fix(infra): cap Objecten/Objecttypen uWSGI to 1 worker — unstarve verify-stack e2e (closes #144)

The Maykin images run uWSGI with 4 processes × 4 threads by default. Two
web services × 4 idle Django workers (~200 MB each) sat idle during the
Playwright e2e step and starved the single shared CI runner, so Keycloak
and the portals stopped responding (login never loaded) and Chromium
crashed — main verify-stack went red from run 2177 (post-#142) onward
while the PR runs passed on a less loaded runner.

These APIs only serve single-request smoke checks and are idle during
e2e, so 1 worker is plenty. Verified locally: both services healthy with
UWSGI_PROCESSES=1 and make verify-objecten / verify-objecttypen still green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -201,6 +201,12 @@ jobs:
       - name: Observability backplane (Grafana + Tempo + Prometheus datasources)
         id: obs
         run: OBS_TIMEOUT=180 make verify-observability
+      - name: Objecttypen API up + token authenticates
+        id: objecttypen
+        run: OBJECTTYPEN_TIMEOUT=120 make verify-objecttypen
+      - name: Objecten API up + token authenticates + trusts Objecttypen
+        id: objecten
+        run: OBJECTEN_TIMEOUT=120 make verify-objecten
       - name: ACL ↔ OpenZaak integration tests
         id: acl
         run: make verify-acl
@@ -233,6 +239,8 @@ jobs:
         env:
           UP: ${{ steps.up.outcome }}
           OBS: ${{ steps.obs.outcome }}
+          OBJECTTYPEN: ${{ steps.objecttypen.outcome }}
+          OBJECTEN: ${{ steps.objecten.outcome }}
           ACL: ${{ steps.acl.outcome }}
           NRC: ${{ steps.nrc.outcome }}
           PROJECTION: ${{ steps.projection.outcome }}
@@ -251,6 +259,8 @@ jobs:
             echo "| ----- | :----: |"
             echo "| Bring up + health | $(icon "$UP") |"
             echo "| Observability backplane | $(icon "$OBS") |"
+            echo "| Objecttypen API + token | $(icon "$OBJECTTYPEN") |"
+            echo "| Objecten API + token | $(icon "$OBJECTEN") |"
             echo "| ACL ↔ OpenZaak | $(icon "$ACL") |"
             echo "| OpenZaak → NRC | $(icon "$NRC") |"
             echo "| NRC → Event Subscriber → projection | $(icon "$PROJECTION") |"
@@ -270,7 +280,7 @@ jobs:
       # Log dump must precede teardown (which removes the containers).
       - name: Dump container logs on failure
         if: failure()
-        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-db flowable-rest flowable-init keycloak acl bff domain projection-db event-subscriber projection-api self-service openbaar behandel beheer tempo prometheus grafana 2>&1 || true
+        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-db flowable-rest flowable-init keycloak acl bff domain projection-db event-subscriber projection-api self-service openbaar behandel beheer objecttypen-db objecttypen-redis objecttypen-init objecttypen objecten-db objecten-redis objecten-init objecten tempo prometheus grafana 2>&1 || true
       - name: Tear down
         if: always()
         run: make down

BACKLOG.md

@@ -277,10 +277,16 @@ Split into independently deployable sub-slices (CLAUDE.md §13):
 
 ## Iteration 4 — Objecten and the authoritative register *(milestone: `Iteration 4 — Objecten`)*
 
-### S-18 · Objecten + Objecttypen up in compose; Register objecttype defined
+### S-18 · Objecten + Objecttypen up in compose; Register objecttype defined *(split — #19 closed)*
 
 **Outcome:** Objecten and Objecttypen running. A `RegisterRecord` objecttype defined with the public-safe schema.
 
+Split into independently deployable sub-slices (CLAUDE.md §13):
+
+- **S-18a** (#139, ✅) · Objecttypen API up in compose (own DB + seeded config + health + static token).
+- **S-18b** (#140, ✅) · Objecten API up in compose, wired to Objecttypen. Depends on S-18a.
+- **S-18c** (#141) · RegisterRecord objecttype defined + registered (public-safe JSON schema). Depends on S-18a/b.
+
 ### S-19 · ACL extension: write register-record to Objecten on approval
 
 **Outcome:** Approval path writes the canonical register record to Objecten, not OpenZaak eigenschappen. Projection now sourced from Objecten events.

Makefile

@@ -10,7 +10,7 @@ COMPOSE    := infra/docker-compose.yml
 # Long-running services with a healthcheck — the smoke polls these for readiness
 # (infra/wait-healthy.sh). One-shot init jobs (oz-init, nrc-init, flowable-init)
 # are not polled; they only need to have run. See docs/runbooks/gitea-actions-gotchas.md.
-WAIT_SVCS  := openzaak nrc-web acl bff domain event-subscriber projection-api self-service openbaar behandel beheer
+WAIT_SVCS  := openzaak nrc-web acl bff domain event-subscriber projection-api self-service openbaar behandel beheer objecttypen objecten
 # Config files (OpenZaak data.yaml, Keycloak realms, Flowable BPMN) are streamed
 # into external named volumes via `docker cp` (infra/seed-config.sh) instead of
 # bind-mounted, because bind mounts don't reach sibling containers on the
@@ -18,7 +18,7 @@ WAIT_SVCS  := openzaak nrc-web acl bff domain event-subscriber projection-api se
 # volumes are `external`, so compose won't remove them — CFG_VOLS lists them for
 # explicit teardown. See docs/runbooks/gitea-actions-gotchas.md.
 SEED       := bash infra/seed-config.sh
-CFG_VOLS   := rr-oz-config rr-nrc-config rr-kc-realms rr-fl-bpmn
+CFG_VOLS   := rr-oz-config rr-nrc-config rr-kc-realms rr-fl-bpmn rr-objecttypen-config rr-objecten-config
 # Local-only stack: same services but config is bind-mounted (no seed step), so a
 # plain `docker compose -f infra/docker-compose.local.yml up` works on any local
 # engine. This is the no-make / Windows-friendly path. See that file's header.
@@ -43,7 +43,7 @@ export DOCKER_HOST := unix://$(PODMAN_SOCK)
 endif
 endif
 
-.PHONY: ci lint build unit mutation frontend integration verify verify-up verify-acl verify-nrc verify-projection verify-bff verify-domain verify-observability verify-tracing verify-metrics verify-notifications smoke up down local verify-local local-down changelog openzaak-up openzaak-smoke openzaak-seed openzaak-down stack-up stack-smoke stack-down keycloak-up keycloak-smoke keycloak-down flowable-up flowable-smoke flowable-down help
+.PHONY: ci lint build unit mutation frontend integration verify verify-up verify-acl verify-nrc verify-projection verify-bff verify-domain verify-observability verify-tracing verify-metrics verify-objecttypen verify-objecten verify-notifications smoke up down local verify-local local-down changelog openzaak-up openzaak-smoke openzaak-seed openzaak-down stack-up stack-smoke stack-down keycloak-up keycloak-smoke keycloak-down flowable-up flowable-smoke flowable-down help
 
 ## ci: run the full pipeline — lint, build, unit, mutation, frontend, verify (mirrors Gitea Actions)
 ## `verify` is the live-stack stage (full stack up once → ACL + notification checks).
@@ -94,14 +94,14 @@ mutation:
 # podman-compose, and needing no `--wait` flag or host port access. The one-shots
 # (oz-init, flowable-init) aren't polled; they just need to have run.
 smoke:
-	$(SEED) oz nrc kc fl
+	$(SEED) oz nrc kc fl objecttypen objecten
 	docker compose -f $(COMPOSE) up -d --build
 	bash -c 'WAIT_TIMEOUT=420 bash infra/wait-healthy.sh $(WAIT_SVCS); rc=$$?; docker compose -f $(COMPOSE) down --volumes; docker volume rm -f $(CFG_VOLS) >/dev/null 2>&1; exit $$rc'
 
 ## up: seed config volumes and start the full stack (use instead of bare
 ## `docker compose up`, which can't self-seed the external config volumes)
 up:
-	$(SEED) oz nrc kc fl
+	$(SEED) oz nrc kc fl objecttypen objecten
 	docker compose -f $(COMPOSE) up -d --build
 
 ## down: stop and remove the local stack (incl. the external config volumes)
@@ -139,7 +139,7 @@ changelog:
 ## verify-up: bring the FULL stack up and wait for health (CI verify-stack step 1;
 ## subsumes the old compose-smoke health gate — the DoD "up reaches green" check).
 verify-up:
-	$(SEED) oz nrc kc fl
+	$(SEED) oz nrc kc fl objecttypen objecten
 	docker compose -f $(COMPOSE) up -d --build
 	WAIT_TIMEOUT=420 bash infra/wait-healthy.sh $(WAIT_SVCS)
 
@@ -186,11 +186,21 @@ verify-tracing:
 verify-metrics:
 	bash infra/run-metrics-check.sh
 
