docs(prd): target .NET 10 LTS instead of 9 (refs #28 )

The PRD pinned ".NET 9 (LTS at iteration time)", but .NET 9 is STS and reaches end-of-life around now; the actual LTS at this iteration is .NET 10. The BFF (and the services to follow) target net10.0, pinned via global.json. Correct the PRD to match. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
feat(bff): add /health endpoint (refs #28 )
2026-06-03 13:36:15 +02:00 · 2026-06-03 13:35:54 +02:00 · 2026-06-03 13:35:22 +02:00
205 changed files with 35 additions and 27244 deletions
--- a/.config/dotnet-tools.json
+++ b/.config/dotnet-tools.json
@@ -1,20 +0,0 @@
-{
-  "version": 1,
-  "isRoot": true,
-  "tools": {
-    "dotnet-stryker": {
-      "version": "4.15.0",
-      "commands": [
-        "dotnet-stryker"
-      ],
-      "rollForward": false
-    },
-    "dotnet-ef": {
-      "version": "10.0.0",
-      "commands": [
-        "dotnet-ef"
-      ],
-      "rollForward": false
-    }
-  }
-}
--- a/.editorconfig
+++ b/.editorconfig
@@ -1,17 +0,0 @@
-# Editor configuration, see http://editorconfig.org
-root = true
-
-[*]
-indent_style = space
-indent_size = 2
-insert_final_newline = true
-trim_trailing_whitespace = true
-
-# .NET sources use 4-space indent (dotnet format enforces this). The 2-space default
-# above is for the frontend (TS/HTML/CSS/JSON); C# keeps the .NET convention.
-[*.cs]
-indent_size = 4
-
-[*.md]
-max_line_length = off
-trim_trailing_whitespace = false
--- a/.gitea/ISSUE_TEMPLATE/adr-proposal.md
+++ b/.gitea/ISSUE_TEMPLATE/adr-proposal.md
@@ -1,24 +0,0 @@
---
-name: ADR proposal
-about: Propose a decision that needs recording before coding (CLAUDE.md §14)
-title: "ADR: "
-labels:
-  - type:adr-proposal
---
-
-**Decision to be made:**
-
-**Context / forces:** <!-- what makes this non-obvious; constraints, trade-offs -->
-
-**Options considered:**
-1.
-2.
-
-**Proposed option + why:**
-
-**Consequences:** <!-- what becomes easier/harder; what we commit to -->
-
-**Coupling rules touched (CLAUDE.md §8):** <!-- none, or which and why -->
-
-> On acceptance, the ADR file (`docs/architecture/adr-NNNN-title.md`, Nygard
-> template) lands in the PR that implements the decision.
--- a/.gitea/ISSUE_TEMPLATE/bug.md
+++ b/.gitea/ISSUE_TEMPLATE/bug.md
@@ -1,21 +0,0 @@
---
-name: Bug
-about: Something behaves incorrectly
-title: ""
-labels:
-  - type:bug
---
-
-**What happened:**
-
-**What you expected:**
-
-**Steps to reproduce:**
-1.
-2.
-
-**Environment:** <!-- branch/commit, OS, container engine, anything relevant -->
-
-**Logs / evidence:**
-
-**Suspected area:** <!-- e.g. area:bff, area:acl — add the matching area label -->
--- a/.gitea/ISSUE_TEMPLATE/slice.md
+++ b/.gitea/ISSUE_TEMPLATE/slice.md
@@ -1,31 +0,0 @@
---
-name: Slice (user story)
-about: A backlog slice — independently demoable, encodes the Definition of Done
-title: "S-NN · "
-labels:
-  - type:slice
---
-
-**Outcome:** <!-- one sentence; user-visible if possible -->
-
-**Acceptance:**
-<!-- Gherkin scenarios or testable assertions -->
-
-
-**Touches:** <!-- services and folders -->
-
-**Out of scope:** <!-- explicit non-goals -->
-
-## Definition of Done
-
- [ ] This linked Gitea issue exists and is on the right milestone.
- [ ] Failing test written and committed first (`test(scope): … (refs #NN)`).
- [ ] Implementation makes the test pass (`feat(scope): … (refs #NN)`).
- [ ] Refactor commit follows if structure improved.
- [ ] Conventional Commit messages referencing this issue.
- [ ] All Gitea Actions CI jobs green (or `make ci` green while no runner exists).
- [ ] `docker compose up` from a fresh clone reaches green health checks within 3 minutes.
- [ ] Docs touched if behaviour, contracts, or operations changed.
- [ ] ADR added in `docs/architecture/` if a non-obvious decision was made.
- [ ] Demo note appended to `docs/demo-script.md` if the slice is user-visible.
- [ ] This issue closed by the merging PR (`closes #NN`).
--- a/.gitea/PULL_REQUEST_TEMPLATE.md
+++ b/.gitea/PULL_REQUEST_TEMPLATE.md
@@ -1,23 +0,0 @@
-<!-- Title: Conventional Commit style, e.g. feat(bff): … (closes #NN) -->
-
-## What & why
-
-<!-- Summary of the change and the slice/bug it addresses. -->
-
-Closes #
-
-## Definition of Done
-
- [ ] Linked Gitea issue (above).
- [ ] Failing test committed before the implementation.
- [ ] Implementation makes the test pass; refactor commit if structure improved.
- [ ] Conventional Commits referencing the issue (`refs #NN`).
- [ ] CI green — all Gitea Actions jobs (or `make ci` green while no runner exists).
- [ ] `docker compose up` from a fresh clone reaches green health checks within 3 minutes.
- [ ] Docs updated if behaviour, contracts, or operations changed.
- [ ] ADR added in `docs/architecture/` if a non-obvious decision was made.
- [ ] Demo note in `docs/demo-script.md` if user-visible.
-
-## Notes for reviewers
-
-<!-- Anything that helps review: trade-offs, follow-ups, known gaps. -->
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -1,133 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-permissions:
-  contents: read
-
-# Self-hosted runner — see docs/runbooks/ci.md for the runner setup.
-# `uses:` are absolute, tag-pinned URLs (CLAUDE.md §8.7 / §15).
-
-# Each job calls a `make` target — the same one developers run locally
-# (`make ci`). The Makefile is the single source of truth; see docs/runbooks/ci.md.
-
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: https://github.com/actions/checkout@v4
-      - uses: https://github.com/actions/setup-dotnet@v4
-        with:
-          dotnet-version: '10.0.x'
-      - run: make lint
-
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: https://github.com/actions/checkout@v4
-      - uses: https://github.com/actions/setup-dotnet@v4
-        with:
-          dotnet-version: '10.0.x'
-      - run: make build
-
-  unit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: https://github.com/actions/checkout@v4
-      - uses: https://github.com/actions/setup-dotnet@v4
-        with:
-          dotnet-version: '10.0.x'
-      - run: make unit
-
-  # Frontend (Nx/Angular) lane: install with pnpm, then Nx lint + test + build.
-  frontend:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: https://github.com/actions/checkout@v4
-      - uses: https://github.com/pnpm/action-setup@v4
-        with:
-          version: 11
-      - uses: https://github.com/actions/setup-node@v4
-        with:
-          node-version: '24'
-          cache: 'pnpm'
-      - run: make frontend
-
-  mutation:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: https://github.com/actions/checkout@v4
-      - uses: https://github.com/actions/setup-dotnet@v4
-        with:
-          dotnet-version: '10.0.x'
-      - run: make mutation
-      # Publish the Stryker HTML reports. `if: always()` uploads them even when the
-      # ratchet fails — that is exactly when you want to inspect the survivors.
-      # `continue-on-error` keeps the upload best-effort: the mutation *gate* is the
-      # ratchet (make mutation's exit code), not the report, so a Gitea artifact-backend
-      # 500 must not fail the job (gitea-actions-gotchas.md §4). Glob handles Stryker's
-      # non-deterministic StrykerOutput/<timestamp>/ dir. Pinned @v3: @v4's bundled
-      # @actions/artifact hard-aborts on non-github.com (GHES guard) — see the runbook.
-      - uses: https://github.com/actions/upload-artifact@v3
-        if: always()
-        continue-on-error: true
-        with:
-          name: acl-mutation-report
-          path: services/acl/StrykerOutput/**/reports/mutation-report.html
-          if-no-files-found: warn
-      - uses: https://github.com/actions/upload-artifact@v3
-        if: always()
-        continue-on-error: true
-        with:
-          name: event-subscriber-mutation-report
-          path: services/event-subscriber/StrykerOutput/**/reports/mutation-report.html
-          if-no-files-found: warn
-      - uses: https://github.com/actions/upload-artifact@v3
-        if: always()
-        continue-on-error: true
-        with:
-          name: domain-mutation-report
-          path: services/domain/StrykerOutput/**/reports/mutation-report.html
-          if-no-files-found: warn
-      - uses: https://github.com/actions/upload-artifact@v3
-        if: always()
-        continue-on-error: true
-        with:
-          name: bff-mutation-report
-          path: services/bff/StrykerOutput/**/reports/mutation-report.html
-          if-no-files-found: warn
-
-  # One stage for every check that needs the live stack. On the single self-hosted
-  # runner jobs run sequentially, so booting OpenZaak once (instead of once per job)
-  # is the cheapest layout (issue #58). No setup-dotnet: the ACL test runs in a built
-  # image and everything reaches services by container IP. Needs Docker + egress
-  # (base images, nuget, selectielijst.openzaak.nl).
-  verify-stack:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: https://github.com/actions/checkout@v4
-      # Bring the full stack up + wait for health — this also is the DoD "compose up
-      # reaches green health" smoke (it replaces the old compose-smoke job).
-      - name: Bring up the full stack & wait for health
-        run: make verify-up
-      - name: ACL ↔ OpenZaak integration tests
-        run: make verify-acl
-      - name: OpenZaak → NRC notification delivery
-        run: make verify-nrc
-      - name: OpenZaak → NRC → Event Subscriber → projection-api
-        run: make verify-projection
-      - name: Domain → Flowable → ACL → OpenZaak
-        run: make verify-domain
-      - name: BFF → Keycloak + domain + projection
-        run: make verify-bff
-      # Log dump must precede teardown (which removes the containers).
-      - name: Dump container logs on failure
-        if: failure()
-        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-db flowable-rest flowable-init keycloak acl bff domain projection-db event-subscriber projection-api 2>&1 || true
-      - name: Tear down
-        if: always()
-        run: make down
--- a/.gitignore
+++ b/.gitignore
@@ -5,9 +5,6 @@ obj/
 [Rr]elease/
 *.user

-# Reqnroll-generated test code (regenerated from *.feature on build)
-*.feature.cs
-
 # Test results / coverage
 [Tt]est[Rr]esults/
 *.trx
@@ -15,9 +12,6 @@ coverage*.json
 coverage*.xml
 *.coverage

-# Stryker.NET mutation-testing reports (regenerated by `make mutation`)
-StrykerOutput/
-
 # Rider / VS / VS Code
 .idea/
 .vs/
@@ -28,25 +22,6 @@ node_modules/
 dist/
 .angular/

-# Python / MkDocs
-.venv/
-site/
-
 # OS
 .DS_Store
 Thumbs.db
-
-# ── Frontend (Nx / Angular / pnpm) ──
-node_modules/
-dist/
-tmp/
-out-tsc/
-/coverage
-.angular/
-.nx/cache
-.nx/workspace-data
-.nx/self-healing
-.nx/migrate-runs
-.nx/polygraph
-vite.config.*.timestamp*
-vitest.config.*.timestamp*
--- a/.prettierignore
+++ b/.prettierignore
@@ -1,8 +0,0 @@
-# Add files here to ignore them from prettier formatting
-/dist
-/coverage
-/.nx/cache
-/.nx/workspace-data
-.angular
-
-.nx/self-healing
--- a/.prettierrc
+++ b/.prettierrc
@@ -1,3 +0,0 @@
-{
-  "singleQuote": true
-}
--- a/BACKLOG.md
+++ b/BACKLOG.md
@@ -12,41 +12,22 @@ Each slice is **independently demoable** and meets the Definition of Done in `CL

 ## Iteration 0 — Foundations *(milestone: `Iteration 0 — Foundations`)*

-> **S-00 was split** (CLAUDE.md §13) into the sub-slices below. The original
-> outcome — a fresh clone + `docker compose up` reaching a green BFF health
-> endpoint, with CI green and the contributor scaffolding in place — is the sum
-> of S-00-a…e. The Gitea milestones, labels, and slice issues already exist —
-> they are managed directly with the `tea` CLI.
+### S-00 · Repository skeleton, Gitea Actions CI, contributor workflow

-### S-00-a · Placeholder BFF + health endpoint
+**Outcome:** A fresh `git clone` from the Respellion Gitea remote, followed by `docker compose up`, produces a green "hello world" health endpoint from a placeholder BFF. Gitea Actions runs lint, build, unit tests, and the compose-up smoke test, all green. Issue templates, PR template, milestones, labels, and the first project board exist in Gitea.

-**Outcome:** A minimal .NET BFF exposing `GET /health` returning green; runnable with `dotnet run`. TDD anchor for the slice.
+**Acceptance:**

-**Touches:** `services/bff/`, tests. **Out of scope:** Docker, CI, OIDC.
+- New developer follows `README.md` and reaches a green local environment in under 10 minutes.
+- Gitea Actions pipeline green on `main`.
+- `git-cliff` produces an empty `CHANGELOG.md`.
+- `docs/PRD.md`, `CLAUDE.md`, `BACKLOG.md`, `docs/architecture/adr-0001-loose-coupling.md`, `docs/gitea-workflow.md` all in repo.
+- `.gitea/workflows/ci.yaml`, `.gitea/ISSUE_TEMPLATE/{slice,bug,adr-proposal}.md`, `.gitea/PULL_REQUEST_TEMPLATE.md` all in repo.
+- Gitea milestone `Iteration 1 — Walking Skeleton` exists, populated with issues S-01 through S-09.

-### S-00-b · Dockerfile + compose skeleton + compose-up smoke
+**Touches:** repo layout, Gitea Actions workflows, Dockerfile for placeholder BFF, `docker-compose.yml` skeleton, MkDocs scaffold, Gitea issue/PR templates.

-**Outcome:** BFF containerized; `infra/docker-compose.yml` brings it up; health green within 3 minutes from a fresh clone.
-
-**Touches:** `services/bff/Dockerfile`, `infra/docker-compose.yml`, smoke script. **Out of scope:** other services, CI.
-
-### S-00-c · Gitea Actions CI (lint, build, unit, compose-up smoke)
-
-**Outcome:** `.gitea/workflows/ci.yaml` green on PRs and `main`: lint, build, unit, compose-up smoke. Actions pinned by absolute URL (§8.7/§15).
-
-**Touches:** `.gitea/workflows/ci.yaml`, `docs/runbooks/ci.md`. **Out of scope:** mutation, e2e, container push.
-
-### S-00-d · Contributor workflow: issue/PR templates, git-cliff, CHANGELOG
-
-**Outcome:** Issue templates (`slice`/`bug`/`adr-proposal`), PR template, `git-cliff` → empty `CHANGELOG.md`, `docs/gitea-workflow.md`.
-
-**Touches:** `.gitea/ISSUE_TEMPLATE/`, `.gitea/PULL_REQUEST_TEMPLATE.md`, `cliff.toml`, `CHANGELOG.md`, `docs/gitea-workflow.md`. **Out of scope:** app code.
-
-### S-00-e · Docs scaffold: MkDocs + ADR-0001 + README quickstart
-
-**Outcome:** MkDocs builds the `docs/` site; `docs/architecture/adr-0001-loose-coupling.md` exists; README has a sub-10-minute quickstart.
-
-**Touches:** `mkdocs.yml`, `docs/` nav, `docs/architecture/adr-0001-loose-coupling.md`, `README.md`. **Out of scope:** Gitea Pages publish.
+**Out of scope:** any business logic, frontend, OpenZaak.

 ---

@@ -151,16 +132,17 @@ The skeleton proves the spine end-to-end: a registration, a workflow, a zaak in

 ### S-08 · Self-Service portal (Angular, NL DS) — submit a registration

-> **S-08 was split** (CLAUDE.md §13; issue #9 closed) into the sub-slices below — it bundled the
-> Nx bootstrap, the generated client, the NL DS + DigiD form, and a full-stack Playwright e2e, well
-> past 1–2 days. Each sub-slice is independently demoable and CI-green.
+**Outcome:** The self-service Angular app, in the Nx monorepo, lets a zorgprofessional log in via mock DigiD and submit a registration. NL Design System styling. Generated API client.

- **S-08a (#65)** · Nx monorepo + Angular tooling + CI Node lane. Placeholder `self-service` app; `nx lint/test/build` green in a new CI Node lane.
- **S-08b (#66)** · Generated api-client lib from `services/bff/openapi.json` (never hand-written, §10) + a mocked-BFF unit test.
- **S-08c (#67)** · Self-service submit form — NL Design System `libs/ui`, DigiD OIDC `libs/auth`, component tests (Angular Testing Library), axe WCAG 2.1 AA on the submit page.
- **S-08d (#68)** · Playwright happy-path e2e (login → submit → success) against the full stack + compose serving + CI e2e lane.
+**Acceptance:**

-**Out of scope (whole of S-08):** document upload, status tracking page.
+- E2E test (Playwright): full happy path, login → submit → success page.
+- Component tests (Testing Library) for the form.
+- Accessibility audit (axe-core) passes WCAG 2.1 AA on the submit page.
+
+**Touches:** `apps/self-service/`, `libs/ui/`, `libs/auth/`, `libs/api-client/`, tests.
+
+**Out of scope:** document upload, status tracking page.

 ### S-09 · Openbaar Register portal — public lookup

--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,20 +0,0 @@
-# Changelog
-
-All notable changes to this project. Generated from Conventional Commits by git-cliff.
-
-## Unreleased
-
-### CI
- Gitea Actions pipeline + runner runbook (refs #30) (#37)
-
-### Chores
- Add idempotent Gitea backlog seeder
- Remove bootstrap scripts from main (#35)
-
-### Documentation
- Split S-00 into sub-slices (refs #1) (#33)
-
-### Features
- Placeholder BFF + /health endpoint (closes #28) (#34)
- Containerize BFF + compose-up smoke (closes #29) (#36)
-
--- a/276
+++ b/276
@@ -1,276 +0,0 @@
-# Developer + CI entrypoints.
-#
-# These targets are the single source of truth for the checks. The Gitea
-# Actions workflow (.gitea/workflows/ci.yaml) invokes the SAME targets, so
-# `make ci` locally runs exactly what the pipeline runs — no drift. Until a
-# self-hosted runner is registered, `make ci` is the gate (see docs/runbooks/ci.md).
-
-SLN        := register-referentie.slnx
-COMPOSE    := infra/docker-compose.yml
-# Long-running services with a healthcheck — the smoke polls these for readiness
-# (infra/wait-healthy.sh). One-shot init jobs (oz-init, nrc-init, flowable-init)
-# are not polled; they only need to have run. See docs/runbooks/gitea-actions-gotchas.md.
-WAIT_SVCS  := openzaak nrc-web acl bff domain event-subscriber projection-api
-# Config files (OpenZaak data.yaml, Keycloak realms, Flowable BPMN) are streamed
-# into external named volumes via `docker cp` (infra/seed-config.sh) instead of
-# bind-mounted, because bind mounts don't reach sibling containers on the
-# containerized CI runner. SEED populates them; run it before every `up`. The
-# volumes are `external`, so compose won't remove them — CFG_VOLS lists them for
-# explicit teardown. See docs/runbooks/gitea-actions-gotchas.md.
-SEED       := bash infra/seed-config.sh
-CFG_VOLS   := rr-oz-config rr-nrc-config rr-kc-realms rr-fl-bpmn
-# Local-only stack: same services but config is bind-mounted (no seed step), so a
-# plain `docker compose -f infra/docker-compose.local.yml up` works on any local
-# engine. This is the no-make / Windows-friendly path. See that file's header.
-LOCAL_COMPOSE := infra/docker-compose.local.yml
-OZ_COMPOSE  := infra/openzaak/docker-compose.yml
-OZ_BASE     := http://localhost:8000
-NRC_COMPOSE := infra/opennotificaties/docker-compose.yml
-NRC_BASE    := http://localhost:8001
-KC_COMPOSE  := infra/keycloak/docker-compose.yml
-KC_BASE     := http://localhost:8180
-FL_COMPOSE  := infra/flowable/docker-compose.yml
-FL_BASE     := http://localhost:8090/flowable-rest/service
-STACK_FILES := -f $(OZ_COMPOSE) -f $(NRC_COMPOSE)
-
-# On a rootless Podman dev box, point Docker CLI/Compose at the Podman socket —
-# but only if that socket exists and DOCKER_HOST isn't already set, so real
-# Docker hosts and CI runners are left untouched.
-PODMAN_SOCK := /run/user/$(shell id -u)/podman/podman.sock
-ifeq ($(wildcard $(PODMAN_SOCK)),$(PODMAN_SOCK))
-ifeq ($(origin DOCKER_HOST),undefined)
-export DOCKER_HOST := unix://$(PODMAN_SOCK)
-endif
-endif
-
-.PHONY: ci lint build unit mutation frontend integration verify verify-up verify-acl verify-nrc verify-projection verify-bff verify-domain verify-notifications smoke up down local local-down changelog openzaak-up openzaak-smoke openzaak-seed openzaak-down stack-up stack-smoke stack-down keycloak-up keycloak-smoke keycloak-down flowable-up flowable-smoke flowable-down help
-
-## ci: run the full pipeline — lint, build, unit, mutation, frontend, verify (mirrors Gitea Actions)
-## `verify` is the live-stack stage (full stack up once → ACL + notification checks).
-ci: lint build unit mutation frontend verify
-
-## frontend: install deps and run the Nx lint/test/build for the portals (pnpm + Node required)
-frontend:
-	pnpm install --frozen-lockfile
-	pnpm nx run-many -t lint test build
-
-## lint: verify formatting (no changes)
-lint:
-	dotnet format $(SLN) --verify-no-changes
-
-## build: release build
-build:
-	dotnet build $(SLN) -c Release
-
-## unit: run unit tests (excludes the container-backed Integration lane)
-unit:
-	dotnet test $(SLN) -c Release --filter "Category!=Integration"
-
-## mutation: run the Stryker.NET ratchet on each service with branching logic (fails below baseline)
-# Stryker is pinned as a local dotnet tool (.config/dotnet-tools.json); `tool restore`
-# makes `make mutation` work from a fresh clone. Each service owns its config + break
-# threshold (the ratchet, CLAUDE.md §5): each services/<svc>/stryker-config.json.
-# Scores never regress below baseline.
-mutation:
-	dotnet tool restore
-	cd services/acl && dotnet stryker
-	cd services/event-subscriber && dotnet stryker
-	cd services/domain && dotnet stryker
-	cd services/bff && dotnet stryker
-
-## smoke: seed config, bring the whole stack up, wait for health-checked services, tear down
-# SEED populates the external config volumes first (upstream images used verbatim;
-# only our acl/bff are built). `up -d --build` starts EVERYTHING. Readiness is
-# checked by infra/wait-healthy.sh polling the durable, health-checked services
-# ($(WAIT_SVCS)) via `docker inspect` — portable across docker compose and
-# podman-compose, and needing no `--wait` flag or host port access. The one-shots
-# (oz-init, flowable-init) aren't polled; they just need to have run.
-smoke:
-	$(SEED) oz nrc kc fl
-	docker compose -f $(COMPOSE) up -d --build
-	bash -c 'WAIT_TIMEOUT=420 bash infra/wait-healthy.sh $(WAIT_SVCS); rc=$$?; docker compose -f $(COMPOSE) down --volumes; docker volume rm -f $(CFG_VOLS) >/dev/null 2>&1; exit $$rc'
-
-## up: seed config volumes and start the full stack (use instead of bare
-## `docker compose up`, which can't self-seed the external config volumes)
-up:
-	$(SEED) oz nrc kc fl
-	docker compose -f $(COMPOSE) up -d --build
-
-## down: stop and remove the local stack (incl. the external config volumes)
-down:
-	docker compose -f $(COMPOSE) down --volumes
-	-docker volume rm -f $(CFG_VOLS)
-
-## local: bring up the bind-mount stack (no seed step) and wait for health
-## (Windows / no-make users: run `docker compose -f infra/docker-compose.local.yml up -d --build` directly)
-local:
-	docker compose -f $(LOCAL_COMPOSE) up -d --build
-	WAIT_TIMEOUT=420 bash infra/wait-healthy.sh $(WAIT_SVCS)
-
-## local-down: stop and remove the bind-mount stack
-local-down:
-	docker compose -f $(LOCAL_COMPOSE) down --volumes
-
-## changelog: regenerate CHANGELOG.md from Conventional Commits (git-cliff)
-changelog:
-	git-cliff --output CHANGELOG.md
-
-# ── ZGW verification ───────────────────────────────────────────────────────
-# On the single runner CI jobs run sequentially, so the OpenZaak-dependent checks
-# share ONE full-stack bring-up: the `verify-stack` CI job runs `verify-up` then
-# `verify-acl` + `verify-nrc` as steps against the same stack (issue #58). The
-# check logic lives in stack-agnostic runners that reach services by container IP
-# (gitea-actions-gotchas.md §5/§6); `integration` / `verify-notifications` are local
-# convenience wrappers that bring up a lighter stack and call the same runners.
-
-## verify-up: bring the FULL stack up and wait for health (CI verify-stack step 1;
-## subsumes the old compose-smoke health gate — the DoD "up reaches green" check).
-verify-up:
-	$(SEED) oz nrc kc fl
-	docker compose -f $(COMPOSE) up -d --build
-	WAIT_TIMEOUT=420 bash infra/wait-healthy.sh $(WAIT_SVCS)
-
-## verify-acl: ACL ↔ OpenZaak integration tests against the already-running stack.
-verify-acl:
-	bash infra/run-acl-integration.sh
-
-## verify-nrc: OpenZaak → NRC notification delivery against the already-running stack.
-verify-nrc:
-	bash infra/run-notification-check.sh
-
-## verify-projection: OpenZaak → NRC → Event Subscriber → projection-api end-to-end (S-06),
-## against the already-running stack.
-verify-projection:
-	bash infra/run-projection-check.sh
-
-## verify-domain: domain → Flowable → ACL → OpenZaak end-to-end (S-05), against the
-## already-running stack. Recreates the acl service to inject the seeded zaaktype URL.
-verify-domain:
-	bash infra/run-domain-check.sh
-
-## verify-bff: BFF end-to-end (S-07) against the up stack — token validation on self-service
-## + anonymous public-safe openbaar register (ADR-0010).
-verify-bff:
-	bash infra/run-bff-check.sh
-
-## verify: local mirror of the CI verify-stack job — full stack up once, all checks,
-## tear down (always). For fast single-concern local iteration use `integration`
-## (oz-only) or `verify-notifications` (oz+nrc) instead.
-verify:
-	$(SEED) oz nrc kc fl
-	docker compose -f $(COMPOSE) up -d --build
-	@bash -c 'set -e; rc=0; \
-	  WAIT_TIMEOUT=420 bash infra/wait-healthy.sh $(WAIT_SVCS) \
-	    && bash infra/run-acl-integration.sh \
-	    && bash infra/run-notification-check.sh \
-	    && bash infra/run-projection-check.sh \
-	    && bash infra/run-domain-check.sh \
-	    && bash infra/run-bff-check.sh || rc=$$?; \
-	  docker compose -f $(COMPOSE) down --volumes >/dev/null 2>&1; \
-	  docker volume rm -f $(CFG_VOLS) >/dev/null 2>&1; \
-	  exit $$rc'
-
-## integration: local convenience — ACL integration test against a throwaway
-## OpenZaak-only stack (fast iteration). CI uses verify-acl on the shared stack.
-integration:
-	bash infra/run-integration.sh
-
-## openzaak-up: start the OpenZaak stack (migrations run on first start)
-openzaak-up:
-	$(SEED) oz
-	docker compose -f $(OZ_COMPOSE) up -d
-
-## openzaak-smoke: start OpenZaak, then assert it is up with auth enforced
-openzaak-smoke: openzaak-up
-	@bash -c 'set -e; \
-	  echo "waiting for OpenZaak to respond..."; \
-	  for i in $$(seq 1 60); do \
-	    code=$$(curl -s -o /dev/null -w "%{http_code}" $(OZ_BASE)/zaken/api/v1/zaken || true); \
-	    [ -n "$$code" ] && [ "$$code" != "000" ] && break; sleep 3; \
-	  done; \
-	  echo "GET /zaken/api/v1/zaken (unauth) -> $$code (expect 403, auth enforced)"; test "$$code" = "403"; \
-	  admin=$$(curl -s -o /dev/null -w "%{http_code}" $(OZ_BASE)/admin/); \
-	  echo "GET /admin/             -> $$admin (expect 302)"; test "$$admin" = "302"; \
-	  root=$$(curl -s -o /dev/null -w "%{http_code}" $(OZ_BASE)/zaken/api/v1/); \
-	  echo "GET /zaken/api/v1/      -> $$root (expect 200)"; test "$$root" = "200"; \
-	  echo "OpenZaak smoke OK"'
-
-## openzaak-seed: bring OpenZaak up and seed the BIG catalogus (idempotent)
-openzaak-seed: openzaak-up
-	@bash -c 'for i in $$(seq 1 50); do \
-	    c=$$(curl -s -o /dev/null -w "%{http_code}" $(OZ_BASE)/catalogi/api/v1/ || true); \
-	    [ "$$c" = "200" ] && break; sleep 3; done; echo "OpenZaak ready ($$c)"'
-	python3 infra/openzaak/seed_catalogus.py
-
-## openzaak-down: stop and remove the OpenZaak stack (wipes data)
-openzaak-down:
-	docker compose -f $(OZ_COMPOSE) down --volumes
-	-docker volume rm -f rr-oz-config
-
-## verify-notifications: local convenience — OpenZaak → NRC notification delivery
-## against a throwaway oz+nrc stack (S-01-c). CI uses verify-nrc on the shared stack.
-verify-notifications:
-	bash infra/verify-notifications.sh
-
-## stack-up: start OpenZaak + Open Notificaties together (shared network), with
-## OpenZaak publishing notifications to NRC (S-01-c).
-stack-up:
-	$(SEED) oz nrc
-	OZ_NOTIFICATIONS_DISABLED=false docker compose $(STACK_FILES) up -d
-
-## stack-smoke: start both, assert OpenZaak (403/302/200) and NRC (302) are reachable
-stack-smoke: stack-up
-	@bash -c 'set -e; \
-	  echo "waiting for OpenZaak + Open Notificaties..."; \
-	  for i in $$(seq 1 60); do \
-	    oz=$$(curl -s -o /dev/null -w "%{http_code}" $(OZ_BASE)/admin/ || true); \
-	    nrc=$$(curl -s -o /dev/null -w "%{http_code}" $(NRC_BASE)/admin/ || true); \
-	    [ "$$oz" = "302" ] && [ "$$nrc" = "302" ] && break; sleep 3; done; \
-	  z=$$(curl -s -o /dev/null -w "%{http_code}" $(OZ_BASE)/zaken/api/v1/zaken); \
-	  echo "OpenZaak /zaken (unauth) -> $$z (expect 403)"; test "$$z" = "403"; \
-	  echo "OpenZaak /admin/         -> $$oz (expect 302)"; test "$$oz" = "302"; \
-	  echo "Open Notificaties /admin/-> $$nrc (expect 302)"; test "$$nrc" = "302"; \
-	  echo "stack smoke OK"'
-
-## stack-down: stop and remove both stacks (wipes data)
-stack-down:
-	docker compose $(STACK_FILES) down --volumes
-	-docker volume rm -f rr-oz-config rr-nrc-config
-
-## keycloak-up: start Keycloak with the four imported realms
-keycloak-up:
-	$(SEED) kc
-	docker compose -f $(KC_COMPOSE) up -d
-
-## keycloak-smoke: start Keycloak, then verify each realm logs in + returns its claim
-keycloak-smoke: keycloak-up
-	@bash -c 'for i in $$(seq 1 60); do \
-	    c=$$(curl -s -o /dev/null -w "%{http_code}" $(KC_BASE)/realms/digid/.well-known/openid-configuration || true); \
-	    [ "$$c" = "200" ] && break; sleep 3; done; echo "Keycloak ready ($$c)"'
-	python3 infra/keycloak/check_realms.py
-
-## keycloak-down: stop and remove Keycloak
-keycloak-down:
-	docker compose -f $(KC_COMPOSE) down --volumes
-	-docker volume rm -f rr-kc-realms
-
-## flowable-up: start Flowable (deploys registratie.bpmn on boot)
-flowable-up:
-	$(SEED) fl
-	docker compose -f $(FL_COMPOSE) up -d
-
-## flowable-smoke: start Flowable, then verify a started instance waits on the external task
-flowable-smoke: flowable-up
-	@bash -c 'for i in $$(seq 1 80); do \
-	    c=$$(curl -s -o /dev/null -w "%{http_code}" -u rest-admin:test $(FL_BASE)/repository/process-definitions?key=registratie || true); \
-	    [ "$$c" = "200" ] && break; sleep 3; done; echo "Flowable ready ($$c)"'
-	python3 infra/flowable/verify.py
-
-## flowable-down: stop and remove Flowable
-flowable-down:
-	docker compose -f $(FL_COMPOSE) down --volumes
-	-docker volume rm -f rr-fl-bpmn
-
-## help: list available targets
-help:
-	@grep -E '^## ' $(MAKEFILE_LIST) | sed 's/^## //'
--- a/README.md
+++ b/README.md
@@ -41,32 +41,22 @@ For the architecture rationale, see [docs/PRD.md §3](docs/PRD.md) and [docs/arc

 **Prerequisites**

- .NET 10 SDK (for `make lint/build/unit`)
- A container engine with Compose v2 — Docker, or rootless Podman (see [docs/runbooks/ci.md](docs/runbooks/ci.md) for the Podman + Compose-provider setup)
- `make`, `curl`, `git`
- ~4 GB free RAM, ~5 GB free disk (grows as services land)
+- Docker Engine (or Docker Desktop) with Compose v2
+- ~8 GB free RAM, ~10 GB free disk
+- Bash or PowerShell

-**Clone**
+**Bring the stack up**

 ```bash
-git clone git@git.labs.respellion.tech:eho/register-referentie.git
-cd register-referentie
+git clone https://gitea.respellion.local/respellion/register-reference.git
+cd register-reference
+cp .env.example .env          # edit if you change ports
+docker compose -f infra/docker-compose.yml up -d
 ```

-**Wired today (Iteration 0):** only the placeholder BFF exists so far. Get to green in under 10 minutes — run the full check gate, or just the running service:
+Health checks should be green within ~3 minutes on a developer machine. If something fails, see [docs/runbooks/local-startup.md](docs/runbooks/local-startup.md).

