@nanobpm/nano-ide-app-embedded-graalvm-native 1.0.0

package/nano-ide.ext.json

@@ -0,0 +1,15 @@
+{
+  "id": "embedded-graalvm-native",
+  "kind": "app",
+  "displayName": "Embedded Nano (GraalVM Native Image)",
+  "fileTypes": [{ "ext": ".java", "monacoLang": "java" }],
+  "templates": [
+    { "id": "embedded-graalvm-starter", "label": "KYC microservice (GraalVM native) — same demo, ~30 MB standalone binary (ADR 0005)" }
+  ],
+  "toolchain": {
+    "detect": ["mvn", "-version"],
+    "run": ["./microservice/target/kyc-microservice"],
+    "compile": ["mvn", "-q", "-f", "microservice/pom.xml", "-Pnative", "-DskipTests", "package"],
+    "targets": []
+  }
+}

package/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "@nanobpm/nano-ide-app-embedded-graalvm-native",
+  "version": "1.0.0",
+  "description": "GraalVM Native Image variant of the embedded Nano JVM template: same Bernd-in-JVM code, compiled to a single standalone binary (~30 MB, no JDK required at runtime).",
+  "license": "Apache-2.0",
+  "keywords": ["nano-ide-ext", "nano-ide-app", "nanobpm", "embedded", "graalvm", "native-image", "bernd"],
+  "publishConfig": { "access": "public" },
+  "repository": { "type": "git", "url": "https://github.com/jwulf/nano-ide.git", "directory": "packages/app-embedded-graalvm-native" },
+  "files": ["nano-ide.ext.json", "templates"]
+}

package/templates/embedded-graalvm-starter/README.md

@@ -0,0 +1,64 @@
+# Embedded Nano — KYC microservice (GraalVM native binary)
+
+Same demo as `@nanobpm/nano-ide-app-embedded-jvm` — orchestration-of-
+orchestration with an outer BPMN on the Nano IDE gateway and an inner
+BPMN on a Bernd engine embedded in this microservice — but packaged as
+a **single ~30 MB standalone binary** via GraalVM Native Image. No JVM
+required at deploy time; ship a scratch container.
+
+See the sibling JVM template's README for the full architectural walk-
+through. This README covers only the native-image differences.
+
+## Prerequisites
+
+- **GraalVM for JDK 21+** with `native-image` on `PATH`
+  ```sh
+  sdk install java 21.0.4-graal
+  ```
+- Maven 3.9+
+
+## Build
+
+```sh
+cd microservice
+mvn -q -Pnative -DskipTests package
+```
+
+Produces `microservice/target/kyc-microservice` (~30 MB). Copy anywhere
+and run.
+
+## Run
+
+```sh
+./microservice/target/kyc-microservice
+# defaults to ws://localhost:8080/falcon; override:
+FALCON_URL=ws://gateway.example.com/falcon ./microservice/target/kyc-microservice
+```
+
+## What's inside the binary
+
+- `com.example.KycMicroservice` (main class)
+- The `kyc.bpmn` XML (packaged as a resource; kept by
+  `-H:IncludeResources=kyc/.*\.bpmn`)
+- The Nano engine's wasm blob shipped inside `nano-bernd` (kept by
+  `-H:IncludeResources=nano-bernd/.*`)
+- Chicory (pure-Java wasm interpreter — AOT-compiles cleanly)
+- Jackson + java.net.http WebSocket for the outer Falcon transport
+
+## Reflection config
+
+`microservice/src/main/resources/META-INF/native-image/reflect-config.json`
+flags the `EmbeddedEngine`, `ActivatedJob`, and `WasmManifest` types
+because `EmbeddedNanoTransport` (in `camunda-client-java-falcon`) uses
+reflection to talk to them — Graal's closed-world compilation needs this
+so the methods aren't stripped.
+
+## Notes
+
+- `native-image` uses ~4 GB RAM during compilation (`-J-Xmx4g` in the pom).
+- The resulting binary is dynamically-linked against libc; for fully-
+  static musl binaries add `--static --libc=musl` to `<buildArgs>` and
+  build on a Linux host with `musl-cross-compile`.
+- Cold start is single-digit milliseconds, so this variant is a good fit
+  for scale-to-zero / short-lived scheduled jobs where JVM warm-up would
+  dominate wall-clock time.

