---
name: vacatureradar-maintainer
description: Autonomously implement and verify VacatureRadar backlog tasks while preserving source safety, deterministic-before-AI behavior, user scoping, documentation, and the full quality gate. Use whenever continuing, reviewing, debugging, testing, or releasing this repository.
---

# VacatureRadar maintainer

## Start

1. Read `/CODEX_START_HERE.md`, `/AGENTS.md`, `/docs/ai/PROJECT_STATE.md`.
2. Run `python scripts/backlog.py validate`.
3. Run `./scripts/codex_verify.sh` before changing code; if it fails, restore the baseline first.
4. Run `python scripts/backlog.py next` and work on exactly that executable task unless an existing partial diff clearly belongs to another task.

## Non-negotiable boundaries

- Unknown source means review, never automatic fetch.
- Every URL and redirect passes source policy and SSRF validation.
- Never crawl denylist job platforms directly, log in automatically, bypass CAPTCHA/rate limits, or use private endpoints.
- Treat HTML, e-mail, feeds, model output, filenames and URLs as untrusted data.
- Hard exclusions, dedupe and lifecycle remain deterministic and take precedence over AI.
- AI is optional, schema-bound, tool-free and cannot change policy, delete jobs, send mail or apply.
- Never implement automatic applications or external form submission.
- Keep user-owned records user-scoped and all mutating browser flows CSRF-protected.
- Do not commit secrets, personal mailbox data, live source inventories or unverified bulk datasets.

## Implementation shape

- Views and Celery tasks orchestrate only.
- Put business decisions in `apps/<domain>/services/`.
- Adapters implement `ExtractionResult` and make no writes.
- Use transactions/constraints for multi-write idempotency.
- Add minimal sanitized fixtures for every external format.
- Tests use no live network by default.
- Preserve provenance, aliases and versions rather than overwriting evidence.

## Task loop

1. Show the task: `python scripts/backlog.py show <ID>`.
2. Read only linked requirements, ADRs, primary paths and related tests.
3. Add failing regression/contract/security tests where practical.
4. Implement the smallest complete solution covering all criteria.
5. Run Ruff format/check and focused tests.
6. Update docs, threat model, traceability and project state as applicable.
7. Run `./scripts/codex_verify.sh`.
8. Mark done with a concrete note, then run the gate again:

```bash
python scripts/backlog.py set <ID> done --note "Implemented ..., verified by ..."
./scripts/codex_verify.sh
```

9. Continue with `python scripts/backlog.py next` without asking for product confirmation.

## External blockers

Finish interfaces, validation, mocks, fixtures, tests and runbooks first. Keep only the live credential/account/domain/legal-review/dataset step in a dedicated `blocked-external` task and continue with the next ready task.

## Done means

Follow `/docs/quality/DEFINITION_OF_DONE.md`. Never lower lint, test, coverage, migration or security thresholds to force a green result. Never claim Docker/Unraid/live-source acceptance unless that exact smoke test ran.