-```bash
-make ci          # lint + build + unit + container smoke — the CI gate
-```
-
-```bash
-docker compose -f infra/docker-compose.yml up -d --build --wait
-curl http://localhost:8080/health     # -> Healthy
-```
-
-`--wait` exits non-zero unless the container reports healthy, so it doubles as the compose-up smoke test. The remaining services and the URLs below land in later slices.
-
-**Target service URLs** *(most land in later slices)*
+**Default URLs**

 | Service | URL |
 |---|---|
@@ -74,7 +64,7 @@ curl http://localhost:8080/health     # -> Healthy
 | Openbaar register | http://localhost:4201 |
 | Behandel-portal | http://localhost:4202 |
 | Beheer-portal | http://localhost:4203 |
-| BFF | http://localhost:8080 |
+| BFF | http://localhost:5000 |
 | OpenZaak | http://localhost:8000 |
 | Open Notificaties | http://localhost:8001 |
 | Flowable | http://localhost:8080 |
@@ -83,12 +73,10 @@ curl http://localhost:8080/health     # -> Healthy

 Test credentials, BSNs, and personas: see [docs/synthetic-data.md](docs/synthetic-data.md).

-**Build the docs site**
+**Re-seed synthetic data**

 ```bash
-python3 -m venv .venv && .venv/bin/pip install mkdocs-material
-.venv/bin/mkdocs serve         # live preview at http://localhost:8000
-.venv/bin/mkdocs build         # static site in ./site
+./tools/seed.sh               # or pwsh ./tools/seed.ps1
 ```

