retrofit: reverse-spec zgw-api-mapping (5 REQs / 13 files)

[rubenvdlinde]

Retrofit — Reverse-Spec

Drafts 5 numbered REQs describing the procest-side ZGW API surface (controllers, ZgwService + helpers, auth middleware, default-mapping seeder).

Ghost change: retrofit-2026-05-24-zgw-api-mapping (delta merged into openspec/specs/zgw-api-mapping/spec.md).

What this PR does

• Adds retrofit_extensions: [REQ-001..REQ-005] to the main spec frontmatter
• Appends REQ-001..REQ-005 to the main spec inside a marked block
• Annotates 13 files with file-level @SPEC pointers (one per task)
• Scaffold under openspec/changes/retrofit-2026-05-24-zgw-api-mapping/

What this PR does NOT do

• No code logic changes — annotations + spec only
• Does not resolve the SendEmailHandler duplicate flagged in the coverage report (handled under automatic-actions cluster)
• Does not split the 32-method DrcController (future work)

REQ summary

1. REQ-001 — ZRC endpoints via ZrcController
2. REQ-002 — ZTC/DRC/BRC/NRC endpoints via dedicated controllers
3. REQ-003 — ZgwService shared mapping/runtime surface
4. REQ-004 — Bearer-token + vertrouwelijkheid filtering in ZgwAuthMiddleware
5. REQ-005 — Default ZGW mapping seed via LoadDefaultZgwMappings repair step

Source: openspec/coverage-report.md generated 2026-05-24 | Cluster: zgw-api-mapping

Refs #565

[github-actions]

Quality Report — ConductionNL/procest @ 803df0d

Check	PHP	Vue	Security	License	Tests
lint	❌
phpcs	❌
phpmd	❌
psalm	❌
phpstan	❌
phpmetrics	❌
eslint		✅
stylelint		✅
composer			❌	❌
npm			✅	✅ 426/426
PHPUnit					⏭️
Newman					⏭️
Playwright					⏭️

---

Quality workflow — 2026-05-24 18:51 UTC

Download the full PDF report from the workflow artifacts.