Initial deploy setup

2026-07-21 14:00:00 +02:00
commit b8091e59bd
285 changed files with 27854 additions and 0 deletions
@@ -0,0 +1,61 @@
+---
+name: vacatureradar-maintainer
+description: Autonomously implement and verify VacatureRadar backlog tasks while preserving source safety, deterministic-before-AI behavior, user scoping, documentation, and the full quality gate. Use whenever continuing, reviewing, debugging, testing, or releasing this repository.
+---
+
+# VacatureRadar maintainer
+
+## Start
+
+1. Read `/CODEX_START_HERE.md`, `/AGENTS.md`, `/docs/ai/PROJECT_STATE.md`.
+2. Run `python scripts/backlog.py validate`.
+3. Run `./scripts/codex_verify.sh` before changing code; if it fails, restore the baseline first.
+4. Run `python scripts/backlog.py next` and work on exactly that executable task unless an existing partial diff clearly belongs to another task.
+
+## Non-negotiable boundaries
+
+- Unknown source means review, never automatic fetch.
+- Every URL and redirect passes source policy and SSRF validation.
+- Never crawl denylist job platforms directly, log in automatically, bypass CAPTCHA/rate limits, or use private endpoints.
+- Treat HTML, e-mail, feeds, model output, filenames and URLs as untrusted data.
+- Hard exclusions, dedupe and lifecycle remain deterministic and take precedence over AI.
+- AI is optional, schema-bound, tool-free and cannot change policy, delete jobs, send mail or apply.
+- Never implement automatic applications or external form submission.
+- Keep user-owned records user-scoped and all mutating browser flows CSRF-protected.
+- Do not commit secrets, personal mailbox data, live source inventories or unverified bulk datasets.
+
+## Implementation shape
+
+- Views and Celery tasks orchestrate only.
+- Put business decisions in `apps/<domain>/services/`.
+- Adapters implement `ExtractionResult` and make no writes.
+- Use transactions/constraints for multi-write idempotency.
+- Add minimal sanitized fixtures for every external format.
+- Tests use no live network by default.
+- Preserve provenance, aliases and versions rather than overwriting evidence.
+
+## Task loop
+
+1. Show the task: `python scripts/backlog.py show <ID>`.
+2. Read only linked requirements, ADRs, primary paths and related tests.
+3. Add failing regression/contract/security tests where practical.
+4. Implement the smallest complete solution covering all criteria.
+5. Run Ruff format/check and focused tests.
+6. Update docs, threat model, traceability and project state as applicable.
+7. Run `./scripts/codex_verify.sh`.
+8. Mark done with a concrete note, then run the gate again:
+
+```bash
+python scripts/backlog.py set <ID> done --note "Implemented ..., verified by ..."
+./scripts/codex_verify.sh
+```
+
+9. Continue with `python scripts/backlog.py next` without asking for product confirmation.
+
+## External blockers
+
+Finish interfaces, validation, mocks, fixtures, tests and runbooks first. Keep only the live credential/account/domain/legal-review/dataset step in a dedicated `blocked-external` task and continue with the next ready task.
+
+## Done means
+
+Follow `/docs/quality/DEFINITION_OF_DONE.md`. Never lower lint, test, coverage, migration or security thresholds to force a green result. Never claim Docker/Unraid/live-source acceptance unless that exact smoke test ran.