": {
-    "LogLevel": {
-      "Default": "Information",
-      "Microsoft.AspNetCore": "Warning"
-    }
-  }
-}

services/acl/Acl.Api/appsettings.json

@@ -1,9 +0,0 @@
-{
-  "Logging": {
-    "LogLevel": {
-      "Default": "Information",
-      "Microsoft.AspNetCore": "Warning"
-    }
-  },
-  "AllowedHosts": "*"
-}

services/acl/Acl.Application/Acl.Application.csproj

@@ -1,9 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <Nullable>enable</Nullable>
-  </PropertyGroup>
-
-</Project>

services/acl/Acl.Application/AclDefaults.cs

@@ -1,10 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>Configured ZGW defaults the ACL fills in (ADR-0003).</summary>
-public sealed class AclDefaults
-{
-    public required string Bronorganisatie { get; init; }
-    public required string VerantwoordelijkeOrganisatie { get; init; }
-    public required string Vertrouwelijkheidaanduiding { get; init; }
-    public required Uri ZaaktypeUrl { get; init; }
-}

services/acl/Acl.Application/AclService.cs

@@ -1,20 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>The ACL's single operation: open a zaak from a domain payload,
-/// default-filling the ZGW-mandatory fields (ADR-0003).</summary>
-public sealed class AclService(IZaakGateway gateway, AclDefaults defaults, IClock clock)
-{
-    public Task<Uri> OpenZaakAsync(DomainRegistration registration, CancellationToken ct = default)
-    {
-        ArgumentNullException.ThrowIfNull(registration);
-
-        var request = new ZaakRequest(
-            defaults.Bronorganisatie,
-            defaults.VerantwoordelijkeOrganisatie,
-            defaults.Vertrouwelijkheidaanduiding,
-            defaults.ZaaktypeUrl,
-            clock.Today);
-
-        return gateway.OpenZaakAsync(request, ct);
-    }
-}

services/acl/Acl.Application/DomainRegistration.cs

@@ -1,4 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>Domain-language payload handed to the ACL. No ZGW concepts here.</summary>
-public sealed record DomainRegistration(string Bsn);

services/acl/Acl.Application/IClock.cs

@@ -1,7 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>Abstracts "today" so startdatum default-fill is deterministic in tests.</summary>
-public interface IClock
-{
-    DateOnly Today { get; }
-}

services/acl/Acl.Application/IZaakGateway.cs

@@ -1,8 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>Port to the ZGW Zaken API. Implemented in Infrastructure — the only
-/// code that talks to OpenZaak (ADR-0001).</summary>
-public interface IZaakGateway
-{
-    Task<Uri> OpenZaakAsync(ZaakRequest request, CancellationToken ct = default);
-}

services/acl/Acl.Application/ZaakRequest.cs

@@ -1,9 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>The fully default-filled zaak the gateway will create in OpenZaak.</summary>
-public sealed record ZaakRequest(
-    string Bronorganisatie,
-    string VerantwoordelijkeOrganisatie,
-    string Vertrouwelijkheidaanduiding,
-    Uri Zaaktype,
-    DateOnly Startdatum);

services/acl/Acl.Infrastructure/Acl.Infrastructure.csproj

@@ -1,13 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <ItemGroup>
-    <ProjectReference Include="..\Acl.Application\Acl.Application.csproj" />
-  </ItemGroup>
-
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <Nullable>enable</Nullable>
-  </PropertyGroup>
-
-</Project>