 ---
--- a/apps/self-service/eslint.config.mjs
+++ b/apps/self-service/eslint.config.mjs
@@ -1,34 +0,0 @@
-import nx from '@nx/eslint-plugin';
-import baseConfig from '../../eslint.config.mjs';
-
-export default [
-  ...nx.configs['flat/angular'],
-  ...nx.configs['flat/angular-template'],
-  ...baseConfig,
-  {
-    files: ['**/*.ts'],
-    rules: {
-      '@angular-eslint/directive-selector': [
-        'error',
-        {
-          type: 'attribute',
-          prefix: 'app',
-          style: 'camelCase',
-        },
-      ],
-      '@angular-eslint/component-selector': [
-        'error',
-        {
-          type: 'element',
-          prefix: 'app',
-          style: 'kebab-case',
-        },
-      ],
-    },
-  },
-  {
-    files: ['**/*.html'],
-    // Override or add rules here
-    rules: {},
-  },
-];
--- a/apps/self-service/project.json
+++ b/apps/self-service/project.json
@@ -1,80 +0,0 @@
-{
-  "name": "self-service",
-  "$schema": "../../node_modules/nx/schemas/project-schema.json",
-  "projectType": "application",
-  "prefix": "app",
-  "sourceRoot": "apps/self-service/src",
-  "tags": [],
-  "targets": {
-    "build": {
-      "executor": "@angular/build:application",
-      "outputs": ["{options.outputPath}"],
-      "defaultConfiguration": "production",
-      "options": {
-        "outputPath": "dist/apps/self-service",
-        "browser": "apps/self-service/src/main.ts",
-        "tsConfig": "apps/self-service/tsconfig.app.json",
-        "assets": [
-          {
-            "glob": "**/*",
-            "input": "apps/self-service/public"
-          }
-        ],
-        "styles": ["apps/self-service/src/styles.css"]
-      },
-      "configurations": {
-        "production": {
-          "budgets": [
-            {
-              "type": "initial",
-              "maximumWarning": "500kb",
-              "maximumError": "1mb"
-            },
-            {
-              "type": "anyComponentStyle",
-              "maximumWarning": "4kb",
-              "maximumError": "8kb"
-            }
-          ],
-          "outputHashing": "all"
-        },
-        "development": {
-          "optimization": false,
-          "extractLicenses": false,
-          "sourceMap": true
-        }
-      }
-    },
-    "serve": {
-      "continuous": true,
-      "executor": "@angular/build:dev-server",
-      "defaultConfiguration": "development",
-      "configurations": {
-        "production": {
-          "buildTarget": "self-service:build:production"
-        },
-        "development": {
-          "buildTarget": "self-service:build:development"
-        }
-      }
-    },
-    "lint": {
-      "executor": "@nx/eslint:lint"
-    },
-    "test": {
-      "executor": "@angular/build:unit-test",
-      "options": {
-        "watch": false
-      }
-    },
-    "serve-static": {
-      "continuous": true,
-      "executor": "@nx/web:file-server",
-      "options": {
-        "buildTarget": "self-service:build",
-        "staticFilePath": "dist/apps/self-service/browser",
-        "spa": true
-      }
-    }
-  }
-}
--- a/apps/self-service/public/favicon.ico
+++ b/apps/self-service/public/favicon.ico
--- a/apps/self-service/src/app/app.config.ts
+++ b/apps/self-service/src/app/app.config.ts
@@ -1,10 +0,0 @@
-import {
-  ApplicationConfig,
-  provideBrowserGlobalErrorListeners,
-} from '@angular/core';
-import { provideRouter } from '@angular/router';
-import { appRoutes } from './app.routes';
-
-export const appConfig: ApplicationConfig = {
-  providers: [provideBrowserGlobalErrorListeners(), provideRouter(appRoutes)],
-};
--- a/apps/self-service/src/app/app.css
+++ b/apps/self-service/src/app/app.css
--- a/apps/self-service/src/app/app.html
+++ b/apps/self-service/src/app/app.html
@@ -1,5 +0,0 @@
-<main>
-  <h1>Zelfservice — BIG-registratie</h1>
-  <p>Portaal voor zorgprofessionals. Inloggen en indienen volgt in S-08c.</p>
-  <router-outlet></router-outlet>
-</main>
--- a/apps/self-service/src/app/app.routes.ts
+++ b/apps/self-service/src/app/app.routes.ts
@@ -1,3 +0,0 @@
-import { Route } from '@angular/router';
-
-export const appRoutes: Route[] = [];
--- a/apps/self-service/src/app/app.spec.ts
+++ b/apps/self-service/src/app/app.spec.ts
@@ -1,17 +0,0 @@
-import { TestBed } from '@angular/core/testing';
-import { App } from './app';
-
-describe('App', () => {
-  beforeEach(async () => {
-    await TestBed.configureTestingModule({
-      imports: [App],
-    }).compileComponents();
-  });
-
-  it('renders the self-service portal heading', async () => {
-    const fixture = TestBed.createComponent(App);
-    await fixture.whenStable();
-    const compiled = fixture.nativeElement as HTMLElement;
-    expect(compiled.querySelector('h1')?.textContent).toContain('Zelfservice');
-  });
-});
--- a/apps/self-service/src/app/app.ts
+++ b/apps/self-service/src/app/app.ts
@@ -1,12 +0,0 @@
-import { Component } from '@angular/core';
-import { RouterModule } from '@angular/router';
-
-@Component({
-  imports: [RouterModule],
-  selector: 'app-root',
-  templateUrl: './app.html',
-  styleUrl: './app.css',
-})
-export class App {
-  protected title = 'self-service';
-}
--- a/apps/self-service/src/index.html
+++ b/apps/self-service/src/index.html
@@ -1,13 +0,0 @@
-<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8" />
-    <title>self-service</title>
-    <base href="/" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <link rel="icon" type="image/x-icon" href="favicon.ico" />
-  </head>
-  <body>
-    <app-root></app-root>
-  </body>
-</html>
--- a/apps/self-service/src/main.ts
+++ b/apps/self-service/src/main.ts
@@ -1,5 +0,0 @@
-import { bootstrapApplication } from '@angular/platform-browser';
-import { appConfig } from './app/app.config';
-import { App } from './app/app';
-
-bootstrapApplication(App, appConfig).catch((err) => console.error(err));
--- a/apps/self-service/src/styles.css
+++ b/apps/self-service/src/styles.css
@@ -1 +0,0 @@
-/* You can add global styles to this file, and also import other style files */
--- a/apps/self-service/tsconfig.app.json
+++ b/apps/self-service/tsconfig.app.json
@@ -1,9 +0,0 @@
-{
-  "extends": "./tsconfig.json",
-  "compilerOptions": {
-    "outDir": "../../dist/out-tsc",
-    "types": []
-  },
-  "include": ["src/**/*.ts"],
-  "exclude": ["src/**/*.spec.ts", "src/**/*.test.ts"]
-}
--- a/apps/self-service/tsconfig.json
+++ b/apps/self-service/tsconfig.json
@@ -1,31 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "strict": true,
-    "noImplicitOverride": true,
-    "noPropertyAccessFromIndexSignature": true,
-    "noImplicitReturns": true,
-    "noFallthroughCasesInSwitch": true,
-    "isolatedModules": true,
-    "target": "es2022",
-    "moduleResolution": "bundler",
-    "emitDecoratorMetadata": false,
-    "module": "preserve"
-  },
-  "angularCompilerOptions": {
-    "enableI18nLegacyMessageIdFormat": false,
-    "strictInjectionParameters": true,
-    "strictInputAccessModifiers": true,
-    "strictTemplates": true
-  },
-  "files": [],
-  "include": [],
-  "references": [
-    {
-      "path": "./tsconfig.app.json"
-    },
-    {
-      "path": "./tsconfig.spec.json"
-    }
-  ]
-}
--- a/apps/self-service/tsconfig.spec.json
+++ b/apps/self-service/tsconfig.spec.json
@@ -1,8 +0,0 @@
-{
-  "extends": "./tsconfig.json",
-  "compilerOptions": {
-    "outDir": "../../dist/out-tsc",
-    "types": ["vitest/globals"]
-  },
-  "include": ["src/**/*.ts", "src/**/*.d.ts"]
-}
--- a/cliff.toml
+++ b/cliff.toml
@@ -1,45 +0,0 @@
-# git-cliff configuration — generates CHANGELOG.md from Conventional Commits.
-# Run via `make changelog`. See https://git-cliff.org.
-
-[changelog]
-header = """
-# Changelog
-
-All notable changes to this project. Generated from Conventional Commits by git-cliff.\n
-"""
-body = """
-{% if version %}\
-## {{ version }} — {{ timestamp | date(format="%Y-%m-%d") }}
-{% else %}\
-## Unreleased
-{% endif %}\
-{% for group, commits in commits | group_by(attribute="group") %}
-### {{ group | upper_first }}
-{% for commit in commits %}\
- {{ commit.message | upper_first }}{% if commit.breaking %} **[BREAKING]**{% endif %}
-{% endfor %}\
-{% endfor %}\n
-"""
-trim = true
-
-[git]
-conventional_commits = true
-filter_unconventional = true
-split_commits = false
-protect_breaking_commits = true
-tag_pattern = "v[0-9]*"
-# CalVer tags: YYYY.MM.PATCH
-filter_commits = false
-commit_parsers = [
-  { message = "^feat", group = "Features" },
-  { message = "^fix", group = "Bug Fixes" },
-  { message = "^perf", group = "Performance" },
-  { message = "^refactor", group = "Refactor" },
-  { message = "^docs", group = "Documentation" },
-  { message = "^test", group = "Tests" },
-  { message = "^ci", group = "CI" },
-  { message = "^build", group = "Build" },
-  { message = "^arch", group = "Architecture" },
-  { message = "^chore", group = "Chores" },
-  { message = ".*", group = "Other" },
-]
--- a/docs/architecture/adr-0001-loose-coupling.md
+++ b/docs/architecture/adr-0001-loose-coupling.md
@@ -1,58 +0,0 @@
-# ADR-0001: Loose coupling to upstream Common Ground modules
-
- **Status:** Accepted
- **Date:** 2026-06-03
- **Deciders:** Respellion engineering
- **Template note:** This is the first ADR and doubles as the worked example of
-  the Nygard template. Copy its shape for new ADRs (`adr-NNNN-title.md`).
-
-## Context
-
-This reference application orchestrates several upstream Common Ground modules —
-OpenZaak (ZGW APIs), Open Notificaties (NRC), Objecten/Objecttypen, Flowable,
-Keycloak. Each is an independently developed, independently deployed peer. The
-temptation in a demo is to reach straight into a peer's database or couple to its
-internal schema to move faster. That coupling is exactly what makes Common Ground
-landscapes brittle and un-upgradeable in practice.
-
-We need a stance, recorded up front, on how our services may talk to these peers.
-
-## Decision
-
-**We integrate with upstream modules only through their documented public APIs, and
-we isolate that integration behind explicit anti-corruption boundaries.**
-
-Concretely (mirrors CLAUDE.md §8):
-
-1. The **ACL** is the only code that talks to ZGW APIs; no other service constructs
-   ZGW URLs.
-2. The **Workflow Client** is the only code that talks to Flowable; BPMN models hold
-   no OpenZaak knowledge.
-3. **Portals talk only to the BFF** — never directly to a backend or a peer module.
-4. **No direct database access across services or to any peer.** Each service owns
-   its schema; the Read Projection is a rebuildable derived artefact.
-5. **Idempotency at every event boundary** (the Event Subscriber tolerates duplicate
-   and out-of-order NRC events).
-
-Bending any of these is an ADR-worthy moment (CLAUDE.md §14): stop and open an
-`adr-proposal` issue first.
-
-## Consequences
-
-**Positive**
-
- Upstream modules can be upgraded or swapped behind their APIs without rippling
-  through our services.
- Coupling is visible and minimal — anti-corruption code lives in one named place.
- The architecture teaches the Common Ground pattern by enforcing it.
-
-**Negative / costs**
-
- More indirection: a translation layer (ACL, Workflow Client) instead of direct
-  calls. Accepted — it's the point.
- Eventual consistency across aggregates must be designed for, not assumed away.
-
-**Follow-up**
-
- Each integration slice that touches a boundary references this ADR; new boundary
-  decisions get their own ADR.
--- a/docs/architecture/adr-0002-catalogus-design.md
+++ b/docs/architecture/adr-0002-catalogus-design.md
@@ -1,53 +0,0 @@
-# ADR-0002: BIG catalogus design and OpenZaak seeding
-
- **Status:** Accepted
- **Date:** 2026-06-03
- **Deciders:** Respellion engineering
- **Relates to:** S-01 (#2)
-
-## Context
-
-S-01 needs a reproducible `BIG` catalogus in OpenZaak with a **lean** `BIG-registratie`
-zaaktype (only schema-mandatory fields) plus a `bsn` eigenschap, and a JWT client that
-can list zaaktypen. We had to decide *how* to provision this idempotently at startup.
-
-Findings from the OpenZaak image (`openzaak/open-zaak:latest`):
- `setup_configuration` (run by the init container) is declarative and idempotent, with
-  steps for **JWT secrets** and **applicaties** (`vng_api_common_credentials`,
-  `vng_api_common_applicaties`) — but **no step for catalogi/zaaktypen**.
- Catalogus/zaaktype/eigenschap can only be created through the **ZTC REST API**.
- Publishing a zaaktype requires ≥1 roltype, ≥1 resultaattype and ≥2 statustypen.
-
-## Decision
-
-1. **Provision the JWT client declaratively** via `infra/openzaak/setup_configuration/data.yaml`:
-   a `JWTSecret` (`big-reference-seed` / dev secret) and an `Applicatie` with
-   `heeft_alle_autorisaties: true`. Idempotent, runs in the init container.
-2. **Seed the catalogus/zaaktype/eigenschap via the ZTC API** with an idempotent,
-   stdlib-only script (`infra/openzaak/seed_catalogus.py`, `make openzaak-seed`). It mints
-   a ZGW JWT from the provisioned client and matches existing objects (by `domein` /
-   `identificatie` / `naam`, querying `status=alles` so concepts are seen) before creating.
-3. **Keep the zaaktype a CONCEPT (not published).** Publishing pulls in roltypen,
-   statustypen and resultaattypen, which go beyond "schema-mandatory"; those arrive with
-   the workflow/zaak slices that actually need a published type. Listing uses `status=alles`.
-4. **Disable outbound notifications** (`NOTIFICATIONS_DISABLED=true`) until Open Notificaties
-   (NRC) lands in S-01-c — otherwise every ZTC write 500s trying to notify.
-5. **Fixed dev values:** RSIN `517439943` (elfproef-valid test value); the JWT secret is
-   dev-only and documented as such.
-
-## Consequences
-
- **Reproducible & version-robust:** the API-driven seed doesn't depend on fixture PKs or
-  a catalogi `setup_configuration` step that may change between versions.
- **Teaches the pattern:** the seed talks to OpenZaak exactly the way the ACL will later —
-  through the documented ZGW API, with a JWT (ADR-0001).
- The seed is a script, but a **data loader is explicitly anticipated** (PRD §8); it lives
-  under `infra/openzaak/`, not as ad-hoc tooling.
- **Follow-ups:** re-enable notifications when NRC is up (S-01-c); publish the zaaktype (add
-  the related types) when a slice needs to create real zaken; pin the OpenZaak image tag.
-
-## Alternatives considered
-
- **Fully declarative in `data.yaml`** — rejected: no catalogi/zaaktype step exists.
- **Django `loaddata` fixture** — rejected: brittle, tied to model PKs and the exact image
-  version; bypasses the API the rest of the system uses.
--- a/docs/architecture/adr-0003-default-fill.md
+++ b/docs/architecture/adr-0003-default-fill.md
@@ -1,44 +0,0 @@
-# ADR-0003: ACL default-fill strategy
-
- **Status:** Accepted
- **Date:** 2026-06-04
- **Deciders:** Respellion engineering
- **Relates to:** S-04 (#5); builds on ADR-0001 (loose coupling)
-
-## Context
-
-The ACL is the only code that talks to ZGW APIs (ADR-0001 / CLAUDE.md §8.1). When the
-domain asks it to "open a zaak", the domain payload is intentionally free of ZGW
-specifics — it carries domain facts (e.g. the registrant's BSN), not OpenZaak fields. But
-OpenZaak's `POST /zaken` requires ZGW-mandatory fields: `bronorganisatie`,
-`verantwoordelijkeOrganisatie`, `startdatum`, `vertrouwelijkheidaanduiding`, and a
-`zaaktype` URL. Something has to supply those, and it must not leak into the domain.
-
-## Decision
-
-**The ACL default-fills the ZGW-mandatory zaak fields; the domain never sees them.**
-
- `bronorganisatie`, `verantwoordelijkeOrganisatie`, `vertrouwelijkheidaanduiding`, and the
-  `zaaktype` URL come from **ACL configuration** (`AclDefaults` options) — not hardcoded,
-  not from the domain. This keeps them operationally manageable (the beheer portal will
-  edit them in S-15) and environment-specific (the seeded BIG zaaktype URL differs per env).
- `startdatum` is derived from an injected **clock** (today's date), so it is
-  deterministic in tests.
- The mapping from domain payload → ZGW `ZaakRequest` lives entirely inside the ACL
-  (`Application` builds the request from payload + defaults; `Infrastructure` serialises and
-  POSTs it). No other service constructs ZGW payloads or URLs.
-
-## Consequences
-
- **Positive:** the domain stays ZGW-agnostic; ZGW knowledge is in one named place; defaults
-  are config (testable, env-specific, later editable via the beheer portal).
- **Cost:** the ACL must be configured per environment (the seeded zaaktype URL, the
-  organisation RSINs). Missing/invalid config fails fast at the ACL boundary.
- **Follow-ups:** mapping the BSN onto the zaak (eigenschap/rol), status transitions, and
-  documents are explicitly out of scope for S-04 and get their own slices.
-
-## Alternatives considered
-
- **Defaults in the domain payload** — rejected: leaks ZGW concerns into the domain,
-  violating ADR-0001.
- **Hardcoded defaults in code** — rejected: not env-specific, not operationally editable.
--- a/docs/architecture/adr-0004-bdd-framework.md
+++ b/docs/architecture/adr-0004-bdd-framework.md
@@ -1,52 +0,0 @@
-# ADR-0004: Reqnroll as the BDD acceptance framework
-
- **Status:** Accepted
- **Date:** 2026-06-04
- **Deciders:** Respellion engineering
- **Relates to:** S-04 (#5); supports CLAUDE.md §3 (BDD at the use-case level) and §11 (tests pyramid)
-
-## Context
-
-CLAUDE.md §11 mandates that each user-visible flow is driven by a Gherkin acceptance
-scenario living in `tests/acceptance/`, and §3 names "BDD at the use-case level" as a core
-engineering principle. The foundational slices (S-00…S-03) added no acceptance layer; S-04
-is the first slice with real domain behaviour to drive, so it is where the BDD framework is
-introduced. We need a .NET tool that:
-
- parses Gherkin `.feature` files and binds steps to C#,
- integrates with the existing xUnit test runner (the repo standardises on xUnit), so
-  acceptance tests run under the same `dotnet test` / `make ci` gate as everything else,
- is actively maintained on modern .NET (we target net10.0).
-
-## Decision
-
-**Use [Reqnroll](https://reqnroll.net/) (`Reqnroll.xUnit`) for acceptance tests.**
-
- Reqnroll is the actively-maintained, open-source successor to SpecFlow (which is no longer
-  maintained). It keeps the same Gherkin + `[Binding]` model, so the knowledge transfers.
- `Reqnroll.xUnit` generates one xUnit test per scenario, so acceptance tests are discovered
-  and run by the same runner as the unit tests — no second test framework, no extra CI step.
- Acceptance projects live under `tests/acceptance/` per the PRD §9 layout. Generated
-  `*.feature.cs` files are build artefacts and are git-ignored.
-
-## Consequences
-
- **Positive:** one assertion/runner stack (xUnit) across unit and acceptance tests; scenarios
-  are written in business language (Dutch domain terms inline) and reviewed as the slice's
-  contract; maintained tooling on net10.0.
- **Cost:** a new dependency (`Reqnroll.xUnit`) and its xUnit v2 transitive graph. Reqnroll
-  pulls `xunit.core` but not the assertion library, so the `xunit` metapackage is referenced
-  explicitly to get `Assert`.
- **Replaceable by:** hand-written xUnit "scenario" tests with a Given/When/Then helper, at
-  the cost of losing Gherkin as the shared, readable contract — which is the whole point of §3.
- **Follow-ups:** the real-OpenZaak integration test (Testcontainers) and the Stryker mutation
-  baseline for S-04 are tracked as their own issues split off #5.
-
-## Alternatives considered
-
- **SpecFlow** — rejected: unmaintained and without an official net10.0 story; Reqnroll is its
-  drop-in successor.
- **Plain xUnit Given/When/Then helpers** — rejected for user-visible flows: loses the
-  business-readable Gherkin contract that §3/§11 require. Still fine for unit-level tests.
- **Xunit.Gherkin.Quick** — rejected: lighter but less featureful (no hooks/scoped contexts,
-  smaller community) than Reqnroll.
--- a/docs/architecture/adr-0005-mutation-testing.md
+++ b/docs/architecture/adr-0005-mutation-testing.md
@@ -1,68 +0,0 @@
-# ADR-0005: Stryker.NET for mutation testing, baseline on the ACL
-
- **Status:** Accepted
- **Date:** 2026-06-25
- **Deciders:** Respellion engineering
- **Relates to:** S-04b (#47); proposed in #51; supports CLAUDE.md §5 (mutation ratchet) and §3 (Definition of Done)
-
-## Context
-
-CLAUDE.md §5 mandates Stryker on every PR with a **ratchet**: CI fails on a regression
-below the established baseline, and the baseline only ever moves up. §3 lists "mutation
-(ratchet)" as a Definition-of-Done gate for **every** slice. Yet no baseline existed — so,
-strictly, no slice could satisfy that gate. S-04b establishes it.
-
-The ACL is the natural place to set the first baseline: it is the first service with real
-branching logic — `OpenZaakGateway` (HTTP contract, geo CRS headers, error handling),
-`ZgwToken` (HS256 JWT minting), and the `AclService` default-fill mapping. We need a tool
-that:
-
- mutates C# and runs the existing xUnit suite per mutant,
- is reproducible (same version locally and in CI, no global install),
- understands this repo's `.slnx` solution format (used repo-wide),
- emits a break threshold CI can gate on.
-
-## Decision
-
-**Use [Stryker.NET](https://stryker-mutator.io/docs/stryker-net/) (`dotnet-stryker`),
-pinned as a local dotnet tool**, configured in solution mode against `Acl.slnx`.
-
- Pinned in `.config/dotnet-tools.json` (v4.15.0); `dotnet tool restore` makes
-  `make mutation` reproducible from a fresh clone, locally and in CI — no global install.
- **Solution mode** (`stryker-config.json` → `solution: Acl.slnx`) mutates the two projects
-  under test (`Acl.Application`, `Acl.Infrastructure`); `Acl.Api` is untested and skipped.
-  Stryker 4.15 reads `.slnx` directly, so no throwaway `.sln` shim is needed.
- A `mutation` make target runs it; it is wired into `make ci` and a parallel Gitea Actions
-  `mutation` job, keeping `make ci` an exact mirror of the pipeline.
-
-**Baseline:** writing S-04b's tests surfaced that the ACL suite was thin — the initial
-score was **35%** (survivors: unasserted CRS headers, null guards, error paths, and JWT
-claims). Those tests were strengthened (killing the mutants honestly rather than lowering
-the bar), raising the score to **95%**. The enforced `break` threshold is set to **90%** —
-one-mutant headroom over the ~20-mutant surface, since a single mutant is ≈5%.
-
-## Consequences
-
- **Positive:** test *strength* is gated, not just coverage; the ratchet protects the ACL's
-  ZGW contract logic; the baseline is repo-wide and ratchets upward per §5.
- **Cost:** a new dependency (`dotnet-stryker`) and a slower CI job than unit tests (~25 s on
-  the small ACL). Pinned + tool-restored, so reproducible.
- **One accepted survivor:** a mutation of the empty-response *exception message string*.
-  Asserting exception message text is brittle and the behaviour (type + control flow) is
-  unchanged — treated as an equivalent mutant, not a test gap.
- **Commitment:** later slices ratchet the threshold up deliberately, never down (§5). New
-  services add their own mutation run as they gain branching logic (BFF, Domain, …).
- **Replaceable by:** no realistic .NET alternative — Stryker.NET is the tool §5 already
-  names; the fallback is no mutation testing, which §5 forbids.
-
-## Alternatives considered
-
- **Global `dotnet tool install -g`** — rejected: not reproducible/pinned per clone; the
-  local manifest gives every checkout and the CI runner the same version.
- **Mutate the whole `register-referentie.slnx`** — rejected for this slice: scopes the
-  baseline to services with no logic yet (BFF skeleton), diluting the signal. Each service
-  opts in as it gains logic.
- **Application-only scope** — rejected: would leave `Acl.Infrastructure`'s HTTP/JWT logic —
-  the riskiest code — unguarded by the ratchet.
- **Coverage gate instead of mutation** — rejected: line coverage does not measure whether
-  tests would *catch* a regression; that is the whole point of §5.
--- a/docs/architecture/adr-0006-integration-test-provisioning.md
+++ b/docs/architecture/adr-0006-integration-test-provisioning.md
@@ -1,92 +0,0 @@
-# ADR-0006: Provision the ACL integration test against the compose stack
-
- **Status:** Accepted
- **Date:** 2026-06-29
- **Deciders:** Respellion engineering
- **Relates to:** S-04a (#46); proposed in #53; builds on ADR-0001 (loose coupling), ADR-0002 (catalogus design), ADR-0003 (default-fill); supports CLAUDE.md §11 (integration tests via real containers)
-
-## Context
-
-S-04 delivered the ACL's one operation — `OpenZaakGateway.OpenZaakAsync` — with unit
-tests against a stubbed `HttpMessageHandler` and a Reqnroll scenario over an in-memory
-stand-in. The deferred S-04 acceptance criterion (S-04a) is the one a stub cannot meet:
-
-> Integration test using Testcontainers against real OpenZaak passes.
-
-The test must drive the gateway against a **real** OpenZaak — real ZGW JWT auth, the real
-`POST /zaken/api/v1/zaken` contract, real CRS handling — and assert a zaak comes back.
-
-Two ways to stand OpenZaak up were considered (the issue's open question): (a) a full
-**Testcontainers** graph started by the test, or (b) target the **running compose stack**
-the repo already defines (`infra/openzaak/docker-compose.yml`, `make openzaak-up`).
-
-Investigation reversed the initially-favoured Testcontainers option:
-
-1. **Testcontainers .NET has no docker-compose support.** OpenZaak needs PostGIS + Redis +
-   a `setup_configuration` one-shot (the JWT client) + the API. Honouring "full graph" would
-   mean re-implementing that five-service stack — init ordering, the config volume, health
-   gating — by hand in C#, duplicating the maintained compose file and rotting with it. That
-   rubs against CLAUDE.md §13 ("if a test is hard to write, the design is wrong").
-2. **The test cannot be hermetic anyway.** OpenZaak's Zaken API rejects a zaak against a
-   *concept* zaaktype (`not-published`), and a *published* zaaktype requires ≥1 resultaattype,
-   which OpenZaak validates by fetching the external **Selectielijst** reference API
-   (`selectielijst.openzaak.nl`). So a real zaak POST already depends on outbound internet
-   from the OpenZaak container — the self-containment that motivated Testcontainers is lost
-   regardless of how the containers are started.
-
-## Decision
-
-**The ACL integration test targets the running compose stack; it does not start containers
-itself. No new test dependency is added.**
-
- A gated test project `Acl.IntegrationTests` (`[Trait("Category","Integration")]`) talks to
-  OpenZaak with a plain `HttpClient`, reusing the same endpoint + JWT-client config the seed
-  uses (`OZ_BASE` / `OZ_CLIENT_ID` / `OZ_SECRET`, defaulting to the local stack). It locates
-  the published `BIG-REGISTRATIE` zaaktype via the Catalogi API and exercises the real
-  `OpenZaakGateway` against it.
- **The lane is kept out of the fast checks.** `make unit` runs with
-  `--filter "Category!=Integration"`; Stryker is pinned to `Acl.Tests` (`test-projects`), so
-  neither the unit nor the mutation lane needs a live stack. A `make integration` target
-  (`infra/run-integration.sh`) brings up a throwaway OpenZaak and runs the lane locally.
-  In CI the check runs as the `verify-acl` step of the consolidated `verify-stack` job
-  (issue #58) — one shared full-stack bring-up. This matches `make` being the single
-  source of truth (ADR-0005).
- **Publishing is opt-in in the seed.** `infra/openzaak/seed_catalogus.py` gains an
-  `OZ_PUBLISH=1` path that adds the relations OpenZaak's publish requires — two statustypen
-  (begin/eind), a roltype, and a resultaattype whose Selectielijst procestype is matched onto
-  the zaaktype — then publishes. The default seed (S-01 / ADR-0002) still leaves the zaaktype
-  a concept; only `make integration` flips the switch.
-
-## Consequences
-
- **Positive:** a small, honest test over the real ZGW contract with no bespoke orchestration
-  to maintain; the compose stack is exercised exactly as operators run it; no new dependency.
- **It caught a real bug.** The gateway sent the zaak body via `JsonContent` without a
-  `Content-Length`, so .NET framed it as `Transfer-Encoding: chunked`, which OpenZaak's uwsgi
-  rejects with 400. A stubbed handler accepts either framing, so only a real OpenZaak surfaced
-  it. Fixed by buffering the body (`LoadIntoBufferAsync`); guarded in the fast lane by a unit
-  test asserting a `Content-Length` is set. This is the concrete justification for §11's
-  integration tier.
- **External dependency:** the integration job needs the OpenZaak container to reach
-  `selectielijst.openzaak.nl`. It is a stable public reference API (the same one OpenZaak uses
-  in production) but it is a network touchpoint, and a CI environment without egress would need
-  a local Selectielijst service or a recorded fixture. `OZ_SELECTIELIJST` overrides the base URL.
- **Cost:** the lane needs the stack up first, so it is separate from the fast lanes.
- **Runs on the hosted runner.** A process *on* the runner can't reach the stack's published
-  ports (Compose starts sibling containers via the host daemon — gitea-actions-gotchas.md §5,
-  same split as §1), so `infra/run-integration.sh` runs both the seed and the test as containers
-  *joined to the OpenZaak network*, reaching it by **container IP** (a single-label host like
-  `openzaak` isn't URL-valid for OpenZaak's own `URLValidator`; an IPv4 literal is). Code is
-  delivered by image build / `docker cp`, never bind mounts. The CI job therefore needs only
-  Docker — no `setup-dotnet`. (This closed the follow-up that was originally split out as #55.)
-
-## Alternatives considered
-
- **Full Testcontainers graph** — rejected: re-implements the compose stack in C# (brittle,
-  duplicative) for no hermeticity gain, since the Selectielijst dependency remains.
- **Single OpenZaak container (sqlite/locmem)** — rejected: diverges from the real
-  PostGIS-backed, Redis-cached deployment; the Zaken API is a geo API and the divergence would
-  undermine the contract the test exists to verify.
- **Mock OpenZaak / record-replay** — rejected: that is what the existing stubbed-handler unit
-  tests already do; it cannot exercise the real contract, and would not have caught the chunked
-  body bug.
--- a/docs/architecture/adr-0007-notification-wiring.md
+++ b/docs/architecture/adr-0007-notification-wiring.md
@@ -1,77 +0,0 @@
-# ADR-0007: Wiring OpenZaak → Open Notificaties (NRC) for notifications
-
- **Status:** Accepted
- **Date:** 2026-06-29
- **Deciders:** Respellion engineering
- **Relates to:** S-01-c (#56); completes S-01 (#2); unblocks the Event Subscriber (#7); builds on ADR-0002 (catalogus/seed) and ADR-0006 (runner-safe container harnesses)
-
-## Context
-
-S-01 brought OpenZaak + Open Notificaties (NRC) up in compose but **deferred the
-notification wiring**: OpenZaak ran with `NOTIFICATIONS_DISABLED=true` and NRC's
-`setup_configuration` was empty. The walking skeleton (PRD §12) needs the upstream
-event path — a zaak created in OpenZaak must publish a notification NRC fans out to
-subscribers — before the Event Subscriber (#7) can consume it.
-
-The OpenZaak↔NRC handshake is intricate and several details are non-obvious; they
-were nailed down by iterating `setup_configuration` against the running stack.
-
-## Decision
-
-**Provision both sides declaratively via `setup_configuration`, authenticate with the
-existing `big-reference-seed` client, and run NRC's celery-beat so deliveries happen.**
-
- **OpenZaak** (`infra/openzaak/setup_configuration/data.yaml`): a `zgw_consumers`
-  service `nrc` (api_type `nrc`, the NRC API root) plus `notifications_config` naming
-  it. `NOTIFICATIONS_DISABLED` is flipped to `false` **only when NRC is present** —
-  the full stack and the local twin set it; OpenZaak-only bring-ups (`openzaak-up`,
-  the ACL integration test) default it back to `true` via `OZ_NOTIFICATIONS_DISABLED`
-  so they don't 500 publishing to an absent NRC.
- **NRC** (`infra/opennotificaties/setup_configuration/data.yaml`): the
-  `big-reference-seed` JWT credential (to verify OpenZaak's token), a `zgw_consumers`
-  `ac` service pointing at **OpenZaak's Autorisaties API**, the `autorisaties_api`
-  step delegating authorization to that AC, and the `zaken` kanaal. NRC's init
-  container switches from `migrate` to `/setup_configuration.sh`; its data.yaml is
-  delivered through the `rr-nrc-config` external volume by `infra/seed-config.sh`
-  (the same `docker cp` pattern as OpenZaak — bind mounts don't reach the CI runner's
-  daemon).
- **celery-beat is required.** NRC accepts a notification and writes a
-  `ScheduledNotification`; a periodic `execute_notifications` task (celery-beat,
-  every `NOTIFICATION_SEC_INTERVAL`s) drains it to the worker for delivery. The lean
-  S-01 stack dropped beat — so notifications were accepted but never delivered. An
-  `nrc-beat` service is added to every compose; the interval is lowered to 5s.
-
-Verification is a runner-safe smoke (`infra/run-notification-check.sh`): it seeds a
-published BIG zaaktype, registers an abonnement to a webhook sink, creates a zaak, and
-asserts the sink receives the `zaken`/`create` notification — all from containers
-**inside** the compose network (ADR-0006). Locally it runs via `make verify-notifications`
-(a throwaway oz+nrc stack); in CI it runs as the `verify-nrc` step of the consolidated
-`verify-stack` job (one shared full-stack bring-up — issue #58).
-
-## Consequences
-
- **Positive:** the walking-skeleton event path works end to end; #7 can consume real
-  notifications; the wiring is declarative and reproducible from a fresh `make`.
- **Gotchas captured (see gitea-actions-gotchas.md):**