+## verify-objecttypen: assert the Objecttypen API is up + its static token authenticates
+## (S-18a), against the already-running stack.
+verify-objecttypen:
+	bash infra/run-objecttypen-check.sh
+
+## verify-objecten: assert the Objecten API is up + its static token authenticates and it
+## trusts the Objecttypen API (S-18b), against the already-running stack.
+verify-objecten:
+	bash infra/run-objecten-check.sh
+
 ## verify: local mirror of the CI verify-stack job — full stack up once, all checks,
 ## tear down (always). For fast single-concern local iteration use `integration`
 ## (oz-only) or `verify-notifications` (oz+nrc) instead.
 verify:
-	$(SEED) oz nrc kc fl
+	$(SEED) oz nrc kc fl objecttypen objecten
 	docker compose -f $(COMPOSE) up -d --build
 	@bash -c 'set -e; rc=0; \
 	  WAIT_TIMEOUT=420 bash infra/wait-healthy.sh $(WAIT_SVCS) \

apps/beheer/src/app/app.html

@@ -1 +1,5 @@
+<nav aria-label="Beheer" class="utrecht-theme">
+  <a routerLink="/" routerLinkActive="active" [routerLinkActiveOptions]="{ exact: true }">Catalogus</a>
+  <a routerLink="/default-fill" routerLinkActive="active">Default-fill</a>
+</nav>
 <router-outlet></router-outlet>

apps/beheer/src/app/app.routes.ts

@@ -1,7 +1,9 @@
 import { Route } from '@angular/router';
 import { authenticatedGuard } from 'auth';
 import { CatalogusPage } from './catalogus/catalogus-page';
+import { DefaultFillPage } from './default-fill/default-fill-page';
 
 export const appRoutes: Route[] = [
   { path: '', component: CatalogusPage, canActivate: [authenticatedGuard] },
+  { path: 'default-fill', component: DefaultFillPage, canActivate: [authenticatedGuard] },
 ];

apps/beheer/src/app/default-fill/default-fill-page.html

@@ -0,0 +1,60 @@
+<main utrecht-document class="utrecht-theme">
+  <utrecht-article>
+    <utrecht-heading-1>Default-fill</utrecht-heading-1>
+    <p utrecht-paragraph>
+      De ZGW-standaardwaarden die de ACL op elke nieuwe zaak invult (ADR-0003). Een wijziging geldt
+      voor de eerstvolgende zaak.
+    </p>
+
+    @if (loading()) {
+      <p utrecht-paragraph role="status">Bezig met laden…</p>
+    } @else if (loaded()) {
+      <form (submit)="save(); $event.preventDefault()">
+        <p>
+          <label for="bronorganisatie">Bronorganisatie</label><br />
+          <input
+            id="bronorganisatie"
+            name="bronorganisatie"
+            [value]="bronorganisatie()"
+            (input)="bronorganisatie.set($any($event.target).value)"
+          />
+        </p>
+        <p>
+          <label for="verantwoordelijkeOrganisatie">Verantwoordelijke organisatie</label><br />
+          <input
+            id="verantwoordelijkeOrganisatie"
+            name="verantwoordelijkeOrganisatie"
+            [value]="verantwoordelijkeOrganisatie()"
+            (input)="verantwoordelijkeOrganisatie.set($any($event.target).value)"
+          />
+        </p>
+        <p>
+          <label for="vertrouwelijkheidaanduiding">Vertrouwelijkheidaanduiding</label><br />
+          <input
+            id="vertrouwelijkheidaanduiding"
+            name="vertrouwelijkheidaanduiding"
+            [value]="vertrouwelijkheidaanduiding()"
+            (input)="vertrouwelijkheidaanduiding.set($any($event.target).value)"
+          />
+        </p>
+        <button utrecht-button appearance="primary-action-button" type="submit" [disabled]="saving()">
+          Opslaan
+        </button>
+      </form>
+
+      @if (saved()) {
+        <p utrecht-paragraph role="status">De standaardwaarden zijn opgeslagen.</p>
+      }
+      @if (failed()) {
+        <p utrecht-paragraph role="alert">
+          Opslaan is niet gelukt. Controleer of je als beheerder bent ingelogd en probeer het opnieuw.
+        </p>
+      }
+    } @else if (failed()) {
+      <p utrecht-paragraph role="alert">
+        Kon de standaardwaarden niet laden. Controleer of je als beheerder bent ingelogd en probeer
+        het opnieuw.
+      </p>
+    }
+  </utrecht-article>
+</main>

apps/beheer/src/app/default-fill/default-fill-page.spec.ts

@@ -0,0 +1,90 @@
+import { signal } from '@angular/core';
+import { fireEvent, render, screen } from '@testing-library/angular';
+import { of, throwError } from 'rxjs';
+import { BeheerDefaultFill, BffApiV1Service } from 'api-client';
+import { AuthService } from 'auth';
+import { axe } from 'vitest-axe';
+import { DefaultFillPage } from './default-fill-page';
+
+const current: BeheerDefaultFill = {
+  bronorganisatie: '517439943',
+  verantwoordelijkeOrganisatie: '517439943',
+  vertrouwelijkheidaanduiding: 'openbaar',
+};
+
+class FakeAuth extends AuthService {
+  readonly isAuthenticated = signal(true);
+  readonly bsn = signal<string | undefined>(undefined);
+  override readonly roles = signal<readonly string[]>(['beheerder']);
+  login(): void {
+    /* not exercised */
+  }
+  logout(): void {
+    /* not exercised */
+  }
+}
+
+function setup(
+  overrides: {
+    getBeheerDefaultFill?: ReturnType<typeof vi.fn>;
+    putBeheerDefaultFill?: ReturnType<typeof vi.fn>;
+  } = {},
+) {
+  const getBeheerDefaultFill = overrides.getBeheerDefaultFill ?? vi.fn().mockReturnValue(of(current));
+  const putBeheerDefaultFill = overrides.putBeheerDefaultFill ?? vi.fn().mockReturnValue(of(undefined));
+  return {
+    getBeheerDefaultFill,
+    putBeheerDefaultFill,
+    providers: [
+      { provide: BffApiV1Service, useValue: { getBeheerDefaultFill, putBeheerDefaultFill } },
+      { provide: AuthService, useClass: FakeAuth },
+    ],
+  };
+}
+
+describe('DefaultFillPage', () => {
+  it('loads the current default-fill into the form on open', async () => {
+    const { getBeheerDefaultFill, providers } = setup();
+    await render(DefaultFillPage, { providers });
+
+    expect(getBeheerDefaultFill).toHaveBeenCalled();
+    const bron = (await screen.findByLabelText('Bronorganisatie')) as HTMLInputElement;
+    expect(bron.value).toBe('517439943');
+  });
+
+  it('saves the edited values via the BFF', async () => {
+    const { putBeheerDefaultFill, providers } = setup();
+    await render(DefaultFillPage, { providers });
+
+    const bron = (await screen.findByLabelText('Bronorganisatie')) as HTMLInputElement;
+    fireEvent.input(bron, { target: { value: '999999999' } });
+    fireEvent.click(screen.getByRole('button', { name: /opslaan/i }));
+
+    expect(putBeheerDefaultFill).toHaveBeenCalledWith(
+      expect.objectContaining({ bronorganisatie: '999999999', vertrouwelijkheidaanduiding: 'openbaar' }),
+    );
+    expect(await screen.findByText(/standaardwaarden zijn opgeslagen/i)).toBeTruthy();
+  });
+
+  it('surfaces a save failure instead of swallowing it', async () => {
+    const { providers } = setup({
+      putBeheerDefaultFill: vi.fn().mockReturnValue(throwError(() => new Error('403'))),
+    });
+    await render(DefaultFillPage, { providers });
+
+    fireEvent.click(await screen.findByRole('button', { name: /opslaan/i }));
+
+    expect(await screen.findByText(/opslaan is niet gelukt/i)).toBeTruthy();
+  });
+
+  it('has no WCAG 2.1 AA violations', async () => {
+    document.documentElement.lang = 'nl';
+    const { container } = await render(DefaultFillPage, { providers: setup().providers });
+
+    const results = await axe(container, {
+      runOnly: { type: 'tag', values: ['wcag2a', 'wcag2aa', 'wcag21a', 'wcag21aa'] },
+    });
+
+    expect(results.violations).toEqual([]);
+  });
+});

apps/beheer/src/app/default-fill/default-fill-page.ts

@@ -0,0 +1,72 @@
+import { Component, inject, signal } from '@angular/core';
+import { BeheerDefaultFill, BffApiV1Service } from 'api-client';
+import { UtrechtComponentsModule } from 'ui';
+
+/**
+ * The beheer default-fill editor (S-15b): a beheerder reads and edits the ZGW default-fill values the
+ * ACL stamps on every zaak (ADR-0003). Load and save go through the BFF (`/beheer/default-fill`),
+ * which proxies the ACL (ADR-0025). A save takes effect on the next zaak (the ACL reads it per zaak).
+ */
+@Component({
+  selector: 'app-default-fill-page',
+  imports: [UtrechtComponentsModule],
+  templateUrl: './default-fill-page.html',
+})
+export class DefaultFillPage {
+  private readonly bff = inject(BffApiV1Service);
+
+  protected readonly bronorganisatie = signal('');
+  protected readonly verantwoordelijkeOrganisatie = signal('');
+  protected readonly vertrouwelijkheidaanduiding = signal('');
+  protected readonly loading = signal(false);
+  protected readonly loaded = signal(false);
+  protected readonly saving = signal(false);
+  protected readonly failed = signal(false);
+  protected readonly saved = signal(false);
+
+  constructor() {
+    this.load();
+  }
+
+  load(): void {
+    this.loading.set(true);
+    this.failed.set(false);
+    this.saved.set(false);
+    this.bff.getBeheerDefaultFill().subscribe({
+      next: (d: BeheerDefaultFill) => {
+        this.bronorganisatie.set(d.bronorganisatie);
+        this.verantwoordelijkeOrganisatie.set(d.verantwoordelijkeOrganisatie);
+        this.vertrouwelijkheidaanduiding.set(d.vertrouwelijkheidaanduiding);
+        this.loading.set(false);
+        this.loaded.set(true);
+      },
+      error: () => {
+        this.loading.set(false);
+        this.loaded.set(true);
+        this.failed.set(true);
+      },
+    });
+  }
+
+  save(): void {
+    this.saving.set(true);
+    this.failed.set(false);
+    this.saved.set(false);
+    this.bff
+      .putBeheerDefaultFill({
+        bronorganisatie: this.bronorganisatie(),
+        verantwoordelijkeOrganisatie: this.verantwoordelijkeOrganisatie(),
+        vertrouwelijkheidaanduiding: this.vertrouwelijkheidaanduiding(),
+      })
+      .subscribe({
+        next: () => {
+          this.saving.set(false);
+          this.saved.set(true);
+        },
+        error: () => {
+          this.saving.set(false);
+          this.failed.set(true);
+        },
+      });
+  }
+}