services/acl/Acl.Infrastructure/OpenZaakGateway.cs

@@ -1,48 +0,0 @@
-using System.Net.Http.Headers;
-using System.Net.Http.Json;
-using System.Text.Json.Serialization;
-using Acl.Application;
-
-namespace Acl.Infrastructure;
-
-/// <summary>The only code that talks to OpenZaak's Zaken API (ADR-0001).</summary>
-public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) : IZaakGateway
-{
-    public async Task<Uri> OpenZaakAsync(ZaakRequest request, CancellationToken ct = default)
-    {
-        ArgumentNullException.ThrowIfNull(request);
-
-        using var message = new HttpRequestMessage(
-            HttpMethod.Post, new Uri(options.BaseUrl, "/zaken/api/v1/zaken"))
-        {
-            Content = JsonContent.Create(new ZaakDto(
-                request.Bronorganisatie,
-                request.Zaaktype.ToString(),
-                request.VerantwoordelijkeOrganisatie,
-                request.Startdatum.ToString("yyyy-MM-dd"),
-                request.Vertrouwelijkheidaanduiding)),
-        };
-        message.Headers.Authorization =
-            new AuthenticationHeaderValue("Bearer", ZgwToken.Mint(options.ClientId, options.Secret));
-        // ZRC is a geo API; it requires the CRS headers.
-        message.Headers.Add("Accept-Crs", "EPSG:4326");
-        message.Content.Headers.Add("Content-Crs", "EPSG:4326");
-
-        using var response = await http.SendAsync(message, ct);
-        response.EnsureSuccessStatusCode();
-
-        var created = await response.Content.ReadFromJsonAsync<ZaakCreatedDto>(ct)
-            ?? throw new InvalidOperationException("OpenZaak returned an empty zaak response");
-        return new Uri(created.Url);
-    }
-
-    private sealed record ZaakDto(
-        [property: JsonPropertyName("bronorganisatie")] string Bronorganisatie,
-        [property: JsonPropertyName("zaaktype")] string Zaaktype,
-        [property: JsonPropertyName("verantwoordelijkeOrganisatie")] string VerantwoordelijkeOrganisatie,
-        [property: JsonPropertyName("startdatum")] string Startdatum,
-        [property: JsonPropertyName("vertrouwelijkheidaanduiding")] string Vertrouwelijkheidaanduiding);
-
-    private sealed record ZaakCreatedDto(
-        [property: JsonPropertyName("url")] string Url);
-}

services/acl/Acl.Infrastructure/OpenZaakOptions.cs

@@ -1,9 +0,0 @@
-namespace Acl.Infrastructure;
-
-/// <summary>Connection + credential config for OpenZaak's ZGW APIs.</summary>
-public sealed class OpenZaakOptions
-{
-    public required Uri BaseUrl { get; init; }
-    public required string ClientId { get; init; }
-    public required string Secret { get; init; }
-}

services/acl/Acl.Infrastructure/SystemClock.cs

@@ -1,8 +0,0 @@
-using Acl.Application;
-
-namespace Acl.Infrastructure;
-
-public sealed class SystemClock : IClock
-{
-    public DateOnly Today => DateOnly.FromDateTime(DateTime.UtcNow);
-}

services/acl/Acl.Infrastructure/ZgwToken.cs

@@ -1,29 +0,0 @@
-using System.Security.Cryptography;
-using System.Text;
-using System.Text.Json;
-
-namespace Acl.Infrastructure;
-
-/// <summary>Mints a ZGW (vng-api-common) JWT: HS256 over the standard claims.</summary>
-internal static class ZgwToken
-{
-    public static string Mint(string clientId, string secret)
-    {
-        var header = B64Url(JsonSerializer.SerializeToUtf8Bytes(new { alg = "HS256", typ = "JWT" }));
-        var payload = B64Url(JsonSerializer.SerializeToUtf8Bytes(new
-        {
-            iss = clientId,
-            iat = DateTimeOffset.UtcNow.ToUnixTimeSeconds(),
-            client_id = clientId,
-            user_id = "acl",
-            user_representation = "acl",
-        }));
-        var signingInput = $"{header}.{payload}";
-        using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
-        var signature = B64Url(hmac.ComputeHash(Encoding.UTF8.GetBytes(signingInput)));
-        return $"{signingInput}.{signature}";
-    }
-
-    private static string B64Url(byte[] bytes) =>
-        Convert.ToBase64String(bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_');
-}

services/acl/Acl.Tests/Acl.Tests.csproj

@@ -1,26 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <Nullable>enable</Nullable>
-    <IsPackable>false</IsPackable>
-  </PropertyGroup>
-
-  <ItemGroup>
-    <PackageReference Include="coverlet.collector" Version="6.0.4" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
-    <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <Using Include="Xunit" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <ProjectReference Include="..\Acl.Application\Acl.Application.csproj" />
-    <ProjectReference Include="..\Acl.Infrastructure\Acl.Infrastructure.csproj" />
-  </ItemGroup>
-
-</Project>

