VacatureRadar/.agents/skills/vacatureradar-maintainer/SKILL.md

name, description

name	description
vacatureradar-maintainer	Autonomously implement and verify VacatureRadar backlog tasks while preserving source safety, deterministic-before-AI behavior, user scoping, documentation, and the full quality gate. Use whenever continuing, reviewing, debugging, testing, or releasing this repository.

VacatureRadar maintainer

Start

1. Read /CODEX_START_HERE.md, /AGENTS.md, /docs/ai/PROJECT_STATE.md.
2. Run python scripts/backlog.py validate.
3. Run ./scripts/codex_verify.sh before changing code; if it fails, restore the baseline first.
4. Run python scripts/backlog.py next and work on exactly that executable task unless an existing partial diff clearly belongs to another task.

Non-negotiable boundaries

• Unknown source means review, never automatic fetch.
• Every URL and redirect passes source policy and SSRF validation.
• Never crawl denylist job platforms directly, log in automatically, bypass CAPTCHA/rate limits, or use private endpoints.
• Treat HTML, e-mail, feeds, model output, filenames and URLs as untrusted data.
• Hard exclusions, dedupe and lifecycle remain deterministic and take precedence over AI.
• AI is optional, schema-bound, tool-free and cannot change policy, delete jobs, send mail or apply.
• Never implement automatic applications or external form submission.
• Keep user-owned records user-scoped and all mutating browser flows CSRF-protected.
• Do not commit secrets, personal mailbox data, live source inventories or unverified bulk datasets.

Implementation shape

• Views and Celery tasks orchestrate only.
• Put business decisions in apps/<domain>/services/.
• Adapters implement ExtractionResult and make no writes.
• Use transactions/constraints for multi-write idempotency.
• Add minimal sanitized fixtures for every external format.
• Tests use no live network by default.
• Preserve provenance, aliases and versions rather than overwriting evidence.

Task loop

1. Show the task: python scripts/backlog.py show <ID>.
2. Read only linked requirements, ADRs, primary paths and related tests.
3. Add failing regression/contract/security tests where practical.
4. Implement the smallest complete solution covering all criteria.
5. Run Ruff format/check and focused tests.
6. Update docs, threat model, traceability and project state as applicable.
7. Run ./scripts/codex_verify.sh.
8. Mark done with a concrete note, then run the gate again:

python scripts/backlog.py set <ID> done --note "Implemented ..., verified by ..."
./scripts/codex_verify.sh

9. Continue with python scripts/backlog.py next without asking for product confirmation.

External blockers

Finish interfaces, validation, mocks, fixtures, tests and runbooks first. Keep only the live credential/account/domain/legal-review/dataset step in a dedicated blocked-external task and continue with the next ready task.

Done means

Follow /docs/quality/DEFINITION_OF_DONE.md. Never lower lint, test, coverage, migration or security thresholds to force a green result. Never claim Docker/Unraid/live-source acceptance unless that exact smoke test ran.