docs/architecture/adr-0026-mutable-default-fill-store.md

@@ -0,0 +1,61 @@
+# ADR-0026: Runtime-mutable ACL default-fill (in-memory store, seeded from config)
+
+- **Status:** Accepted
+- **Date:** 2026-07-24
+- **Deciders:** Respellion engineering
+- **Slice:** S-15b (#131), second of the S-15 (#16) split
+
+## Context
+
+ADR-0003 made the ACL *default-fill* the ZGW-mandatory fields it stamps on every
+zaak, supplied as static configuration (`Acl:Defaults`, read once at startup as an
+immutable singleton). S-15b lets a beheerder **edit** those values from the portal
+and have the next zaak reflect them — so the defaults must become mutable at runtime.
+
+Two questions: **what** is editable, and **where** the mutable state lives.
+
+## Decision
+
+**Make the three ZGW default-fill fields a runtime-mutable, in-memory store
+(`IDefaultFillStore`), seeded from `Acl:Defaults` at startup. The ACL reads it per
+zaak; the beheer `PUT /default-fill` replaces it.**
+
+### Only the three ZGW fill fields are editable
+
+`Acl:Defaults` also carries the S-27 catalog-resolution keys (`ZaaktypeIdentificatie`,
+`InformatieobjecttypeOmschrijving`). Those feed the resolved-URL cache
+(`CachedZaaktypeCatalog`, ADR-0021); editing them at runtime would leave a stale cache
+and is catalogus *wiring*, not "default fill". So they **stay static config** and are
+out of scope for the CRUD. The editable set is exactly `Bronorganisatie`,
+`VerantwoordelijkeOrganisatie`, `Vertrouwelijkheidaanduiding` (`DefaultFillSettings`).
+
+### In-memory, not persisted
+
+The store is a thread-safe in-memory singleton. **An edit is lost on restart**, when it
+reverts to the configured env. That is acceptable for this reference app: the slice
+demonstrates the *pattern* (beheer edits config that the ACL honours), not durable
+config management. The ACL stays stateless — no DB, no EF, no migration, no extra
+compose service.
+
+- ponytail ceiling: no persistence, no audit trail, no optimistic concurrency.
+- Upgrade path: back `IDefaultFillStore` with a DB (or an Objecten record) if durable,
+  audited, multi-instance config is needed — the port stays the same.
+
+## Consequences
+
+**Positive**
+
+- Demoable end to end (edit in portal → next zaak reflects it) with minimal moving parts.
+- The read path is per-zaak, so no restart and no cache concerns for the ZGW fields.
+
+**Negative / costs**
+
+- Edits don't survive a restart and aren't shared across replicas (single-instance
+  assumption). Documented ceiling above.
+- Two sources of default config now (static keys on `AclDefaults`, mutable fields in the
+  store) — a deliberate split by editability.
+
+## Coupling rules touched (CLAUDE.md §8)
+
+None new. The BFF→ACL edge already exists (ADR-0025); this adds a read/write pair on it.
+The ACL remains the owner of the ZGW-facing config.

docs/demo-script.md

@@ -5,6 +5,86 @@ copy-pasteable walkthrough against a local `make up` stack.
 
 ---
 
+## S-18b — Objecten API up in compose, wired to Objecttypen (#140)
+
+**Outcome:** the upstream Maykin **Objecten API** runs in the stack — own **PostGIS** DB + redis,
+config seeded like the other CG modules (`objecten-init` runs `setup_configuration` from the
+`rr-objecten-config` volume: migrate + provision a dev **static API token** + register the
+**Objecttypen API** (S-18a) as a trusted service), a health-checked `objecten` web on host `:8021`.
+An object can now reference its objecttype; the ACL writes register records here on approval (S-19).
+
+```bash
+make up
+# 1. The API is up; the seeded token authenticates (401 without, 200 with):
+curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8021/api/v2/objects                                       # 401
+curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: Token 1234567890abcdef1234567890abcdef12345678" \
+  http://localhost:8021/api/v2/objects                                                                              # 200
+#
+# 2. It trusts Objecttypen — the seeded zgw_consumers service points at the Objecttypen API:
+docker exec infra-objecten-1 python src/manage.py shell -c \
+  "from zgw_consumers.models import Service; print(*[(s.slug,s.api_root) for s in Service.objects.all()])"
+#   → ('objecttypen', 'http://objecttypen:8000/api/v2/')
+#
+# 3. Automated (a CI verify-stack step): asserts unauth 401 + token 200, against the running stack.
+make verify-objecten           # → OK — no-auth 401, token 200
+```
+
+**The path:** verbatim upstream image (`maykinmedia/objects-api`, pinned 3.4.0) + the same seed
+pattern as S-18a — `infra/seed-config.sh objecten` streams `data.yaml` into an external config
+volume, `objecten-init` (RUN_SETUP_CONFIG) applies it. Its `zgw_consumers` step registers Objecttypen
+(`api_type: orc`, api-key auth with the S-18a dev token). The RegisterRecord objecttype (S-18c) and
+the ACL write path (S-19) build on this.
+
+---
+
+## S-18a — Objecttypen API up in compose (#139)
+
+**Outcome:** the upstream Maykin **Objecttypen API** runs in the stack — own Postgres + redis, config
+seeded like the other CG modules (`objecttypen-init` runs `setup_configuration` from the
+`rr-objecttypen-config` volume: migrate + provision a dev **static API token**), a health-checked
+`objecttypen` web service on host `:8020`. This is the objecttype catalogue the register record
+(S-18b/S-18c, S-19) will use.
+
+```bash
+make up
+# 1. The API is up; the seeded token authenticates (401 without, 200 with):
+curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8020/api/v2/objecttypes                                   # 401
+curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: Token 0123456789abcdef0123456789abcdef01234567" \
+  http://localhost:8020/api/v2/objecttypes                                                                          # 200
+#
+# 2. Automated (a CI verify-stack step): asserts both, against the running stack.
+make verify-objecttypen        # → OK — no-auth 401, token 200
+```
+
+**The path:** verbatim upstream image (`maykinmedia/objecttypes-api`, pinned) + the same seed pattern
+as OpenZaak/NRC — `infra/seed-config.sh objecttypen` streams `data.yaml` into an external config
+volume, `objecttypen-init` (RUN_SETUP_CONFIG) applies it. Objecten (S-18b) and the RegisterRecord
+objecttype (S-18c) build on this.
+
+---
+
+## S-15b — Beheer-portal: default-fill configuration editor (#131, ADR-0026)
+
+**Outcome:** a beheerder edits the ACL's ZGW **default-fill** values (bronorganisatie,
+verantwoordelijke organisatie, vertrouwelijkheidaanduiding) from the beheer portal, and the next zaak
+is stamped with the new values — no restart. Path: portal → BFF `GET/PUT /beheer/default-fill`
+(beheerder role) → ACL `GET/PUT /default-fill` → a runtime-mutable in-memory store the ACL reads per
+zaak (ADR-0026). The S-27 catalog-resolution keys stay static config (editing them would desync the
+zaaktype cache). Store is in-memory: an edit reverts to the configured env on restart.
+
+```bash
+make up
+# 1. Log in as bram-beheerder / test123 → "Default-fill" tab → change a value → Opslaan.
+open http://localhost:8143/default-fill
+#
+# 2. Automated: the ACL uses the current default-fill per zaak (unit) and the endpoints are behind the
+#    beheerder role (BFF unit):
+#    Acl.Tests → AclServiceTests.Opening_a_zaak_reflects_a_default_fill_update
+#    Bff.Tests → BeheerDefaultFillEndpointTests
+```
+
+---
+
 ## S-15a — Beheer-portal: read-only catalogus viewer (#130, ADR-0025)
 
 **Outcome:** a new **beheer** portal (medewerker realm, like behandel) shows the ZTC catalogus —

infra/docker-compose.local.yml

@@ -560,11 +560,143 @@ services:
         condition: service_started
     networks: [cg]
 