package/templates/embedded-graalvm-starter/microservice/pom.xml

@@ -0,0 +1,101 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <groupId>com.example</groupId>
+  <artifactId>kyc-microservice-native</artifactId>
+  <version>0.1.0</version>
+  <packaging>jar</packaging>
+
+  <name>KYC Microservice (GraalVM native)</name>
+  <description>
+    Same code as the JVM embedded starter, packaged as a GraalVM Native
+    Image single binary (~30 MB). The KYC microservice — including its
+    embedded Bernd engine and the packaged kyc.bpmn — becomes a
+    standalone executable with no JVM required at runtime.
+  </description>
+
+  <properties>
+    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+    <maven.compiler.source>21</maven.compiler.source>
+    <maven.compiler.target>21</maven.compiler.target>
+
+    <camunda-client.version>1.1.0-SNAPSHOT</camunda-client.version>
+    <nano-bernd.version>0.2.0</nano-bernd.version>
+    <native.maven.plugin.version>0.10.3</native.maven.plugin.version>
+  </properties>
+
+  <dependencies>
+    <dependency>
+      <groupId>io.github.jwulf</groupId>
+      <artifactId>camunda-client-java-falcon</artifactId>
+      <version>${camunda-client.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>io.github.jwulf</groupId>
+      <artifactId>nano-bernd</artifactId>
+      <version>${nano-bernd.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>slf4j-simple</artifactId>
+      <version>2.0.13</version>
+    </dependency>
+    <dependency>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter</artifactId>
+      <version>5.11.0</version>
+      <scope>test</scope>
+    </dependency>
+  </dependencies>
+
+  <profiles>
+    <profile>
+      <id>native</id>
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.graalvm.buildtools</groupId>
+            <artifactId>native-maven-plugin</artifactId>
+            <version>${native.maven.plugin.version}</version>
+            <extensions>true</extensions>
+            <executions>
+              <execution>
+                <id>build-native</id>
+                <goals><goal>compile-no-fork</goal></goals>
+                <phase>package</phase>
+              </execution>
+            </executions>
+            <configuration>
+              <imageName>kyc-microservice</imageName>
+              <mainClass>com.example.KycMicroservice</mainClass>
+              <buildArgs>
+                <buildArg>--no-fallback</buildArg>
+                <buildArg>-H:+UnlockExperimentalVMOptions</buildArg>
+                <!-- Embed both BPMN files and the wasm engine into the binary. -->
+                <buildArg>-H:IncludeResources=kyc/.*\.bpmn</buildArg>
+                <buildArg>-H:IncludeResources=nano-bernd/nano_engine\.wasm</buildArg>
+                <buildArg>-H:IncludeResources=nano-bernd/manifest\.json</buildArg>
+                <buildArg>-J-Xmx4g</buildArg>
+              </buildArgs>
+            </configuration>
+          </plugin>
+        </plugins>
+      </build>
+    </profile>
+  </profiles>
+
+  <build>
+    <plugins>
+      <plugin>
+        <artifactId>maven-jar-plugin</artifactId>
+        <version>3.4.2</version>
+        <configuration>
+          <archive><manifest><mainClass>com.example.KycMicroservice</mainClass></manifest></archive>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
+</project>

package/templates/embedded-graalvm-starter/microservice/src/main/java/com/example/KycMicroservice.java

