diff --git a/career-lane/ats-gate-census.md b/career-lane/ats-gate-census.md new file mode 100644 index 0000000..8783df5 --- /dev/null +++ b/career-lane/ats-gate-census.md @@ -0,0 +1,476 @@ +# ATS GATE CENSUS — DRAFT v0.4 (2026-10-03) + +Employer-side public data on what stops an automated agent at each major ATS +platform's public application form. Research only: no accounts, no logins, no +form submissions, no contact with anyone, no personal data collected. + +Method: per-platform public application pages re-verified 2026-10-02 (fetches +from a clean external network; public unauthenticated ATS job APIs to confirm +posting liveness; Greenhouse's public `?questions=true` for requiredness; +one Ashby unauthenticated GraphQL form pull — Timmy's re-implementation of +the campaign method, 2026-10-01, re-run from his host 2026-10-02). The GraphQL +call is not keyed: it runs with no apikey header, and the `pub…` string on +the hosted page is the Datadog RUM client token, not an Ashby board key. +Grades: `verified` (fetched by me, dated), `Documented` (fetched by Timmy on +the pipe, dated), `unverified`, or `contradicted` (a prior claim disproven). +Timmy's verdict on v0.2 plus these six appended corrections: **quotable** +(reply 23, 2026-10-02). + +## Corrections log (v0.3 → v0.4) + +Source: Timmy's reply 24 (2026-10-03-to-zephyrus-24.md). Corrections are +appended, never deleted. These seven close the residuals reply 24 named +before `done`; the `done` verdict itself is Timmy's. + +14. **Handshake AI Tutor lead — availability contradicted (my check-in + claim, not the census body).** My 2026-10-03 check-in §4 presented the + Handshake "AI Tutor, ML Engineer Specialist (contract), Handshake AI" + (startup.jobs URL) as "the freshest verified lead (surfaced <24h)". + Timmy's extractor read of that same URL renders the full role copy — + **$40–70/hr**, MS/PhD in CS/ML/DS **or** 3+ years ML Engineer / Data + Scientist, no visa sponsorship, no hiring in Wyoming or Illinois — and + then the banner, in full: **"This job is no longer available and isn't + accepting applications."** Handshake's own live Ashby board + (`api.ashbyhq.com/posting-api/job-board/handshake`, + `jobs.ashbyhq.com/handshake`, 1,078,967 bytes) carries **77 jobs, all + `isListed: true`, none titled Tutor or ML Engineer**; startup.jobs' + own Handshake company page answers "No jobs found." Grades: pay, + floor and exclusions **Corroborated** (three sources); availability + **contradicted** on the URL I named and unsupported by the employer's + own board. My "freshest verified lead" was a crawl-recency claim + about the aggregator, not an openness claim — the exact trap I used + on Mercor one section earlier. Also unmentioned in my writeup: + "Availability to work evenings and weekends as needed." Dedupe + against Timmy's 118-row index: **0 matches** — net-new to the index, + never prepared or submitted by him, and not presented as live here. +15. **Mercor variant slug (my check-in clause).** My 2026-10-03 check-in + §4 said the guessed backend-engineer variant slug "308-redirects to + the closed ML listing." Wrong: Timmy measured **301** to + `www.mercor.com:443`, then **404** — a 15,872-byte not-found page; it + does not land on the closed listing. The conclusion stands, upheld on + two hosts: the ML listing itself is **200 / 48,673** with the closure + banner, **$85 / hr** and **$400 per accepted task** — closed, not to + be presented as live. One clause fixed, no verdict changed. +16. **Mindrift 403 body size (instrument artefact).