+  # ── Objecttypen API (S-18a) — bind-mounted config (local variant) ──────────
+  objecttypen-db:
+    image: docker.io/library/postgres:17-alpine
+    environment:
+      POSTGRES_USER: objecttypes
+      POSTGRES_PASSWORD: objecttypes
+      POSTGRES_DB: objecttypes
+    volumes:
+      - objecttypen-db:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U objecttypes"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+    networks: [cg]
+
+  objecttypen-redis:
+    image: docker.io/library/redis:7
+    networks: [cg]
+
+  objecttypen-init:
+    image: docker.io/maykinmedia/objecttypes-api:${OBJECTTYPES_TAG:-3.4.2}
+    environment: &objecttypen-env-local
+      # 1 uWSGI worker, not the image default of 4×4 (#144) — idle workers starve the CI runner.
+      UWSGI_PROCESSES: "1"
+      UWSGI_THREADS: "2"
+      DJANGO_SETTINGS_MODULE: objecttypes.conf.docker
+      SECRET_KEY: ${OBJECTTYPES_SECRET_KEY:-dev-only-not-for-production}
+      DB_HOST: objecttypen-db
+      DB_NAME: objecttypes
+      DB_USER: objecttypes
+      DB_PASSWORD: objecttypes
+      ALLOWED_HOSTS: "*"
+      CACHE_DEFAULT: objecttypen-redis:6379/0
+      CACHE_AXES: objecttypen-redis:6379/0
+      DISABLE_2FA: "true"
+      OTEL_SDK_DISABLED: "true"
+      RUN_SETUP_CONFIG: "true"
+    command: /setup_configuration.sh
+    volumes:
+      - ./objecttypen/setup_configuration:/app/setup_configuration:ro,z
+    depends_on:
+      objecttypen-db:
+        condition: service_healthy
+      objecttypen-redis:
+        condition: service_started
+    networks: [cg]
+
+  objecttypen:
+    image: docker.io/maykinmedia/objecttypes-api:${OBJECTTYPES_TAG:-3.4.2}
+    environment: *objecttypen-env-local
+    healthcheck:
+      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+    ports:
+      - "8020:8000"
+    depends_on:
+      objecttypen-init:
+        condition: service_completed_successfully
+    networks: [cg]
+
+  # ── Objecten API (S-18b) — bind-mounted config (local variant) ─────────────
+  objecten-db:
+    image: docker.io/postgis/postgis:17-3.5
+    environment:
+      POSTGRES_USER: objects
+      POSTGRES_PASSWORD: objects
+      POSTGRES_DB: objects
+    volumes:
+      - objecten-db:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U objects"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+    networks: [cg]
+
+  objecten-redis:
+    image: docker.io/library/redis:7
+    networks: [cg]
+
+  objecten-init:
+    image: docker.io/maykinmedia/objects-api:${OBJECTS_TAG:-3.4.0}
+    environment: &objecten-env-local
+      # 1 uWSGI worker, not the image default of 4×4 (#144) — idle workers starve the CI runner.
+      UWSGI_PROCESSES: "1"
+      UWSGI_THREADS: "2"
+      DJANGO_SETTINGS_MODULE: objects.conf.docker
+      SECRET_KEY: ${OBJECTS_SECRET_KEY:-dev-only-not-for-production}
+      DB_HOST: objecten-db
+      DB_NAME: objects
+      DB_USER: objects
+      DB_PASSWORD: objects
+      ALLOWED_HOSTS: "*"
+      CACHE_DEFAULT: objecten-redis:6379/0
+      CACHE_AXES: objecten-redis:6379/0
+      DISABLE_2FA: "true"
+      OTEL_SDK_DISABLED: "true"
+      RUN_SETUP_CONFIG: "true"
+    command: /setup_configuration.sh
+    volumes:
+      - ./objecten/setup_configuration:/app/setup_configuration:ro,z
+    depends_on:
+      objecten-db:
+        condition: service_healthy
+      objecten-redis:
+        condition: service_started
+      objecttypen:
+        condition: service_healthy
+    networks: [cg]
+
+  objecten:
+    image: docker.io/maykinmedia/objects-api:${OBJECTS_TAG:-3.4.0}
+    environment: *objecten-env-local
+    healthcheck:
+      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+    ports:
+      - "8021:8000"
+    depends_on:
+      objecten-init:
+        condition: service_completed_successfully
+    networks: [cg]
+
 volumes:
   oz-db:
   nrc-db:
   flowable-db:
   projection-db:
+  objecttypen-db:
+  objecten-db:
   # Carries the seed-generated acl.env (server-assigned zaaktype URLs) from local-seed to the ACL.
   seed-env:
 

infra/docker-compose.yml

@@ -569,6 +569,150 @@ services:
         condition: service_started
     networks: [cg]
 
+  # ── Objecttypen API (S-18a) — upstream Maykin image, verbatim ──────────────
+  # The register's objecttype catalogue. Same shape as the other CG modules: own DB + redis, an
+  # `-init` that runs setup_configuration (RUN_SETUP_CONFIG → migrate + provision a static API token)
+  # from the external config volume streamed in by infra/seed-config.sh, and a health-checked web
+  # service that depends on init completing.
+  objecttypen-db:
+    image: docker.io/library/postgres:17-alpine
+    environment:
+      POSTGRES_USER: objecttypes
+      POSTGRES_PASSWORD: objecttypes
+      POSTGRES_DB: objecttypes
+    volumes:
+      - objecttypen-db:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U objecttypes"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+    networks: [cg]
+
+  objecttypen-redis:
+    image: docker.io/library/redis:7
+    networks: [cg]
+
+  objecttypen-init:
+    image: docker.io/maykinmedia/objecttypes-api:${OBJECTTYPES_TAG:-3.4.2}
+    environment: &objecttypen-env
+      # 1 uWSGI worker, not the image default of 4×4: this API only serves single-request smoke
+      # checks and sits idle during the e2e step — 4 idle Django workers each pin ~200 MB and starve
+      # the shared CI runner (#144). Init ignores this (it runs setup_configuration, not uwsgi).
+      UWSGI_PROCESSES: "1"
+      UWSGI_THREADS: "2"
+      DJANGO_SETTINGS_MODULE: objecttypes.conf.docker
+      SECRET_KEY: ${OBJECTTYPES_SECRET_KEY:-dev-only-not-for-production}
+      DB_HOST: objecttypen-db
+      DB_NAME: objecttypes
+      DB_USER: objecttypes
+      DB_PASSWORD: objecttypes
+      ALLOWED_HOSTS: "*"
+      CACHE_DEFAULT: objecttypen-redis:6379/0
+      CACHE_AXES: objecttypen-redis:6379/0
+      DISABLE_2FA: "true"
+      OTEL_SDK_DISABLED: "true"
+      RUN_SETUP_CONFIG: "true"
+    command: /setup_configuration.sh
+    # data.yaml is streamed into this external volume by infra/seed-config.sh before start.
+    volumes:
+      - objecttypen-config:/app/setup_configuration:ro
+    depends_on:
+      objecttypen-db:
+        condition: service_healthy
+      objecttypen-redis:
+        condition: service_started
+    networks: [cg]
+
+  objecttypen:
+    image: docker.io/maykinmedia/objecttypes-api:${OBJECTTYPES_TAG:-3.4.2}
+    environment: *objecttypen-env
+    healthcheck:
+      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+    ports:
+      - "8020:8000"
+    depends_on:
+      objecttypen-init:
+        condition: service_completed_successfully
+    networks: [cg]
+
+  # ── Objecten API (S-18b) — upstream Maykin image, verbatim ─────────────────
+  # The authoritative object store. Same shape as Objecttypen (own DB + redis, an `-init` that runs
+  # setup_configuration from the external config volume, a health-checked web). Two differences: the
+  # DB is PostGIS (objects carry geometry), and setup_configuration registers the Objecttypen API
+  # (S-18a) as a trusted service so an object can reference its objecttype.
+  objecten-db:
+    image: docker.io/postgis/postgis:17-3.5
+    environment:
+      POSTGRES_USER: objects
+      POSTGRES_PASSWORD: objects
+      POSTGRES_DB: objects
+    volumes:
+      - objecten-db:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U objects"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+    networks: [cg]
+
+  objecten-redis:
+    image: docker.io/library/redis:7
+    networks: [cg]
+
+  objecten-init:
+    image: docker.io/maykinmedia/objects-api:${OBJECTS_TAG:-3.4.0}
+    environment: &objecten-env
+      # 1 uWSGI worker, not the image default of 4×4 — see the objecttypen note above (#144).
+      UWSGI_PROCESSES: "1"
+      UWSGI_THREADS: "2"
+      DJANGO_SETTINGS_MODULE: objects.conf.docker
+      SECRET_KEY: ${OBJECTS_SECRET_KEY:-dev-only-not-for-production}
+      DB_HOST: objecten-db
+      DB_NAME: objects
+      DB_USER: objects
+      DB_PASSWORD: objects
+      ALLOWED_HOSTS: "*"
+      CACHE_DEFAULT: objecten-redis:6379/0
+      CACHE_AXES: objecten-redis:6379/0
+      DISABLE_2FA: "true"
+      OTEL_SDK_DISABLED: "true"
+      RUN_SETUP_CONFIG: "true"
+    command: /setup_configuration.sh
+    # data.yaml is streamed into this external volume by infra/seed-config.sh before start.
+    volumes:
+      - objecten-config:/app/setup_configuration:ro
+    depends_on:
+      objecten-db:
+        condition: service_healthy
+      objecten-redis:
+        condition: service_started
+      # Objecten's setup_configuration registers the Objecttypen service; that service only needs to
+      # exist as config, but wait for Objecttypen to be up so the register is meaningful end to end.
+      objecttypen:
+        condition: service_healthy
+    networks: [cg]
+
+  objecten:
+    image: docker.io/maykinmedia/objects-api:${OBJECTS_TAG:-3.4.0}
+    environment: *objecten-env
+    healthcheck:
+      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+    ports:
+      - "8021:8000"
+    depends_on:
+      objecten-init:
+        condition: service_completed_successfully
+    networks: [cg]
+
   # ── Observability backplane (S-16a, ADR-0023) ──────────────────────────────
   # Grafana-native stack: Tempo ingests OTLP traces (the .NET services export
   # straight to it — no collector hop, S-16b), Prometheus scrapes service
@@ -618,6 +762,8 @@ volumes:
   nrc-db:
   flowable-db:
   projection-db:
+  objecttypen-db:
+  objecten-db:
   # Config volumes — created and populated out-of-band by infra/seed-config.sh
   # (docker cp), because bind mounts don't reach sibling containers on the CI
   # runner. `external` keeps the names deterministic; the seed step manages them.
@@ -633,6 +779,12 @@ volumes:
   fl-bpmn:
     external: true
     name: rr-fl-bpmn
+  objecttypen-config:
+    external: true
+    name: rr-objecttypen-config
+  objecten-config:
+    external: true
+    name: rr-objecten-config
 