@@ -0,0 +1,204 @@
+/*
+ * KYC Microservice — embedded-Nano demo (ADR 0005).
+ *
+ *   [ Nano IDE gateway ]                         [ This JVM process ]
+ *          │                                             │
+ *   models/onboarding.bpmn                        microservice/
+ *   (auto-deployed by IDE)                        └─ src/main/resources/kyc/kyc.bpmn
+ *          │                                             │
+ *          │  Falcon WebSocket (NanoTransport.falcon)    │
+ *          │◄──────────────── verify_kyc ────────────────┤
+ *          │                                             │
+ *          │                                     ┌───────┴───────┐
+ *          │                            starts inner instance
+ *          │                            on in-process Bernd engine
+ *          │                            (NanoTransport.embedded)
+ *          │                            │
+ *          │              check_id → screen_sanctions → check_pep → risk_score
+ *          │                            │
+ *          │              aggregates result to a KYC decision
+ *          │                                     │
+ *          │◄──── completeJob(decision) ────────┘
+ *
+ * Both engines are BPMN. Both are auditable. Onboarding team owns the
+ * outer file; compliance owns kyc.bpmn.
+ */
+package com.example;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.nanobpm.camunda.falcon.FalconTransport;
+import com.nanobpm.camunda.transport.NanoTransport;
+import io.github.jwulf.nano.bernd.EmbeddedEngine;
+import java.io.InputStream;
+import java.net.URI;
+import java.nio.charset.StandardCharsets;
+import java.util.Map;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+
+public final class KycMicroservice {
+
+  private static final String KYC_BPMN_RESOURCE = "/kyc/kyc.bpmn";
+
+  // Set FALCON_URL to override; defaults to the Nano IDE gateway's Falcon endpoint.
+  private static final String DEFAULT_FALCON_URL = "ws://localhost:8080/falcon";
+
+  public static void main(final String[] args) throws Exception {
+    final URI falconUrl = URI.create(
+        System.getenv().getOrDefault("FALCON_URL", DEFAULT_FALCON_URL));
+
+    // 1. Boot the in-process Bernd engine and deploy the inner KYC flow.
+    final EmbeddedEngine kycEngine = EmbeddedEngine.create();
+    final String kycBpmn = loadResource(KYC_BPMN_RESOURCE);
+    kycEngine.deploy(kycBpmn);
+    System.out.println("[boot] Bernd engine up; kyc.bpmn deployed (engine v"
+        + kycEngine.manifest().engineVersion() + ", ABI v" + kycEngine.manifest().abiVersion() + ")");
+
+    // 2. Open the Falcon transport to the outer gateway.
+    final NanoTransport outer = NanoTransport.falcon(falconUrl);
+    outer.connect().get(5, TimeUnit.SECONDS);
+    System.out.println("[boot] connected to outer gateway at " + falconUrl);
+
+    // 3. Subscribe to the outer 'verify_kyc' job. Each activation runs the
+    //    inner kyc.bpmn to completion on the embedded engine, then acks the
+    //    outer job with a { decision: approved|manual_review|rejected }
+    //    variable so the outer gateway routes correctly.
+    // NOTE: maxJobs=1 (serial). The embedded engine + per-instance KycContext
+    // are shared state driven by driveInnerFlow, so handling multiple outer
+    // verify_kyc activations concurrently would let inner activateJobs polls
+    // race across KycContexts. For higher throughput, run several
+    // microservice instances (or refactor to a per-invocation engine).
+    outer.subscribe(new FalconTransport.Subscription(
+        "verify_kyc", "kyc-microservice", 1, 30_000L, null,
+        (JsonNode job) -> handleVerifyKyc(job, kycEngine, outer))
+    ).get(5, TimeUnit.SECONDS);
+    System.out.println("[ready] subscribed to verify_kyc — start an onboarding instance in the IDE");
+
+    // Keep alive.
+    Runtime.getRuntime().addShutdownHook(new Thread(() -> {
+      try { outer.close(); } catch (final Exception ignored) { /* best effort */ }
+      try { kycEngine.close(); } catch (final Exception ignored) { /* best effort */ }
+    }));
+    new CountDownLatch(1).await();
+  }
+
+  private static void handleVerifyKyc(
+      final JsonNode job, final EmbeddedEngine kycEngine, final NanoTransport outer) {
+    final String outerJobKey = job.get("jobKey").asText();
+    final JsonNode vars = job.path("variables");
+    final String customerId = vars.path("customerId").asText("cust-unknown");
+
+    System.out.println();
+    System.out.println("═══════════════════════════════════════════════════════════════");
+    System.out.println("[outer] verify_kyc activated (jobKey=" + outerJobKey + ", customer=" + customerId + ")");
+    System.out.println("[inner] starting kyc.bpmn instance for " + customerId);