-  - **Single-label hosts aren't URL-valid.** OpenZaak/NRC reject `http://openzaak…`
-    /`http://nrc-web…` in URLs they validate (Django `URLValidator`); the verify
-    harness reaches services and registers the sink callback **by container IP**.
-  - **Abonnement callbacks must enforce auth.** NRC probes the callback during
-    registration and refuses it (`no-auth-on-callback-url`) unless it returns 401
-    without the configured `Authorization`; the sink enforces a bearer token.
- **Cost:** an extra long-running service (`nrc-beat`) per stack, and the verify job
-  needs egress (base images + `selectielijst.openzaak.nl`, since the published
-  zaaktype the check creates a zaak against depends on it — ADR-0006).
- **Dev-only credentials** reused (`big-reference-seed` / its secret) across publish,
-  AC lookup, and seeding — acceptable for the reference app, not production.
-
-## Alternatives considered
-
- **NRC with its own (non-AC) authorization** — rejected: delegating to OpenZaak's
-  Autorisaties API is the upstream-intended model and reuses the applicatie that
-  already grants `heeft_alle_autorisaties`.
- **Keep beat out, deliver synchronously** — not an option: Open Notificaties 1.16
-  delivers via scheduled notifications drained by beat; there is no sync path.
- **A persistent abonnement in `setup_configuration`** instead of registering one in
-  the verify harness — deferred: the real subscriber is #7; the harness's sink
-  abonnement is throwaway and IP-specific.
--- a/docs/architecture/adr-0008-read-projection-store.md
+++ b/docs/architecture/adr-0008-read-projection-store.md
@@ -1,89 +0,0 @@
-# ADR-0008: The read projection — a shared, rebuildable store with a writer and a reader
-
- **Status:** Accepted
- **Date:** 2026-06-30
- **Deciders:** Respellion engineering
- **Relates to:** S-06 (#7); builds on ADR-0001 (loose coupling), ADR-0007 (#56, OZ→NRC wiring); first EF Core usage in the repo
-
-## Context
-
-S-06 (#7) adds the upstream event path's destination: an **Event Subscriber** that consumes
-NRC notifications and a **read projection** the openbaar register reads. The walking-skeleton
-projection (PRD §8.4) holds one row per zaak — `id`, `bsn`, `naam_placeholder`, `status` —
-and must be **idempotent** (NRC redelivers and reorders, CLAUDE.md §8.6) and **rebuildable**
-(a derived artefact, never a write-only source of truth).
-
-Two design questions had no obvious answer:
-
-1. **Where does `bsn` come from?** The NRC `zaken`/`zaak`/`create` notification carries only the
-   zaak URL plus the fixed `kenmerken` (`bronorganisatie`, `zaaktype`, `vertrouwelijkheidaanduiding`).
-   It does **not** carry the bsn. Reading it means calling a ZGW API — which **only the ACL** may
-   do (CLAUDE.md §8.1). The issue's "Touches" lists only `event-subscriber` + `projection-api`,
-   not the ACL.
-2. **Who owns the projection schema?** The subscriber writes the projection; the projection-api
-   reads it. CLAUDE.md §8.5 says "no direct DB access across services; each service owns its
-   schema." Two deployables on one table looks like a violation.
-
-## Decision
-
-**One Postgres database is the read projection. The Event Subscriber writes it (projector) and
-the projection-api reads it (query); both are processes of the single "Read Projection" bounded
-context and share one schema, defined in a shared `Projection.ReadModel` library. `bsn` is
-deferred.**
-
- **Schema ownership.** The read model — `register_projection` plus the subscriber's
-  `processed_notifications` log — lives in `services/projection-api/Projection.ReadModel`
-  (EF Core + Npgsql). Both services reference it. This is the textbook CQRS read-model split
-  (one writer, one reader over one derived store), **not** the cross-*domain* DB reach §8.5
-  forbids: no domain owns write-state here; the projection is rebuildable (§8.4). §8.5 still
-  holds for every domain database.
- **Idempotency** is the primary key on `processed_notifications.key` (a deterministic key
-  derived from the immutable notification content). A duplicate insert raises a unique violation,
-  caught and reported as "already recorded", so the duplicate never reaches the projection. The
-  projection upsert is itself idempotent on the zaak id, a second line of defence.
- **Rebuild replays the log, not OpenZaak.** `POST /admin/rebuild` clears `register_projection`
-  and reprojects every row in `processed_notifications`. So "rebuildable" needs **no** ZGW access
-  (§8.1) and no ACL dependency — keeping S-06 within its stated scope.
- **`bsn` and `naam_placeholder` are deferred.** They are columns (nullable) but the minimal slice
-  populates only `id` + `status` (`INGEDIEND`) from the notification. Populating personal data
-  requires reading the zaak **through the ACL** (§8.1) and is its own follow-up; the column shape
-  is in place so that change is additive.
- **New dependency: EF Core 10 + `Npgsql.EntityFrameworkCore.PostgreSQL`.** What it gives us: a
-  migrated relational schema, LINQ queries, and a clean port implementation. What we'd write
-  instead: hand-rolled SQL + a migration runner. Risk: ORM complexity and an extra dependency
-  graph — bounded here to a tiny two-table read model. `dotnet-ef` is pinned as a local tool for
-  migrations; `NuGetAuditMode=direct` keeps EF's design-time-only tooling transitive out of the
-  audited, shipped graph.
-
-The end-to-end path is verified by a runner-safe live-stack smoke (`infra/run-projection-check.sh`,
-the `verify-projection` step of the `verify-stack` job, #58): register an abonnement at the real
-Event Subscriber's callback, create a zaak, assert projection-api serves an `INGEDIEND` row — all
-in-network, reaching services by container IP (ADR-0006/0007).
-
-## Consequences
-
- **Positive:** the upstream event path reaches a queryable projection; idempotent and rebuildable
-  without OpenZaak; S-06 stays inside its stated touch-set (no ACL change); the projection-api is
-  ready for S-09 to tighten public-safe field filtering.
- **Negative / deferred:**
-  - `bsn`/`naam_placeholder` stay empty until a follow-up wires zaak reads via the ACL.
-  - The abonnement is registered by the verify harness (by container IP), not provisioned
-    persistently — ADR-0007 already deferred a persistent abonnement, and a single-label service
-    host is not URL-valid for NRC, so persistent registration needs a dotted network alias. Tracked
-    as a follow-up; a plain `make up` therefore needs the abonnement registered before the event
-    path flows.
-  - Two services share one database. Acceptable for a derived read model; revisit if the read and
-    write sides ever need independent scaling or storage.
-
-## Alternatives considered
-
- **Subscriber reads OpenZaak directly to fill `bsn`** — rejected: breaks §8.1 (only the ACL talks
-  to ZGW) and would need its own ADR to bend the rule.
- **Extend the ACL with a zaak-read operation, consumed as a library** — viable and §8.1-clean, but
-  it grows S-06 beyond its stated scope (touches the ACL) and pulls personal-data handling forward;
-  deferred to a follow-up.
- **projection-api owns the DB and exposes an internal write endpoint the subscriber calls** —
-  rejected for the walking skeleton: adds an HTTP hop and a write surface on a read service for no
-  current benefit over a shared, rebuildable read model.
- **Separate databases for the log and the projection** — rejected as premature: both are the read
-  side's private, rebuildable state; one DB is simpler and still honours §8.5's intent.
--- a/docs/architecture/adr-0009-external-task-job-worker.md
+++ b/docs/architecture/adr-0009-external-task-job-worker.md
@@ -1,88 +0,0 @@
-# ADR-0009: The Domain Service drives Flowable as an external-task job worker
-
- **Status:** Accepted
- **Date:** 2026-06-30
- **Deciders:** Respellion engineering
- **Relates to:** S-05 (#6); proposal #60; builds on ADR-0001 (loose coupling, §8.1/§8.2), S-03 (#4, the `registratie` BPMN), S-04 (#5, the ACL `OpenZaak` operation)
-
-## Context
-
-S-05 (#6) adds the **BIG Domain Service**. Submitting a registration must: create a
-`Registration` aggregate, **start the Flowable `registratie` process** (S-03), have the
-`OpenZaakAanmaken` task **open a zaak via the ACL** (S-04), and store the resulting zaak URL
-back on the aggregate.
-
-`OpenZaakAanmaken` is a Flowable **external-worker** service task (`flowable:type="external-worker"`,
-topic `OpenZaakAanmaken`). Flowable does not push it anywhere — it parks the job and waits for a
-worker to **acquire and lock** it, do the work, and **complete** it. Two coupling rules constrain
-who may do what:
-
- **§8.2 — the Workflow Client is the only code that talks to Flowable.** BPMN models never embed
-  OpenZaak knowledge; they ask the Workflow Client to execute external tasks.
- **§8.1 — the ACL is the only code that talks to ZGW.** The worker opens the zaak *through the ACL*,
-  never by constructing ZGW URLs itself.
-
-This is an ADR-worthy moment (§14): a service boundary is defined and both coupling rules are
-exercised. The open question is *how* the external task is driven.
-
-## Decision
-
-**The Domain Service drives the `OpenZaakAanmaken` task as a hosted external-task job worker
-(PRD §36). Orchestration is eventually consistent, not request-synchronous.**
-
- **`POST /registrations` is fast and side-effecting only on the domain side.** It creates the
-  `Registration` aggregate in state `INGEDIEND`, persists it, and asks the Workflow Client to start
-  one `registratie` process instance, recording the process-instance id on the aggregate. It returns
-  immediately; it does **not** wait for the zaak to be opened.
- **A hosted worker polls Flowable for `OpenZaakAanmaken` jobs.** It acquires and locks a job, calls
-  the ACL `OpenZaak` operation (§8.1), attaches the returned zaak URL to the matching aggregate
-  (`Registration.AttachZaak`), and completes the job in Flowable. The process then runs to its end
-  event.
- **The Workflow Client is the only Flowable client (§8.2).** It lives in the Domain Service's
-  `Infrastructure` layer and speaks Flowable's REST API (start process-instance; acquire/lock/complete
-  external-worker jobs). No other code — not the Application layer, not the BPMN — knows Flowable
-  exists.
- **The worker *logic* is an Application service over ports**, not Flowable-aware code. `OpenZaakWorker`
-  takes an acquired job (topic + the registration id it carries), calls `IAclClient` and
-  `IRegistrationStore`, and returns the zaak URL to complete with. The **polling loop** is a thin
-  `BackgroundService` in `Infrastructure` that fetches jobs via the Workflow Client and feeds them to
-  the worker. So the orchestration is covered by fast unit tests against fakes; only the REST framing
-  needs a container integration test.
-
-## Scope decisions for the minimal slice
-
- **Registration persistence is in-memory.** The walking skeleton's *read* path is fed by
-  NRC → Event Subscriber → projection (S-06, #7), not by the domain database. An EF-backed domain
-  store buys nothing the demo needs yet, so it is a documented follow-up; the `IRegistrationStore`
-  port keeps that change additive. (PRD §88 envisions EF Core for the domain DB eventually.)
- **The aggregate's state machine is minimal:** `INGEDIEND` on submission. Later flows (withdrawal,
-  beoordeling, herregistratie) add states in their own slices — they are out of scope here.
- **No bsn flows to ZGW yet.** The ACL `OpenZaak` operation already default-fills the ZGW-mandatory
-  fields (ADR-0003) and takes the bsn as its domain payload; the domain hands it through unchanged.
-
-## Consequences
-
- **Positive:** the submit request is decoupled from ACL/OpenZaak latency; the documented Common
-  Ground pattern (external-task worker) is realised; both coupling rules (§8.1, §8.2) hold with the
-  Flowable knowledge isolated to one Infrastructure class; the orchestration is unit-testable.
- **Negative / deferred:**
-  - Eventual consistency: immediately after `POST /registrations` the aggregate has no zaak URL yet.
-    Acceptable — the read side is the projection, not the domain store.
-  - In-memory registration state is lost on restart; fine for the skeleton, replaced by an EF store
-    in a follow-up.
-  - The worker polls (no push); poll interval is a tuning knob, not a correctness concern, since
-    Flowable holds the job until completed.
-
-## Alternatives considered
-
- **Synchronous acquire+complete inside the `POST /registrations` request** — rejected: simpler and
-  deterministic, but couples the submit request to ACL/OpenZaak latency and failure, and is not the
-  external-task worker pattern PRD §36 mandates. It would also make the request fail if OpenZaak is
-  briefly down, instead of the job simply staying parked for the worker to retry.
- **A standalone Workflow Client service, separate from the Domain Service** — rejected for this
-  slice: the worker needs the domain's aggregate store and the ACL client anyway, and PRD §9 places
-  the Workflow Client inside the Domain Service deployment. A separate process adds a hop and a
-  shared store for no current benefit.
- **Flowable pushes to a webhook instead of being polled** — rejected: Flowable's external-worker
-  model is pull-based (acquire/lock/complete); a push shim would re-implement it with weaker
-  delivery guarantees.
--- a/docs/architecture/adr-0010-bff-oidc.md
+++ b/docs/architecture/adr-0010-bff-oidc.md
@@ -1,74 +0,0 @@
-# ADR-0010: The BFF validates Keycloak tokens and is the portals' only backend
-
- **Status:** Accepted
- **Date:** 2026-07-01
- **Deciders:** Respellion engineering
- **Relates to:** S-07 (#8); proposal #63; builds on ADR-0001 (loose coupling, §8.3), S-02 (#3, Keycloak realms), S-05 (#6, Domain Service), S-06 (#7, read projection)
-
-## Context
-
-S-07 (#8) adds the **BFF (Backend-for-Frontend)** — the single backend the Angular portals talk
-to (CLAUDE.md §8.3). For the walking skeleton it exposes two endpoints and fans out to services
-already built:
-
- `POST /self-service/registrations` → Domain Service `POST /registrations` (S-05).
- `GET /openbaar/register?q=…` → projection-api `GET /register` (S-06).
-
-It must validate tokens issued by Keycloak (S-02). This is an ADR-worthy moment (§14): a new
-dependency (JWT bearer authentication) and two new service boundaries (BFF→domain, BFF→projection).
-
-## Decision
-
-**The BFF is the portals' only backend; it validates Keycloak `digid`-realm JWTs on the
-self-service endpoint, leaves the openbaar lookup anonymous, and fans out to the domain and
-projection over typed HTTP clients.**
-
- **Auth model.** `POST /self-service/registrations` requires a valid `digid`-realm bearer token;
-  the BFF reads the `bsn` claim and forwards it to the domain. Missing / invalid / expired token →
-  **401**. `GET /openbaar/register` is **anonymous** — the openbaar register is a public lookup
-  (S-09), so no token is required.
- **Portals talk only to the BFF (§8.3).** They never call the Domain Service, ACL, projection, or
-  OpenZaak directly. The BFF orchestrates via typed `HttpClient`s whose base URLs come from config.
-  Downstream calls are unauthenticated on the internal network for the walking skeleton; a
-  service-to-service auth story (e.g. client-credentials) is a later slice, not this one.
- **Validation is `Microsoft.AspNetCore.Authentication.JwtBearer`** pointed at the Keycloak `digid`
-  realm authority. **New dependency justification:** it gives us standards-based OIDC/JWT validation
-  (signature, issuer, expiry, audience) maintained by the framework; rolling our own JWT validation
-  would be error-prone security code; the risk is a first-party ASP.NET Core package — minimal.
- **Tests mint their own tokens.** `WebApplicationFactory` tests override the bearer options with a
-  **test signing key**, so valid / invalid / expired tokens are minted in-process without a live
-  Keycloak. Real Keycloak validation is exercised by a live-stack `verify-bff` check.
- **OpenAPI is generated and committed** (`services/bff/openapi.json`) from .NET's built-in OpenAPI,
-  so S-08's Angular client is generated from the spec, never hand-written (§10).
-
-## Known wrinkle — container OIDC issuer mismatch
-
-Keycloak stamps tokens with an `iss` equal to its **browser-facing** URL (what the portal used to
-log in), which differs from the BFF's **in-container** authority (`http://keycloak:8080/realms/digid`).
-Strict issuer validation then rejects otherwise-valid tokens. Unit tests avoid this (test key).
-`verify-bff` handles it by aligning the configured authority/issuer with the token's `iss` (and, if
-needed, disabling metadata address rewriting). Recorded so it is not rediscovered each time.
-
-## Consequences
-
- **Positive:** the walking skeleton gains its front door; §8.3 holds with all portal traffic going
-  through one backend; token validation is standard and testable without infra; the committed
-  OpenAPI unblocks S-08.
- **Negative / deferred:**
-  - Downstream service-to-service auth is deferred (internal-network trust for now).
-  - The openbaar endpoint is anonymous; when public-safe field filtering tightens (S-09) it stays
-    anonymous but the projection query narrows.
-  - The issuer-mismatch handling is dev-oriented; a production reverse-proxy setup would align the
-    browser and internal issuer URLs instead.
-
-## Alternatives considered
-
- **Token-gate the openbaar endpoint too** — rejected: the openbaar register is public by design
-  (S-09); requiring a login would contradict the slice's intent.
- **Validate tokens by calling Keycloak's introspection endpoint per request** — rejected: adds a
-  network hop per call and a Keycloak dependency on the hot path; local JWT signature validation via
-  the realm's JWKS is the standard, faster choice.
- **Hand-written JWT parsing** — rejected: security-sensitive code we shouldn't own when a
-  first-party validator exists.
- **Generate the OpenAPI client by hand / keep the spec uncommitted** — rejected: §10 requires a
-  generated client from a committed spec.
--- a/docs/demo-script.md
+++ b/docs/demo-script.md
@@ -1,125 +0,0 @@
-# Demo script
-
-A running log of demoable outcomes, one section per slice. Each entry is a short,
-copy-pasteable walkthrough against a local `make up` stack.
-
---
-
-## S-08a — Nx workspace + self-service portal skeleton
-
-**Outcome:** the frontend foundation — an Nx (pnpm) monorepo with the `self-service` Angular app
-(standalone + signals), lint/test/build green in a CI Node lane. The login + submit form follow in
-S-08c.
-
-```bash
-# From a fresh clone (Node 24 + pnpm 11):
-pnpm install                       # native builds are pre-approved in pnpm-workspace.yaml
-pnpm nx test self-service          # Vitest component test
-pnpm nx build self-service         # production build
-pnpm nx serve self-service         # → http://localhost:4200  (placeholder page)
-# Or the CI-equivalent one-shot:
-make frontend                      # install + nx lint/test/build
-```
-
-> Nx manages only `apps/`+`libs/`; the .NET services stay on `dotnet`/the Makefile. NL Design System
-> and the real form arrive in S-08c (#67); see `docs/frontend-decisions.md`.
-
---
-
-## S-07 — BFF: the portals' single backend
-
-**Outcome:** the BFF validates Keycloak `digid` tokens on the self-service submit (forwarding the
-bsn to the domain) and serves the openbaar register anonymously with only public-safe fields — the
-front door the portals (S-08/S-09) will talk to.
-
-**The path:** portal → BFF `POST /self-service/registrations` (token-gated) → domain; and
-BFF `GET /openbaar/register` (anonymous) → projection-api. See ADR-0010.
-
-```bash
-# 1. Bring the full stack up.
-make up
-
-# 2. Drive the BFF end-to-end (401 without a token, 202 with a real digid token, anonymous openbaar).
-make verify-bff        # → "OK — BFF: 401 without token, 202 with a digid token, anonymous ..."
-
-# 3. Try it by hand (BFF on host port 8080).
-#    a) A digid access token for the mock user jan-burger (bsn 123456782):
-tok=$(curl -s -X POST http://localhost:8180/realms/digid/protocol/openid-connect/token \
-  -d grant_type=password -d client_id=big-portal -d username=jan-burger -d password=test123 \
-  | python3 -c "import sys,json;print(json.load(sys.stdin)['access_token'])")
-
-#    b) Submit — without the token it is 401; with it, 202:
-curl -s -o /dev/null -w "no token  -> %{http_code}\n" -X POST http://localhost:8080/self-service/registrations
-curl -s -o /dev/null -w "with token-> %{http_code}\n" -X POST http://localhost:8080/self-service/registrations \
-  -H "Authorization: Bearer $tok"
-
-#    c) The openbaar register is anonymous and exposes only id + status (never the bsn):
-curl -fsS http://localhost:8080/openbaar/register | jq
-```
-
-> The self-service token is validated against Keycloak's `digid` realm; the openbaar lookup needs no
-> token (S-09). The generated contract lives at `services/bff/openapi.json` — S-08's client is built
-> from it.
-
---
-
-## S-05 — BIG Domain Service: submit a registration
-
-**Outcome:** submitting a registration starts a Flowable process; the external-task worker
-opens a zaak via the ACL and records it on the aggregate — the upstream half of the skeleton
-that produces the zaak S-06 then projects.
-
-**The path:** domain `POST /registrations` → Flowable `registratie` process → `OpenZaakAanmaken`
-worker → ACL → OpenZaak; `GET /registrations/{id}` shows the opened zaak (ADR-0009).
-
-```bash
-# 1. Bring the full stack up (seeds config, builds our services, waits for health).
-make up
-
-# 2. Drive the full path end-to-end. This also seeds a published BIG zaaktype and points the
-#    ACL at it (the zaak's zaaktype URL is server-assigned, so it isn't known at bring-up).
-make verify-domain      # → "OK — the domain opened a zaak and recorded it on the registration"
-
-# 3. Submit one yourself (domain on host port 8130). Returns 202 + a Location to read back.
-loc=$(curl -fsS -D - -o /dev/null -X POST http://localhost:8130/registrations \
-  -H 'Content-Type: application/json' -d '{"bsn":"123456782"}' | sed -n 's/\r$//; s/^[Ll]ocation: //p')
-
-# 4. The worker opens the zaak off the request path (eventual consistency, ADR-0009); poll
-#    until zaakUrl is filled. (Step 2 must have run first, so the ACL knows the zaaktype.)
-curl -fsS "http://localhost:8130$loc" | jq
-# → { "registrationId": "...", "status": "Ingediend", "zaakUrl": "http://.../zaken/api/v1/zaken/<uuid>" }
-```
-
-> Registration state is in-memory for this slice (ADR-0009); the rebuildable read model is the
-> projection (S-06), fed by the very zaak this flow opens.
-
---
-
-## S-06 — Event Subscriber + read projection
-
-**Outcome:** a zaak created in OpenZaak flows through NRC to the Event Subscriber, which
-projects it into a rebuildable read projection the projection-api serves.
-
-**The path:** OpenZaak → (notification) NRC → (abonnement callback) Event Subscriber →
-`register_projection` → projection-api `GET /register`.
-
-```bash
-# 1. Bring the full stack up (seeds config, builds our services, waits for health).
-make up
-
-# 2. Register the Event Subscriber's abonnement and create a zaak, then read it back.
-#    (The verify-projection check does exactly this end-to-end and asserts the result.)
-make verify-projection            # → "OK — projection-api serves zaak <uuid> with status INGEDIEND"
-
-# 3. Observe the projection directly via the read API (host port 8120).
-curl -fsS http://localhost:8120/register | jq
-# → [ { "id": "<zaak-uuid>", "status": "INGEDIEND", "bsn": null, "naamPlaceholder": null } ]
-
-# 4. Idempotency + rebuild: replays don't duplicate; a rebuild repopulates from the
-#    notification log (no OpenZaak access needed — ADR-0008).
-curl -fsS -X POST http://localhost:8110/admin/rebuild   # Event Subscriber, host port 8110
-curl -fsS http://localhost:8120/register | jq 'length'  # → unchanged
-```
-
-> `bsn` / `naam_placeholder` are deferred (ADR-0008) — the notification doesn't carry them and
-> the subscriber may not read OpenZaak directly (§8.1). They surface in a later slice.
--- a/docs/frontend-decisions.md
+++ b/docs/frontend-decisions.md
@@ -1,31 +0,0 @@
-# Frontend decisions
-
-A running log of frontend tooling and component decisions (CLAUDE.md §10). One entry per
-decision; record *why*, and note any deviation from NL Design System.
-
---
-
-## Workspace & tooling (S-08a, #65)
-
-The portals live in an **Nx monorepo at the repository root**, alongside the .NET `services/`.
-
- **Package manager: pnpm.** Native build scripts are approved explicitly in `pnpm-workspace.yaml`
-  under `allowBuilds` (pnpm 11 fails the install otherwise). Node 24, pnpm 11.
- **Angular, standalone components + signals, no NgModules** (§10). Apps are generated with
-  `@nx/angular:application`.
- **Unit tests: Vitest** via Angular's built-in `@angular/build:unit-test` (the `vitest-angular`
-  runner). **Angular Testing Library** is added for component tests when the first real components
-  land (S-08c); the S-08a placeholder uses a plain `TestBed` render assertion.
- **Lint: ESLint** (flat config, `@nx/eslint`).
- **Nx is scoped to `apps/` + `libs/` only.** The `@nx/docker` and `@nx/dotnet` plugins are **not**
-  installed — the .NET services are built by `dotnet`/the Makefile, and `@nx/docker` would otherwise
-  infer every `services/*/Dockerfile` as an unnamed Nx project and break the project graph.
- **No Nx Cloud.** `nxCloudId` is stripped from `nx.json`; remote caching would depend on an
-  external service, and the repo is Gitea-only (§8.7). Nx's "configure-ai-agents" additions
-  (`.claude/settings.json`, a CLAUDE.md section referencing a GitHub marketplace) are **not**
-  committed for the same reason.
- **CI:** a `frontend` job (`make frontend` → `pnpm install --frozen-lockfile` + `nx run-many -t
-  lint test build`) runs on pnpm + Node, with pinned action URLs (§15).
-
-**NL Design System:** not yet introduced — the S-08a app is a placeholder. NL DS components arrive
-with the submit form (S-08c, #67); any deviation from NL DS will be recorded here.
--- a/docs/gitea-workflow.md
+++ b/docs/gitea-workflow.md
@@ -1,52 +0,0 @@
-# Working with Gitea: issues, milestones, PRs
-
-Gitea is the **system of record** (CLAUDE.md §7). `BACKLOG.md` is a human-readable
-mirror of the active milestone — when they disagree, Gitea wins.
-
-## Issues
-
- Open issues from the templates in `.gitea/ISSUE_TEMPLATE/`:
-  - **Slice** — a backlog user story (`S-NN · …`), encodes the Definition of Done.
-  - **Bug** — a defect.
-  - **ADR proposal** — a decision to record before coding (CLAUDE.md §14).
- Every issue gets `type:*` plus the relevant `area:*` label(s), and is assigned to
-  its iteration **milestone** (`Iteration N — …`).
- Splitting a slice that grew too big: see CLAUDE.md §13 and the "How to split a
-  slice" section of `BACKLOG.md`.
-
-## Branches & commits
-
- Trunk-based: short-lived branches off `main`, squash-merged. Never push to `main`.
- Branch name: `<type>/<issue-number>-<slug>`, e.g. `feat/28-bff-health`.
- Conventional Commits, each referencing its issue: `feat(bff): … (refs #28)`.
- TDD order: the `test(...)` red commit precedes the `feat(...)` green commit.
-
-## Pull requests
-
- Open with `tea pr create` (the Gitea CLI) or the web UI; the body uses
-  `.gitea/PULL_REQUEST_TEMPLATE.md` and its DoD checklist.
- The merging PR closes its issue via `closes #NN` in the squash-commit body.
-  Work that isn't finished (e.g. CI green pending a runner) uses `refs #NN` and the
-  issue stays open.
- A PR needs a linked issue. Don't open one without it.
-
-## CI gate
-
-Until a self-hosted `respellion-linux` runner is registered, `make ci` is the gate
-(it runs the same checks the workflow does). See [runbooks/ci.md](runbooks/ci.md).
-
-## CLI cheatsheet (`tea`)
-
-```bash
-tea issues list --state open          # backlog
-tea issue create --title "S-NN · …" --labels type:slice,area:bff --milestone "Iteration 1 — Walking Skeleton"
-tea pr create --base main --head <branch> --title "…" --description "… closes #NN"
-tea pr list                           # open PRs
-tea pr merge <n> --style squash       # merge (after review)
-```
-
-## Changelog & releases
-
-`CHANGELOG.md` is generated from commits by `git-cliff` (`make changelog`), refreshed
-on tag. Versioning is **CalVer** `YYYY.MM.PATCH`; releases are published via Gitea
-Releases.
--- a/docs/index.md
+++ b/docs/index.md
@@ -1,23 +0,0 @@
-# register-referentie
-
-A reference application demonstrating Respellion's Common Ground architecture
-pattern. Quality and architectural clarity over feature throughput — every commit
-should teach.
-
-## Where to go
-
- **[Product Requirements](PRD.md)** — what we're building and why.
- **[ADR-0001: Loose coupling](architecture/adr-0001-loose-coupling.md)** — the
-  non-negotiable integration stance; the template for future ADRs.
- **[Working in Gitea](gitea-workflow.md)** — issues, milestones, branches, PRs.
- **[CI runbook](runbooks/ci.md)** — the pipeline and the `make ci` local gate.
-
-## Quickstart
-
-See the repository `README.md`. In short: clone, then either run the checks with
-`make ci`, or bring the BFF up with
-`docker compose -f infra/docker-compose.yml up -d --build --wait` and
-`curl http://localhost:8080/health`.
-
-> This site is built with MkDocs Material (`mkdocs build`). It grows with the
-> backlog; sections appear as their slices land.
--- a/docs/runbooks/ci.md
+++ b/docs/runbooks/ci.md
@@ -1,151 +0,0 @@
-# CI runbook — Gitea Actions
-
-> **Status: active.** The workflow `.gitea/workflows/ci.yaml` runs on Gitea's
-> hosted `ubuntu-latest` runner — no self-hosted runner required.
-> **`make ci` is still the local gate** — it runs the exact same checks
-> (the workflow calls the same `make` targets).
-
-## The pipeline
-
-`.gitea/workflows/ci.yaml` runs on every push and pull request to `main`. Each job
-calls a `make` target — the **single source of truth** for the checks, so local
-and CI cannot drift:
-
-| Job | Target | Needs |
-|---|---|---|
-| `lint` | `make lint` → `dotnet format … --verify-no-changes` | .NET 10 SDK |
-| `build` | `make build` → `dotnet build … -c Release` | .NET 10 SDK |
-| `unit` | `make unit` → `dotnet test … -c Release --filter "Category!=Integration"` | .NET 10 SDK |
-| `mutation` | `make mutation` → `dotnet tool restore` → `dotnet stryker` (ACL); uploads the HTML report as an artifact | .NET 10 SDK |
-| `verify-stack` | the single live-stack stage — steps: `make verify-up` (full stack up + health, the DoD smoke) → `make verify-acl` (ACL ↔ OpenZaak) → `make verify-nrc` (OpenZaak → NRC delivery) → `make down` | container engine + egress (base images, nuget, `selectielijst.openzaak.nl`) |
-
-> **Why one `verify-stack` job, not three.** The single self-hosted runner runs jobs
-> **sequentially**, so booting OpenZaak once (instead of once per check) is the
-> cheapest layout (issue #58). It subsumes the old `integration`, `notifications`, and
-> `compose-smoke` jobs — the bring-up step *is* the "compose up reaches green health"
-> gate. No `setup-dotnet`: the ACL test runs in a built image and every check reaches
-> services by **container IP** (the runner can't reach published ports — see
-> [gitea-actions-gotchas.md §5/§6](gitea-actions-gotchas.md)).
-
-All `uses:` references are absolute, tag-pinned URLs (`https://github.com/actions/checkout@v4`,
-`https://github.com/actions/setup-dotnet@v4`) per CLAUDE.md §8.7 and §15 — Gitea
-Actions resolves them from GitHub.
-
-> **`verify-stack` runs on a containerized runner.** Workspace bind mounts do
-> **not** reach the sibling containers Compose starts, so config/assets are
-> streamed into external named volumes via `docker cp` (`infra/seed-config.sh`),
-> and the upstream images are used verbatim (no build). If you add a service that
-> needs a repo file at runtime, seed it the same way — don't bind-mount it. Note:
-> bare `docker compose up` no longer self-seeds; use `make up`. See
-> [gitea-actions-gotchas.md](gitea-actions-gotchas.md).
-
-## Mutation testing (the ratchet)
-
-The `mutation` job enforces test *strength*, not just coverage (CLAUDE.md §5).
-[Stryker.NET](https://stryker-mutator.io/docs/stryker-net/) is pinned as a local
-dotnet tool (`.config/dotnet-tools.json`), so it runs identically locally and in CI:
-
-```bash
-make mutation     # dotnet tool restore + dotnet stryker on the ACL
-```
-
-Config lives in [`services/acl/stryker-config.json`](../../services/acl/stryker-config.json).
-It runs in **solution mode** against `Acl.slnx`, mutating the two projects under test
-(`Acl.Application`, `Acl.Infrastructure`); `Acl.Api` has no tests and is skipped.
-
-**Baseline (the ratchet):** the ACL is the first service with branching logic, so it
-sets the repo-wide baseline. Observed score **95%**; enforced `break` threshold **90%**
-(one-mutant headroom over the ~20-mutant surface). Stryker exits non-zero — failing the
-job — when the score drops below `break`. Per §5 the baseline only moves **up**, and only
-as a slice's stated outcome; never lower it. New services add their own mutation run as
-they gain logic.
-
-The HTML report is written to `services/acl/StrykerOutput/<timestamp>/reports/` (git-ignored);
-open it to see survived vs. killed mutants.
-
-In CI the `mutation` job publishes that report as the **`acl-mutation-report`** artifact
-(download it from the run's summary page). The upload step uses `if: always()`, so the
-report is available even when the ratchet *fails* — which is exactly when you want to inspect
-the survivors. It is the repo's first use of `actions/upload-artifact`, pinned to **`@v3`**:
-`@v4` refuses to run on Gitea (its `@actions/artifact` v2 library blocks any non-github.com