 networks:
   cg:

infra/objecten-check.py

@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+"""S-18b (#140): prove the Objecten API is up and its static token authenticates.
+
+Assert an unauthenticated call to /api/v2/objects is 401 and an authenticated one (the seeded dev
+token) is 200 — i.e. the service migrated, booted, and setup_configuration provisioned the token
+and the Objecttypen service it trusts. Stdlib only so it runs in a bare python:3-slim container on
+the compose network.
+"""
+import os
+import sys
+import time
+import urllib.error
+import urllib.request
+
+BASE = os.environ["OBJECTEN"]          # http://<ip>:8000
+TOKEN = os.environ["OBJECTEN_TOKEN"]
+TIMEOUT = int(os.environ.get("OBJECTEN_TIMEOUT", "60"))
+
+
+def status(url, token=None):
+    req = urllib.request.Request(url)
+    if token:
+        req.add_header("Authorization", f"Token {token}")
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return r.status
+    except urllib.error.HTTPError as e:
+        return e.code
+    except Exception:
+        return 0
+
+
+def main():
+    url = f"{BASE}/api/v2/objects"
+    deadline = time.time() + TIMEOUT
+    while time.time() < deadline:
+        unauth = status(url)
+        authed = status(url, TOKEN)
+        if unauth == 401 and authed == 200:
+            print(f"OK — {url}: no-auth {unauth}, token {authed}")
+            return 0
+        time.sleep(3)
+    print(f"FAIL — {url}: expected no-auth 401 + token 200, got {status(url)} / {status(url, TOKEN)}",
+          file=sys.stderr)
+    return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

infra/objecten/setup_configuration/data.yaml

@@ -0,0 +1,31 @@
+# Objecten API setup_configuration (S-18b). Streamed into the external rr-objecten-config volume by
+# infra/seed-config.sh and applied by objecten-init (RUN_SETUP_CONFIG). Declarative + idempotent.
+#
+# Two things: (1) register the Objecttypen API (S-18a) as a trusted service so an object can
+# reference its objecttype — authenticating with the dev static token Objecttypen provisioned; and
+# (2) a dev static token so peers (the ACL, S-19) can write objects here. Dev-only, not for prod.
+
+# (1) Trust the Objecttypen API. `orc` = overige RESTful component (how zgw_consumers classifies the
+# Objecttypen API). The RegisterRecord objecttype (S-18c) will reference an objecttype under this
+# service by uuid.
+zgw_consumers_config_enable: true
+zgw_consumers:
+  services:
+    - identifier: objecttypen
+      label: Objecttypen API
+      api_type: orc
+      api_root: http://objecttypen:8000/api/v2/
+      auth_type: api_key
+      header_key: Authorization
+      header_value: Token 0123456789abcdef0123456789abcdef01234567
+
+# (2) Static API token peers use to write/read objects.
+tokenauth_config_enable: true
+tokenauth:
+  items:
+    - identifier: register-referentie
+      token: 1234567890abcdef1234567890abcdef12345678
+      contact_person: Register Referentie
+      email: admin@localhost
+      organization: Respellion
+      is_superuser: true

infra/objecttypen-check.py

@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+"""S-18a (#139): prove the Objecttypen API is up and its static token authenticates.
+
+Assert an unauthenticated call to /api/v2/objecttypes is 401 and an authenticated one (the seeded
+dev token) is 200 — i.e. the service migrated, booted, and setup_configuration provisioned the token.
+Stdlib only so it runs in a bare python:3-slim container on the compose network.
+"""
+import os
+import sys
+import time
+import urllib.error
+import urllib.request
+
+BASE = os.environ["OBJECTTYPEN"]          # http://<ip>:8000
+TOKEN = os.environ["OBJECTTYPEN_TOKEN"]
+TIMEOUT = int(os.environ.get("OBJECTTYPEN_TIMEOUT", "60"))
+
+
+def status(url, token=None):
+    req = urllib.request.Request(url)
+    if token:
+        req.add_header("Authorization", f"Token {token}")
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return r.status
+    except urllib.error.HTTPError as e:
+        return e.code
+    except Exception:
+        return 0
+
+
+def main():
+    url = f"{BASE}/api/v2/objecttypes"
+    deadline = time.time() + TIMEOUT
+    while time.time() < deadline:
+        unauth = status(url)
+        authed = status(url, TOKEN)
+        if unauth == 401 and authed == 200:
+            print(f"OK — {url}: no-auth {unauth}, token {authed}")
+            return 0
+        time.sleep(3)
+    print(f"FAIL — {url}: expected no-auth 401 + token 200, got {status(url)} / {status(url, TOKEN)}",
+          file=sys.stderr)
+    return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

infra/objecttypen/setup_configuration/data.yaml

@@ -0,0 +1,11 @@
+# Objecttypen API setup_configuration (S-18a). Streamed into the external rr-objecttypen-config
+# volume by infra/seed-config.sh and applied by objecttypen-init (RUN_SETUP_CONFIG). Declarative +
+# idempotent. Dev-only static token so peers (Objecten S-18b, the ACL) can authenticate.
+tokenauth_config_enable: true
+tokenauth:
+  items:
+    - identifier: register-referentie
+      token: 0123456789abcdef0123456789abcdef01234567
+      contact_person: Register Referentie
+      email: admin@localhost
+      organization: Respellion

infra/run-objecten-check.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+#
+# S-18b (#140): assert the Objecten API is healthy + its static token authenticates, against an
+# ALREADY-RUNNING stack. Runs the check in a python:3-slim container on the stack network (the
+# service is reached by container IP; the runner can't reach published ports — gitea-actions-gotchas.md
+# §5/§6). Does NOT manage the stack lifecycle.
+set -euo pipefail
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# The dev token provisioned by infra/objecten/setup_configuration/data.yaml.
+TOKEN="${OBJECTEN_TOKEN:-1234567890abcdef1234567890abcdef12345678}"
+
+ot="$(docker ps -q --filter 'name=objecten' --filter 'health=healthy' | head -1)"
+[ -n "$ot" ] || ot="$(docker ps -q --filter 'name=[-_]objecten[-_]' | head -1)"
+[ -n "$ot" ] || { echo "ERROR: no running objecten container — bring the stack up first" >&2; exit 1; }
+net="$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{"\n"}}{{end}}' "$ot" | head -1)"
+ip="$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$ot")"
+echo ">> network=$net objecten=$ip"
+
+cid="$(docker create --network "$net" \
+  -e "OBJECTEN=http://$ip:8000" -e "OBJECTEN_TOKEN=$TOKEN" \
+  -e "OBJECTEN_TIMEOUT=${OBJECTEN_TIMEOUT:-60}" \
+  python:3-slim python /objecten-check.py)"
+docker cp "$here/objecten-check.py" "$cid:/objecten-check.py" >/dev/null
+rc=0; docker start -a "$cid" || rc=$?
+docker rm -f "$cid" >/dev/null
+exit $rc

infra/run-objecttypen-check.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+#
+# S-18a (#139): assert the Objecttypen API is healthy + its static token authenticates, against an
+# ALREADY-RUNNING stack. Runs the check in a python:3-slim container on the stack network (the
+# service is reached by container IP; the runner can't reach published ports — gitea-actions-gotchas.md
+# §5/§6). Does NOT manage the stack lifecycle.
+set -euo pipefail
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# The dev token provisioned by infra/objecttypen/setup_configuration/data.yaml.
+TOKEN="${OBJECTTYPEN_TOKEN:-0123456789abcdef0123456789abcdef01234567}"
+
+ot="$(docker ps -q --filter 'name=objecttypen' --filter 'health=healthy' | head -1)"
+[ -n "$ot" ] || ot="$(docker ps -q --filter 'name=[-_]objecttypen[-_]' | head -1)"
+[ -n "$ot" ] || { echo "ERROR: no running objecttypen container — bring the stack up first" >&2; exit 1; }
+net="$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{"\n"}}{{end}}' "$ot" | head -1)"
+ip="$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$ot")"
+echo ">> network=$net objecttypen=$ip"
+
+cid="$(docker create --network "$net" \
+  -e "OBJECTTYPEN=http://$ip:8000" -e "OBJECTTYPEN_TOKEN=$TOKEN" \
+  -e "OBJECTTYPEN_TIMEOUT=${OBJECTTYPEN_TIMEOUT:-60}" \
+  python:3-slim python /objecttypen-check.py)"
+docker cp "$here/objecttypen-check.py" "$cid:/objecttypen-check.py" >/dev/null
+rc=0; docker start -a "$cid" || rc=$?
+docker rm -f "$cid" >/dev/null
+exit $rc

infra/seed-config.sh

@@ -13,7 +13,7 @@
 # subcommand. Fixed-name `external` volumes keep the names deterministic across
 # both runtimes. See docs/runbooks/gitea-actions-gotchas.md.
 #
-# Usage: seed-config.sh <key> [<key> ...]   where key ∈ { oz, kc, fl }
+# Usage: seed-config.sh <key> [<key> ...]   where key ∈ { oz, nrc, kc, fl, objecttypen, objecten }
 set -euo pipefail
 
 here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -33,7 +33,7 @@ populate() {  # volume  source(file or dir/.)
   echo "  seeded $vol"
 }
 