+
+    // Run the inner flow on Bernd. Aggregate check results in the context.
+    // If it throws, log and return WITHOUT completing the outer job so
+    // Nano's job timeout drives a retry.
+    final KycContext ctx = new KycContext(customerId);
+    final String decision;
+    try {
+      final String innerInstance = kycEngine.createInstance("kyc");
+      System.out.println("[inner] instance " + innerInstance + " running");
+      driveInnerFlow(kycEngine, ctx);
+      decision = ctx.aggregate();
+    } catch (final Exception e) {
+      System.err.println("[inner] flow failed for customer=" + customerId + ": " + e);
+      e.printStackTrace(System.err);
+      System.err.println("[outer] NOT completing verify_kyc — outer job will time out and retry");
+      return;
+    }
+
+    System.out.println("[inner] kyc.bpmn done — decision: " + decision);
+    System.out.println("[outer] completing verify_kyc with decision=" + decision);
+    System.out.println("═══════════════════════════════════════════════════════════════");
+
+    try {
+      // ABI v2 embedded engine ignores completeJob variables; but the OUTER
+      // gateway is the full Nano engine and does accept them, so the
+      // exclusive gateway in onboarding.bpmn can branch on `decision`.
+      outer.completeJob(outerJobKey, Map.of("decision", decision, "customerId", customerId))
+          .get(5, TimeUnit.SECONDS);
+    } catch (final Exception e) {
+      System.err.println("[outer] complete failed: " + e.getMessage());
+    }
+  }
+
+  /**
+   * Drive the inner flow by polling activateJobs on the embedded engine for
+   * each step type in order. Each step is a Java lambda that mutates the
+   * context and prints a console line — like a Camunda job worker, but
+   * in-process. Once the last step's job completes and the inner instance
+   * reaches its end event, this method returns.
+   */
+  private static void driveInnerFlow(final EmbeddedEngine engine, final KycContext ctx) {
+    step(engine, ctx, "check_id", (c) -> {
+      c.idValid = true;   // real impl would OCR + verify against issuing authority
+      System.out.println("  [inner:check_id] ID document verified ✓");
+    });
+    step(engine, ctx, "screen_sanctions", (c) -> {
+      c.sanctionsHit = false;
+      System.out.println("  [inner:screen_sanctions] OFAC + UN lists clear ✓");
+    });
+    step(engine, ctx, "check_pep", (c) -> {
+      c.pepMatch = c.customerId.startsWith("vip-");   // demo: 'vip-*' triggers PEP path
+      System.out.println("  [inner:check_pep] PEP list " + (c.pepMatch ? "MATCH ⚠" : "clear ✓"));
+    });
+    step(engine, ctx, "risk_score", (c) -> {
+      // Demo heuristic. Real world: a rules engine or ML model.
+      c.riskScore = c.pepMatch ? 75 : (c.sanctionsHit ? 100 : 15);
+      System.out.println("  [inner:risk_score] score = " + c.riskScore);
+    });
+  }
+
+  /** Poll activateJobs for one job of the given type, run the lambda, complete. */
+  private static void step(
+      final EmbeddedEngine engine, final KycContext ctx, final String type,
+      final java.util.function.Consumer<KycContext> handler) {
+    final long deadline = System.currentTimeMillis() + 5_000L;
+    while (System.currentTimeMillis() < deadline) {
+      final var jobs = engine.activateJobs(type, "kyc-inner", 1, 30_000L);
+      if (!jobs.isEmpty()) {
+        final var job = jobs.get(0);
+        handler.accept(ctx);
+        engine.completeJob(job.key());
+        return;
+      }
+      try {
+        Thread.sleep(10);
+      } catch (final InterruptedException ie) {
+        Thread.currentThread().interrupt();
+        throw new IllegalStateException(
+            "inner flow interrupted while waiting for " + type + " job", ie);
+      }
+    }
+    throw new IllegalStateException("inner flow stalled: no " + type + " job appeared within 5s");
+  }
+
+  private static String loadResource(final String path) throws Exception {
+    try (InputStream in = KycMicroservice.class.getResourceAsStream(path)) {
+      if (in == null) throw new IllegalStateException("missing resource: " + path);
+      return new String(in.readAllBytes(), StandardCharsets.UTF_8);
+    }
+  }
+
+  /** Per-customer aggregation of the inner check results. */
+  static final class KycContext {
+    final String customerId;
+    boolean idValid;
+    boolean sanctionsHit;
+    boolean pepMatch;
+    int riskScore;
+
+    KycContext(final String customerId) { this.customerId = customerId; }
+
+    String aggregate() {
+      if (!idValid || sanctionsHit) return "rejected";
+      if (pepMatch || riskScore >= 70) return "manual_review";
+      return "approved";
+    }
+  }
+
+  private KycMicroservice() {}
+}