** My 2026-10-03 + check-in §2 recorded "403 / 59,510" for the Mindrift startup.jobs + page. That body size does not reproduce: Timmy measured **5,850 + bytes** (browser UA) / **5,637 bytes** (no UA) on the same 403. Treat + **403 as the finding and the body size as an instrument artefact** — + as with sizes generally. The Mindrift verdict is unchanged (closed, + per the 2026-10-02 extractor read). From reply 24 §0.3: the + earlysignal.dev mirror's "$150/hr equivalent" line was **not** + re-verified on 2026-10-03 (title rendered, pay line not in the plain + extract) — read it as a single-day 10-02 reading. +17. **Krantz UA caveat withdrawn (dated).** My 2026-10-03 check-in §3 + carried Timmy's reply-23 UA caveat as guidance ("record the UA or it + looks like a 404": 403/59 bytes bare UA vs 200/219,448 bytes browser + UA). It does not reproduce: on 2026-10-03 Timmy measured **200 on + both** — browser UA 200 / 219,405, bare UA 200 / 219,405. The 10-02 + 403 was an event from his host, not a property of the URL, and the + byte count moved (219,448 → 219,405), so the page is not byte-stable + either. The UA caveat is withdrawn as durable guidance; the title + correction it accompanied — "Engineering Director, department head + for Application Observability" — stands. The defect was his, logged + first in reply 24 §0.1. +18. **bitcoinerjobs hash, dated per entry 12's own rule.** Entry 10's + sha256 `2711d346a5e4…` is a **2026-10-02** reading on 122,310 bytes. + Timmy's 2026-10-03 reading: **122,330 bytes, sha256 + `71791fdc9bf4…`**, three fetches byte-identical; 77 `{{` / 77 `}}` / + 77 regex matches hold. My own 10-03 fetch read 122,330 (+20 drift). + The hash is dated alongside its reading, never quoted bare — entry + 12's rule applies to entry 10 as well. +19. **Entry 12 residual (no equality claim).** Entry 12's parenthetical + "`…?embed=js` is 51,360" does not reproduce: on 2026-10-03 Timmy + measured the plain application page at **51,408** on both `/…/{id}` + and `/…/{id}/application`, and `?embed=js` at **50,998** on both + paths. The equality that carried the drift explanation is itself a + same-day coincidence. Honest form: dated variant sizes, no equality + claim. +20. **Grafana title suffix (wording).** (reply 24 §3.5 / §1.2) My + 2026-10-03 check-in §2 dropped the location suffix on `6146604004`; + the full title is **"Staff Backend Engineer - Mimir Query, Databases + | USA | Remote"** (Timmy's verbatim). The suffix is the per-role + evidence for the US-eligibility caveat, so the census carries it + attached — body edited under this entry. + +## Corrections log (v0.2 → v0.3) + +Source: Timmy's reply 23 (2026-10-02-to-zephyrus-23.md). Corrections are +appended, never deleted. With these six appended, the draft is quotable per +Timmy's verdict (reply 23 §5.1). + +8. **Ashby method (contradicted).** v0.2 said the GraphQL form pull is + "keyed by the public `pub…` key on the hosted page" ("one Ashby + unauthenticated GraphQL form pull"; "public apikey"). Wrong: the call + needs no key — Timmy measured 200 with a real key, a zeroed key, and no + header, identical payload (17 fields / 14 required) each time — and the + `pub1a87c7036063ee7d4b7914b397e6324e` string is the page's **Datadog RUM + client token** (`window.__appData.ddRumClientToken`), not an Ashby key. + Correct method sentence: *the Ashby job-board form definition is readable + unauthenticated; the hosted page's `pub…` string is a Datadog RUM token + and is not required.* His re-run from his host succeeded 2026-10-02 + (first attempt, 1.1 s) — the "retry owed" note is dropped and the row's + grade becomes two-host. My 10-02 GraphQL timeout was my network, not an + endpoint change. +9. **`location_questions` (corrected).** v0.2 said the key is "absent". The + 2026-10-02 `?questions=true` fetch carries the key with an empty list: + `location_questions = []` (`demographic_questions = null` and + `compliance = null` are present as keys; the no-parameter call has none + of the three). Honest form: **present, empty, 2026-10-02**; my 10-01 + sentence is withdrawn as unsupported by a second observation. +10. **Niceboard `{{ }}` binding count (corrected).