-[ "$#" -gt 0 ] || { echo "usage: seed-config.sh <oz|nrc|kc|fl> ..." >&2; exit 2; }
+[ "$#" -gt 0 ] || { echo "usage: seed-config.sh <oz|nrc|kc|fl|objecttypen|objecten> ..." >&2; exit 2; }
 
 # The registratie process (BPMN) and its diploma-eligibility DMN are deployed as SEPARATE Flowable
 # deployments — the process engine and the DMN engine each own theirs (S-13, ADR-0016). flowable-rest
@@ -49,6 +49,8 @@ for key in "$@"; do
     oz) populate rr-oz-config "$here/openzaak/setup_configuration/." ;;
     nrc) populate rr-nrc-config "$here/opennotificaties/setup_configuration/." ;;
     kc) populate rr-kc-realms "$here/keycloak/realms/." ;;
+    objecttypen) populate rr-objecttypen-config "$here/objecttypen/setup_configuration/." ;;
+    objecten) populate rr-objecten-config "$here/objecten/setup_configuration/." ;;
     fl) d="$(mktemp -d)"; stage_flowable_workflows "$d"; populate rr-fl-bpmn "$d/." ;;
     *)  echo "unknown seed key: $key" >&2; exit 2 ;;
   esac

libs/api-client/src/lib/generated/bff-api.ts

@@ -24,6 +24,12 @@ import {
   Observable
 } from 'rxjs';
 
+export interface BeheerDefaultFill {
+  bronorganisatie: string;
+  verantwoordelijkeOrganisatie: string;
+  vertrouwelijkheidaanduiding: string;
+}
+
 export interface BeheerZaaktype {
   identificatie: string;
   omschrijving: string;
@@ -446,4 +452,69 @@ export class BffApiV1Service {
     );
   }
 
+ getBeheerDefaultFill<TData = BeheerDefaultFill>( options?: HttpClientBodyOptions): Observable<TData>;
+ getBeheerDefaultFill<TData = BeheerDefaultFill>( options?: HttpClientEventOptions): Observable<HttpEvent<TData>>;
+ getBeheerDefaultFill<TData = BeheerDefaultFill>( options?: HttpClientResponseOptions): Observable<AngularHttpResponse<TData>>;
+  getBeheerDefaultFill<TData = BeheerDefaultFill>(
+     options?: HttpClientObserveOptions): Observable<TData | HttpEvent<TData> | AngularHttpResponse<TData>> {
+    if (options?.observe === 'events') {
+      return this.http.get<TData>(
+      `/beheer/default-fill`,{
+        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
+        observe: 'events',
+      }
+    );
+    }
+
+    if (options?.observe === 'response') {
+      return this.http.get<TData>(
+      `/beheer/default-fill`,{
+        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
+        observe: 'response',
+      }
+    );
+    }
+
+    return this.http.get<TData>(
+      `/beheer/default-fill`,{
+        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
+        observe: 'body',
+      }
+    );
+  }
+
+ putBeheerDefaultFill<TData = void>(beheerDefaultFill: BeheerDefaultFill, options?: HttpClientBodyOptions): Observable<TData>;
+ putBeheerDefaultFill<TData = void>(beheerDefaultFill: BeheerDefaultFill, options?: HttpClientEventOptions): Observable<HttpEvent<TData>>;
+ putBeheerDefaultFill<TData = void>(beheerDefaultFill: BeheerDefaultFill, options?: HttpClientResponseOptions): Observable<AngularHttpResponse<TData>>;
+  putBeheerDefaultFill<TData = void>(
+    beheerDefaultFill: BeheerDefaultFill, options?: HttpClientObserveOptions): Observable<TData | HttpEvent<TData> | AngularHttpResponse<TData>> {
+    if (options?.observe === 'events') {
+      return this.http.put<TData>(
+      `/beheer/default-fill`,
+      beheerDefaultFill,{
+        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
+        observe: 'events',
+      }
+    );
+    }
+
+    if (options?.observe === 'response') {
+      return this.http.put<TData>(
+      `/beheer/default-fill`,
+      beheerDefaultFill,{
+        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
+        observe: 'response',
+      }
+    );
+    }
+
+    return this.http.put<TData>(
+      `/beheer/default-fill`,
+      beheerDefaultFill,{
+        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
+        observe: 'body',
+      }
+    );
+  }
+
 };

services/acl/Acl.Api/Program.cs

@@ -33,6 +33,15 @@ builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
 builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
     .GetSection("Acl:OpenZaak").Get<OpenZaakOptions>()
     ?? throw new InvalidOperationException("Missing configuration section 'Acl:OpenZaak'"));
+// The default-fill values are held in a runtime-mutable store (S-15b, ADR-0026), seeded from the
+// configured Acl:Defaults. The beheer portal edits it; the worker reads it per zaak. The S-27
+// resolution keys stay on AclDefaults (static) — see DefaultFillSettings.
+builder.Services.AddSingleton<IDefaultFillStore>(sp =>
+{
+    var d = sp.GetRequiredService<AclDefaults>();
+    return new InMemoryDefaultFillStore(
+        new DefaultFillSettings(d.Bronorganisatie, d.VerantwoordelijkeOrganisatie, d.Vertrouwelijkheidaanduiding));
+});
 builder.Services.AddHttpClient<IZaakGateway, OpenZaakGateway>();
 // Singleton so the resolved zaaktype/informatieobjecttype URLs are cached across requests (S-27).
 builder.Services.AddSingleton<IZaaktypeCatalog, CachedZaaktypeCatalog>();
@@ -91,6 +100,22 @@ app.MapPost("/documenten", async (StoreDocumentRequest body, AclService acl, Can
 app.MapGet("/catalogi/zaaktypen", async (AclService acl, CancellationToken ct) =>
     Results.Ok(await acl.ListZaaktypenAsync(ct)));
 
+// Read the current default-fill settings (beheer config viewer, S-15b).
+app.MapGet("/default-fill", (AclService acl) => Results.Ok(acl.GetDefaultFill()));
+
+// Update the default-fill settings from the beheer portal (S-15b). Behind beheerder authorization at
+// the BFF; the ACL validates the values are present (the three ZGW-mandatory fields).
+app.MapPut("/default-fill", (DefaultFillSettings body, AclService acl) =>
+{
+    if (string.IsNullOrWhiteSpace(body.Bronorganisatie) ||
+        string.IsNullOrWhiteSpace(body.VerantwoordelijkeOrganisatie) ||
+        string.IsNullOrWhiteSpace(body.Vertrouwelijkheidaanduiding))
+        return Results.BadRequest(new { error = "bronorganisatie, verantwoordelijkeOrganisatie and vertrouwelijkheidaanduiding are all required." });
+
+    acl.UpdateDefaultFill(body);
+    return Results.NoContent();
+});
+
 app.Run();
 
 public sealed record OpenZaakRequest(string Bsn, string Reference);

services/acl/Acl.Application/AclService.cs

@@ -2,12 +2,15 @@ namespace Acl.Application;
 
 /// <summary>The ACL's single operation: open a zaak from a domain payload,
 /// default-filling the ZGW-mandatory fields (ADR-0003).</summary>
-public sealed class AclService(IZaakGateway gateway, AclDefaults defaults, IZaaktypeCatalog catalog, IClock clock)
+public sealed class AclService(IZaakGateway gateway, IDefaultFillStore fill, IZaaktypeCatalog catalog, IClock clock)
 {
     public async Task<Uri> OpenZaakAsync(DomainRegistration registration, CancellationToken ct = default)
     {
         ArgumentNullException.ThrowIfNull(registration);
 
+        // Read the current default-fill per zaak (not at construction), so a beheerder edit (S-15b)
+        // takes effect on the next zaak without a restart.
+        var defaults = fill.Current;
         var request = new ZaakRequest(
             defaults.Bronorganisatie,
             defaults.VerantwoordelijkeOrganisatie,
@@ -47,6 +50,17 @@ public sealed class AclService(IZaakGateway gateway, AclDefaults defaults, IZaak
     public Task<IReadOnlyList<ZaaktypeSummary>> ListZaaktypenAsync(CancellationToken ct = default) =>
         gateway.ListZaaktypenAsync(ct);
 