-server as "GHES"), while `@v3` speaks the artifact protocol Gitea implements. See
-[gitea-actions-gotchas.md §4](gitea-actions-gotchas.md) (§15).
-
-## Running the stack locally without `make` (Windows / Docker Desktop)
-
-`make` and the bash helpers assume a Unix shell. To bring the whole stack up on a
-machine without them (e.g. Windows + Docker Desktop), use the **local compose
-file**, which bind-mounts the config instead of seeding volumes — so it needs no
-`make`, no seed step, and no bash:
-
-```bash
-docker compose -f infra/docker-compose.local.yml up -d --build          # any engine
-docker compose -f infra/docker-compose.local.yml up -d --build --wait    # Docker Desktop (Compose v2)
-docker compose -f infra/docker-compose.local.yml down --volumes
-```
-
-On Linux/macOS the same thing is wrapped as `make local` / `make local-down`.
-
-`infra/docker-compose.local.yml` mirrors the canonical `infra/docker-compose.yml`
-but swaps the external config volumes for bind mounts — valid locally because a
-local daemon can see the working directory (the seed/volume dance only exists for
-the containerized CI runner). Keep the two files in sync.
-
-## Running CI locally (`make ci`)
-
-`make ci` runs the exact same checks as the pipeline — handy to run before pushing:
-
-```bash
-make ci          # lint + build + unit + mutation + verify — mirrors the pipeline
-make lint        # or a single stage
-make mutation    # Stryker.NET ratchet on the ACL
-make verify      # the live-stack stage: full stack up once → ACL + NRC checks → down
-```
-
-> **`make verify`** mirrors the CI `verify-stack` job: it boots the full stack once and
-> runs both the ACL ↔ OpenZaak and OpenZaak → NRC checks against it. For fast,
-> single-concern local iteration use a lighter throwaway stack instead:
->
-> ```bash
-> make integration          # ACL ↔ OpenZaak only (no NRC)
-> make verify-notifications # OpenZaak → NRC delivery only
-> ```
-
-**Prerequisites:** .NET 10 SDK, a container engine with Compose v2, and `curl`.
-
-On a **rootless Podman** box (the default dev setup here), the `smoke` target needs
-the Podman API socket and a Compose provider:
-
-```bash
-systemctl --user enable --now podman.socket            # start the API socket
-ln -sf "$(command -v podman)" ~/.local/bin/docker      # docker -> podman shim
-# install Docker Compose v2 into ~/.local/bin as `docker-compose` (the provider)
-```
-
-The Makefile auto-points `DOCKER_HOST` at `/run/user/$(id -u)/podman/podman.sock`
-when that socket exists and `DOCKER_HOST` is unset, so `make smoke` "just works"
-locally while leaving real Docker hosts / CI runners untouched.
-
-## Runner: `ubuntu-latest`
-
-All jobs run on Gitea's hosted **`ubuntu-latest`** runner — no self-hosted runner
-setup is required. The hosted runner ships with Docker and Docker Compose v2, so
-`make smoke` (`docker compose … up --wait`) works without extra configuration.
-
-If Gitea's hosted runners are unavailable and a self-hosted fallback is needed,
-register an `act_runner` with the `ubuntu-latest` label:
-
-```bash
-VER=0.2.11
-curl -fsSL -o /usr/local/bin/act_runner \
-  "https://dl.gitea.com/act_runner/${VER}/act_runner-${VER}-linux-amd64"
-chmod +x /usr/local/bin/act_runner
-
-act_runner register --no-interactive \
-  --instance https://git.labs.respellion.tech \
-  --token <REGISTRATION_TOKEN> \
-  --name respellion-ci-1 \
-  --labels "ubuntu-latest:docker://node:20-bookworm"
-
-act_runner daemon
-```
--- a/docs/runbooks/flowable.md
+++ b/docs/runbooks/flowable.md
@@ -1,40 +0,0 @@
-# Flowable runbook
-
-Flowable (`infra/flowable/docker-compose.yml`) runs the **flowable-rest** engine on
-Postgres. The `workflows/registratie.bpmn` model is deployed via the REST API at boot by
-the `flowable-init` container. Host port **:8090**; REST API under
-`http://localhost:8090/flowable-rest/service/` (basic auth **rest-admin / test**, dev only).
-
-## The model — `registratie`
-
-A minimal "Registratie ontvangen" process: **start → external-worker task
-`OpenZaakAanmaken` → end**. The external task is where the Workflow Client / ACL will
-later create the zaak in OpenZaak (S-04/S-05); for now a started instance parks there.
-
-## Quick test (`make`)
-
-```bash
-make flowable-up      # start engine + deploy registratie.bpmn on boot
-make flowable-smoke   # start + verify a new instance waits on the external task
-make flowable-down    # stop + wipe
-```
-
-`make flowable-smoke` runs `infra/flowable/verify.py`, which:
-1. waits for the `registratie` process definition to be deployed,
-2. starts an instance and asserts it did **not** end immediately,
-3. asserts an execution is parked at activity **`OpenZaakAanmaken`**,
-4. deletes the test instance.
-
-## Notes
-
- **Deploy on boot** is idempotent: `flowable-init` skips if a deployment named
-  `registratie` already exists (so restarts on the same volume don't pile up versions).
- **Dev creds:** `rest-admin` / `test`. Override via the flowable-rest app config for
-  anything beyond local dev.
- **Image** `flowable/flowable-rest:latest` — pin a tag when stabilising.
- Start an instance by hand:
-  ```bash
-  curl -s -u rest-admin:test -H 'Content-Type: application/json' \
-    -d '{"processDefinitionKey":"registratie"}' \
-    http://localhost:8090/flowable-rest/service/runtime/process-instances
-  ```
--- a/docs/runbooks/gitea-actions-gotchas.md
+++ b/docs/runbooks/gitea-actions-gotchas.md
@@ -1,198 +0,0 @@
-# Gitea Actions gotchas
-
-How our CI (Gitea Actions on the hosted **`ubuntu-latest`** runner) differs from a
-local run, and the workarounds in this repo. Referenced by `CLAUDE.md` §8.7/§15.
-
-**One root cause sits under most of this:** the runner executes the job **inside a
-container**, so when a step runs `docker compose up`, Compose starts the stack as
-**sibling containers** on the host's daemon. Anything that assumes the job and
-those containers share a filesystem — or a `localhost` — breaks.
-
-| Gotcha | Fix | Lives in |
-|---|---|---|
-| Bind-mounted config arrives empty | `docker cp` config into external volumes | `infra/seed-config.sh` |
-| `docker compose up --wait` is unsupported / flaky | poll health with `docker inspect` | `infra/wait-healthy.sh` |
-| `pg_isready` passes before PostGIS is ready | add a `PostGIS_Version()` probe | the db healthchecks |
-| `upload-artifact@v4` fails ("not supported on GHES") | pin `@v3` | `.gitea/workflows/ci.yaml` (`mutation` job) |
-| `upload-artifact@v3` fails with "Artifact service responded with 500" | mark the upload `continue-on-error: true` (server-side; issue #62) | `.gitea/workflows/ci.yaml` (`mutation` job) |
-
---
-
-## 1. Bind mounts don't reach the containers
-
-**Symptom** — green locally, but `compose-smoke` fails with:
-
-```
-oz-init-1 | CommandError: Yaml file `/app/setup_configuration/data.yaml` does not exist.
-```
-
-Migrations run fine; only the step that reads a *mounted* file fails. The same
-trap hits `nrc-init`, `flowable-init`, and `keycloak`.
-
-**Why** — a relative bind mount like `./openzaak/setup_configuration:/app/...` is
-resolved by Compose to a path *inside the job container*
-(`/workspace/.../setup_configuration`). The daemon then looks for that path on
-*its own host*, doesn't find it, and mounts an **empty directory**. (It works on a
-runner that executes jobs on the host — which is why moving to `ubuntu-latest`
-exposed it.)
-
-**Fix** — use the upstream images verbatim (no build) and stream config into
-**external named volumes** with `docker cp`, which copies over the Docker API and
-so works wherever the daemon runs. `infra/seed-config.sh` creates each volume,
-mounts it in a throwaway helper, and copies the files in:
-
-| Asset | Volume | Mounted at |
-|---|---|---|
-| OpenZaak `data.yaml` | `rr-oz-config` | `oz-init:/app/setup_configuration` |
-| Keycloak realms | `rr-kc-realms` | `keycloak:/opt/keycloak/data/import` |
-| `registratie.bpmn` | `rr-fl-bpmn` | `flowable-init:/work` |
-
-The volumes are `external: true` with fixed names, so they resolve identically
-under docker compose and podman-compose. `make` seeds before every `up`; `make
-down` removes them. (Open Notificaties needs nothing — `nrc-init` migrates only.)
-
-**Consequence — bare `docker compose up` can't self-seed external volumes:**
-
- **CI / Linux / macOS:** `make up` or `make smoke` (seed, then start).
- **No-make / Windows:** `infra/docker-compose.local.yml` — a twin stack that
-  **bind-mounts** the config instead. Bind mounts are fine *locally* because a
-  local daemon can see your working directory, so
-  `docker compose -f infra/docker-compose.local.yml up -d` just works.
-
-**Why not the obvious alternatives**
-
- *Bake config into an image* (incl. an inline Dockerfile) — `docker compose up`
-  would then work unaided, but it's a build; we wanted the upstream images as-is.
- *Compose `configs:` with inline `content`* — Compose writes a client-side temp
-  file and bind-mounts it, hitting the exact same problem.
- *A host-executing runner* — bind mounts would work with zero seeding, but it
-  reintroduces a self-hosted runner and undoes the move to `ubuntu-latest`.
-
---
-
-## 2. Readiness: poll health, don't use `--wait`
-
-`docker compose up --wait` looks ideal but fails us three ways:
-
- **podman-compose doesn't implement it** (`unrecognized arguments: --wait`) — so
-  it would break local dev.
- A project-wide `--wait` **treats a one-shot exiting `0` as a failure** unless
-  something `depends_on` it with `service_completed_successfully`. `flowable-init`
-  deploys the BPMN and exits with no dependant, so `--wait` fails the moment it
-  does — last line `container infra-flowable-init-1 exited (0)`.
- The containerized runner **can't reach published host ports**, so an external
-  `curl localhost:8080/health` can't work either.
-
-**Fix** — `infra/wait-healthy.sh` polls each durable service (`openzaak nrc-web
-acl bff`, listed as `WAIT_SVCS` in the `Makefile`) with `docker ps` + `docker
-inspect '{{.State.Health.Status}}'` until it reports `healthy`. It uses only
-primitives both runtimes support, reads the **in-container** healthcheck (no host
-port needed), and ignores the one-shots (they only need to have run).
-`WAIT_TIMEOUT` defaults to 420 s — enough for the cold OpenZaak migrate (~90 s)
-plus app start.
-
---
-
-## 3. `pg_isready` passes before PostGIS is ready
-
-`pg_isready` succeeds as soon as the TCP port is open — *before* the
-`postgis/postgis` image has finished running `CREATE EXTENSION postgis`. An init
-container that starts migrating in that window can fail on a missing PostGIS. So
-the db healthchecks add a `SELECT PostGIS_Version()` probe, making dependents wait
-for the extension, not just the port.
-
---
-
-## 4. `actions/upload-artifact@v4` refuses to run on Gitea
-
-**Symptom** — the `mutation` job's `make mutation` step passes (95% score), but the
-upload step right after it fails the job:
-
-```
-::error::@actions/artifact v2.0.0+, upload-artifact@v4+ and download-artifact@v4+
-are not currently supported on GHES.
-❌  Failure - Main https://github.com/actions/upload-artifact@v4
-```
-
-**Why** — `upload-artifact@v4` bundles `@actions/artifact` v2, which inspects the
-server URL and **hard-aborts on anything that isn't `github.com`**, treating Gitea
-as an unsupported GitHub Enterprise Server. The check fires regardless of whether
-the Gitea server can actually store artifacts (1.24+ can). It is the *action*, not
-the server, that refuses.
-
-**Fix** — pin **`actions/upload-artifact@v3`** (and `download-artifact@v3` if ever
-needed). v3 uses the older artifact protocol that Gitea implements, and has no GHES
-guard. Inputs are the same (`name`, `path`, `if-no-files-found`), so it is a drop-in
-swap. Do **not** bump to `@v4` until act_runner advertises github.com-compatible
-artifact support.
-
-**Second failure mode — the server's artifact backend returns 500.** Even on the
-correctly-pinned `@v3`, uploads can fail with:
-
-```
-Create Artifact Container - Attempt 5 of 5 failed with error: Artifact service responded with 500
-::error::Create Artifact Container failed: Artifact service responded with 500
-```
-
-This is the **Gitea server's** artifact storage failing (not the action's GHES guard),
-so it is outside the repo's control. Because the `mutation` job's upload steps run with
-`if: always()`, that 500 would fail the job even though the ratchet passed. **Fix:** mark
-the uploads `continue-on-error: true` (issue #62). The mutation *gate* is the Stryker
-ratchet — `make mutation`'s exit code fails the job on a real regression — so the report
-upload is best-effort: when the server's artifact storage is restored, reports publish
-again with no workflow change.
-
---
-
-## 5. A runner process can't reach a service container's published port
-
-**Symptom** — green locally, but a CI step that runs *on the runner* and talks to a
-compose service over `localhost` fails. The ACL integration test's seed died with:
-
-```
-OpenZaak ready (000)
-urllib.error.URLError: <urlopen error [Errno 111] Connection refused>
-make: *** [Makefile:114: integration] Error 1
-```
-
-OpenZaak was demonstrably up — uwsgi had been serving for ~2 minutes — yet
-`curl`/`urllib` to `localhost:8000` from the runner were refused the whole time.
-
-**Why** — the same sibling-container split as §1. Compose starts the stack via the
-host daemon, so `ports: ["8000:8000"]` publishes to the *daemon host*, not to the job
-container. From the runner, `localhost:8000` has nothing listening. (`make smoke`
-sidesteps this by polling readiness via `docker inspect` (§2), never a service port.)
-
-**Fix** — don't talk to service ports from the runner. Either check state via `docker
-inspect` (health), or run the client **inside the compose network** so it reaches the
-service by name (`http://openzaak:8000`). For a test/seed that needs the repo's own
-code, deliver it via a **built image** (not a bind mount — §1), then
-`docker run --network <stack>_cg …`.
-
-**Applied** — `make integration` (ADR-0006) and `make verify-notifications` (ADR-0007)
-do exactly this: they run the seed/test/driver as containers on the stack network and
-reach services by **container IP** (see §6).
-
---
-
-## 6. OpenZaak / NRC reject single-label hosts in URLs
-
-**Symptom** — talking to OpenZaak or NRC by compose **service name** fails where a URL
-is validated: catalogus/zaaktype filters, the zaak `zaaktype` URL, and abonnement
-`callbackUrl` come back `400 "Voer een geldige URL in."` — even though the host
-resolves and is reachable.
-
-**Why** — these apps validate URLs with Django's `URLValidator`, which rejects a
-**single-label** host like `openzaak` or `nrc-web` (no dot, and not `localhost`).
-`localhost` passes (so it's invisible in host-port-based local runs); in-network the
-reality is a service name or an IPv4 literal — and only the IP passes.
-
-**Fix** — in-network tooling reaches OpenZaak/NRC by **container IP**
-(`docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}'`), not
-service name; the notif verify harness also registers the sink callback by IP.
-(`infra/run-acl-integration.sh`, `infra/run-notification-check.sh`.)
-
-**Related — abonnement callbacks must enforce auth.** NRC probes a callback when an
-abonnement is registered and refuses it (`no-auth-on-callback-url`) unless it returns
-**401** without the configured `Authorization`. The verify sink
-(`infra/notification-sink.py`) enforces a bearer token for exactly this reason.
--- a/docs/runbooks/keycloak.md
+++ b/docs/runbooks/keycloak.md
@@ -1,37 +0,0 @@
-# Keycloak runbook
-
-Keycloak (`infra/keycloak/docker-compose.yml`) runs in dev mode with four realms
-imported at boot from `infra/keycloak/realms/`: **digid**, **eherkenning**, **eidas**,
-**medewerker**. It mocks the Dutch identity brokers so portals can do real OIDC logins
-locally. Host port **:8180**.
-
-## Quick test (`make`)
-
-```bash
-make keycloak-up      # start Keycloak + import realms (~30-60s first boot)
-make keycloak-smoke   # start + verify every realm logs in and returns its claim
-make keycloak-down    # stop + wipe
-```
-
-`make keycloak-smoke` runs `infra/keycloak/check_realms.py`, which does a password-grant
-login per realm and asserts the identifying claim:
-
-| Realm | User | Claim asserted |
-|---|---|---|
-| digid | jan-burger | `bsn` |
-| eherkenning | acme-ondernemer | `kvk` |
-| eidas | pierre-dupont | `eidas_id` |
-| medewerker | merel-behandelaar | role `behandelaar` |
-
-All test users / credentials are in [../synthetic-data.md](../synthetic-data.md).
-
-## Notes
-
- **Admin console:** <http://localhost:8180/> — `admin` / `admin` (dev only).
- **Client `big-portal`** is public with `standardFlowEnabled` (browser redirect login)
-  *and* `directAccessGrantsEnabled` (password grant, used by the smoke test).
- **Dev store:** in-memory H2 via `start-dev`; realms re-import on each boot, so changes
-  made in the admin UI don't persist. Edit the realm JSONs to make durable changes.
- **Image** pinned to `quay.io/keycloak/keycloak:26.1`.
- Claims are injected by OIDC protocol mappers on `big-portal` (user attribute → token
-  claim); `medewerker` roles come through `realm_access.roles`.
--- a/docs/runbooks/opennotificaties.md
+++ b/docs/runbooks/opennotificaties.md
@@ -1,44 +0,0 @@
-# Open Notificaties (NRC) runbook
-
-The Open Notificaties stack (`infra/opennotificaties/docker-compose.yml`) is a lean
-adaptation of the upstream dev compose: PostGIS db, redis (also the Celery broker), a
-one-shot migrate-init, the API, and a celery worker. It shares the **`cg`** Docker
-network with the OpenZaak stack so the two can reach each other by service name.
-
-NRC is published on host **:8001** (OpenZaak holds :8000).
-
-## Quick test (`make`) — both platforms together
-
-```bash
-make stack-up      # OpenZaak + Open Notificaties on the shared network
-make stack-smoke   # start both + assert reachable (OZ 403/302/200, NRC 302)
-make stack-down    # stop + wipe both
-```
-
-`make stack-smoke` runs `docker compose -f infra/openzaak/... -f infra/opennotificaties/... up -d`
-and asserts:
-
-| Check | Expected |
-|---|---|
-| OpenZaak `GET /zaken/api/v1/zaken` (no JWT) | 403 (auth enforced) |
-| OpenZaak `GET /admin/` | 302 |
-| Open Notificaties `GET /admin/` | 302 |
-
-NRC admin UI: <http://localhost:8001/admin/> (dev superuser **admin / admin**).
-
-## Notification wiring is deferred to S-06
-
-Both platforms are **up and reachable**, but OpenZaak→NRC notification *delivery* is not
-wired yet, and OpenZaak still runs with `NOTIFICATIONS_DISABLED=true`. The bidirectional
-auth wiring (NRC `setup_configuration`: Services + Authorization to OpenZaak's
-Autorisaties API + JWT secrets + Kanalen + Abonnementen; OpenZaak's NotificationConfig)
-lands with **S-06 (Event Subscriber)** — the slice that actually consumes events. NRC's
-`setup_configuration/data.yaml` is intentionally minimal (migrations only) until then.
-
-This matches S-01's acceptance, which asks only that the platforms *come up in compose*
-and a health check confirms them reachable.
-
-## Prerequisites
-
-Same rootless-Podman setup as the rest of the repo — see [ci.md](ci.md) and
-[openzaak.md](openzaak.md). `systemctl --user start podman.socket` once per session.
--- a/docs/runbooks/openzaak.md
+++ b/docs/runbooks/openzaak.md
@@ -1,82 +0,0 @@
-# OpenZaak runbook
-
-The OpenZaak stack (`infra/openzaak/docker-compose.yml`) is a lean adaptation of the
-upstream open-zaak dev compose: PostGIS db, redis, a one-shot init that runs
-migrations, the OpenZaak API, and a celery worker.
-
-## Quick test (`make`)
-
-```bash
-make openzaak-up       # start the stack (first run pulls images + migrates: 1-3 min)
-make openzaak-smoke    # start + assert it's up with auth enforced (403/302/200)
-make openzaak-seed     # start + seed the BIG catalogus (idempotent)
-make openzaak-down     # stop and wipe data
-```
-
-## Seed the BIG catalogus
-
-`make openzaak-seed` brings the stack up and runs `infra/openzaak/seed_catalogus.py`,
-which creates (idempotently, via the ZTC API):
-
- catalogus **BIG**
- a lean **BIG-REGISTRATIE** zaaktype (concept; only schema-mandatory fields)
- a **bsn** eigenschap on it
-
-then confirms the JWT client can list it. See **ADR-0002** for the design (why the
-zaaktype stays a concept, why notifications are disabled, why the API not a fixture).
-
-**JWT client** (provisioned declaratively by `setup_configuration/data.yaml`, **dev only**):
-
-| | |
-|---|---|
-| client_id | `big-reference-seed` |
-| secret | `insecure-dev-secret-change-me` |
-| authorizations | `heeft_alle_autorisaties` (all) |
-
-The seed mints a ZGW JWT (HS256) from these and calls `/catalogi/api/v1/...`.
-
-`make openzaak-smoke` polls until the API responds, then asserts:
-
-| Check | Expected |
-|---|---|
-| `GET /zaken/api/v1/zaken` (no JWT) | **403** — `PermissionDenied` ZGW fout (auth enforced) |
-| `GET /admin/` | **302** — admin login redirect |
-| `GET /zaken/api/v1/` | **200** — ZGW API schema root |
-
-> **403, not 401.** OpenZaak's ZGW APIs return `403 PermissionDenied` for a missing
-> or invalid JWT. The S-01 acceptance text says "401" — that's inaccurate; 403 is the
-> correct auth-enforced response.
-
-The admin UI is at <http://localhost:8000/admin/>; the dev superuser is **admin /
-admin** (from the compose env — dev only).
-
-## Prerequisites (rootless Podman)
-
-Same setup as the rest of the repo (see [ci.md](ci.md)):
-
-```bash
-systemctl --user start podman.socket    # the Docker-API socket the shim talks to
-```
-
-The Makefile auto-points `DOCKER_HOST` at the Podman socket when it exists, so the
-`make openzaak-*` targets work without extra env.
-
-## Notes
-
- **Not in `make ci`.** The OpenZaak smoke is a separate, heavier check (large image
-  pull + migrations); it is intentionally kept out of `make ci` so the core gate
-  stays fast. Run `make openzaak-smoke` when you touch the OpenZaak stack.
- **Notifications disabled.** `NOTIFICATIONS_DISABLED=true` — otherwise ZTC writes 500
-  trying to notify. Open Notificaties is now up (see [opennotificaties.md](opennotificaties.md)),
-  but OZ→NRC delivery wiring + re-enabling lands with **S-06**.
- **Zaaktype is a concept**, not published (publishing needs roltypen/statustypen/
-  resultaattypen — beyond the lean seed). List with `?status=alles`.
- **Image tag.** Pinned to `openzaak/open-zaak:1.28.2` via `${OPENZAAK_TAG}` (bump
-  deliberately, not via `:latest`).
- **Config arrives via a volume, not a bind mount.** `setup_configuration/data.yaml`
-  is streamed into the external `rr-oz-config` volume by `infra/seed-config.sh`
-  (`docker cp`) and mounted at `/app/setup_configuration`, so the init container
-  finds it on Gitea's containerized CI runner too (bind mounts don't reach sibling
-  containers there). The image is the upstream `openzaak/open-zaak` verbatim — no
-  build. Run via `make openzaak-up` (seeds first). See
-  [gitea-actions-gotchas.md](gitea-actions-gotchas.md).
--- a/docs/synthetic-data.md
+++ b/docs/synthetic-data.md
@@ -1,35 +0,0 @@
-# Synthetic data
-
-All credentials here are **dev-only** synthetic test data — never real personal data,
-never used outside local development.
-
-## Keycloak realms (S-02)
-
-Keycloak runs at <http://localhost:8180> (admin console: **admin / admin**). Four realms
-are imported at boot from `infra/keycloak/realms/`. Each has a public OIDC client
-**`big-portal`** (standard flow + direct access grants enabled, redirect URIs `*` for dev).
-
-All test users share the password **`test123`**.
-
-| Realm | Mimics | User | Identifying claim |
-|---|---|---|---|
-| `digid` | DigiD (burgers) | `jan-burger` | `bsn` = `123456782` |
-| `eherkenning` | eHerkenning (bedrijven) | `acme-ondernemer` | `kvk` = `12345678` |
-| `eidas` | eIDAS (EU) | `pierre-dupont` | `eidas_id` = `FR/NL/AB-1234-5678` |
-| `medewerker` | Internal staff | `merel-behandelaar` | role `behandelaar` |
-| `medewerker` | Internal staff | `tom-teamlead` | roles `behandelaar`, `teamlead` |
-
-The identifying claims are injected via OIDC protocol mappers on `big-portal`
-(user-attribute → token claim); `medewerker` roles appear in `realm_access.roles`.
-
-## Get a token (for testing)
-
-```bash
-curl -s -X POST \
-  http://localhost:8180/realms/digid/protocol/openid-connect/token \
-  -d grant_type=password -d client_id=big-portal \
-  -d username=jan-burger -d password=test123 -d scope=openid | jq -r .access_token
-```
-
-Decode the JWT payload to see the `bsn` claim. `make keycloak-smoke` checks every realm
-automatically.
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -1,58 +0,0 @@
-import nx from '@nx/eslint-plugin';
-
-export default [
-  ...nx.configs['flat/base'],
-  ...nx.configs['flat/typescript'],
-  ...nx.configs['flat/javascript'],
-  {
-    ignores: [
-      '**/dist',
-      '**/vite.config.*.timestamp*',
-      '**/vitest.config.*.timestamp*',
-    ],
-  },
-  {
-    files: ['**/*.ts', '**/*.tsx', '**/*.js', '**/*.jsx'],
-    rules: {
-      '@nx/enforce-module-boundaries': [
-        'error',
-        {
-          enforceBuildableLibDependency: true,
-          allow: ['^.*/eslint(\\.base)?\\.config\\.[cm]?[jt]s$'],
-          depConstraints: [
-            {
-              sourceTag: 'scope:shared',
-              onlyDependOnLibsWithTags: ['scope:shared'],
-            },
-            {
-              sourceTag: 'scope:shop',
-              onlyDependOnLibsWithTags: ['scope:shop', 'scope:shared'],
-            },
-            {
-              sourceTag: 'scope:api',
-              onlyDependOnLibsWithTags: ['scope:api', 'scope:shared'],
-            },
-            {
-              sourceTag: 'type:data',
-              onlyDependOnLibsWithTags: ['type:data'],
-            },
-          ],
-        },
-      ],
-    },
-  },
-  {
-    files: [
-      '**/*.ts',
-      '**/*.tsx',
-      '**/*.cts',
-      '**/*.mts',
-      '**/*.js',
-      '**/*.jsx',
-      '**/*.cjs',
-      '**/*.mjs',
-    ],
-    // Override or add rules here
-    rules: {},
-  },
-];
--- a/infra/docker-compose.local.yml
+++ b/infra/docker-compose.local.yml
@@ -1,372 +0,0 @@
-# LOCAL development stack — runs with a plain `docker compose up`, no make / no
-# seed step / no bash. Use this on a local engine (Docker Desktop on Windows or
-# macOS, or rootless Podman on Linux).
-#
-#   docker compose -f infra/docker-compose.local.yml up -d --build         # podman
-#   docker compose -f infra/docker-compose.local.yml up -d --build --wait  # Docker Desktop
-#   docker compose -f infra/docker-compose.local.yml down --volumes
-#
-# It is identical to infra/docker-compose.yml EXCEPT that the three config inputs
-# (OpenZaak data.yaml, Keycloak realms, Flowable BPMN) are **bind-mounted** from
-# the repo instead of being streamed into external volumes by infra/seed-config.sh.
-# Bind mounts work here because a local daemon can see your working directory —
-# the seed dance only exists for the containerized CI runner, where it can't. See
-# docs/runbooks/gitea-actions-gotchas.md.
-#
-# `infra/docker-compose.yml` remains the CI-canonical stack; keep the two in sync.
-#
-# Port map (host):
-#   8000 OpenZaak · 8001 Open Notificaties · 8080 BFF · 8090 Flowable REST
-#   8100 ACL · 8180 Keycloak   (all admin: admin / admin — dev only)
-
-services:
-
-  # ── OpenZaak (S-01) ──────────────────────────────────────────────────────
-  oz-db:
-    image: docker.io/postgis/postgis:17-3.5
-    environment:
-      POSTGRES_USER: openzaak
-      POSTGRES_PASSWORD: openzaak
-      POSTGRES_DB: openzaak
-    command: postgres -c max_connections=300
-    volumes:
-      - oz-db:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U openzaak -d openzaak && psql -U openzaak -d openzaak -c 'SELECT PostGIS_Version();' -q 2>/dev/null"]
-      interval: 5s
-      timeout: 5s
-      retries: 30
-      start_period: 15s
-    networks: [cg]
-
-  oz-redis:
-    image: docker.io/library/redis:7
-    networks: [cg]
-
-  oz-init:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
-    environment: &oz-env
-      DJANGO_SETTINGS_MODULE: openzaak.conf.docker
-      SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production}
-      DB_HOST: oz-db
-      DB_NAME: openzaak
-      DB_USER: openzaak
-      DB_PASSWORD: openzaak
-      IS_HTTPS: "no"
-      ALLOWED_HOSTS: "*"
-      CACHE_DEFAULT: oz-redis:6379/0
-      CACHE_AXES: oz-redis:6379/0
-      CELERY_BROKER_URL: redis://oz-redis:6379/1
-      CELERY_RESULT_BACKEND: redis://oz-redis:6379/1
-      DISABLE_2FA: "true"
-      # Publish notifications to NRC (always present in this twin). See ADR-0007.
-      NOTIFICATIONS_DISABLED: "false"
-      OPENZAAK_SUPERUSER_USERNAME: admin
-      DJANGO_SUPERUSER_PASSWORD: admin
-      OPENZAAK_SUPERUSER_EMAIL: admin@localhost
-      RUN_SETUP_CONFIG: "true"
-    command: /setup_configuration.sh
-    # Bind mount (`:z` relabels for SELinux on Linux; a no-op on Docker Desktop).
-    volumes:
-      - ./openzaak/setup_configuration:/app/setup_configuration:ro,z
-    depends_on:
-      oz-db:
-        condition: service_healthy
-      oz-redis:
-        condition: service_started
-    networks: [cg]
-
-  openzaak:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
-    environment: *oz-env
-    healthcheck:
-      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
-      start_period: 30s
-    ports:
-      - "8000:8000"
-    depends_on:
-      oz-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  oz-celery:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
-    environment: *oz-env
-    command: /celery_worker.sh
-    depends_on:
-      oz-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  # ── Open Notificaties / NRC (S-01-c) ─────────────────────────────────────
-  nrc-db:
-    image: docker.io/postgis/postgis:17-3.5
-    environment:
-      POSTGRES_USER: opennotificaties
-      POSTGRES_PASSWORD: opennotificaties
-      POSTGRES_DB: opennotificaties
-    command: postgres -c max_connections=300
-    volumes:
-      - nrc-db:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U opennotificaties -d opennotificaties"]
-      interval: 5s
-      timeout: 3s
-      retries: 10
-    networks: [cg]
-
-  nrc-redis:
-    image: docker.io/library/redis:7
-    networks: [cg]
-
-  nrc-init:
-    # Migrations + setup_configuration (S-01-c): the JWT credential, Autorisaties-API
-    # delegation, and the `zaken` kanaal that let OpenZaak publish. Config is
-    # bind-mounted here (this twin is the local/no-make path). See ADR-0007.
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
-    environment: &nrc-env
-      DJANGO_SETTINGS_MODULE: nrc.conf.docker
-      SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production}
-      DB_HOST: nrc-db
-      DB_NAME: opennotificaties
-      DB_USER: opennotificaties
-      DB_PASSWORD: opennotificaties
-      IS_HTTPS: "no"
-      ALLOWED_HOSTS: "*"
-      CACHE_DEFAULT: nrc-redis:6379/0
-      CACHE_AXES: nrc-redis:6379/0
-      CELERY_BROKER_URL: redis://nrc-redis:6379/1
-      CELERY_RESULT_BACKEND: redis://nrc-redis:6379/1
-      DISABLE_2FA: "true"
-      OPENNOTIFICATIES_SUPERUSER_USERNAME: admin
-      DJANGO_SUPERUSER_PASSWORD: admin
-      OPENNOTIFICATIES_SUPERUSER_EMAIL: admin@localhost
-      RUN_SETUP_CONFIG: "true"
-      NOTIFICATION_SEC_INTERVAL: "5"
-    command: /setup_configuration.sh
-    volumes:
-      - ./opennotificaties/setup_configuration:/app/setup_configuration:ro,z
-    depends_on:
-      nrc-db:
-        condition: service_healthy
-      nrc-redis:
-        condition: service_started
-      openzaak:
-        condition: service_healthy
-    networks: [cg]
-
-  nrc-web:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
-    environment: *nrc-env
-    healthcheck:
-      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
-      start_period: 30s
-    ports:
-      - "8001:8000"
-    depends_on:
-      nrc-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  nrc-celery:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
-    environment: *nrc-env
-    command: /celery_worker.sh
-    depends_on:
-      nrc-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  # Celery beat drains scheduled notifications to subscribers — required for
-  # delivery, not optional. See ADR-0007.
-  nrc-beat:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
-    environment: *nrc-env
-    command: /celery_beat.sh
-    depends_on:
-      nrc-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  # ── Keycloak (S-02) ──────────────────────────────────────────────────────
-  keycloak:
-    image: quay.io/keycloak/keycloak:26.1
-    command: ["start-dev", "--import-realm"]
-    environment:
-      KC_BOOTSTRAP_ADMIN_USERNAME: admin
-      KC_BOOTSTRAP_ADMIN_PASSWORD: admin
-      KEYCLOAK_ADMIN: admin
-      KEYCLOAK_ADMIN_PASSWORD: admin
-      KC_HEALTH_ENABLED: "true"
-      KC_HTTP_ENABLED: "true"
-    ports:
-      - "8180:8080"
-    volumes:
-      - ./keycloak/realms:/opt/keycloak/data/import:ro,z
-    networks: [cg]
-
-  # ── Flowable (S-03) ──────────────────────────────────────────────────────
-  flowable-db:
-    image: docker.io/library/postgres:16
-    environment:
-      POSTGRES_USER: flowable
-      POSTGRES_PASSWORD: flowable
-      POSTGRES_DB: flowable
-    volumes:
-      - flowable-db:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U flowable -d flowable"]
-      interval: 5s
-      timeout: 3s
-      retries: 10
-    networks: [cg]
-
-  flowable-rest:
-    image: docker.io/flowable/flowable-rest:latest
-    environment:
-      SPRING_DATASOURCE_DRIVER-CLASS-NAME: org.postgresql.Driver
-      SPRING_DATASOURCE_URL: jdbc:postgresql://flowable-db:5432/flowable
-      SPRING_DATASOURCE_USERNAME: flowable
-      SPRING_DATASOURCE_PASSWORD: flowable
-    ports:
-      - "8090:8080"
-    depends_on:
-      flowable-db:
-        condition: service_healthy
-    networks: [cg]
-
-  flowable-init:
-    image: docker.io/curlimages/curl:latest
-    restart: "no"
-    volumes:
-      - ../workflows/registratie.bpmn:/work/registratie.bpmn:ro,z
-    command:
-      - sh
-      - -c
-      - |
-        base=http://flowable-rest:8080/flowable-rest/service/repository/deployments
-        until curl -sf -u rest-admin:test "$$base" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
-        if curl -s -u rest-admin:test "$$base?name=registratie" | grep -q '"name":"registratie"'; then
-          echo "registratie already deployed; skip"
-        else
-          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$base" >/dev/null && echo "deployed registratie"
-        fi
-    depends_on:
-      flowable-rest:
-        condition: service_started
-    networks: [cg]
-
-  # ── ACL ──────────────────────────────────────────────────────────────────
-  acl:
-    build:
-      context: ../services/acl
-      dockerfile: Dockerfile
-    image: register-referentie/acl:dev
-    environment:
-      Acl__OpenZaak__BaseUrl: http://openzaak:8000/
-      Acl__OpenZaak__ClientId: big-reference-seed
-      Acl__OpenZaak__Secret: insecure-dev-secret-change-me
-      Acl__Defaults__Bronorganisatie: "517439943"
-      Acl__Defaults__VerantwoordelijkeOrganisatie: "517439943"
-      Acl__Defaults__Vertrouwelijkheidaanduiding: openbaar
-      Acl__Defaults__ZaaktypeUrl: ${ACL_ZAAKTYPE_URL:-http://openzaak:8000/catalogi/api/v1/zaaktypen/00000000-0000-0000-0000-000000000000}
-    ports:
-      - "8100:8080"
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s
-    depends_on:
-      openzaak:
-        condition: service_healthy
-    networks: [cg]
-
-  # ── BFF ──────────────────────────────────────────────────────────────────
-  bff:
-    build:
-      context: ../services/bff
-      dockerfile: Dockerfile
-    image: register-referentie/bff:dev
-    ports:
-      - "8080:8080"
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s
-    networks: [cg]
-
-  # ── Read projection (S-06) ────────────────────────────────────────────────
-  projection-db:
-    image: docker.io/library/postgres:16
-    environment:
-      POSTGRES_USER: projection
-      POSTGRES_PASSWORD: projection
-      POSTGRES_DB: projection
-    volumes:
-      - projection-db:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U projection -d projection"]
-      interval: 5s
-      timeout: 3s
-      retries: 10
-    networks: [cg]
-
-  event-subscriber:
-    build:
-      context: ..
-      dockerfile: services/event-subscriber/Dockerfile
-    image: register-referentie/event-subscriber:dev
-    environment:
-      ConnectionStrings__Projection: Host=projection-db;Database=projection;Username=projection;Password=projection
-      EventSubscriber__Webhook__AuthToken: ${NOTIFICATION_WEBHOOK_TOKEN:-Bearer big-reference-notifications}
-    ports:
-      - "8110:8080"
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 15s
-    depends_on:
-      projection-db:
-        condition: service_healthy
-    networks: [cg]
-
-  projection-api:
-    build:
-      context: ..
-      dockerfile: services/projection-api/Dockerfile
-    image: register-referentie/projection-api:dev
-    environment:
-      ConnectionStrings__Projection: Host=projection-db;Database=projection;Username=projection;Password=projection
-    ports:
-      - "8120:8080"
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 15s
-    depends_on:
-      projection-db:
-        condition: service_healthy
-    networks: [cg]
-
-volumes:
-  oz-db:
-  nrc-db:
-  flowable-db:
-  projection-db:
-
-networks:
-  cg:
--- a/infra/docker-compose.yml
+++ b/infra/docker-compose.yml
@@ -1,458 +0,0 @@
-# Development stack — boots all infra services plus the ACL and BFF.
-#
-# Consolidates infra/openzaak/, infra/opennotificaties/, infra/keycloak/,
-# and infra/flowable/ and adds the ACL and BFF services.
-#
-# Port map (host):
-#   8000  OpenZaak ZGW API  (admin: admin / admin)
-#   8001  Open Notificaties (admin: admin / admin)
-#   8080  BFF               GET /health → Healthy
-#   8090  Flowable REST     http://localhost:8090/flowable-rest/service/
-#   8100  ACL               GET /health → Healthy  POST /zaken
-#   8110  Event Subscriber  GET /health → Healthy  POST /notifications
-#   8120  projection-api    GET /health → Healthy  GET /register
-#   8180  Keycloak          (admin: admin / admin)
-#
-#   docker compose -f infra/docker-compose.yml up -d --build --wait
-#
-# After first boot, seed the BIG catalogus and note the zaaktype URL:
-#   python infra/openzaak/seed_catalogus.py
-# Then set ACL_ZAAKTYPE_URL in a .env file or your shell and re-up the acl
-# service:
-#   export ACL_ZAAKTYPE_URL=http://openzaak:8000/catalogi/api/v1/zaaktypen/<uuid>
-#   docker compose -f infra/docker-compose.yml up -d acl
-
-services:
-
-  # ── OpenZaak (S-01) ──────────────────────────────────────────────────────
-  oz-db:
-    image: docker.io/postgis/postgis:17-3.5
-    environment:
-      POSTGRES_USER: openzaak
-      POSTGRES_PASSWORD: openzaak
-      POSTGRES_DB: openzaak
-    command: postgres -c max_connections=300
-    volumes:
-      - oz-db:/var/lib/postgresql/data
-    healthcheck:
-      # pg_isready only checks TCP; the second clause verifies PostGIS is installed
-      # so oz-init migrations can safely start (avoids race on cold container start).
-      test: ["CMD-SHELL", "pg_isready -U openzaak -d openzaak && psql -U openzaak -d openzaak -c 'SELECT PostGIS_Version();' -q 2>/dev/null"]
-      interval: 5s
-      timeout: 5s
-      retries: 30
-      start_period: 15s
-    networks: [cg]
-
-  oz-redis:
-    image: docker.io/library/redis:7
-    networks: [cg]
-
-  oz-init:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
-    environment: &oz-env
-      DJANGO_SETTINGS_MODULE: openzaak.conf.docker
-      SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production}
-      DB_HOST: oz-db
-      DB_NAME: openzaak
-      DB_USER: openzaak
-      DB_PASSWORD: openzaak
-      IS_HTTPS: "no"
-      ALLOWED_HOSTS: "*"
-      CACHE_DEFAULT: oz-redis:6379/0
-      CACHE_AXES: oz-redis:6379/0
-      CELERY_BROKER_URL: redis://oz-redis:6379/1
-      CELERY_RESULT_BACKEND: redis://oz-redis:6379/1
-      DISABLE_2FA: "true"
-      # Publish notifications to NRC (always present in this full stack). The NRC
-      # service + notifications_config are provisioned by setup_configuration
-      # (infra/openzaak/setup_configuration/data.yaml). See ADR-0007 / S-01-c.
-      NOTIFICATIONS_DISABLED: "false"
-      OPENZAAK_SUPERUSER_USERNAME: admin
-      DJANGO_SUPERUSER_PASSWORD: admin
-      OPENZAAK_SUPERUSER_EMAIL: admin@localhost
-      RUN_SETUP_CONFIG: "true"
-    command: /setup_configuration.sh
-    # data.yaml is streamed into this external volume by infra/seed-config.sh
-    # before start (bind mounts don't reach sibling containers on the CI runner).
-    volumes:
-      - oz-config:/app/setup_configuration:ro
-    depends_on:
-      oz-db:
-        condition: service_healthy
-      oz-redis:
-        condition: service_started
-    networks: [cg]
-
-  openzaak:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
-    environment: *oz-env
-    healthcheck:
-      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
-      start_period: 30s
-    ports:
-      - "8000:8000"
-    depends_on:
-      oz-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  oz-celery:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
-    environment: *oz-env
-    command: /celery_worker.sh
-    depends_on:
-      oz-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  # ── Open Notificaties / NRC (S-01-c) ─────────────────────────────────────
-  nrc-db:
-    image: docker.io/postgis/postgis:17-3.5
-    environment:
-      POSTGRES_USER: opennotificaties
-      POSTGRES_PASSWORD: opennotificaties
-      POSTGRES_DB: opennotificaties
-    command: postgres -c max_connections=300
-    volumes:
-      - nrc-db:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U opennotificaties -d opennotificaties"]
-      interval: 5s
-      timeout: 3s
-      retries: 10
-    networks: [cg]
-
-  nrc-redis:
-    image: docker.io/library/redis:7
-    networks: [cg]
-
-  nrc-init:
-    # Plain base image — nrc-init runs migrations only (see command below), so it
-    # needs no baked config.
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
-    environment: &nrc-env
-      DJANGO_SETTINGS_MODULE: nrc.conf.docker
-      SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production}
-      DB_HOST: nrc-db
-      DB_NAME: opennotificaties
-      DB_USER: opennotificaties
-      DB_PASSWORD: opennotificaties
-      IS_HTTPS: "no"
-      ALLOWED_HOSTS: "*"
-      CACHE_DEFAULT: nrc-redis:6379/0
-      CACHE_AXES: nrc-redis:6379/0
-      CELERY_BROKER_URL: redis://nrc-redis:6379/1
-      CELERY_RESULT_BACKEND: redis://nrc-redis:6379/1
-      DISABLE_2FA: "true"
-      OPENNOTIFICATIES_SUPERUSER_USERNAME: admin
-      DJANGO_SUPERUSER_PASSWORD: admin
-      OPENNOTIFICATIES_SUPERUSER_EMAIL: admin@localhost
-      RUN_SETUP_CONFIG: "true"
-      # nrc-beat fires `execute_notifications` this often to drain scheduled
-      # notifications to subscribers (upstream default 20s). See ADR-0007.
-      NOTIFICATION_SEC_INTERVAL: "5"
-    # Runs migrations + setup_configuration (S-01-c): the JWT credential, the
-    # Autorisaties-API delegation, and the `zaken` kanaal that let OpenZaak publish.
-    # data.yaml is streamed into rr-nrc-config by infra/seed-config.sh (bind mounts
-    # don't reach sibling containers on the CI runner). See data.yaml + ADR-0007.
-    command: /setup_configuration.sh
-    volumes:
-      - nrc-config:/app/setup_configuration:ro
-    depends_on:
-      nrc-db:
-        condition: service_healthy
-      nrc-redis:
-        condition: service_started
-      openzaak:
-        condition: service_healthy
-    networks: [cg]
-
-  nrc-web:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
-    environment: *nrc-env
-    healthcheck:
-      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
-      start_period: 30s
-    ports:
-      - "8001:8000"
-    depends_on:
-      nrc-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  nrc-celery:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
-    environment: *nrc-env
-    command: /celery_worker.sh
-    depends_on:
-      nrc-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  # Celery beat drains the ScheduledNotification rows the API creates on publish
-  # and hands them to the worker. Without it, notifications are accepted but never
-  # delivered to subscribers — required, not optional. See ADR-0007.
-  nrc-beat:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
-    environment: *nrc-env
-    command: /celery_beat.sh
-    depends_on:
-      nrc-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  # ── Keycloak (S-02) ──────────────────────────────────────────────────────
-  keycloak:
-    image: quay.io/keycloak/keycloak:26.1
-    command: ["start-dev", "--import-realm"]
-    environment:
-      KC_BOOTSTRAP_ADMIN_USERNAME: admin
-      KC_BOOTSTRAP_ADMIN_PASSWORD: admin
-      KEYCLOAK_ADMIN: admin
-      KEYCLOAK_ADMIN_PASSWORD: admin
-      KC_HEALTH_ENABLED: "true"
-      KC_HTTP_ENABLED: "true"
-    ports:
-      - "8180:8080"
-    # realm exports are streamed into this external volume by infra/seed-config.sh.
-    volumes:
-      - kc-realms:/opt/keycloak/data/import:ro
-    networks: [cg]
-
-  # ── Flowable (S-03) ──────────────────────────────────────────────────────
-  flowable-db:
-    image: docker.io/library/postgres:16
-    environment:
-      POSTGRES_USER: flowable
-      POSTGRES_PASSWORD: flowable
-      POSTGRES_DB: flowable
-    volumes:
-      - flowable-db:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U flowable -d flowable"]
-      interval: 5s
-      timeout: 3s
-      retries: 10
-    networks: [cg]
-
-  flowable-rest:
-    image: docker.io/flowable/flowable-rest:latest
-    environment:
-      SPRING_DATASOURCE_DRIVER-CLASS-NAME: org.postgresql.Driver
-      SPRING_DATASOURCE_URL: jdbc:postgresql://flowable-db:5432/flowable
-      SPRING_DATASOURCE_USERNAME: flowable
-      SPRING_DATASOURCE_PASSWORD: flowable
-    ports:
-      - "8090:8080"
-    depends_on:
-      flowable-db:
-        condition: service_healthy
-    networks: [cg]
-
-  flowable-init:
-    image: docker.io/curlimages/curl:latest
-    restart: "no"
-    # registratie.bpmn is streamed into this external volume by infra/seed-config.sh.
-    volumes:
-      - fl-bpmn:/work:ro
-    command:
-      - sh
-      - -c
-      - |
-        base=http://flowable-rest:8080/flowable-rest/service/repository/deployments
-        until curl -sf -u rest-admin:test "$$base" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
-        if curl -s -u rest-admin:test "$$base?name=registratie" | grep -q '"name":"registratie"'; then
-          echo "registratie already deployed; skip"
-        else
-          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$base" >/dev/null && echo "deployed registratie"
-        fi
-    depends_on:
-      flowable-rest:
-        condition: service_started
-    networks: [cg]
-
-  # ── ACL ──────────────────────────────────────────────────────────────────
-  acl:
-    build:
-      context: ../services/acl
-      dockerfile: Dockerfile
-    image: register-referentie/acl:dev
-    environment:
-      # Overridable so verify-domain can point the ACL at the same OpenZaak host that
-      # owns the seeded zaaktype URL (host-consistent zaak creation, ADR-0009).
-      Acl__OpenZaak__BaseUrl: ${ACL_OPENZAAK_BASEURL:-http://openzaak:8000/}
-      Acl__OpenZaak__ClientId: big-reference-seed
-      Acl__OpenZaak__Secret: insecure-dev-secret-change-me
-      Acl__Defaults__Bronorganisatie: "517439943"
-      Acl__Defaults__VerantwoordelijkeOrganisatie: "517439943"
-      Acl__Defaults__Vertrouwelijkheidaanduiding: openbaar
-      # Override with the real zaaktype URL after running seed_catalogus.py.
-      Acl__Defaults__ZaaktypeUrl: ${ACL_ZAAKTYPE_URL:-http://openzaak:8000/catalogi/api/v1/zaaktypen/00000000-0000-0000-0000-000000000000}
-    ports:
-      - "8100:8080"
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s
-    depends_on:
-      openzaak:
-        condition: service_healthy
-    networks: [cg]
-
-  # ── BIG Domain Service (S-05) ──────────────────────────────────────────────
-  # Orchestrates a registration: POST /registrations creates the aggregate and
-  # starts the registratie Flowable process; a hosted worker acquires the
-  # OpenZaakAanmaken job, opens a zaak via the ACL and completes it (ADR-0009).
-  # Talks only to Flowable (Workflow Client, §8.2) and the ACL (§8.1).
-  domain:
-    build:
-      context: ../services/domain
-      dockerfile: Dockerfile
-    image: register-referentie/domain:dev
-    environment:
-      Flowable__BaseUrl: http://flowable-rest:8080/flowable-rest/
-      Flowable__Username: rest-admin
-      Flowable__Password: test
-      Acl__BaseUrl: http://acl:8080/
-    ports:
-      - "8130:8080"
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s
-    depends_on:
-      acl:
-        condition: service_healthy
-      flowable-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  # ── BFF ──────────────────────────────────────────────────────────────────
-  bff:
-    build:
-      context: ../services/bff
-      dockerfile: Dockerfile
-    image: register-referentie/bff:dev
-    environment:
-      # The BFF is the portals' only backend; it validates digid tokens and fans out (ADR-0010).
-      # Keycloak (start-dev) derives the issuer from the request host, so the BFF authority and the
-      # verify token request both use keycloak:8080 to keep the issuer consistent.
-      Keycloak__Authority: http://keycloak:8080/realms/digid
-      Downstream__Domain__BaseUrl: http://domain:8080/
-      Downstream__Projection__BaseUrl: http://projection-api:8080/
-    ports:
-      - "8080:8080"
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s
-    depends_on:
-      domain:
-        condition: service_healthy
-      projection-api:
-        condition: service_healthy
-      keycloak:
-        condition: service_started
-    networks: [cg]
-
-  # ── Read projection (S-06) ────────────────────────────────────────────────
-  # One Postgres DB backing the rebuildable read projection (PRD §8.4): the Event
-  # Subscriber writes it, projection-api reads it. See ADR-0008.
-  projection-db:
-    image: docker.io/library/postgres:16
-    environment:
-      POSTGRES_USER: projection
-      POSTGRES_PASSWORD: projection
-      POSTGRES_DB: projection
-    volumes:
-      - projection-db:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U projection -d projection"]
-      interval: 5s
-      timeout: 3s
-      retries: 10
-    networks: [cg]
-
-  # Consumes NRC notifications (abonnement callback) and projects zaak-created events
-  # into register_projection. Build context is the repo root: it shares the read model
-  # in services/projection-api/Projection.ReadModel.
-  event-subscriber:
-    build:
-      context: ..
-      dockerfile: services/event-subscriber/Dockerfile
-    image: register-referentie/event-subscriber:dev
-    environment:
-      ConnectionStrings__Projection: Host=projection-db;Database=projection;Username=projection;Password=projection
-      # The bearer Open Notificaties must present on the abonnement callback. NRC's
-      # registration probe expects a 401 without it (ADR-0007). Dev-only token.
-      EventSubscriber__Webhook__AuthToken: ${NOTIFICATION_WEBHOOK_TOKEN:-Bearer big-reference-notifications}
-    ports:
-      - "8110:8080"
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 15s
-    depends_on:
-      projection-db:
-        condition: service_healthy
-    networks: [cg]
-
-  # The read side of the projection. Shares Projection.ReadModel, so build context is root.
-  projection-api:
-    build:
-      context: ..
-      dockerfile: services/projection-api/Dockerfile
-    image: register-referentie/projection-api:dev
-    environment:
-      ConnectionStrings__Projection: Host=projection-db;Database=projection;Username=projection;Password=projection
-    ports:
-      - "8120:8080"
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 15s
-    depends_on:
-      projection-db:
-        condition: service_healthy
-    networks: [cg]
-
-volumes:
-  oz-db:
-  nrc-db:
-  flowable-db:
-  projection-db:
-  # Config volumes — created and populated out-of-band by infra/seed-config.sh
-  # (docker cp), because bind mounts don't reach sibling containers on the CI
-  # runner. `external` keeps the names deterministic; the seed step manages them.
-  oz-config:
-    external: true
-    name: rr-oz-config
-  nrc-config:
-    external: true
-    name: rr-nrc-config
-  kc-realms:
-    external: true
-    name: rr-kc-realms
-  fl-bpmn:
-    external: true
-    name: rr-fl-bpmn
-
-networks:
-  cg:
--- a/infra/flowable/docker-compose.yml
+++ b/infra/flowable/docker-compose.yml
@@ -1,70 +0,0 @@
-# Flowable (S-03): the flowable-rest engine on Postgres.
-# The registratie.bpmn model is deployed via the REST API on startup by flowable-init.
-#
-#   docker compose -f infra/flowable/docker-compose.yml up -d
-#   # REST API (basic auth) under http://localhost:8090/flowable-rest/service/
-#
-# Host port 8090 (8000/8001/8080/8180 are taken by OpenZaak/NRC/BFF/Keycloak).
-services:
-  flowable-db:
-    image: docker.io/library/postgres:16
-    environment:
-      POSTGRES_USER: flowable
-      POSTGRES_PASSWORD: flowable
-      POSTGRES_DB: flowable
-    volumes:
-      - flowable-db:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U flowable -d flowable"]
-      interval: 5s
-      timeout: 3s
-      retries: 10
-    networks: [cg]
-
-  flowable-rest:
-    image: docker.io/flowable/flowable-rest:latest
-    environment:
-      SPRING_DATASOURCE_DRIVER-CLASS-NAME: org.postgresql.Driver
-      SPRING_DATASOURCE_URL: jdbc:postgresql://flowable-db:5432/flowable
-      SPRING_DATASOURCE_USERNAME: flowable
-      SPRING_DATASOURCE_PASSWORD: flowable
-    ports:
-      - "8090:8080"
-    depends_on:
-      flowable-db:
-        condition: service_healthy
-    networks: [cg]
-
-  # Deploys workflows/registratie.bpmn via the REST API once flowable-rest is up.
-  # Idempotent: skips if a deployment named "registratie" already exists.
-  flowable-init:
-    image: docker.io/curlimages/curl:latest
-    restart: "no"
-    # registratie.bpmn is streamed into this external volume by infra/seed-config.sh.
-    volumes:
-      - fl-bpmn:/work:ro
-    command:
-      - sh
-      - -c
-      - |
-        base=http://flowable-rest:8080/flowable-rest/service/repository/deployments
-        until curl -sf -u rest-admin:test "$$base" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
-        if curl -s -u rest-admin:test "$$base?name=registratie" | grep -q '"name":"registratie"'; then
-          echo "registratie already deployed; skip"
-        else
-          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$base" >/dev/null && echo "deployed registratie"
-        fi
-    depends_on:
-      flowable-rest:
-        condition: service_started
-    networks: [cg]
-
-volumes:
-  flowable-db:
-  # populated out-of-band by infra/seed-config.sh (docker cp) — see that script.
-  fl-bpmn:
-    external: true
-    name: rr-fl-bpmn
-
-networks:
-  cg:
--- a/infra/flowable/verify.py
+++ b/infra/flowable/verify.py
@@ -1,54 +0,0 @@
-#!/usr/bin/env python3
-"""Smoke-check Flowable: the registratie process is deployed, and starting an
-instance parks it on the OpenZaakAanmaken external task. Stdlib only.
-"""
-import base64, json, sys, time, urllib.error, urllib.request
-
-BASE = "http://localhost:8090/flowable-rest/service"
-AUTH = "Basic " + base64.b64encode(b"rest-admin:test").decode()
-
-
-def call(method, path, payload=None):
-    data = json.dumps(payload).encode() if payload is not None else None
-    req = urllib.request.Request(BASE + path, data=data, method=method, headers={
-        "Authorization": AUTH, "Content-Type": "application/json", "Accept": "application/json"})
-    with urllib.request.urlopen(req, timeout=30) as r:
-        return r.status, json.loads(r.read() or "null")
-
-
-def main():
-    # 1. process definition deployed? (wait for the async init-container deploy)
-    defs = {"total": 0}
-    for _ in range(40):
-        _, defs = call("GET", "/repository/process-definitions?key=registratie")
-        if defs["total"] >= 1:
-            break
-        time.sleep(3)
-    assert defs["total"] >= 1, "registratie process definition not deployed"
-    print(f"process definition 'registratie' deployed (total={defs['total']})")
-
-    # 2. start an instance
-    st, pi = call("POST", "/runtime/process-instances", {"processDefinitionKey": "registratie"})
-    assert st == 201, f"start failed: {st} {pi}"
-    pid = pi["id"]
-    assert pi.get("ended") is False, "instance ended immediately — external task not reached"
-    print(f"started instance {pid} (ended={pi.get('ended')})")
-
-    # 3. waiting on the external task?
-    _, ex = call("GET", f"/runtime/executions?processInstanceId={pid}")
-    activities = [e.get("activityId") for e in ex["data"]]
-    assert "OpenZaakAanmaken" in activities, f"not waiting at OpenZaakAanmaken: {activities}"
-    print(f"instance is waiting at the external task: {activities}")
-
-    # 4. cleanup
-    try:
-        call("DELETE", f"/runtime/process-instances/{pid}")
-        print("cleaned up instance")
-    except urllib.error.HTTPError:
-        pass
-
-    print("flowable smoke OK")
-
-
-if __name__ == "__main__":
-    main()
--- a/infra/keycloak/check_realms.py
+++ b/infra/keycloak/check_realms.py
@@ -1,60 +0,0 @@
-#!/usr/bin/env python3
-"""Smoke-check the Keycloak realms: each realm's OIDC login works (password grant)
-and returns its expected identifying claim. Stdlib only. Exits non-zero on failure.
-"""
-import base64, json, sys, urllib.error, urllib.parse, urllib.request
-
-BASE = "http://localhost:8180"
-CLIENT = "big-portal"
-PWD = "test123"
-
-# realm, user, claim ("__roles__" => check realm_access.roles), expected-contains
-CHECKS = [
-    ("digid", "jan-burger", "bsn", "123456782"),
-    ("eherkenning", "acme-ondernemer", "kvk", "12345678"),
-    ("eidas", "pierre-dupont", "eidas_id", "FR/NL"),
-    ("medewerker", "merel-behandelaar", "__roles__", "behandelaar"),
-]
-
-
-def decode(jwt):
-    p = jwt.split(".")[1]
-    p += "=" * (-len(p) % 4)
-    return json.loads(base64.urlsafe_b64decode(p))
-
-
-def grant(realm, user):
-    data = urllib.parse.urlencode({
-        "grant_type": "password", "client_id": CLIENT,
-        "username": user, "password": PWD, "scope": "openid",
-    }).encode()
-    req = urllib.request.Request(
-        f"{BASE}/realms/{realm}/protocol/openid-connect/token", data=data,
-        headers={"Content-Type": "application/x-www-form-urlencoded"})
-    with urllib.request.urlopen(req, timeout=20) as r:
-        return json.loads(r.read())
-
-
-def main():
-    ok = True
-    for realm, user, claim, expect in CHECKS:
-        try:
-            at = decode(grant(realm, user)["access_token"])
-            if claim == "__roles__":
-                val = at.get("realm_access", {}).get("roles", [])
-                good = expect in val
-            else:
-                val = at.get(claim)
-                good = val is not None and expect in str(val)
-            print(f"{realm:12} {user:18} login OK | {claim} = {val} "
-                  f"[{'OK' if good else 'UNEXPECTED'}]")
-            ok = ok and good
-        except urllib.error.HTTPError as e:
-            ok = False
-            print(f"{realm:12} {user:18} LOGIN FAILED {e.code}: {e.read()[:200]!r}")
-    print("keycloak smoke OK" if ok else "keycloak smoke FAILED")
-    sys.exit(0 if ok else 1)
-
-
-if __name__ == "__main__":
-    main()
--- a/infra/keycloak/docker-compose.yml
+++ b/infra/keycloak/docker-compose.yml
@@ -1,35 +0,0 @@
-# Keycloak (S-02) with four pre-seeded realms imported at boot:
-#   digid · eherkenning · eidas · medewerker
-# Dev mode, H2 in-memory store, realm JSONs imported from ./realms.
-#
-#   docker compose -f infra/keycloak/docker-compose.yml up -d
-#   curl -s -o /dev/null -w '%{http_code}\n' \
-#     http://localhost:8180/realms/digid/.well-known/openid-configuration   # -> 200
-#
-# Admin console: http://localhost:8180/  (admin / admin — dev only)
-services:
-  keycloak:
-    image: quay.io/keycloak/keycloak:26.1
-    command: ["start-dev", "--import-realm"]
-    environment:
-      KC_BOOTSTRAP_ADMIN_USERNAME: admin
-      KC_BOOTSTRAP_ADMIN_PASSWORD: admin
-      # Older var names too, harmless on 26.x:
-      KEYCLOAK_ADMIN: admin
-      KEYCLOAK_ADMIN_PASSWORD: admin
-      KC_HEALTH_ENABLED: "true"
-      KC_HTTP_ENABLED: "true"
-    ports:
-      - "8180:8080"
-    # realm exports are streamed into this external volume by infra/seed-config.sh.
-    volumes:
-      - kc-realms:/opt/keycloak/data/import:ro
-    networks: [cg]
-
-volumes:
-  kc-realms:
-    external: true
-    name: rr-kc-realms
-
-networks:
-  cg:
--- a/infra/keycloak/realms/digid-realm.json
+++ b/infra/keycloak/realms/digid-realm.json
@@ -1,43 +0,0 @@
-{
-  "realm": "digid",
-  "enabled": true,
-  "displayName": "Mock DigiD",
-  "clients": [
-    {
-      "clientId": "big-portal",
-      "enabled": true,
-      "publicClient": true,
-      "standardFlowEnabled": true,
-      "directAccessGrantsEnabled": true,
-      "redirectUris": ["*"],
-      "webOrigins": ["*"],
-      "protocolMappers": [
-        {
-          "name": "bsn",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-attribute-mapper",
-          "config": {
-            "user.attribute": "bsn",
-            "claim.name": "bsn",
-            "jsonType.label": "String",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "userinfo.token.claim": "true"
-          }
-        }
-      ]
-    }
-  ],
-  "users": [
-    {
-      "username": "jan-burger",
-      "enabled": true,
-      "firstName": "Jan",
-      "lastName": "Burger",
-      "email": "jan.burger@example.nl",
-      "emailVerified": true,
-      "credentials": [{ "type": "password", "value": "test123", "temporary": false }],
-      "attributes": { "bsn": ["123456782"] }
-    }
-  ]
-}
--- a/infra/keycloak/realms/eherkenning-realm.json
+++ b/infra/keycloak/realms/eherkenning-realm.json
@@ -1,43 +0,0 @@
-{
-  "realm": "eherkenning",
-  "enabled": true,
-  "displayName": "Mock eHerkenning",
-  "clients": [
-    {
-      "clientId": "big-portal",
-      "enabled": true,
-      "publicClient": true,
-      "standardFlowEnabled": true,
-      "directAccessGrantsEnabled": true,
-      "redirectUris": ["*"],
-      "webOrigins": ["*"],
-      "protocolMappers": [
-        {
-          "name": "kvk",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-attribute-mapper",
-          "config": {
-            "user.attribute": "kvk",
-            "claim.name": "kvk",
-            "jsonType.label": "String",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "userinfo.token.claim": "true"
-          }
-        }
-      ]
-    }
-  ],
-  "users": [
-    {
-      "username": "acme-ondernemer",
-      "enabled": true,
-      "firstName": "Anita",
-      "lastName": "Ondernemer",
-      "email": "anita@acme.nl",
-      "emailVerified": true,
-      "credentials": [{ "type": "password", "value": "test123", "temporary": false }],
-      "attributes": { "kvk": ["12345678"] }
-    }
-  ]
-}
--- a/infra/keycloak/realms/eidas-realm.json
+++ b/infra/keycloak/realms/eidas-realm.json
@@ -1,43 +0,0 @@
-{
-  "realm": "eidas",
-  "enabled": true,
-  "displayName": "Mock eIDAS",
-  "clients": [
-    {
-      "clientId": "big-portal",
-      "enabled": true,
-      "publicClient": true,
-      "standardFlowEnabled": true,
-      "directAccessGrantsEnabled": true,
-      "redirectUris": ["*"],
-      "webOrigins": ["*"],
-      "protocolMappers": [
-        {
-          "name": "eidas_id",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-attribute-mapper",
-          "config": {
-            "user.attribute": "eidas_id",
-            "claim.name": "eidas_id",
-            "jsonType.label": "String",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "userinfo.token.claim": "true"
-          }
-        }
-      ]
-    }
-  ],
-  "users": [
-    {
-      "username": "pierre-dupont",
-      "enabled": true,
-      "firstName": "Pierre",
-      "lastName": "Dupont",
-      "email": "pierre.dupont@example.fr",
-      "emailVerified": true,
-      "credentials": [{ "type": "password", "value": "test123", "temporary": false }],
-      "attributes": { "eidas_id": ["FR/NL/AB-1234-5678"] }
-    }
-  ]
-}
--- a/infra/keycloak/realms/medewerker-realm.json
+++ b/infra/keycloak/realms/medewerker-realm.json
@@ -1,44 +0,0 @@
-{
-  "realm": "medewerker",
-  "enabled": true,
-  "displayName": "Medewerkers",
-  "roles": {
-    "realm": [
-      { "name": "behandelaar", "description": "Behandelt registratieaanvragen" },
-      { "name": "teamlead", "description": "Teamleider behandeling" }
-    ]
-  },
-  "clients": [
-    {
-      "clientId": "big-portal",
-      "enabled": true,
-      "publicClient": true,
-      "standardFlowEnabled": true,
-      "directAccessGrantsEnabled": true,
-      "redirectUris": ["*"],
-      "webOrigins": ["*"]
-    }
-  ],
-  "users": [
-    {
-      "username": "merel-behandelaar",
-      "enabled": true,
-      "firstName": "Merel",
-      "lastName": "Behandelaar",
-      "email": "merel@big.example.nl",
-      "emailVerified": true,
-      "credentials": [{ "type": "password", "value": "test123", "temporary": false }],
-      "realmRoles": ["behandelaar"]
-    },
-    {
-      "username": "tom-teamlead",
-      "enabled": true,
-      "firstName": "Tom",
-      "lastName": "Teamlead",
-      "email": "tom@big.example.nl",
-      "emailVerified": true,
-      "credentials": [{ "type": "password", "value": "test123", "temporary": false }],
-      "realmRoles": ["behandelaar", "teamlead"]
-    }
-  ]
-}
--- a/infra/notification-sink.py
+++ b/infra/notification-sink.py
@@ -1,39 +0,0 @@
-#!/usr/bin/env python3
-"""A throwaway webhook sink for verifying the OpenZaak → NRC notification path.
-
-NRC delivers abonnement callbacks here as POSTs; each body is printed to stdout
-(prefixed `NOTIFICATION `) so the verify harness can assert on `docker logs`.
-
-NRC refuses to register an abonnement whose callback is unauthenticated
-(`no-auth-on-callback`): when validating it sends a probe and expects the callback
-to reject a request without the configured `Authorization` value. So this sink
-enforces that header (EXPECTED_AUTH env) — 401 without it, 204 with it.
-
-Stdlib only. Listens on :9000. See infra/verify-notifications.sh / S-01-c (#56).
-"""
-import http.server
-import os
-import sys
-
-EXPECTED_AUTH = os.environ.get("EXPECTED_AUTH", "Bearer notification-sink-token")
-
-
-class Handler(http.server.BaseHTTPRequestHandler):
-    def do_POST(self):
-        length = int(self.headers.get("content-length", 0))
-        body = self.rfile.read(length).decode("utf-8", "replace")
-        if self.headers.get("Authorization") != EXPECTED_AUTH:
-            self.send_response(401)
-            self.end_headers()
-            return
-        print("NOTIFICATION " + body, flush=True)
-        self.send_response(204)
-        self.end_headers()
-
-    def log_message(self, *args):  # silence default request logging
-        pass
-
-
-if __name__ == "__main__":
-    http.server.HTTPServer(("0.0.0.0", 9000), Handler).serve_forever()
-    sys.exit(0)
--- a/infra/opennotificaties/docker-compose.yml
+++ b/infra/opennotificaties/docker-compose.yml
@@ -1,120 +0,0 @@