package/templates/embedded-graalvm-starter/microservice/src/main/resources/META-INF/native-image/reflect-config.json

@@ -0,0 +1,26 @@
+[
+  {
+    "name": "io.github.jwulf.nano.bernd.EmbeddedEngine",
+    "allDeclaredConstructors": true,
+    "allPublicConstructors": true,
+    "allDeclaredMethods": true,
+    "allPublicMethods": true,
+    "allDeclaredFields": true
+  },
+  {
+    "name": "io.github.jwulf.nano.bernd.ActivatedJob",
+    "allDeclaredConstructors": true,
+    "allPublicConstructors": true,
+    "allDeclaredMethods": true,
+    "allPublicMethods": true,
+    "allDeclaredFields": true
+  },
+  {
+    "name": "io.github.jwulf.nano.bernd.WasmManifest",
+    "allDeclaredConstructors": true,
+    "allPublicConstructors": true,
+    "allDeclaredMethods": true,
+    "allPublicMethods": true,
+    "allDeclaredFields": true
+  }
+]

package/templates/embedded-graalvm-starter/microservice/src/main/resources/META-INF/native-image/resource-config.json

@@ -0,0 +1,9 @@
+{
+  "resources": {
+    "includes": [
+      { "pattern": "kyc/.*\\.bpmn" },
+      { "pattern": "nano-bernd/nano_engine\\.wasm" },
+      { "pattern": "nano-bernd/manifest\\.json" }
+    ]
+  }
+}

package/templates/embedded-graalvm-starter/microservice/src/main/resources/kyc/kyc.bpmn

@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<bpmn:definitions xmlns:bpmn="http://www.omg.org/spec/BPMN/20100524/MODEL"
+                  xmlns:zeebe="http://camunda.org/schema/zeebe/1.0"
+                  targetNamespace="http://example.com/kyc"
+                  id="kyc_defs">
+
+  <!--
+    KYC verification — the INNER process, embedded into the microservice jar
+    (Maven picks up src/main/resources/kyc/kyc.bpmn automatically) and
+    orchestrated by an in-process Bernd engine (io.github.jwulf:nano-bernd).
+
+    Compliance owns this file. Add a step here (say, "check_adverse_media")
+    and bump the microservice — the onboarding team's outer flow doesn't
+    change.
+
+    ABI v2 note: variable-driven gateways aren't wired to inner engines yet,
+    so this flow is a linear sequence of checks. The microservice aggregates
+    the per-check results in Java-land and returns a single 'decision' to
+    the outer flow. When ABI v3 exposes variables-on-complete, branches
+    like "sanctions_hit → straight-to-rejected" move in here.
+  -->
+
+  <bpmn:process id="kyc" name="KYC Verification" isExecutable="true">
+    <bpmn:startEvent id="s"><bpmn:outgoing>f1</bpmn:outgoing></bpmn:startEvent>
+
+    <bpmn:serviceTask id="check_id" name="Verify ID document">
+      <bpmn:extensionElements><zeebe:taskDefinition type="check_id" /></bpmn:extensionElements>
+      <bpmn:incoming>f1</bpmn:incoming><bpmn:outgoing>f2</bpmn:outgoing>
+    </bpmn:serviceTask>
+
+    <bpmn:serviceTask id="screen_sanctions" name="Screen OFAC / UN sanctions">
+      <bpmn:extensionElements><zeebe:taskDefinition type="screen_sanctions" /></bpmn:extensionElements>
+      <bpmn:incoming>f2</bpmn:incoming><bpmn:outgoing>f3</bpmn:outgoing>
+    </bpmn:serviceTask>
+
+    <bpmn:serviceTask id="check_pep" name="Check politically-exposed person list">
+      <bpmn:extensionElements><zeebe:taskDefinition type="check_pep" /></bpmn:extensionElements>
+      <bpmn:incoming>f3</bpmn:incoming><bpmn:outgoing>f4</bpmn:outgoing>
+    </bpmn:serviceTask>
+
+    <bpmn:serviceTask id="risk_score" name="Compute risk score">
+      <bpmn:extensionElements><zeebe:taskDefinition type="risk_score" /></bpmn:extensionElements>
+      <bpmn:incoming>f4</bpmn:incoming><bpmn:outgoing>f5</bpmn:outgoing>
+    </bpmn:serviceTask>
+
+    <bpmn:endEvent id="e"><bpmn:incoming>f5</bpmn:incoming></bpmn:endEvent>
+
+    <bpmn:sequenceFlow id="f1" sourceRef="s" targetRef="check_id" />
+    <bpmn:sequenceFlow id="f2" sourceRef="check_id" targetRef="screen_sanctions" />
+    <bpmn:sequenceFlow id="f3" sourceRef="screen_sanctions" targetRef="check_pep" />
+    <bpmn:sequenceFlow id="f4" sourceRef="check_pep" targetRef="risk_score" />
+    <bpmn:sequenceFlow id="f5" sourceRef="risk_score" targetRef="e" />
+  </bpmn:process>
+</bpmn:definitions>