+    /// <summary>The current default-fill settings, for the beheer config viewer (S-15b).</summary>
+    public DefaultFillSettings GetDefaultFill() => fill.Current;
+
+    /// <summary>Replace the default-fill settings from the beheer portal (S-15b). Takes effect on the
+    /// next zaak (the fill is read per zaak, not cached).</summary>
+    public void UpdateDefaultFill(DefaultFillSettings settings)
+    {
+        ArgumentNullException.ThrowIfNull(settings);
+        fill.Update(settings);
+    }
+
     /// <summary>The zaak's reference (its ZGW identificatie), for the read projection (#78).</summary>
     public Task<string> GetZaakReferenceAsync(Uri zaakUrl, CancellationToken ct = default)
     {
@@ -68,6 +82,7 @@ public sealed class AclService(IZaakGateway gateway, AclDefaults defaults, IZaak
         ArgumentException.ThrowIfNullOrWhiteSpace(fileName);
         ArgumentException.ThrowIfNullOrWhiteSpace(contentType);
 
+        var defaults = fill.Current;
         var request = new DocumentRequest(
             defaults.Bronorganisatie,
             await catalog.GetInformatieobjecttypeUrlAsync(ct),

services/acl/Acl.Application/DefaultFillSettings.cs

@@ -0,0 +1,10 @@
+namespace Acl.Application;
+
+/// <summary>The ZGW default-fill values a beheerder can edit at runtime (S-15b) — the mandatory fields
+/// the ACL stamps on every zaak (ADR-0003). The S-27 catalog-resolution keys (zaaktype identificatie,
+/// informatieobjecttype omschrijving) stay static config: editing them would desync the resolved-URL
+/// cache, and they're catalogus wiring rather than "default fill".</summary>
+public sealed record DefaultFillSettings(
+    string Bronorganisatie,
+    string VerantwoordelijkeOrganisatie,
+    string Vertrouwelijkheidaanduiding);

services/acl/Acl.Application/IDefaultFillStore.cs

@@ -0,0 +1,14 @@
+namespace Acl.Application;
+
+/// <summary>Holds the ACL's current default-fill values, editable at runtime through the beheer portal
+/// (S-15b). Seeded from config at startup.
+///
+/// ponytail: in-memory only — an edit is lost on restart, when it reverts to the configured env
+/// (ADR-0026). Adequate for the reference demo; back it with a DB if durable, audited config is needed.
+/// </summary>
+public interface IDefaultFillStore
+{
+    DefaultFillSettings Current { get; }
+
+    void Update(DefaultFillSettings settings);
+}

services/acl/Acl.Application/InMemoryDefaultFillStore.cs

@@ -0,0 +1,20 @@
+namespace Acl.Application;
+
+/// <summary>In-memory <see cref="IDefaultFillStore"/> (ADR-0026), seeded from config. Thread-safe: the
+/// hosted worker reads <see cref="Current"/> per zaak while the beheer endpoint may update it.</summary>
+public sealed class InMemoryDefaultFillStore(DefaultFillSettings seed) : IDefaultFillStore
+{
+    private readonly object _gate = new();
+    private DefaultFillSettings _current = seed;
+
+    public DefaultFillSettings Current
+    {
+        get { lock (_gate) return _current; }
+    }
+
+    public void Update(DefaultFillSettings settings)
+    {
+        ArgumentNullException.ThrowIfNull(settings);
+        lock (_gate) _current = settings;
+    }
+}

services/acl/Acl.Tests/AclServiceTests.cs

@@ -84,8 +84,11 @@ public class AclServiceTests
         InformatieobjecttypeOmschrijving = "Diploma",
     };
 
+    private static InMemoryDefaultFillStore FillFrom(AclDefaults d) =>
+        new(new DefaultFillSettings(d.Bronorganisatie, d.VerantwoordelijkeOrganisatie, d.Vertrouwelijkheidaanduiding));
+
     private static AclService ServiceWith(FakeGateway gateway, AclDefaults defaults, DateOnly today) =>
-        new(gateway, defaults, new CachedZaaktypeCatalog(gateway, defaults), new FixedClock(today));
+        new(gateway, FillFrom(defaults), new CachedZaaktypeCatalog(gateway, defaults), new FixedClock(today));
 
     private sealed class FixedClock(DateOnly today) : IClock
     {
@@ -113,6 +116,22 @@ public class AclServiceTests
         Assert.Equal("reg-77", req.Identificatie);
     }
 
+    [Fact]
+    public async Task Opening_a_zaak_reflects_a_default_fill_update(/* S-15b */)
+    {
+        var gateway = new FakeGateway();
+        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
+
+        // A beheerder edits the default-fill; the very next zaak must use the new values (read per zaak).
+        service.UpdateDefaultFill(new DefaultFillSettings("999999999", "888888888", "vertrouwelijk"));
+        await service.OpenZaakAsync(new DomainRegistration("123456782", "reg-1"));
+
+        var req = gateway.Captured!;
+        Assert.Equal("999999999", req.Bronorganisatie);
+        Assert.Equal("888888888", req.VerantwoordelijkeOrganisatie);
+        Assert.Equal("vertrouwelijk", req.Vertrouwelijkheidaanduiding);
+    }
+
     [Fact]
     public async Task Rejects_a_null_registration_without_calling_the_gateway()
     {

services/acl/Acl.Tests/DefaultFillStoreTests.cs

@@ -0,0 +1,29 @@
+using Acl.Application;
+
+namespace Acl.Tests;
+
+public class DefaultFillStoreTests
+{
+    private static DefaultFillSettings Seed() => new("517439943", "517439943", "openbaar");
+
+    [Fact]
+    public void Seeds_from_the_supplied_settings()
+    {
+        var store = new InMemoryDefaultFillStore(Seed());
+
+        Assert.Equal("517439943", store.Current.Bronorganisatie);
+        Assert.Equal("openbaar", store.Current.Vertrouwelijkheidaanduiding);
+    }
+
+    [Fact]
+    public void Updating_replaces_the_current_settings()
+    {
+        var store = new InMemoryDefaultFillStore(Seed());
+
+        store.Update(new DefaultFillSettings("999999999", "888888888", "vertrouwelijk"));
+
+        Assert.Equal("999999999", store.Current.Bronorganisatie);
+        Assert.Equal("888888888", store.Current.VerantwoordelijkeOrganisatie);
+        Assert.Equal("vertrouwelijk", store.Current.Vertrouwelijkheidaanduiding);
+    }
+}

services/bff/Bff.Api/DownstreamClients.cs

@@ -59,12 +59,26 @@ public interface IProjectionClient
 /// internal reference, not shown in the portal.</summary>
 public sealed record BeheerZaaktype(string Identificatie, string Omschrijving);
 
-/// <summary>Port to the ACL for read-only catalogus queries (beheer portal, S-15a). The BFF reaches the
+/// <summary>The ACL default-fill settings the beheer portal reads + edits (S-15b): the three ZGW-mandatory
-/// ACL directly for this read: the catalogus isn't a domain concern, and the ACL is the only code
+/// fields the ACL stamps on every zaak (ADR-0003).</summary>
-/// allowed to read the ZGW Catalogi API (§8.1, ADR-0025).</summary>
+public sealed record BeheerDefaultFill(
+    string Bronorganisatie,
+    string VerantwoordelijkeOrganisatie,
+    string Vertrouwelijkheidaanduiding);
+
+/// <summary>Port to the ACL for beheer queries (beheer portal). The BFF reaches the ACL directly: these
+/// aren't a domain concern, and the ACL is the only code allowed to read/own the ZGW-facing config
+/// (§8.1, ADR-0025).</summary>
 public interface IAclClient
 {
+    /// <summary>The published catalogus zaaktypen, read-only (S-15a).</summary>
     Task<IReadOnlyList<BeheerZaaktype>> GetZaaktypenAsync(CancellationToken ct = default);
+
+    /// <summary>The current default-fill settings (S-15b).</summary>
+    Task<BeheerDefaultFill> GetDefaultFillAsync(CancellationToken ct = default);
+
+    /// <summary>Replace the default-fill settings (S-15b).</summary>
+    Task UpdateDefaultFillAsync(BeheerDefaultFill settings, CancellationToken ct = default);
 }
 
 /// <summary>Calls the Domain Service's <c>POST /registrations</c>.</summary>
@@ -141,4 +155,14 @@ public sealed class AclClient(HttpClient http) : IAclClient
 {
     public async Task<IReadOnlyList<BeheerZaaktype>> GetZaaktypenAsync(CancellationToken ct = default)
         => await http.GetFromJsonAsync<List<BeheerZaaktype>>("catalogi/zaaktypen", ct) ?? [];
+
+    public async Task<BeheerDefaultFill> GetDefaultFillAsync(CancellationToken ct = default)
+        => await http.GetFromJsonAsync<BeheerDefaultFill>("default-fill", ct)
+           ?? throw new InvalidOperationException("The ACL returned an empty default-fill response.");
+
+    public async Task UpdateDefaultFillAsync(BeheerDefaultFill settings, CancellationToken ct = default)
+    {
+        using var response = await http.PutAsJsonAsync("default-fill", settings, ct);
+        response.EnsureSuccessStatusCode();
+    }
 }

services/bff/Bff.Api/Program.cs

@@ -228,6 +228,25 @@ app.MapGet("/beheer/catalogi/zaaktypen", async (IAclClient acl, CancellationToke
     .Produces(StatusCodes.Status401Unauthorized)
     .Produces(StatusCodes.Status403Forbidden);
 