-# Open Notificaties (NRC) stack (S-01-c). Lean adaptation of the upstream dev compose:
-# db (PostGIS) + redis (also the Celery broker) + migrate-init + the API + a celery worker.
-#
-# Shares the `cg` network with the OpenZaak stack so the two can reach each other.
-# Run BOTH together (NRC needs OpenZaak's Autorisaties API for auth wiring):
-#
-#   docker compose -f infra/openzaak/docker-compose.yml -f infra/opennotificaties/docker-compose.yml up -d
-#   curl -s -o /dev/null -w '%{http_code}\n' http://localhost:8001/admin/   # -> 302
-#
-# NRC is published on host :8001 (OpenZaak holds :8000).
-services:
-  nrc-db:
-    image: docker.io/postgis/postgis:17-3.5
-    environment:
-      POSTGRES_USER: opennotificaties
-      POSTGRES_PASSWORD: opennotificaties
-      POSTGRES_DB: opennotificaties
-    command: postgres -c max_connections=300
-    volumes:
-      - nrc-db:/var/lib/postgresql/data
-    healthcheck:
-      # pg_isready only checks TCP; the second clause verifies PostGIS is installed
-      # so nrc-init migrations can safely start (avoids race on cold container start).
-      test: ["CMD-SHELL", "pg_isready -U opennotificaties -d opennotificaties && psql -U opennotificaties -d opennotificaties -c 'SELECT PostGIS_Version();' -q 2>/dev/null"]
-      interval: 5s
-      timeout: 5s
-      retries: 30
-      start_period: 15s
-    networks: [cg]
-
-  nrc-redis:
-    image: docker.io/library/redis:7
-    networks: [cg]
-
-  nrc-init:
-    # Plain base image — nrc-init runs migrations only (see command below).
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
-    environment: &nrc-env
-      DJANGO_SETTINGS_MODULE: nrc.conf.docker
-      SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production}
-      DB_HOST: nrc-db
-      DB_NAME: opennotificaties
-      DB_USER: opennotificaties
-      DB_PASSWORD: opennotificaties
-      IS_HTTPS: "no"
-      ALLOWED_HOSTS: "*"
-      CACHE_DEFAULT: nrc-redis:6379/0
-      CACHE_AXES: nrc-redis:6379/0
-      CELERY_BROKER_URL: redis://nrc-redis:6379/1
-      CELERY_RESULT_BACKEND: redis://nrc-redis:6379/1
-      DISABLE_2FA: "true"
-      OPENNOTIFICATIES_SUPERUSER_USERNAME: admin
-      DJANGO_SUPERUSER_PASSWORD: admin
-      OPENNOTIFICATIES_SUPERUSER_EMAIL: admin@localhost
-      RUN_SETUP_CONFIG: "true"
-      # Delivery cadence: nrc-beat fires `execute_notifications` this often to drain
-      # scheduled notifications to subscribers. Upstream default is 20s; 5s keeps the
-      # walking-skeleton + the verify smoke responsive.
-      NOTIFICATION_SEC_INTERVAL: "5"
-    # Runs migrations + setup_configuration (S-01-c): the JWT credential, the
-    # Autorisaties-API delegation, and the `zaken` kanaal that let OpenZaak publish
-    # notifications. data.yaml is streamed into this external volume by
-    # infra/seed-config.sh (same pattern as oz-init). See data.yaml + ADR-0006.
-    command: /setup_configuration.sh
-    volumes:
-      - nrc-config:/app/setup_configuration:ro
-    depends_on:
-      nrc-db:
-        condition: service_healthy
-      nrc-redis:
-        condition: service_started
-    networks: [cg]
-
-  nrc-web:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
-    environment: *nrc-env
-    healthcheck:
-      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
-      start_period: 30s
-    ports:
-      - "8001:8000"
-    depends_on:
-      nrc-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  nrc-celery:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
-    environment: *nrc-env
-    command: /celery_worker.sh
-    depends_on:
-      nrc-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  # Celery beat: periodically fires `execute_notifications`, which drains the
-  # ScheduledNotification rows the API creates on publish and hands them to the
-  # worker for delivery. Without beat, notifications are accepted but never
-  # delivered to subscribers — so it is required, not optional. See ADR-0007.
-  nrc-beat:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
-    environment: *nrc-env
-    command: /celery_beat.sh
-    depends_on:
-      nrc-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-volumes:
-  nrc-db:
-  # populated out-of-band by infra/seed-config.sh (docker cp) — see that script.
-  nrc-config:
-    external: true
-    name: rr-nrc-config
-
-networks:
-  cg:
--- a/infra/opennotificaties/setup_configuration/data.yaml
+++ b/infra/opennotificaties/setup_configuration/data.yaml
@@ -1,41 +0,0 @@
-# Open Notificaties (NRC) setup_configuration (S-01-c, #56).
-# Wires NRC so OpenZaak can publish notifications:
-#  - the JWT credential OpenZaak authenticates with,
-#  - delegation of authorization checks to OpenZaak's Autorisaties API (AC),
-#  - the `zaken` kanaal OpenZaak publishes zaak events on.
-# Dev-only credentials — not for production. Steps from nrc.setup_configuration.
-
-# 1. JWT credential NRC uses to verify the token OpenZaak presents.
-vng_api_common_credentials_config_enable: true
-vng_api_common_credentials:
-  items:
-    - identifier: big-reference-seed
-      secret: insecure-dev-secret-change-me
-
-# 2. The Autorisaties API (OpenZaak's AC) NRC consults to authorize publishers.
-zgw_consumers_config_enable: true
-zgw_consumers:
-  services:
-    - identifier: openzaak-ac
-      label: OpenZaak Autorisaties API
-      api_type: ac
-      api_root: http://openzaak:8000/autorisaties/api/v1/
-      auth_type: zgw
-      client_id: big-reference-seed
-      secret: insecure-dev-secret-change-me
-
-# 3. Delegate authorization to that AC.
-autorisaties_api_config_enable: true
-autorisaties_api:
-  authorizations_api_service_identifier: openzaak-ac
-
-# 4. The kanaal OpenZaak publishes zaak events on.
-notifications_kanalen_config_enable: true
-notifications_kanalen_config:
-  items:
-    - naam: zaken
-      documentatie_link: https://github.com/VNG-Realisatie/gemma-zaken
-      filters:
-        - bronorganisatie
-        - zaaktype
-        - vertrouwelijkheidaanduiding
--- a/infra/openzaak/docker-compose.yml
+++ b/infra/openzaak/docker-compose.yml
@@ -1,104 +0,0 @@
-# OpenZaak stack (S-01). Lean adaptation of the upstream open-zaak dev compose:
-# db (PostGIS) + redis + a one-shot init (migrations) + the API + a celery worker.
-# Dropped from upstream for leanness: nginx, celery-beat, flower, OTEL.
-#
-#   docker compose -f infra/openzaak/docker-compose.yml up -d --wait
-#   curl -i http://localhost:8000/zaken/api/v1/zaken   # -> 401 (auth required)
-#
-# NOTE: image pinned to a tag (not :latest) once a known-good tag is chosen; see
-# the catalogus-design ADR. Using a tag var with a sensible default for now.
-services:
-  oz-db:
-    image: docker.io/postgis/postgis:17-3.5
-    environment:
-      POSTGRES_USER: openzaak
-      POSTGRES_PASSWORD: openzaak
-      POSTGRES_DB: openzaak
-    command: postgres -c max_connections=300
-    volumes:
-      - oz-db:/var/lib/postgresql/data
-    healthcheck:
-      # pg_isready only checks TCP; the second clause verifies PostGIS is installed
-      # so oz-init migrations can safely start (avoids race on cold container start).
-      test: ["CMD-SHELL", "pg_isready -U openzaak -d openzaak && psql -U openzaak -d openzaak -c 'SELECT PostGIS_Version();' -q 2>/dev/null"]
-      interval: 5s
-      timeout: 5s
-      retries: 30
-      start_period: 15s
-    networks: [cg]
-
-  oz-redis:
-    image: docker.io/library/redis:7
-    networks: [cg]
-
-  oz-init:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
-    environment: &oz-env
-      DJANGO_SETTINGS_MODULE: openzaak.conf.docker
-      SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production}
-      DB_HOST: oz-db
-      DB_NAME: openzaak
-      DB_USER: openzaak
-      DB_PASSWORD: openzaak
-      IS_HTTPS: "no"
-      ALLOWED_HOSTS: "*"
-      CACHE_DEFAULT: oz-redis:6379/0
-      CACHE_AXES: oz-redis:6379/0
-      CELERY_BROKER_URL: redis://oz-redis:6379/1
-      CELERY_RESULT_BACKEND: redis://oz-redis:6379/1
-      DISABLE_2FA: "true"
-      # Notifications are OFF by default so OpenZaak-only bring-ups (openzaak-up,
-      # the ACL integration test) don't 500 trying to reach an absent NRC. When
-      # OpenZaak runs together with the NRC stack, set OZ_NOTIFICATIONS_DISABLED=false
-      # (make stack-up does) to publish; the NRC service + notifications_config that
-      # name it are provisioned by setup_configuration (data.yaml, S-01-c).
-      NOTIFICATIONS_DISABLED: "${OZ_NOTIFICATIONS_DISABLED:-true}"
-      OPENZAAK_SUPERUSER_USERNAME: admin
-      DJANGO_SUPERUSER_PASSWORD: admin
-      OPENZAAK_SUPERUSER_EMAIL: admin@localhost
-      RUN_SETUP_CONFIG: "true"
-    command: /setup_configuration.sh
-    # data.yaml is streamed into this external volume by infra/seed-config.sh.
-    volumes:
-      - oz-config:/app/setup_configuration:ro
-    depends_on:
-      oz-db:
-        condition: service_healthy
-      oz-redis:
-        condition: service_started
-    networks: [cg]
-
-  openzaak:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
-    environment: *oz-env
-    healthcheck:
-      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
-      start_period: 30s
-    ports:
-      - "8000:8000"
-    depends_on:
-      oz-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-  oz-celery:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
-    environment: *oz-env
-    command: /celery_worker.sh
-    depends_on:
-      oz-init:
-        condition: service_completed_successfully
-    networks: [cg]
-
-volumes:
-  oz-db:
-  # populated out-of-band by infra/seed-config.sh (docker cp) — see that script.
-  oz-config:
-    external: true
-    name: rr-oz-config
-
-networks:
-  cg:
--- a/infra/openzaak/seed_catalogus.py
+++ b/infra/openzaak/seed_catalogus.py
@@ -1,221 +0,0 @@
-#!/usr/bin/env python3
-"""Idempotent seed of the BIG catalogus into OpenZaak via the ZTC API.
-
-Creates (if absent):
-  - catalogus "BIG"
-  - a lean "BIG-registratie" zaaktype (only schema-mandatory fields)
-  - a "bsn" eigenschap on that zaaktype
-  - then publishes the zaaktype.
-
-Auth uses the JWT client provisioned by setup_configuration (see ADR-0002).
-Stdlib only — no pip deps. Re-running is safe (matches existing by identifier).
-"""
-import base64, hashlib, hmac, json, os, sys, time, urllib.error, urllib.request
-
-BASE = os.environ.get("OZ_BASE", "http://localhost:8000")
-CLIENT_ID = os.environ.get("OZ_CLIENT_ID", "big-reference-seed")
-SECRET = os.environ.get("OZ_SECRET", "insecure-dev-secret-change-me")
-ZTC = f"{BASE}/catalogi/api/v1"
-RSIN = "517439943"  # elfproef-valid test RSIN
-
-# Opt-in: also publish the zaaktype so OpenZaak's Zaken API accepts a zaak against
-# it (a concept zaaktype is rejected with `not-published`). Off by default — the
-# S-01 compose seed keeps it a concept (ADR-0002). The ACL integration test
-# (S-04a, #46) sets OZ_PUBLISH=1. Publishing requires ≥2 statustypen, ≥1 roltype
-# and ≥1 resultaattype; the resultaattype is validated against the external
-# Selectielijst reference API, so this path needs outbound access to it. See ADR-0006.
-PUBLISH = os.environ.get("OZ_PUBLISH", "").lower() in ("1", "true", "yes")
-SELECTIELIJST = os.environ.get(
-    "OZ_SELECTIELIJST", "https://selectielijst.openzaak.nl/api/v1").rstrip("/")
-
-
-def token():
-    b64 = lambda b: base64.urlsafe_b64encode(b).rstrip(b"=")
-    hdr = {"alg": "HS256", "typ": "JWT"}
-    pl = {"iss": CLIENT_ID, "iat": int(time.time()), "client_id": CLIENT_ID,
-          "user_id": "seed", "user_representation": "seed"}
-    seg = b64(json.dumps(hdr, separators=(",", ":")).encode()) + b"." + \
-          b64(json.dumps(pl, separators=(",", ":")).encode())
-    sig = b64(hmac.new(SECRET.encode(), seg, hashlib.sha256).digest())
-    return (seg + b"." + sig).decode()
-
-
-def api(method, path, body=None):
-    url = path if path.startswith("http") else f"{ZTC}{path}"
-    data = json.dumps(body).encode() if body is not None else None
-    req = urllib.request.Request(url, data=data, method=method, headers={
-        "Authorization": "Bearer " + token(),
-        "Content-Type": "application/json",
-        "Accept": "application/json",
-    })
-    try:
-        with urllib.request.urlopen(req, timeout=30) as r:
-            return r.status, json.loads(r.read() or "null")
-    except urllib.error.HTTPError as e:
-        return e.code, json.loads(e.read() or "null")
-
-
-def find(path):
-    status, body = api("GET", path)
-    if status != 200:
-        sys.exit(f"GET {path} -> {status}: {body}")
-    return body.get("results", [])
-
-
-def selectielijst(path):
-    """GET the external Selectielijst reference API (no auth). Used only when publishing."""
-    req = urllib.request.Request(f"{SELECTIELIJST}{path}", headers={"Accept": "application/json"})
-    with urllib.request.urlopen(req, timeout=30) as r:
-        return json.loads(r.read())
-
-
-def publish_zaaktype(zt):
-    """Add the relations OpenZaak requires to publish, then publish (idempotent).
-
-    Publish validation (verified against OpenZaak 1.28.2) demands: ≥2 statustypen
-    (begin + eind), ≥1 roltype, ≥1 resultaattype. A resultaattype needs a
-    Selectielijst `selectielijstklasse` whose procestype matches the zaaktype's
-    `selectielijstProcestype`, plus a `resultaattypeomschrijving`.
-    """
-    have_st = {s.get("volgnummer") for s in find(f"/statustypen?zaaktype={zt['url']}&status=alles")}
-    for volgnummer, omschrijving in [(1, "Ontvangen"), (2, "Afgehandeld")]:
-        if volgnummer not in have_st:
-            st, body = api("POST", "/statustypen", {
-                "omschrijving": omschrijving, "zaaktype": zt["url"], "volgnummer": volgnummer})
-            if st != 201:
-                sys.exit(f"create statustype {volgnummer} -> {st}: {json.dumps(body, indent=2)}")
-            print(f"create statustype {volgnummer} ({omschrijving})")
-
-    if find(f"/roltypen?zaaktype={zt['url']}&status=alles"):
-        print("skip   roltype Aanvrager")
-    else:
-        st, body = api("POST", "/roltypen", {
-            "zaaktype": zt["url"], "omschrijving": "Aanvrager", "omschrijvingGeneriek": "initiator"})
-        if st != 201:
-            sys.exit(f"create roltype -> {st}: {json.dumps(body, indent=2)}")
-        print("create roltype Aanvrager")
-
-    if find(f"/resultaattypen?zaaktype={zt['url']}&status=alles"):
-        print("skip   resultaattype Geregistreerd")
-    else:
-        resultaat = selectielijst("/resultaten?pageSize=1")["results"][0]
-        omschrijvingen = selectielijst("/resultaattypeomschrijvingen")
-        oms = (omschrijvingen if isinstance(omschrijvingen, list) else omschrijvingen["results"])[0]["url"]
-        # The selectielijstklasse and the zaaktype must share a procestype.
-        st, body = api("PATCH", zt["url"], {"selectielijstProcestype": resultaat["procesType"]})
-        if st != 200:
-            sys.exit(f"set procestype -> {st}: {json.dumps(body, indent=2)}")
-        st, body = api("POST", "/resultaattypen", {
-            "zaaktype": zt["url"], "omschrijving": "Geregistreerd",
-            "resultaattypeomschrijving": oms, "selectielijstklasse": resultaat["url"],
-            "archiefnominatie": "blijvend_bewaren",
-            "brondatumArchiefprocedure": {"afleidingswijze": "afgehandeld"},
-        })
-        if st != 201:
-            sys.exit(f"create resultaattype -> {st}: {json.dumps(body, indent=2)}")
-        print("create resultaattype Geregistreerd")
-
-    if zt.get("concept", True):
-        st, body = api("POST", f"{zt['url']}/publish")
-        if st != 200:
-            sys.exit(f"publish zaaktype -> {st}: {json.dumps(body, indent=2)}")
-        print(f"publish zaaktype BIG-REGISTRATIE ({zt['url']})")
-    else:
-        print("skip   publish (already published)")
-
-
-def main():
-    # 1. Catalogus
-    existing = [c for c in find(f"/catalogussen?domein=BIG") if c.get("domein") == "BIG"]
-    if existing:
-        cat = existing[0]
-        print(f"skip   catalogus BIG ({cat['url']})")
-    else:
-        st, cat = api("POST", "/catalogussen", {
-            "domein": "BIG", "rsin": RSIN,
-            "contactpersoonBeheerNaam": "BIG Beheer",
-        })
-        if st != 201:
-            sys.exit(f"create catalogus -> {st}: {cat}")
-        print(f"create catalogus BIG ({cat['url']})")
-
-    # 2. Zaaktype (concept)
-    # status=alles so concept zaaktypen are matched too (else we'd duplicate).
-    zts = [z for z in find(f"/zaaktypen?catalogus={cat['url']}&status=alles")
-           if z.get("identificatie") == "BIG-REGISTRATIE"]
-    if zts:
-        zt = zts[0]
-        print(f"skip   zaaktype BIG-REGISTRATIE ({zt['url']}) concept={zt.get('concept')}")
-    else:
-        st, zt = api("POST", "/zaaktypen", {
-            "identificatie": "BIG-REGISTRATIE",
-            "omschrijving": "BIG-registratie",
-            "vertrouwelijkheidaanduiding": "openbaar",
-            "doel": "Registratie van een zorgprofessional in het BIG-register",
-            "aanleiding": "Aanvraag tot registratie",
-            "indicatieInternOfExtern": "extern",
-            "handelingInitiator": "indienen",
-            "onderwerp": "BIG-registratie",
-            "handelingBehandelaar": "behandelen",
-            "doorlooptijd": "P30D",
-            "opschortingEnAanhoudingMogelijk": False,
-            "verlengingMogelijk": False,
-            "publicatieIndicatie": False,
-            "productenOfDiensten": [],
-            "referentieproces": {"naam": "BIG-registratie"},
-            "catalogus": cat["url"],
-            "besluittypen": [],
-            "gerelateerdeZaaktypen": [],
-            "beginGeldigheid": "2026-01-01",
-            "versiedatum": "2026-01-01",
-            "verantwoordelijke": RSIN,
-        })
-        if st != 201:
-            sys.exit(f"create zaaktype -> {st}: {json.dumps(zt, indent=2)}")
-        print(f"create zaaktype BIG-REGISTRATIE ({zt['url']})")
-
-    # 3. bsn eigenschap (only addable while concept)
-    eigs = [e for e in find(f"/eigenschappen?zaaktype={zt['url']}&status=alles")
-            if e.get("naam") == "bsn"]
-    if eigs:
-        print("skip   eigenschap bsn")
-    elif zt.get("concept", True):
-        st, eig = api("POST", "/eigenschappen", {
-            "naam": "bsn",
-            "definitie": "Burgerservicenummer van de zorgprofessional",
-            "zaaktype": zt["url"],
-            "specificatie": {"groep": "aanvrager", "formaat": "tekst",
-                             "lengte": "9", "kardinaliteit": "1", "waardenverzameling": []},
-        })
-        if st != 201:
-            sys.exit(f"create eigenschap -> {st}: {json.dumps(eig, indent=2)}")
-        print("create eigenschap bsn")
-    else:
-        print("warn   zaaktype already published; cannot add bsn eigenschap")
-
-    # 4. Optionally publish. By default the zaaktype stays a concept: publishing
-    # requires roltypen, resultaattypen and statustypen, beyond the "lean /
-    # schema-mandatory" zaaktype S-01 asks for (ADR-0002). Set OZ_PUBLISH=1 to add
-    # those relations and publish — needed so a real zaak POST is accepted, which
-    # the ACL integration test (S-04a, #46) exercises. See ADR-0006.
-    if PUBLISH:
-        # Re-fetch: the bsn-eigenschap branch above may hold a stale concept flag.
-        zt = next(z for z in find(f"/zaaktypen?catalogus={cat['url']}&status=alles")
-                  if z.get("identificatie") == "BIG-REGISTRATIE")
-        publish_zaaktype(zt)
-
-    # 5. Verify the JWT client can list the zaaktype (concepts included).
-    zaaktypen = find(f"/zaaktypen?catalogus={cat['url']}&status=alles")
-    names = [z.get("identificatie") for z in zaaktypen]
-    print(f"zaaktypen in BIG: {names}")
-    assert "BIG-REGISTRATIE" in names, "BIG-REGISTRATIE not listed"
-    state = "published" if PUBLISH else "concept"
-    # Machine-readable line so callers (e.g. infra/run-domain-check.sh) can capture the
-    # zaaktype URL to configure the ACL's default-fill (ADR-0003/0009).
-    zt_url = next(z["url"] for z in zaaktypen if z.get("identificatie") == "BIG-REGISTRATIE")
-    print(f"ZAAKTYPE_URL {zt_url}")
-    print(f"OK — BIG catalogus seeded (BIG-REGISTRATIE {state} + bsn eigenschap)")
-
-
-if __name__ == "__main__":
-    main()
--- a/infra/openzaak/setup_configuration/data.yaml
+++ b/infra/openzaak/setup_configuration/data.yaml
@@ -1,41 +0,0 @@
-# OpenZaak setup_configuration (idempotent, declarative).
-# Provisions the JWT client the seed + ACL use to call OpenZaak's APIs.
-# Dev-only credentials — not for production.
-#
-# Steps come from vng_api_common.contrib.setup_configuration (see ADR-0002).
-
-vng_api_common_credentials_config_enable: true
-vng_api_common_credentials:
-  items:
-    - identifier: big-reference-seed
-      secret: insecure-dev-secret-change-me
-
-vng_api_common_applicaties_config_enable: true
-vng_api_common_applicaties:
-  items:
-    # uuid must be given explicitly as a string (the step's auto-default is a
-    # UUID object that fails its own validation).
-    - uuid: "11111111-1111-4111-8111-111111111111"
-      client_ids:
-        - big-reference-seed
-      label: BIG reference seed client
-      heeft_alle_autorisaties: true
-
-# ── OpenZaak → Open Notificaties (NRC) publishing (S-01-c, #56) ─────────────
-# The NRC service OpenZaak posts notifications to, authenticating with the same
-# big-reference-seed client (NRC verifies the JWT and authorizes it via the AC).
-zgw_consumers_config_enable: true
-zgw_consumers:
-  services:
-    - identifier: nrc
-      label: Open Notificaties
-      api_type: nrc
-      api_root: http://nrc-web:8000/api/v1/
-      auth_type: zgw
-      client_id: big-reference-seed
-      secret: insecure-dev-secret-change-me
-
-# Point OpenZaak's notifications at that service. Requires NOTIFICATIONS_DISABLED=false.
-notifications_config_enable: true
-notifications_config:
-  notifications_api_service_identifier: nrc
--- a/infra/run-acl-integration.sh
+++ b/infra/run-acl-integration.sh
@@ -1,37 +0,0 @@
-#!/usr/bin/env bash
-#
-# Run the ACL integration tests (Category=Integration) against the OpenZaak that is
-# ALREADY running — works for any stack: oz-only (`make integration`), the standalone
-# oz+nrc stack, or the full compose stack (the CI `verify-stack` job). Seeds a
-# published BIG zaaktype (idempotent), then builds + runs the test image on the stack
-# network, reaching OpenZaak by container IP (a single-label host isn't URL-valid;
-# the runner can't reach published ports — see gitea-actions-gotchas.md §5/§6).
-#
-# Does NOT manage the stack lifecycle: the caller owns bring-up + teardown. Plain
-# docker primitives only (docker/podman-portable). See ADR-0006.
-set -euo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-root="$(cd "$here/.." && pwd)"
-
-# The OpenZaak API container, matched across compose projects + docker/podman naming
-# (`<project>[-_]openzaak[-_]<n>`); the delimiters exclude oz-db / oz-redis / oz-init.
-oz="$(docker ps -q --filter 'name=[-_]openzaak[-_]' | head -1)"
-[ -n "$oz" ] || { echo "ERROR: no running OpenZaak container found — bring the stack up first" >&2; exit 1; }
-net="$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{"\n"}}{{end}}' "$oz" | head -1)"
-oz_ip="$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$oz")"
-oz_base="http://$oz_ip:8000"
-echo ">> OpenZaak at $oz_base on network $net"
-
-echo ">> seeding a published BIG zaaktype (idempotent)"
-sid="$(docker create --network "$net" -e "OZ_BASE=$oz_base" -e OZ_PUBLISH=1 \
-  python:3-slim python /seed.py)"
-docker cp "$here/openzaak/seed_catalogus.py" "$sid:/seed.py" >/dev/null
-docker start -a "$sid"
-docker rm -f "$sid" >/dev/null
-
-echo ">> building the integration test image"
-docker build -f "$root/services/acl/Dockerfile.integration" -t rr-acl-integration "$root/services/acl"
-
-echo ">> running the ACL integration tests (inside the network)"
-docker run --rm --network "$net" -e "OZ_BASE=$oz_base" rr-acl-integration
--- a/infra/run-bff-check.sh
+++ b/infra/run-bff-check.sh
@@ -1,58 +0,0 @@
-#!/usr/bin/env bash
-#
-# Verify the BFF end-to-end (S-07) against an ALREADY-RUNNING full stack. The BFF is the portals'
-# only backend (§8.3): it validates Keycloak digid tokens on the self-service submit and serves the
-# openbaar register anonymously with only public-safe fields (ADR-0010).
-#
-# Checks, in-network (services reached by container IP; Keycloak by its service name so the token's
-# host-derived issuer matches the BFF's authority — see the compose bff env and ADR-0010):
-#   1. POST /self-service/registrations without a token            -> 401
-#   2. mint a real digid access token (direct grant) and POST it   -> 202 (forwarded to the domain)
-#   3. GET /openbaar/register (anonymous)                          -> 200 JSON array, never a bsn
-#
-# Does NOT manage the stack lifecycle (the caller owns bring-up + teardown). Plain docker primitives.
-set -euo pipefail
-
-ip() { docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$1"; }
-
-bff="$(docker ps -q --filter 'name=[-_]bff[-_]' | head -1)"
-kc="$(docker ps -q --filter 'name=keycloak' | head -1)"
-[ -n "$bff" ] || { echo "ERROR: no running bff container — bring the stack up first" >&2; exit 1; }
-[ -n "$kc" ] || { echo "ERROR: no running keycloak container — bring the stack up first" >&2; exit 1; }
-net="$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{"\n"}}{{end}}' "$bff" | head -1)"
-bff_ip="$(ip "$bff")"
-echo ">> bff=$bff_ip network=$net"
-
-# Helper: run curl inside a throwaway container on the stack network (reaches services by name/IP).
-net_curl() { docker run --rm --network "$net" curlimages/curl:latest "$@"; }
-
-echo ">> 1. self-service submit without a token must be 401"
-code="$(net_curl -s -o /dev/null -w '%{http_code}' -X POST "http://$bff_ip:8080/self-service/registrations" \
-  -H 'Content-Type: application/json' -d '{}')"
-echo "   -> $code"; [ "$code" = "401" ] || { echo "FAIL: expected 401, got $code" >&2; exit 1; }
-
-echo ">> 2. minting a digid token (direct grant) via keycloak:8080 (host-consistent issuer)"
-token=""
-for _ in $(seq 1 20); do
-  token="$(net_curl -s -X POST "http://keycloak:8080/realms/digid/protocol/openid-connect/token" \
-    -H 'Content-Type: application/x-www-form-urlencoded' \
-    --data-urlencode 'grant_type=password' --data-urlencode 'client_id=big-portal' \
-    --data-urlencode 'username=jan-burger' --data-urlencode 'password=test123' \
-    | sed -n 's/.*"access_token":"\([^"]*\)".*/\1/p')"
-  [ -n "$token" ] && break
-  sleep 3
-done
-[ -n "$token" ] || { echo "FAIL: could not obtain a digid access token" >&2; exit 1; }
-echo "   -> got a token"
-
-echo ">> 2b. self-service submit with the token must be 202"
-code="$(net_curl -s -o /dev/null -w '%{http_code}' -X POST "http://$bff_ip:8080/self-service/registrations" \
-  -H "Authorization: Bearer $token" -H 'Content-Type: application/json' -d '{}')"
-echo "   -> $code"; [ "$code" = "202" ] || { echo "FAIL: expected 202, got $code" >&2; docker logs "$bff" 2>&1 | tail -15 >&2; exit 1; }
-
-echo ">> 3. openbaar register (anonymous) must be 200 JSON, never a bsn"
-body="$(net_curl -s "http://$bff_ip:8080/openbaar/register")"
-echo "$body" | grep -q '^\[' || { echo "FAIL: openbaar did not return a JSON array: $body" >&2; exit 1; }
-if echo "$body" | grep -q '"bsn"'; then echo "FAIL: openbaar leaked a bsn field" >&2; exit 1; fi
-
-echo "OK — BFF: 401 without token, 202 with a digid token, anonymous public-safe openbaar register"
--- a/infra/run-domain-check.sh
+++ b/infra/run-domain-check.sh
@@ -1,68 +0,0 @@
-#!/usr/bin/env bash
-#
-# Verify the BIG Domain Service end-to-end (S-05) against an ALREADY-RUNNING full stack:
-# domain → Flowable (start the registratie process + external-task worker) → ACL → OpenZaak.
-# Submits a registration to the domain and asserts the worker opens a zaak in OpenZaak and
-# records its URL on the aggregate (ADR-0009).
-#
-# The seeded zaaktype URL is server-assigned, so it isn't knowable at initial bring-up. This
-# script therefore seeds a published BIG zaaktype and recreates the `acl` service configured to
-# default-fill it — pointing the ACL at the SAME OpenZaak host that owns the URL, so zaak creation
-# is host-consistent (exactly the configuration the ACL integration test proves, ADR-0006). That
-# one recreate aside, the caller owns stack bring-up + teardown.
-#
-# All in-network, reaching services by container IP (a single-label host isn't URL-valid; the
-# runner can't reach published ports — gitea-actions-gotchas.md §5/§6). Plain docker primitives.
-set -euo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-root="$(cd "$here/.." && pwd)"
-compose="$root/infra/docker-compose.yml"
-
-ip() { docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$1"; }
-
-oz="$(docker ps -q --filter 'name=[-_]openzaak[-_]' | head -1)"
-dom="$(docker ps -q --filter 'name=domain' | head -1)"
-[ -n "$oz" ] || { echo "ERROR: no running OpenZaak container — bring the stack up first" >&2; exit 1; }
-[ -n "$dom" ] || { echo "ERROR: no running domain container — bring the stack up first" >&2; exit 1; }
-net="$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{"\n"}}{{end}}' "$oz" | head -1)"
-oz_ip="$(ip "$oz")"; dom_ip="$(ip "$dom")"
-oz_base="http://$oz_ip:8000"
-echo ">> openzaak=$oz_ip domain=$dom_ip network=$net"
-
-echo ">> seeding a published BIG zaaktype (idempotent) and capturing its URL"
-sid="$(docker create --network "$net" -e "OZ_BASE=$oz_base" -e OZ_PUBLISH=1 python:3-slim python /seed.py)"
-docker cp "$here/openzaak/seed_catalogus.py" "$sid:/seed.py" >/dev/null
-zt_url="$(docker start -a "$sid" | sed -n 's/^ZAAKTYPE_URL //p' | head -1)"
-docker rm -f "$sid" >/dev/null
-[ -n "$zt_url" ] || { echo "ERROR: seed did not report a ZAAKTYPE_URL" >&2; exit 1; }
-echo ">> zaaktype: $zt_url"
-
-echo ">> recreating the acl service pointed at the seeded zaaktype (host-consistent)"
-ACL_ZAAKTYPE_URL="$zt_url" ACL_OPENZAAK_BASEURL="$oz_base/" docker compose -f "$compose" up -d acl
-WAIT_TIMEOUT="${WAIT_TIMEOUT:-120}" bash "$here/wait-healthy.sh" acl
-
-echo ">> submitting a registration to the domain"
-loc="$(docker run --rm --network "$net" curlimages/curl:latest \
-  -fsS -D - -o /dev/null -X POST "http://$dom_ip:8080/registrations" \
-  -H 'Content-Type: application/json' -d '{"bsn":"123456782"}' \
-  | sed -n 's/\r$//; s/^[Ll]ocation: //p' | head -1)"
-[ -n "$loc" ] || { echo "ERROR: POST /registrations returned no Location" >&2; exit 1; }
-echo ">> registration accepted at $loc"
-
-echo ">> polling the domain until the worker records the opened zaak"
-for _ in $(seq 1 30); do
-  body="$(docker run --rm --network "$net" curlimages/curl:latest \
-    -fsS "http://$dom_ip:8080$loc" 2>/dev/null || true)"
-  if echo "$body" | grep -q '/zaken/api/v1/zaken/'; then
-    echo "OK — the domain opened a zaak and recorded it on the registration:"
-    echo "$body" | cut -c1-300
-    exit 0
-  fi
-  sleep 2
-done
-echo "FAIL — the registration never received a zaak URL" >&2
-echo "--- domain log ---" >&2; docker logs "$dom" 2>&1 | tail -15 >&2
-acl="$(docker ps -q --filter 'name=[-_]acl[-_]' | head -1)"
-[ -n "$acl" ] && { echo "--- acl log ---" >&2; docker logs "$acl" 2>&1 | tail -15 >&2; }
-exit 1
--- a/infra/run-integration.sh
+++ b/infra/run-integration.sh
@@ -1,34 +0,0 @@
-#!/usr/bin/env bash
-#
-# Local convenience: run the ACL integration test against a throwaway OpenZaak-only
-# stack (fast iteration on the ACL gateway). Brings OpenZaak up, runs the shared
-# stack-agnostic check (infra/run-acl-integration.sh), then always tears down.
-#
-# CI does not use this — there the full stack is brought up once and the same runner
-# is invoked as a step (see the `verify-stack` job / Makefile `verify-*`). See ADR-0006.
-set -euo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-OZ_COMPOSE="$here/openzaak/docker-compose.yml"
-
-cleanup() {
-  docker compose -f "$OZ_COMPOSE" down --volumes >/dev/null 2>&1 || true
-  docker volume rm -f rr-oz-config >/dev/null 2>&1 || true
-}
-trap cleanup EXIT
-
-echo ">> bringing OpenZaak up"
-bash "$here/seed-config.sh" oz
-docker compose -f "$OZ_COMPOSE" up -d
-
-echo ">> waiting for the OpenZaak API container to be healthy"
-for _ in $(seq 1 140); do
-  oz="$(docker ps -q --filter 'name=[-_]openzaak[-_]' | head -1)"
-  if [ -n "$oz" ] && [ "$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{end}}' "$oz" 2>/dev/null || true)" = healthy ]; then
-    break
-  fi
-  sleep 3
-done
-[ -n "${oz:-}" ] || { echo "ERROR: OpenZaak never came up" >&2; exit 1; }
-
-bash "$here/run-acl-integration.sh"
--- a/infra/run-notification-check.sh
+++ b/infra/run-notification-check.sh
@@ -1,72 +0,0 @@
-#!/usr/bin/env bash
-#
-# Verify the OpenZaak → NRC notification path against an ALREADY-RUNNING oz+nrc stack
-# (the standalone stack via `make verify-notifications`, or the full compose stack in
-# the CI `verify-stack` job). Seeds a published BIG zaaktype (idempotent), registers
-# an abonnement to a webhook sink, creates a zaak, and asserts the sink receives the
-# `zaken`/`create` notification. All in-network, reaching services by container IP
-# (single-label hosts aren't URL-valid; the runner can't reach published ports).
-#
-# Does NOT manage the stack lifecycle (the caller owns bring-up + teardown), but it
-# cleans up the throwaway sink/driver it creates. Plain docker primitives only.
-# See ADR-0007.
-set -euo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-SINK_AUTH="Bearer notification-sink-token"
-
-cleanup() { docker rm -f rr-nsink rr-nverify >/dev/null 2>&1 || true; }
-trap cleanup EXIT
-
-ip() { docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$1"; }
-
-oz="$(docker ps -q --filter 'name=[-_]openzaak[-_]' | head -1)"
-nrc="$(docker ps -q --filter 'name=nrc-web' | head -1)"