services/acl/Acl.Tests/AclServiceTests.cs

@@ -1,47 +0,0 @@
-using Acl.Application;
-
-namespace Acl.Tests;
-
-public class AclServiceTests
-{
-    private sealed class FakeGateway : IZaakGateway
-    {
-        public ZaakRequest? Captured;
-        public Uri Result { get; } = new("http://openzaak/zaken/api/v1/zaken/abc");
-
-        public Task<Uri> OpenZaakAsync(ZaakRequest request, CancellationToken ct = default)
-        {
-            Captured = request;
-            return Task.FromResult(Result);
-        }
-    }
-
-    private sealed class FixedClock(DateOnly today) : IClock
-    {
-        public DateOnly Today { get; } = today;
-    }
-
-    [Fact]
-    public async Task Opening_a_zaak_default_fills_zgw_fields_and_returns_the_zaak_url()
-    {
-        var gateway = new FakeGateway();
-        var defaults = new AclDefaults
-        {
-            Bronorganisatie = "517439943",
-            VerantwoordelijkeOrganisatie = "517439943",
-            Vertrouwelijkheidaanduiding = "openbaar",
-            ZaaktypeUrl = new("http://openzaak/catalogi/api/v1/zaaktypen/big"),
-        };
-        var service = new AclService(gateway, defaults, new FixedClock(new DateOnly(2026, 6, 4)));
-
-        var url = await service.OpenZaakAsync(new DomainRegistration("123456782"));
-
-        Assert.Equal(gateway.Result, url);
-        var req = Assert.IsType<ZaakRequest>(gateway.Captured);
-        Assert.Equal("517439943", req.Bronorganisatie);
-        Assert.Equal("517439943", req.VerantwoordelijkeOrganisatie);
-        Assert.Equal("openbaar", req.Vertrouwelijkheidaanduiding);
-        Assert.Equal(defaults.ZaaktypeUrl, req.Zaaktype);
-        Assert.Equal(new DateOnly(2026, 6, 4), req.Startdatum);
-    }
-}

services/acl/Acl.Tests/OpenZaakGatewayTests.cs

@@ -1,51 +0,0 @@
-using System.Net;
-using System.Net.Http.Json;
-using Acl.Application;
-using Acl.Infrastructure;
-
-namespace Acl.Tests;
-
-public class OpenZaakGatewayTests
-{
-    private sealed class StubHandler(Func<HttpRequestMessage, Task<HttpResponseMessage>> onSend)
-        : HttpMessageHandler
-    {
-        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken ct)
-            => onSend(request);
-    }
-
-    [Fact]
-    public async Task Posts_zaak_to_openzaak_with_bearer_and_default_fields_and_returns_url()
-    {
-        HttpRequestMessage? seen = null;
-        string? body = null;
-        var handler = new StubHandler(async req =>
-        {
-            seen = req;
-            body = await req.Content!.ReadAsStringAsync();
-            return new HttpResponseMessage(HttpStatusCode.Created)
-            {
-                Content = JsonContent.Create(new { url = "http://openzaak/zaken/api/v1/zaken/xyz" }),
-            };
-        });
-        var gateway = new OpenZaakGateway(
-            new HttpClient(handler),
-            new OpenZaakOptions { BaseUrl = new("http://openzaak"), ClientId = "cid", Secret = "sec" });
-        var request = new ZaakRequest(
-            "517439943", "517439943", "openbaar",
-            new("http://openzaak/catalogi/api/v1/zaaktypen/big"), new DateOnly(2026, 6, 4));
-
-        var url = await gateway.OpenZaakAsync(request);
-
-        Assert.Equal("http://openzaak/zaken/api/v1/zaken/xyz", url.ToString());
-        Assert.Equal(HttpMethod.Post, seen!.Method);
-        Assert.Equal("http://openzaak/zaken/api/v1/zaken", seen.RequestUri!.ToString());
-        Assert.Equal("Bearer", seen.Headers.Authorization!.Scheme);
-        Assert.False(string.IsNullOrWhiteSpace(seen.Headers.Authorization.Parameter));
-        Assert.Contains("\"bronorganisatie\":\"517439943\"", body);
-        Assert.Contains("\"verantwoordelijkeOrganisatie\":\"517439943\"", body);
-        Assert.Contains("\"vertrouwelijkheidaanduiding\":\"openbaar\"", body);
-        Assert.Contains("\"startdatum\":\"2026-06-04\"", body);
-        Assert.Contains("\"zaaktype\":\"http://openzaak/catalogi/api/v1/zaaktypen/big\"", body);
-    }
-}

services/acl/Acl.slnx

@@ -1,6 +0,0 @@
-<Solution>
-  <Project Path="Acl.Api/Acl.Api.csproj" />
-  <Project Path="Acl.Application/Acl.Application.csproj" />
-  <Project Path="Acl.Infrastructure/Acl.Infrastructure.csproj" />
-  <Project Path="Acl.Tests/Acl.Tests.csproj" />
-</Solution>