package/templates/embedded-graalvm-starter/microservice/src/test/java/com/example/KycInnerFlowTest.java

@@ -0,0 +1,64 @@
+/*
+ * Smoke test: exercise the KycMicroservice inner-flow logic without a live
+ * gateway. Verifies that (a) the packaged kyc.bpmn deploys, (b) the inner
+ * flow drives to completion, (c) the aggregation produces the expected
+ * decision for representative customer IDs.
+ */
+package com.example;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import io.github.jwulf.nano.bernd.EmbeddedEngine;
+import java.io.InputStream;
+import java.lang.reflect.Method;
+import java.nio.charset.StandardCharsets;
+import org.junit.jupiter.api.Test;
+
+class KycInnerFlowTest {
+
+  @Test
+  void inner_flow_approves_a_low_risk_customer() throws Exception {
+    try (EmbeddedEngine engine = EmbeddedEngine.create()) {
+      engine.deploy(loadBpmn());
+      final String instanceKey = engine.createInstance("kyc");
+      assertTrue(!"0".equals(instanceKey), "engine rejected inner instance");
+
+      final KycMicroservice.KycContext ctx = new KycMicroservice.KycContext("customer-42");
+      invokeDriveInnerFlow(engine, ctx);
+      assertEquals("approved", ctx.aggregate());
+      assertTrue(engine.isCompleted(instanceKey), "inner instance should complete");
+    }
+  }
+
+  @Test
+  void inner_flow_flags_vip_for_manual_review() throws Exception {
+    try (EmbeddedEngine engine = EmbeddedEngine.create()) {
+      engine.deploy(loadBpmn());
+      engine.createInstance("kyc");
+      final KycMicroservice.KycContext ctx = new KycMicroservice.KycContext("vip-alice");
+      invokeDriveInnerFlow(engine, ctx);
+      assertEquals("manual_review", ctx.aggregate());
+    }
+  }
+
+  private static String loadBpmn() throws Exception {
+    try (InputStream in = KycInnerFlowTest.class.getResourceAsStream("/kyc/kyc.bpmn")) {
+      if (in == null) {
+        throw new IllegalStateException(
+            "test resource /kyc/kyc.bpmn not found on classpath — "
+                + "check that src/main/resources/kyc/kyc.bpmn is packaged");
+      }
+      return new String(in.readAllBytes(), StandardCharsets.UTF_8);
+    }
+  }
+
+  private static void invokeDriveInnerFlow(
+      final EmbeddedEngine engine, final KycMicroservice.KycContext ctx) throws Exception {
+    final Method m =
+        KycMicroservice.class.getDeclaredMethod(
+            "driveInnerFlow", EmbeddedEngine.class, KycMicroservice.KycContext.class);
+    m.setAccessible(true);
+    m.invoke(null, engine, ctx);
+  }
+}