-[ -n "$oz" ] && [ -n "$nrc" ] || { echo "ERROR: OpenZaak and/or NRC not running — bring the stack up first" >&2; exit 1; }
-net="$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{"\n"}}{{end}}' "$oz" | head -1)"
-oz_ip="$(ip "$oz")"; nrc_ip="$(ip "$nrc")"
-echo ">> network=$net openzaak=$oz_ip nrc=$nrc_ip"
-
-echo ">> seeding a published BIG zaaktype (idempotent)"
-sid="$(docker create --network "$net" -e "OZ_BASE=http://$oz_ip:8000" -e OZ_PUBLISH=1 \
-  python:3-slim python /seed.py)"
-docker cp "$here/openzaak/seed_catalogus.py" "$sid:/seed.py" >/dev/null
-docker start -a "$sid"
-docker rm -f "$sid" >/dev/null
-
-echo ">> starting the webhook sink"
-docker rm -f rr-nsink >/dev/null 2>&1 || true
-sink="$(docker create --network "$net" --name rr-nsink -e "EXPECTED_AUTH=$SINK_AUTH" \
-  python:3-slim python /sink.py)"
-docker cp "$here/notification-sink.py" "$sink:/sink.py" >/dev/null
-docker start "$sink" >/dev/null
-sleep 1
-sink_ip="$(ip rr-nsink)"
-echo ">> sink at $sink_ip:9000"
-
-echo ">> registering abonnement + creating a zaak"
-docker rm -f rr-nverify >/dev/null 2>&1 || true
-drv="$(docker create --network "$net" --name rr-nverify \
-  -e "OZ_BASE=http://$oz_ip:8000" -e "NRC_BASE=http://$nrc_ip:8000" \
-  -e "SINK_CALLBACK=http://$sink_ip:9000/" -e "SINK_AUTH=$SINK_AUTH" \
-  python:3-slim python /driver.py)"
-docker cp "$here/verify-notification-driver.py" "$drv:/driver.py" >/dev/null
-docker start -a "$drv"
-zaak_url="$(docker logs rr-nverify 2>/dev/null | sed -n 's/^ZAAK_CREATED //p' | head -1)"
-docker rm -f rr-nverify >/dev/null
-[ -n "$zaak_url" ] || { echo "ERROR: driver did not create a zaak" >&2; exit 1; }
-zaak_uuid="${zaak_url##*/}"
-echo ">> zaak created: $zaak_url"
-
-echo ">> waiting for the notification to reach the sink"
-for _ in $(seq 1 30); do
-  if docker logs rr-nsink 2>&1 | grep -q "$zaak_uuid"; then
-    echo "OK — NRC delivered the zaken notification for zaak $zaak_uuid to the sink"
-    docker logs rr-nsink 2>&1 | grep "$zaak_uuid" | tail -1 | cut -c1-300
-    exit 0
-  fi
-  sleep 2
-done
-echo "FAIL — the sink never received a notification for zaak $zaak_uuid" >&2
-echo "--- sink log ---" >&2; docker logs rr-nsink 2>&1 | tail -8 >&2
-exit 1
--- a/infra/run-projection-check.sh
+++ b/infra/run-projection-check.sh
@@ -1,68 +0,0 @@
-#!/usr/bin/env bash
-#
-# Verify the end-to-end read-projection path (S-06) against an ALREADY-RUNNING full stack:
-# OpenZaak → NRC → Event Subscriber → projection → projection-api. Seeds a published BIG
-# zaaktype (idempotent), registers an abonnement on the `zaken` kanaal pointing at the real
-# Event Subscriber's /notifications callback (with the bearer it enforces), creates a zaak,
-# and asserts projection-api serves a row for that zaak with status INGEDIEND.
-#
-# All in-network, reaching services by container IP — single-label hosts aren't URL-valid and
-# the runner can't reach published ports (gitea-actions-gotchas.md §5/§6). Reuses the
-# notification driver to register the abonnement + create the zaak. Does NOT manage the stack
-# lifecycle (the caller owns bring-up + teardown). Plain docker primitives only. See ADR-0007/0008.
-set -euo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-WEBHOOK_AUTH="${NOTIFICATION_WEBHOOK_TOKEN:-Bearer big-reference-notifications}"
-
-cleanup() { docker rm -f rr-pverify rr-pquery >/dev/null 2>&1 || true; }
-trap cleanup EXIT
-
-ip() { docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$1"; }
-
-oz="$(docker ps -q --filter 'name=[-_]openzaak[-_]' | head -1)"
-nrc="$(docker ps -q --filter 'name=nrc-web' | head -1)"
-es="$(docker ps -q --filter 'name=event-subscriber' | head -1)"
-proj="$(docker ps -q --filter 'name=projection-api' | head -1)"
-[ -n "$oz" ] && [ -n "$nrc" ] || { echo "ERROR: OpenZaak and/or NRC not running — bring the stack up first" >&2; exit 1; }
-[ -n "$es" ] && [ -n "$proj" ] || { echo "ERROR: event-subscriber and/or projection-api not running — bring the stack up first" >&2; exit 1; }
-net="$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{"\n"}}{{end}}' "$oz" | head -1)"
-oz_ip="$(ip "$oz")"; nrc_ip="$(ip "$nrc")"; es_ip="$(ip "$es")"; proj_ip="$(ip "$proj")"
-echo ">> network=$net openzaak=$oz_ip nrc=$nrc_ip event-subscriber=$es_ip projection-api=$proj_ip"
-
-echo ">> seeding a published BIG zaaktype (idempotent)"
-sid="$(docker create --network "$net" -e "OZ_BASE=http://$oz_ip:8000" -e OZ_PUBLISH=1 \
-  python:3-slim python /seed.py)"
-docker cp "$here/openzaak/seed_catalogus.py" "$sid:/seed.py" >/dev/null
-docker start -a "$sid"
-docker rm -f "$sid" >/dev/null
-
-echo ">> registering abonnement at the Event Subscriber + creating a zaak"
-docker rm -f rr-pverify >/dev/null 2>&1 || true
-drv="$(docker create --network "$net" --name rr-pverify \
-  -e "OZ_BASE=http://$oz_ip:8000" -e "NRC_BASE=http://$nrc_ip:8000" \
-  -e "SINK_CALLBACK=http://$es_ip:8080/notifications" -e "SINK_AUTH=$WEBHOOK_AUTH" \
-  python:3-slim python /driver.py)"
-docker cp "$here/verify-notification-driver.py" "$drv:/driver.py" >/dev/null
-docker start -a "$drv"
-zaak_url="$(docker logs rr-pverify 2>/dev/null | sed -n 's/^ZAAK_CREATED //p' | head -1)"
-docker rm -f rr-pverify >/dev/null
-[ -n "$zaak_url" ] || { echo "ERROR: driver did not create a zaak" >&2; exit 1; }
-zaak_uuid="${zaak_url##*/}"
-echo ">> zaak created: $zaak_url"
-
-echo ">> polling projection-api for the projected row (status INGEDIEND)"
-for _ in $(seq 1 30); do
-  body="$(docker run --rm --network "$net" curlimages/curl:latest \
-    -fsS "http://$proj_ip:8080/register/$zaak_uuid" 2>/dev/null || true)"
-  if echo "$body" | grep -q '"INGEDIEND"'; then
-    echo "OK — projection-api serves zaak $zaak_uuid with status INGEDIEND"
-    echo "$body" | cut -c1-300
-    exit 0
-  fi
-  sleep 2
-done
-echo "FAIL — projection-api never served an INGEDIEND row for zaak $zaak_uuid" >&2
-echo "--- event-subscriber log ---" >&2; docker logs "$es" 2>&1 | tail -10 >&2
-echo "--- projection-api log ---" >&2; docker logs "$proj" 2>&1 | tail -10 >&2
-exit 1
--- a/infra/seed-config.sh
+++ b/infra/seed-config.sh
@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-#
-# Populate the external named *config* volumes that the upstream services mount,
-# by `docker cp`-ing files into a throwaway helper container that mounts each one.
-#
-# Why: the compose stack uses the upstream images verbatim (no build). On Gitea's
-# containerized runner, `docker compose` starts the stack as SIBLING containers
-# via the host daemon, so a workspace bind mount resolves to a path the daemon
-# can't see and is mounted empty. `docker cp` instead streams bytes over the
-# Docker API, so the files reach the volume regardless of where the daemon runs.
-# We use plain docker primitives (volume create / run / cp / rm) rather than
-# `docker compose create`, because podman-compose (local dev) lacks that
-# subcommand. Fixed-name `external` volumes keep the names deterministic across
-# both runtimes. See docs/runbooks/gitea-actions-gotchas.md.
-#
-# Usage: seed-config.sh <key> [<key> ...]   where key ∈ { oz, kc, fl }
-set -euo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-HELPER="${SEED_HELPER_IMAGE:-docker.io/library/busybox:stable}"
-
-populate() {  # volume  source(file or dir/.)
-  local vol="$1" src="$2" cid
-  docker volume rm -f "$vol" >/dev/null 2>&1 || true
-  docker volume create "$vol" >/dev/null
-  # A *created* (never started) helper is enough: the volume is attached at create
-  # time, `docker cp` writes through to it, and `docker rm` is instant (nothing to
-  # stop). `docker create` is a container subcommand both docker and podman have —
-  # unlike `docker compose create`, which podman-compose lacks.
-  cid="$(docker create -v "$vol:/dest" "$HELPER" true)"
-  docker cp "$src" "$cid:/dest/"
-  docker rm "$cid" >/dev/null
-  echo "  seeded $vol"
-}
-
-[ "$#" -gt 0 ] || { echo "usage: seed-config.sh <oz|nrc|kc|fl> ..." >&2; exit 2; }
-
-for key in "$@"; do
-  case "$key" in
-    oz) populate rr-oz-config "$here/openzaak/setup_configuration/." ;;
-    nrc) populate rr-nrc-config "$here/opennotificaties/setup_configuration/." ;;
-    kc) populate rr-kc-realms "$here/keycloak/realms/." ;;
-    fl) populate rr-fl-bpmn  "$here/../workflows/registratie.bpmn" ;;
-    *)  echo "unknown seed key: $key" >&2; exit 2 ;;
-  esac
-done
--- a/infra/verify-notification-driver.py
+++ b/infra/verify-notification-driver.py
@@ -1,90 +0,0 @@
-#!/usr/bin/env python3
-"""Drive the OpenZaak → NRC notification check from *inside* the compose network.
-
-Registers an abonnement on the `zaken` kanaal pointing at a webhook sink, then
-creates a zaak against the published BIG zaaktype. OpenZaak publishes a
-`zaken`/`create` notification; NRC delivers it to the sink. The host harness
-(infra/verify-notifications.sh) then asserts the sink received it.
-
-Reached by container IP, not service name: OpenZaak/NRC validate URLs with Django's
-URLValidator, which rejects a single-label host like `openzaak`. Stdlib only.
-Env: OZ_BASE, NRC_BASE, SINK_CALLBACK, SINK_AUTH, OZ_CLIENT_ID, OZ_SECRET.
-"""
-import base64
-import hashlib
-import hmac
-import json
-import os
-import sys
-import time
-import urllib.error
-import urllib.request
-
-OZ = os.environ["OZ_BASE"].rstrip("/")
-NRC = os.environ["NRC_BASE"].rstrip("/")
-SINK_CALLBACK = os.environ["SINK_CALLBACK"]
-SINK_AUTH = os.environ.get("SINK_AUTH", "Bearer notification-sink-token")
-CID = os.environ.get("OZ_CLIENT_ID", "big-reference-seed")
-SECRET = os.environ.get("OZ_SECRET", "insecure-dev-secret-change-me")
-RSIN = "517439943"
-
-
-def token():
-    b64 = lambda b: base64.urlsafe_b64encode(b).rstrip(b"=")
-    seg = (
-        b64(json.dumps({"alg": "HS256", "typ": "JWT"}, separators=(",", ":")).encode())
-        + b"."
-        + b64(json.dumps(
-            {"iss": CID, "iat": int(time.time()), "client_id": CID,
-             "user_id": "verify", "user_representation": "verify"},
-            separators=(",", ":")).encode())
-    )
-    return (seg + b"." + b64(hmac.new(SECRET.encode(), seg, hashlib.sha256).digest())).decode()
-
-
-def call(method, url, body=None, crs=False):
-    headers = {"Authorization": "Bearer " + token(),
-               "Content-Type": "application/json", "Accept": "application/json"}
-    if crs:
-        headers["Accept-Crs"] = "EPSG:4326"
-        headers["Content-Crs"] = "EPSG:4326"
-    data = json.dumps(body).encode() if body is not None else None
-    try:
-        with urllib.request.urlopen(
-            urllib.request.Request(url, data=data, method=method, headers=headers), timeout=30
-        ) as r:
-            return r.status, json.loads(r.read() or "null")
-    except urllib.error.HTTPError as e:
-        return e.code, json.loads(e.read() or "null")
-
-
-def main():
-    status, ab = call("POST", f"{NRC}/api/v1/abonnement", {
-        "callbackUrl": SINK_CALLBACK,
-        "auth": SINK_AUTH,
-        "kanalen": [{"naam": "zaken", "filters": {}}],
-    })
-    if status != 201:
-        sys.exit(f"create abonnement -> {status}: {json.dumps(ab)}")
-    print(f"abonnement: {ab['url']}")
-
-    status, body = call(
-        "GET", f"{OZ}/catalogi/api/v1/zaaktypen?identificatie=BIG-REGISTRATIE&status=definitief")
-    results = body.get("results", []) if status == 200 else []
-    if not results:
-        sys.exit("no published BIG-REGISTRATIE zaaktype — seed with OZ_PUBLISH=1 first")
-    zaaktype = results[0]["url"]
-
-    status, zaak = call("POST", f"{OZ}/zaken/api/v1/zaken", {
-        "bronorganisatie": RSIN, "verantwoordelijkeOrganisatie": RSIN,
-        "zaaktype": zaaktype, "startdatum": time.strftime("%Y-%m-%d"),
-        "vertrouwelijkheidaanduiding": "openbaar",
-    }, crs=True)
-    if status != 201:
-        sys.exit(f"create zaak -> {status}: {json.dumps(zaak)}")
-    # The harness greps the sink for this exact URL.
-    print(f"ZAAK_CREATED {zaak['url']}")
-
-
-if __name__ == "__main__":
-    main()
--- a/infra/verify-notifications.sh
+++ b/infra/verify-notifications.sh
@@ -1,41 +0,0 @@
-#!/usr/bin/env bash
-#
-# Local convenience: verify the OpenZaak → NRC notification path against a throwaway
-# oz+nrc stack. Brings both up (notifications enabled), runs the shared stack-agnostic
-# check (infra/run-notification-check.sh), then always tears down.
-#
-# CI does not use this — there the full stack is brought up once and the same runner
-# is invoked as a step (see the `verify-stack` job / Makefile `verify-*`). See ADR-0007.
-set -euo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-OZ_COMPOSE="$here/openzaak/docker-compose.yml"
-NRC_COMPOSE="$here/opennotificaties/docker-compose.yml"
-
-cleanup() {
-  docker compose -f "$OZ_COMPOSE" -f "$NRC_COMPOSE" down --volumes >/dev/null 2>&1 || true
-  docker volume rm -f rr-oz-config rr-nrc-config >/dev/null 2>&1 || true
-}
-trap cleanup EXIT
-
-wait_healthy() {  # name-regex
-  local re="$1" cid
-  for _ in $(seq 1 140); do
-    cid="$(docker ps -q --filter "name=$re" | head -1)"
-    if [ -n "$cid" ] && [ "$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{end}}' "$cid" 2>/dev/null || true)" = healthy ]; then
-      return 0
-    fi
-    sleep 3
-  done
-  return 1
-}
-
-echo ">> bringing up OpenZaak + Open Notificaties (notifications enabled)"
-bash "$here/seed-config.sh" oz nrc
-OZ_NOTIFICATIONS_DISABLED=false docker compose -f "$OZ_COMPOSE" -f "$NRC_COMPOSE" up -d
-
-echo ">> waiting for OpenZaak + NRC to be healthy"
-wait_healthy '[-_]openzaak[-_]' || { echo "ERROR: OpenZaak not healthy" >&2; exit 1; }
-wait_healthy 'nrc-web' || { echo "ERROR: NRC not healthy" >&2; exit 1; }
-
-bash "$here/run-notification-check.sh"
--- a/infra/wait-healthy.sh
+++ b/infra/wait-healthy.sh
@@ -1,36 +0,0 @@
-#!/usr/bin/env bash
-#
-# Wait until the named compose services report a healthy healthcheck.
-#
-# Portable across `docker compose` (CI) and `podman-compose` (local dev): it uses
-# plain `docker ps` + `docker inspect`, so it needs neither `docker compose
-# up --wait` (podman-compose doesn't implement that flag) nor host port access
-# (the containerized CI runner can't reach published ports). It also sidesteps the
-# `--wait`-fails-when-a-one-shot-exits issue, since we only poll long-running
-# services that declare a healthcheck. See docs/runbooks/gitea-actions-gotchas.md.
-#
-# Usage: WAIT_TIMEOUT=420 wait-healthy.sh <service> [<service> ...]
-set -euo pipefail
-
-timeout="${WAIT_TIMEOUT:-420}"
-deadline=$(( $(date +%s) + timeout ))
-
-# compose service name -> container id. The name filter matches both docker
-# compose ("infra-openzaak-1") and podman-compose ("infra_openzaak_1") naming.
-cid_for() { docker ps -aq --filter "name=$1" | head -1; }
-
-for svc in "$@"; do
-  echo "waiting for '$svc' to be healthy (timeout ${timeout}s)..."
-  while :; do
-    cid="$(cid_for "$svc")"
-    status=""
-    [ -n "$cid" ] && status="$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}' "$cid" 2>/dev/null || true)"
-    [ "$status" = "healthy" ] && { echo "  '$svc' is healthy"; break; }
-    if [ "$(date +%s)" -ge "$deadline" ]; then
-      echo "TIMEOUT: '$svc' not healthy (status=${status:-no-container})" >&2
-      docker ps -a --filter "name=$svc" >&2 || true
-      exit 1
-    fi
-    sleep 3
-  done
-done
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -1,52 +0,0 @@
-site_name: register-referentie
-site_description: Reference application for Respellion's Common Ground architecture pattern
-docs_dir: docs
-
-theme:
-  name: material
-  features:
-    - navigation.sections
-    - navigation.top
-    - content.code.copy
-  palette:
-    - scheme: default
-      toggle:
-        icon: material/brightness-7
-        name: Switch to dark mode
-    - scheme: slate
-      toggle:
-        icon: material/brightness-4
-        name: Switch to light mode
-
-nav:
-  - Home: index.md
-  - Product Requirements: PRD.md
-  - Architecture:
-      - "ADR-0001: Loose coupling": architecture/adr-0001-loose-coupling.md
-      - "ADR-0002: Catalogus design": architecture/adr-0002-catalogus-design.md
-      - "ADR-0003: ACL default-fill": architecture/adr-0003-default-fill.md
-      - "ADR-0004: BDD framework": architecture/adr-0004-bdd-framework.md
-      - "ADR-0005: Mutation testing": architecture/adr-0005-mutation-testing.md
-      - "ADR-0006: ACL integration test provisioning": architecture/adr-0006-integration-test-provisioning.md
-      - "ADR-0007: OpenZaak → NRC notification wiring": architecture/adr-0007-notification-wiring.md
-      - "ADR-0008: Read projection store": architecture/adr-0008-read-projection-store.md
-      - "ADR-0009: External-task job worker": architecture/adr-0009-external-task-job-worker.md
-      - "ADR-0010: BFF OIDC validation": architecture/adr-0010-bff-oidc.md
-  - Working in Gitea: gitea-workflow.md
-  - Frontend decisions: frontend-decisions.md
-  - Demo script: demo-script.md
-  - Runbooks:
-      - CI: runbooks/ci.md
-
-markdown_extensions:
-  - admonition
-  - toc:
-      permalink: true
-  - pymdownx.superfences
-
-# Many docs referenced by PRD.md land in later slices; don't fail the build on them.
-validation:
-  nav:
-    omitted_files: warn
-  links:
-    not_found: warn
--- a/nx.json
+++ b/nx.json
@@ -1,120 +0,0 @@
-{
-  "$schema": "./node_modules/nx/schemas/nx-schema.json",
-  "namedInputs": {
-    "default": [
-      "{projectRoot}/**/*",
-      "sharedGlobals"
-    ],
-    "production": [
-      "default",
-      "!{projectRoot}/.eslintrc.json",
-      "!{projectRoot}/eslint.config.mjs",
-      "!{projectRoot}/**/?(*.)+(spec|test).[jt]s?(x)?(.snap)",
-      "!{projectRoot}/tsconfig.spec.json",
-      "!{projectRoot}/src/test-setup.[jt]s",
-      "!{projectRoot}/jest.config.[jt]s",
-      "!{projectRoot}/test-setup.[jt]s"
-    ],
-    "sharedGlobals": []
-  },
-  "targetDefaults": {
-    "@angular/build:application": {
-      "cache": true,
-      "dependsOn": [
-        "^build"
-      ],
-      "inputs": [
-        "production",
-        "^production"
-      ]
-    },
-    "@nx/eslint:lint": {
-      "cache": true,
-      "inputs": [
-        "default",
-        "^default",
-        "{workspaceRoot}/.eslintrc.json",
-        "{workspaceRoot}/.eslintignore",
-        "{workspaceRoot}/eslint.config.mjs",
-        "{workspaceRoot}/tools/eslint-rules/**/*"
-      ]
-    },
-    "@nx/esbuild:esbuild": {
-      "cache": true,
-      "dependsOn": [
-        "^build"
-      ],
-      "inputs": [
-        "production",
-        "^production"
-      ]
-    },
-    "@nx/js:tsc": {
-      "cache": true,
-      "dependsOn": [
-        "^build"
-      ],
-      "inputs": [
-        "production",
-        "^production"
-      ]
-    },
-    "@nx/vitest:test": {
-      "cache": true,
-      "inputs": [
-        "default",
-        "^production"
-      ]
-    },
-    "@angular/build:unit-test": {
-      "cache": true,
-      "inputs": [
-        "default",
-        "^production"
-      ]
-    }
-  },
-  "plugins": [
-    {
-      "plugin": "@nx/eslint/plugin",
-      "options": {
-        "targetName": "lint"
-      }
-    },
-    {
-      "plugin": "@nx/vite/plugin",
-      "options": {
-        "buildTargetName": "build",
-        "serveTargetName": "serve",
-        "devTargetName": "dev",
-        "previewTargetName": "preview",
-        "serveStaticTargetName": "serve-static",
-        "typecheckTargetName": "typecheck",
-        "buildDepsTargetName": "build-deps",
-        "watchDepsTargetName": "watch-deps"
-      }
-    },
-    {
-      "plugin": "@nx/vitest",
-      "options": {
-        "testTargetName": "vite:test"
-      }
-    }
-  ],
-  "generators": {
-    "@nx/angular:application": {
-      "e2eTestRunner": "playwright",
-      "linter": "eslint",
-      "style": "css",
-      "unitTestRunner": "vitest-analog"
-    },
-    "@nx/angular:library": {
-      "linter": "eslint",
-      "unitTestRunner": "vitest-analog"
-    },
-    "@nx/angular:component": {
-      "style": "css"
-    }
-  },
-  "analytics": false
-}
--- a/package.json
+++ b/package.json
@@ -1,64 +0,0 @@
-{
-  "name": "register-referentie",
-  "version": "0.0.0",
-  "license": "MIT",
-  "scripts": {},
-  "private": true,
-  "dependencies": {
-    "@angular-devkit/build-angular": "21.2.7",
-    "@angular/common": "21.2.9",
-    "@angular/compiler": "21.2.9",
-    "@angular/core": "21.2.9",
-    "@angular/forms": "21.2.9",
-    "@angular/platform-browser": "21.2.9",
-    "@angular/router": "21.2.9",
-    "rxjs": "~7.8.0",
-    "zone.js": "0.16.0"
-  },
-  "devDependencies": {
-    "@analogjs/vite-plugin-angular": "2.2.0",
-    "@analogjs/vitest-angular": "2.2.0",
-    "@angular-devkit/core": "21.2.7",
-    "@angular-devkit/schematics": "21.2.7",
-    "@angular/build": "21.2.7",
-    "@angular/cli": "21.2.7",
-    "@angular/compiler-cli": "21.2.9",
-    "@angular/language-service": "21.2.9",
-    "@eslint/js": "^9.8.0",
-    "@nx/angular": "23.0.1",
-    "@nx/devkit": "23.0.1",
-    "@nx/esbuild": "23.0.1",
-    "@nx/eslint": "23.0.1",
-    "@nx/eslint-plugin": "23.0.1",
-    "@nx/js": "23.0.1",
-    "@nx/vite": "23.0.1",
-    "@nx/vitest": "23.0.1",
-    "@nx/web": "23.0.1",
-    "@nx/workspace": "23.0.1",
-    "@oxc-project/runtime": "^0.115.0",
-    "@schematics/angular": "21.2.7",
-    "@swc-node/register": "1.11.1",
-    "@swc/core": "1.15.8",
-    "@swc/helpers": "0.5.18",
-    "@types/node": "20.19.9",
-    "@typescript-eslint/utils": "^8.40.0",
-    "@vitest/coverage-v8": "~4.1.0",
-    "@vitest/ui": "~4.1.0",
-    "angular-eslint": "21.3.1",
-    "esbuild": "^0.27.0",
-    "eslint": "^9.8.0",
-    "eslint-config-prettier": "^10.0.0",
-    "jiti": "2.4.2",
-    "jsdom": "~22.1.0",
-    "jsonc-eslint-parser": "^2.1.0",
-    "nx": "23.0.1",
-    "prettier": "^3.8.1",
-    "ts-node": "10.9.1",
-    "tslib": "^2.3.0",
-    "typescript": "~5.9.2",
-    "typescript-eslint": "^8.40.0",
-    "vite": "8.0.9",
-    "vite-tsconfig-paths": "^5.1.4",
-    "vitest": "~4.1.0"
-  }
-}
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,10 +0,0 @@
-packages: []
-allowBuilds:
-  '@parcel/watcher': true
-  less: true
-  esbuild: true
-  '@swc/core': true
-  nx: true
-  unrs-resolver: true
-  lmdb: true
-  msgpackr-extract: true
--- a/register-referentie.slnx
+++ b/register-referentie.slnx
@@ -1,33 +0,0 @@
-<Solution>
-  <Folder Name="/services/" />
-  <Folder Name="/services/acl/">
-    <Project Path="services/acl/Acl.Api/Acl.Api.csproj" />
-    <Project Path="services/acl/Acl.Application/Acl.Application.csproj" />
-    <Project Path="services/acl/Acl.Infrastructure/Acl.Infrastructure.csproj" />
-    <Project Path="services/acl/Acl.IntegrationTests/Acl.IntegrationTests.csproj" />
-    <Project Path="services/acl/Acl.Tests/Acl.Tests.csproj" />
-  </Folder>
-  <Folder Name="/services/domain/">
-    <Project Path="services/domain/Big.Domain/Big.Domain.csproj" />
-    <Project Path="services/domain/Big.Application/Big.Application.csproj" />
-    <Project Path="services/domain/Big.Infrastructure/Big.Infrastructure.csproj" />
-    <Project Path="services/domain/Big.Api/Big.Api.csproj" />
-    <Project Path="services/domain/Big.Tests/Big.Tests.csproj" />
-  </Folder>
-  <Folder Name="/services/bff/">
-    <Project Path="services/bff/Bff.Api/Bff.Api.csproj" />
-    <Project Path="services/bff/Bff.Tests/Bff.Tests.csproj" />
-  </Folder>
-  <Folder Name="/services/event-subscriber/">
-    <Project Path="services/event-subscriber/EventSubscriber.Api/EventSubscriber.Api.csproj" />
-    <Project Path="services/event-subscriber/EventSubscriber.Application/EventSubscriber.Application.csproj" />
-    <Project Path="services/event-subscriber/EventSubscriber.Tests/EventSubscriber.Tests.csproj" />
-  </Folder>
-  <Folder Name="/services/projection-api/">
-    <Project Path="services/projection-api/Projection.ReadModel/Projection.ReadModel.csproj" />
-    <Project Path="services/projection-api/ProjectionApi.Api/ProjectionApi.Api.csproj" />
-  </Folder>
-  <Folder Name="/tests/">
-    <Project Path="tests/acceptance/Acceptance.csproj" />
-  </Folder>
-</Solution>
--- a/services/acl/.dockerignore
+++ b/services/acl/.dockerignore
@@ -1,3 +0,0 @@
-**/bin
-**/obj
-**/*.user
--- a/services/acl/Acl.Api/Acl.Api.csproj
+++ b/services/acl/Acl.Api/Acl.Api.csproj
@@ -1,14 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk.Web">
-
-  <ItemGroup>
-    <ProjectReference Include="..\Acl.Application\Acl.Application.csproj" />
-    <ProjectReference Include="..\Acl.Infrastructure\Acl.Infrastructure.csproj" />
-  </ItemGroup>
-
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <Nullable>enable</Nullable>
-    <ImplicitUsings>enable</ImplicitUsings>
-  </PropertyGroup>
-
-</Project>
--- a/services/acl/Acl.Api/Program.cs
+++ b/services/acl/Acl.Api/Program.cs
@@ -1,31 +0,0 @@
-using Acl.Application;
-using Acl.Infrastructure;
-
-var builder = WebApplication.CreateBuilder(args);
-
-builder.Services.AddSingleton<IClock, SystemClock>();
-builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
-    .GetSection("Acl:Defaults").Get<AclDefaults>()
-    ?? throw new InvalidOperationException("Missing configuration section 'Acl:Defaults'"));
-builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
-    .GetSection("Acl:OpenZaak").Get<OpenZaakOptions>()
-    ?? throw new InvalidOperationException("Missing configuration section 'Acl:OpenZaak'"));
-builder.Services.AddHttpClient<IZaakGateway, OpenZaakGateway>();
-builder.Services.AddScoped<AclService>();
-
-var app = builder.Build();
-
-app.MapGet("/health", () => "Healthy");
-
-// The ACL's single operation, exposed as a service endpoint.
-app.MapPost("/zaken", async (OpenZaakRequest body, AclService acl, CancellationToken ct) =>
-{
-    var zaakUrl = await acl.OpenZaakAsync(new DomainRegistration(body.Bsn), ct);
-    return Results.Ok(new { zaakUrl = zaakUrl.ToString() });
-});
-
-app.Run();
-
-public sealed record OpenZaakRequest(string Bsn);
-
-public partial class Program;
--- a/services/acl/Acl.Api/Properties/launchSettings.json
+++ b/services/acl/Acl.Api/Properties/launchSettings.json
@@ -1,23 +0,0 @@
-{
-  "$schema": "https://json.schemastore.org/launchsettings.json",
-  "profiles": {
-    "http": {
-      "commandName": "Project",
-      "dotnetRunMessages": true,
-      "launchBrowser": true,
-      "applicationUrl": "http://localhost:5041",
-      "environmentVariables": {
-        "ASPNETCORE_ENVIRONMENT": "Development"
-      }
-    },
-    "https": {
-      "commandName": "Project",
-      "dotnetRunMessages": true,
-      "launchBrowser": true,
-      "applicationUrl": "https://localhost:7260;http://localhost:5041",
-      "environmentVariables": {
-        "ASPNETCORE_ENVIRONMENT": "Development"
-      }
-    }
-  }
-}
--- a/services/acl/Acl.Api/appsettings.Development.json
+++ b/services/acl/Acl.Api/appsettings.Development.json
@@ -1,8 +0,0 @@
-{
-  "Logging": {
-    "LogLevel": {
-      "Default": "Information",
-      "Microsoft.AspNetCore": "Warning"
-    }
-  }
-}
--- a/services/acl/Acl.Api/appsettings.json
+++ b/services/acl/Acl.Api/appsettings.json
@@ -1,9 +0,0 @@
-{
-  "Logging": {
-    "LogLevel": {
-      "Default": "Information",
-      "Microsoft.AspNetCore": "Warning"
-    }
-  },
-  "AllowedHosts": "*"
-}
--- a/services/acl/Acl.Application/Acl.Application.csproj
+++ b/services/acl/Acl.Application/Acl.Application.csproj
@@ -1,9 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <Nullable>enable</Nullable>
-  </PropertyGroup>
-
-</Project>
--- a/services/acl/Acl.Application/AclDefaults.cs
+++ b/services/acl/Acl.Application/AclDefaults.cs
@@ -1,10 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>Configured ZGW defaults the ACL fills in (ADR-0003).</summary>
-public sealed class AclDefaults
-{
-    public required string Bronorganisatie { get; init; }
-    public required string VerantwoordelijkeOrganisatie { get; init; }
-    public required string Vertrouwelijkheidaanduiding { get; init; }
-    public required Uri ZaaktypeUrl { get; init; }
-}
--- a/services/acl/Acl.Application/AclService.cs
+++ b/services/acl/Acl.Application/AclService.cs
@@ -1,20 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>The ACL's single operation: open a zaak from a domain payload,
-/// default-filling the ZGW-mandatory fields (ADR-0003).</summary>
-public sealed class AclService(IZaakGateway gateway, AclDefaults defaults, IClock clock)
-{
-    public Task<Uri> OpenZaakAsync(DomainRegistration registration, CancellationToken ct = default)
-    {
-        ArgumentNullException.ThrowIfNull(registration);
-
-        var request = new ZaakRequest(
-            defaults.Bronorganisatie,
-            defaults.VerantwoordelijkeOrganisatie,
-            defaults.Vertrouwelijkheidaanduiding,
-            defaults.ZaaktypeUrl,
-            clock.Today);
-
-        return gateway.OpenZaakAsync(request, ct);
-    }
-}
--- a/services/acl/Acl.Application/DomainRegistration.cs
+++ b/services/acl/Acl.Application/DomainRegistration.cs
@@ -1,4 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>Domain-language payload handed to the ACL. No ZGW concepts here.</summary>
-public sealed record DomainRegistration(string Bsn);
--- a/services/acl/Acl.Application/IClock.cs
+++ b/services/acl/Acl.Application/IClock.cs
@@ -1,7 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>Abstracts "today" so startdatum default-fill is deterministic in tests.</summary>
-public interface IClock
-{
-    DateOnly Today { get; }
-}
--- a/services/acl/Acl.Application/IZaakGateway.cs
+++ b/services/acl/Acl.Application/IZaakGateway.cs
@@ -1,8 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>Port to the ZGW Zaken API. Implemented in Infrastructure — the only
-/// code that talks to OpenZaak (ADR-0001).</summary>
-public interface IZaakGateway
-{
-    Task<Uri> OpenZaakAsync(ZaakRequest request, CancellationToken ct = default);
-}
--- a/services/acl/Acl.Application/ZaakRequest.cs
+++ b/services/acl/Acl.Application/ZaakRequest.cs
@@ -1,9 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>The fully default-filled zaak the gateway will create in OpenZaak.</summary>
-public sealed record ZaakRequest(
-    string Bronorganisatie,
-    string VerantwoordelijkeOrganisatie,
-    string Vertrouwelijkheidaanduiding,
-    Uri Zaaktype,
-    DateOnly Startdatum);
--- a/services/acl/Acl.Infrastructure/Acl.Infrastructure.csproj
+++ b/services/acl/Acl.Infrastructure/Acl.Infrastructure.csproj
@@ -1,13 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <ItemGroup>
-    <ProjectReference Include="..\Acl.Application\Acl.Application.csproj" />
-  </ItemGroup>
-
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <Nullable>enable</Nullable>
-  </PropertyGroup>
-
-</Project>
--- a/services/acl/Acl.Infrastructure/OpenZaakGateway.cs
+++ b/services/acl/Acl.Infrastructure/OpenZaakGateway.cs
@@ -1,53 +0,0 @@
-using System.Net.Http.Headers;
-using System.Net.Http.Json;
-using System.Text.Json.Serialization;
-using Acl.Application;
-
-namespace Acl.Infrastructure;
-
-/// <summary>The only code that talks to OpenZaak's Zaken API (ADR-0001).</summary>
-public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) : IZaakGateway
-{
-    public async Task<Uri> OpenZaakAsync(ZaakRequest request, CancellationToken ct = default)
-    {
-        ArgumentNullException.ThrowIfNull(request);
-
-        using var message = new HttpRequestMessage(
-            HttpMethod.Post, new Uri(options.BaseUrl, "/zaken/api/v1/zaken"))
-        {
-            Content = JsonContent.Create(new ZaakDto(
-                request.Bronorganisatie,
-                request.Zaaktype.ToString(),
-                request.VerantwoordelijkeOrganisatie,
-                request.Startdatum.ToString("yyyy-MM-dd"),
-                request.Vertrouwelijkheidaanduiding)),
-        };
-        message.Headers.Authorization =
-            new AuthenticationHeaderValue("Bearer", ZgwToken.Mint(options.ClientId, options.Secret));
-        // ZRC is a geo API; it requires the CRS headers.
-        message.Headers.Add("Accept-Crs", "EPSG:4326");
-        message.Content.Headers.Add("Content-Crs", "EPSG:4326");
-        // OpenZaak runs behind uwsgi, which rejects a chunked request body with 400.
-        // JsonContent streams without a known length (→ Transfer-Encoding: chunked),
-        // so buffer it first to send a Content-Length instead. Only a real OpenZaak
-        // surfaces this — a stubbed HttpMessageHandler accepts either framing.
-        await message.Content.LoadIntoBufferAsync(ct);
-
-        using var response = await http.SendAsync(message, ct);
-        response.EnsureSuccessStatusCode();
-
-        var created = await response.Content.ReadFromJsonAsync<ZaakCreatedDto>(ct)
-            ?? throw new InvalidOperationException("OpenZaak returned an empty zaak response");
-        return new Uri(created.Url);
-    }
-
-    private sealed record ZaakDto(
-        [property: JsonPropertyName("bronorganisatie")] string Bronorganisatie,
-        [property: JsonPropertyName("zaaktype")] string Zaaktype,
-        [property: JsonPropertyName("verantwoordelijkeOrganisatie")] string VerantwoordelijkeOrganisatie,
-        [property: JsonPropertyName("startdatum")] string Startdatum,
-        [property: JsonPropertyName("vertrouwelijkheidaanduiding")] string Vertrouwelijkheidaanduiding);
-
-    private sealed record ZaakCreatedDto(
-        [property: JsonPropertyName("url")] string Url);
-}
--- a/services/acl/Acl.Infrastructure/OpenZaakOptions.cs
+++ b/services/acl/Acl.Infrastructure/OpenZaakOptions.cs
@@ -1,9 +0,0 @@
-namespace Acl.Infrastructure;
-
-/// <summary>Connection + credential config for OpenZaak's ZGW APIs.</summary>
-public sealed class OpenZaakOptions
-{
-    public required Uri BaseUrl { get; init; }
-    public required string ClientId { get; init; }
-    public required string Secret { get; init; }
-}
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`/* You can add global styles to this file, and also import other style files */`