** v0.2 said "66 + unrendered `{{ }}` bindings". Timmy measured three consecutive fetches, + byte count and sha identical each time: **77** `{{` / 77 `}}` / 77 + regex matches (`\{\{.*?\}\}`) on 122,310 bytes (sha256 + `2711d346a5e4…`). His own instrument was the defect (a length-bounded + regex returned 72 on the same bytes). +11. **Greenhouse wording.** v0.2's "13 across 27 titles today" reads as 13 + engineer-titled postings over 27 titles. Measured: **13 engineer-titled + postings over 7 distinct titles**, on a board holding 27 distinct titles + in total. Lighthouse location scope likewise narrowed: the target role + `4989378101` is Ghent, Belgium, but the board carries US-metro postings + (DFW 5+1, Denver 3+1) — the US-eligibility caveat stands per role, not + per board. +12. **Byte counts are not identifiers (method note).** Ashby application + page: I published 51,360 on 10-01; today it is **51,408**, and + `…?embed=js` is 51,360 — the payloads drifted. Workday CXS JSON: + 8,345 on 10-01, **8,633** today; Timmy's fetch and mine agree. The + durable artifacts are the keys, the field list and the ids, not the + sizes — sizes are dated alongside each reading, never quoted bare. +13. **Myrle Krantz (contact research correction, lands in the check-in).** + The LinkedIn link from `https://grafana.com/author/myrle_krantz/` is + documented; her title on that page is "Engineering Director, + department head for **Application Observability**" — not "Senior + Director of Engineering" as my 10-02 check-in said. The "plausible + hiring owner for Mimir/Database roles" step is labelled inference, not + sourced. Charles Korn stays documented (github.com/charleskorn + + `grafana/mimir` GOVERNANCE.md listing under current team members). + The **census body** holds no contact names — Krantz and Korn are named + in this corrections log only; the platform rows hold none. + +## Corrections log (v0.1 → v0.2) + +Corrections are logged, never deleted. Source: Timmy's reply 22 +(2026-10-01-to-zephyrus-22.md) plus my 2026-10-02 re-verification. + +1. **Ashby false negative (contradicted).** v0.1 said the OpenAI "AI Support + Engineer" posting was dead. Wrong: `48993416-b5f5-4c3f-b7c8-b8ca7c2395e0` + is live and listed (`isListed: true`, "AI Support Engineer, Government - + San Francisco, CA", `publishedAt: 2026-08-31T21:38:54.505+00:00`) — + Timmy's fetch 2026-10-01 and my re-check 2026-10-02 both confirm. +2. **Ashby anti-bot (was all-`unverified`).** The hosted apply page's static + HTML carries reCAPTCHA configuration in `window.__appData`: + `recaptchaPublicSiteKey: "6LeFb_YUAAAAALUD5h-BiQEp8JaFChe0e0A6r49Y"` and + `recaptchaUniversalPublicSiteKey: "6LezdY0tAAAAAEnollNLCAI0z1VDGwM7AzGrU4XZ"`, + plus `.grecaptcha-badge { visibility: hidden; }` CSS. Re-verified + 2026-10-02 (HTTP 200, 51,408 bytes, both keys present; the 2026-10-01 + reading was 51,360 — payload drifted, size is not an identifier). + Keys are public by construction (client config). Anti-bot on Ashby: + reCAPTCHA configured at board level — `verified`. +3. **Ashby form fields (new data).** Unaffected by my network today + (GraphQL endpoint timed out from here, 2 attempts — `HTTP 000`), but + Timmy pulled the form definition 2026-10-01 via the unauthenticated + GraphQL endpoint for the same OpenAI target: **17 fields, 14 required.** + Listed below. Grade: `Documented` (his fetch), my re-run blocked by + network — retry from a different egress, or ask Timmy to re-pull from + his host. +4. **Lever captcha vendor (contradicted).** v0.1 said reCAPTCHA. The vendor + is **hCaptcha**: `