package/templates/embedded-graalvm-starter/models/onboarding.bpmn

@@ -0,0 +1,89 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<bpmn:definitions xmlns:bpmn="http://www.omg.org/spec/BPMN/20100524/MODEL"
+                  xmlns:zeebe="http://camunda.org/schema/zeebe/1.0"
+                  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                  targetNamespace="http://example.com/onboarding"
+                  id="onboarding_defs">
+
+  <!--
+    Customer onboarding — the OUTER process. Runs on the Nano IDE gateway
+    (models/ is auto-deployed on save). One service task 'verify_kyc' is
+    served by the embedded KYC microservice under ../microservice/, which
+    itself orchestrates the individual checks on its own in-process Bernd
+    engine.
+
+    Compliance owns kyc.bpmn (the inner flow); onboarding owns this file.
+    Both are inspectable BPMN — audit trail = deploy both, log both instance
+    keys.
+  -->
+
+  <bpmn:process id="onboarding" name="Customer Onboarding" isExecutable="true">
+    <bpmn:startEvent id="start" name="New customer">
+      <bpmn:outgoing>f_start</bpmn:outgoing>
+    </bpmn:startEvent>
+
+    <bpmn:serviceTask id="verify_kyc" name="Verify KYC">
+      <bpmn:extensionElements>
+        <zeebe:taskDefinition type="verify_kyc" />
+      </bpmn:extensionElements>
+      <bpmn:incoming>f_start</bpmn:incoming>
+      <bpmn:outgoing>f_to_gate</bpmn:outgoing>
+    </bpmn:serviceTask>
+
+    <bpmn:exclusiveGateway id="kyc_gate" name="KYC decision">
+      <bpmn:incoming>f_to_gate</bpmn:incoming>
+      <bpmn:outgoing>f_approved</bpmn:outgoing>
+      <bpmn:outgoing>f_manual</bpmn:outgoing>
+      <bpmn:outgoing>f_rejected</bpmn:outgoing>
+    </bpmn:exclusiveGateway>
+
+    <bpmn:serviceTask id="activate_account" name="Activate account">
+      <bpmn:extensionElements>
+        <zeebe:taskDefinition type="activate_account" />
+      </bpmn:extensionElements>
+      <bpmn:incoming>f_approved</bpmn:incoming>
+      <bpmn:outgoing>f_activated</bpmn:outgoing>
+    </bpmn:serviceTask>
+
+    <bpmn:serviceTask id="queue_for_ops" name="Queue for manual review">
+      <bpmn:extensionElements>
+        <zeebe:taskDefinition type="queue_for_ops" />
+      </bpmn:extensionElements>
+      <bpmn:incoming>f_manual</bpmn:incoming>
+      <bpmn:outgoing>f_queued</bpmn:outgoing>
+    </bpmn:serviceTask>
+
+    <bpmn:serviceTask id="notify_rejection" name="Notify rejection">
+      <bpmn:extensionElements>
+        <zeebe:taskDefinition type="notify_rejection" />
+      </bpmn:extensionElements>
+      <bpmn:incoming>f_rejected</bpmn:incoming>
+      <bpmn:outgoing>f_notified</bpmn:outgoing>
+    </bpmn:serviceTask>
+
+    <bpmn:endEvent id="end_approved" name="Onboarded">
+      <bpmn:incoming>f_activated</bpmn:incoming>
+    </bpmn:endEvent>
+    <bpmn:endEvent id="end_manual" name="Manual review">
+      <bpmn:incoming>f_queued</bpmn:incoming>
+    </bpmn:endEvent>
+    <bpmn:endEvent id="end_rejected" name="Rejected">
+      <bpmn:incoming>f_notified</bpmn:incoming>
+    </bpmn:endEvent>
+
+    <bpmn:sequenceFlow id="f_start" sourceRef="start" targetRef="verify_kyc" />
+    <bpmn:sequenceFlow id="f_to_gate" sourceRef="verify_kyc" targetRef="kyc_gate" />
+    <bpmn:sequenceFlow id="f_approved" name="approved" sourceRef="kyc_gate" targetRef="activate_account">
+      <bpmn:conditionExpression xsi:type="bpmn:tFormalExpression">=decision = "approved"</bpmn:conditionExpression>
+    </bpmn:sequenceFlow>
+    <bpmn:sequenceFlow id="f_manual" name="manual review" sourceRef="kyc_gate" targetRef="queue_for_ops">
+      <bpmn:conditionExpression xsi:type="bpmn:tFormalExpression">=decision = "manual_review"</bpmn:conditionExpression>
+    </bpmn:sequenceFlow>
+    <bpmn:sequenceFlow id="f_rejected" name="rejected" sourceRef="kyc_gate" targetRef="notify_rejection">
+      <bpmn:conditionExpression xsi:type="bpmn:tFormalExpression">=decision = "rejected"</bpmn:conditionExpression>
+    </bpmn:sequenceFlow>
+    <bpmn:sequenceFlow id="f_activated" sourceRef="activate_account" targetRef="end_approved" />
+    <bpmn:sequenceFlow id="f_queued" sourceRef="queue_for_ops" targetRef="end_manual" />
+    <bpmn:sequenceFlow id="f_notified" sourceRef="notify_rejection" targetRef="end_rejected" />
+  </bpmn:process>
+</bpmn:definitions>