+// Beheer default-fill config (S-15b): read + edit the ACL's default-fill values. Behind medewerker-
+// realm + beheerder authorization; the BFF proxies the ACL (ADR-0025). The ACL validates the values.
+app.MapGet("/beheer/default-fill", async (IAclClient acl, CancellationToken ct) =>
+    Results.Ok(await acl.GetDefaultFillAsync(ct)))
+    .RequireAuthorization(BeheerAuth.Policy)
+    .Produces<BeheerDefaultFill>(StatusCodes.Status200OK)
+    .Produces(StatusCodes.Status401Unauthorized)
+    .Produces(StatusCodes.Status403Forbidden);
+
+app.MapPut("/beheer/default-fill", async (BeheerDefaultFill body, IAclClient acl, CancellationToken ct) =>
+{
+    await acl.UpdateDefaultFillAsync(body, ct);
+    return Results.NoContent();
+})
+    .RequireAuthorization(BeheerAuth.Policy)
+    .Produces(StatusCodes.Status204NoContent)
+    .Produces(StatusCodes.Status401Unauthorized)
+    .Produces(StatusCodes.Status403Forbidden);
+
 app.Run();
 
 /// <summary>The behandelaar's decision on a registration.</summary>

services/bff/Bff.Tests/BeheerDefaultFillEndpointTests.cs

@@ -0,0 +1,84 @@
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using Bff.Api;
+
+namespace Bff.Tests;
+
+/// <summary>
+/// The beheer default-fill config endpoints (S-15b): read (GET) and edit (PUT) the ACL's default-fill,
+/// reached only with a medewerker-realm token carrying the <c>beheerder</c> role. Missing token → 401;
+/// a medewerker without the role → 403; a beheerder reads and updates via the ACL client.
+/// </summary>
+public class BeheerDefaultFillEndpointTests
+{
+    private static HttpRequestMessage Get(string? bearer)
+    {
+        var r = new HttpRequestMessage(HttpMethod.Get, "/beheer/default-fill");
+        if (bearer is not null) r.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
+        return r;
+    }
+
+    private static HttpRequestMessage Put(string? bearer, object body)
+    {
+        var r = new HttpRequestMessage(HttpMethod.Put, "/beheer/default-fill") { Content = JsonContent.Create(body) };
+        if (bearer is not null) r.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
+        return r;
+    }
+
+    [Fact]
+    public async Task Rejects_read_without_a_token()
+    {
+        using var factory = new BffFactory();
+        var response = await factory.CreateClient().SendAsync(Get(bearer: null));
+        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Rejects_a_medewerker_without_the_beheerder_role()
+    {
+        using var factory = new BffFactory();
+        var response = await factory.CreateClient().SendAsync(Get(TestTokens.Medewerker("behandelaar")));
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Serves_the_current_default_fill_to_a_beheerder()
+    {
+        using var factory = new BffFactory();
+        factory.Acl.DefaultFill = new BeheerDefaultFill("517439943", "517439943", "openbaar");
+
+        var response = await factory.CreateClient().SendAsync(Get(TestTokens.Medewerker("beheerder")));
+
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        var body = await response.Content.ReadFromJsonAsync<BeheerDefaultFill>();
+        Assert.Equal("517439943", body!.Bronorganisatie);
+        Assert.Equal("openbaar", body.Vertrouwelijkheidaanduiding);
+    }
+
+    [Fact]
+    public async Task Updates_the_default_fill_via_the_acl_for_a_beheerder()
+    {
+        using var factory = new BffFactory();
+
+        var response = await factory.CreateClient().SendAsync(
+            Put(TestTokens.Medewerker("beheerder"),
+                new { bronorganisatie = "999999999", verantwoordelijkeOrganisatie = "888888888", vertrouwelijkheidaanduiding = "vertrouwelijk" }));
+
+        Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
+        Assert.Equal("999999999", factory.Acl.Updated!.Bronorganisatie);
+        Assert.Equal("vertrouwelijk", factory.Acl.Updated.Vertrouwelijkheidaanduiding);
+    }
+
+    [Fact]
+    public async Task Rejects_an_update_from_a_non_beheerder()
+    {
+        using var factory = new BffFactory();
+
+        var response = await factory.CreateClient().SendAsync(
+            Put(TestTokens.Medewerker("behandelaar"), new { bronorganisatie = "1", verantwoordelijkeOrganisatie = "2", vertrouwelijkheidaanduiding = "openbaar" }));
+
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+        Assert.Null(factory.Acl.Updated);
+    }
+}

services/bff/Bff.Tests/BffFactory.cs

@@ -142,11 +142,24 @@ internal sealed class FakeProjectionClient : IProjectionClient
         => Task.FromResult<IReadOnlyList<ProjectionEntry>>(Entries);
 }
 
-/// <summary>Serves a configurable set of catalogus zaaktypen (beheer viewer, S-15a).</summary>
+/// <summary>Serves catalogus zaaktypen (S-15a) and holds the default-fill settings (S-15b).</summary>
 internal sealed class FakeAclClient : IAclClient
 {
     public List<BeheerZaaktype> Zaaktypen { get; } = [];
 
     public Task<IReadOnlyList<BeheerZaaktype>> GetZaaktypenAsync(CancellationToken ct = default)
         => Task.FromResult<IReadOnlyList<BeheerZaaktype>>(Zaaktypen);
+
+    public BeheerDefaultFill DefaultFill { get; set; } = new("517439943", "517439943", "openbaar");
+    public BeheerDefaultFill? Updated { get; private set; }
+
+    public Task<BeheerDefaultFill> GetDefaultFillAsync(CancellationToken ct = default)
+        => Task.FromResult(DefaultFill);
+
+    public Task UpdateDefaultFillAsync(BeheerDefaultFill settings, CancellationToken ct = default)
+    {
+        Updated = settings;
+        DefaultFill = settings;
+        return Task.CompletedTask;
+    }
 }

services/bff/openapi.json

@@ -255,10 +255,80 @@
           }
         }
       }
+    },
+    "/beheer/default-fill": {
+      "get": {
+        "tags": [
+          "Bff.Api"
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/BeheerDefaultFill"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Bff.Api"
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/BeheerDefaultFill"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "204": {
+            "description": "No Content"
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden"
+          }
+        }
+      }
     }
   },
   "components": {
     "schemas": {
+      "BeheerDefaultFill": {
+        "required": [
+          "bronorganisatie",
+          "verantwoordelijkeOrganisatie",
+          "vertrouwelijkheidaanduiding"
+        ],
+        "type": "object",
+        "properties": {
+          "bronorganisatie": {
+            "type": "string"
+          },
+          "verantwoordelijkeOrganisatie": {
+            "type": "string"
+          },
+          "vertrouwelijkheidaanduiding": {
+            "type": "string"
+          }
+        }
+      },
       "BeheerZaaktype": {
         "required": [
           "identificatie",

tests/acceptance/Steps/EenZaakOpenenSteps.cs

@@ -44,7 +44,9 @@ public sealed class EenZaakOpenenSteps
     [When("the domain asks the ACL to open a zaak")]
     public async Task WhenTheDomainAsksTheAclToOpenAZaak()
     {
-        var service = new AclService(_gateway, _defaults!, new CachedZaaktypeCatalog(_gateway, _defaults!), new FixedClock(_today));
+        var fill = new InMemoryDefaultFillStore(new DefaultFillSettings(
+            _defaults!.Bronorganisatie, _defaults.VerantwoordelijkeOrganisatie, _defaults.Vertrouwelijkheidaanduiding));
+        var service = new AclService(_gateway, fill, new CachedZaaktypeCatalog(_gateway, _defaults!), new FixedClock(_today));
         _returnedUrl = await service.OpenZaakAsync(_registration!);
     }
 

tests/e2e/default-fill.spec.ts

@@ -0,0 +1,26 @@
+import { expect, test } from '@playwright/test';
+
+// S-15b: a beheerder edits the ACL default-fill in the beheer portal and gets a saved confirmation.
+// Runs against the shared verify stack; it edits + saves (the ACL store is in-memory, ADR-0026) and
+// asserts the confirmation, without depending on another test's state.
+test('a beheerder edits and saves the default-fill', async ({ page }) => {
+  await page.goto('http://beheer/');
+
+  // Keycloak medewerker-realm login (same realm as behandel).
+  await page.locator('#username').fill('bram-beheerder');
+  await page.locator('#password').fill('test123');
+  await page.locator('#kc-login').click();
+
+  await expect(page.getByRole('heading', { name: /Catalogus/i })).toBeVisible();
+
+  // Navigate to the default-fill editor and change a value.
+  await page.getByRole('link', { name: /Default-fill/i }).click();
+  await expect(page.getByRole('heading', { name: /Default-fill/i })).toBeVisible();
+
+  const bron = page.getByLabel('Bronorganisatie');
+  await expect(bron).toBeVisible();
+  await bron.fill('517439943');
+  await page.getByRole('button', { name: /Opslaan/i }).click();
+
+  await expect(page.getByText(/standaardwaarden zijn opgeslagen/i)).toBeVisible();
+});