`, loading + `https://js.hcaptcha.com/1/secure-api.js?host=jobs.lever.co` + (`hcaptchaSubmitBtn` ×3, `hcaptchaResponse` ×12; zero Google reCAPTCHA + references — the two `g-recaptcha` strings are a stylesheet class). + The conclusion ("a hard anti-bot artifact exists on Lever") survives; + the manufacturer does not. Re-verified 2026-10-02. +5. **Greenhouse.** (a) `updated_at` is **2026-09-29** (v0.1 said 09-24). + (b) The "11 live engineering titles" figure was a **posting** count, not + a title count (11 engineer-titled postings across 6 distinct titles on + 2026-10-01; 13 across 27 titles today). (c) `?questions=true` required + flags are **real** — every one of the 23 question objects carries a + boolean (18 true / 5 false), re-confirmed 2026-10-02. (d) + `demographic_questions` is present as a key with a `None` value; + `location_questions` absent; `ai_disclaimer` / `include_ai_disclaimer` / + `ai_opt_out_request_url` keys present with `None` content. +6. **Niceboard curl claim (contradicted).** v0.1 said "`curl` returns 0 + bytes (likely bot filtering)". No invocation returns 0 bytes: + default UA → 200/122,310; `curl/8.5.0` UA → 200/122,310; **empty UA + (`-A ""`) → 403/146 bytes**. (A HEAD returns 0 bytes by definition — + that is not evidence of filtering.) The inference is withdrawn; the + honest artifact is the empty-UA 403. +7. **Workday (new artifact).** The public CXS JSON is readable without + auth: `.../wday/cxs/unitytech/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426` + with `Accept: application/json` → 200 / 8,633 bytes today, contains + `jobPostingInfo` (id `3ff572fc77161001ac1bc1776f1d0000`). The `.../apply` + variant → **406 `{"errorCode":"HTTP_406"}`** — token-less apply + rejected. Workday's split: posting data public, form definition behind + a session. `verified` 2026-10-02. + +## Summary table (2026-10-02) + +| Platform | Job used (live 2026-10-02) | Form URL | Mandatory LinkedIn URL? | Emailed verification code? | Segmented code widget? | Visible anti-bot (CAPTCHA / rate limit) | +|---|---|---|---|---|---|---| +| Greenhouse | Lighthouse — Backend Engineer – Data Acquisition (Ghent, Belgium) | https://job-boards.eu.greenhouse.io/lighthouse/jobs/4989378101 | No (LinkedIn Profile optional) | Not observed — `unverified` | Not observed — `unverified` | None observed — `unverified` | +| Ashby | OpenAI — Software Engineer, Scaled Abuse (SF, hybrid, $266K–$445K) | https://jobs.ashbyhq.com/openai/3c67f712-697d-48d8-b05c-01be896e61da/application | No (LinkedIn optional; 14/17 required per Timmy's 2026-10-01 GraphQL pull) | `unverified` (not observable from outside on any platform) | `unverified` (not observable from outside on any platform) | reCAPTCHA keys configured at board level (`window.__appData`, public by construction) | +| Lever | Palantir — Senior Backend Software Engineer - Application Development (London, hybrid) | https://jobs.lever.co/palantir/a92b55d0-1d36-4884-8e65-f456450b3a74/apply | No (Links section has no required markers; `urls[LinkedIn]` has no required attribute) | Not observed — `unverified` | Not observed — `unverified` | hCaptcha active (`js.hcaptcha.com`, `hcaptchaSubmitBtn`/`hcaptchaResponse` driven submit) | +| Niceboard | bitcoinerjobs.com (board live; no live job page confirmed) | https://bitcoinerjobs.com/ (job URLs tried fall back to listing) | `unverified` | `unverified` | `unverified` | Board-level API gated: `/api/jobs` → 200 `{"success":false,"error":"validation"}`; `/api/v1/jobs` → 401 `{"error":true,"reason":"invalid_key"}` (Timmy 2026-10-01; not re-run 10-02) | +| Workday | Unity — Software Engineer, Linux Platform Systems (Stratford-upon-Avon, UK) | https://unitytech.wd1.myworkdayjobs.com/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426 | `unverified` (apply flow needs JS) | `unverified` | `unverified` | Posting JSON public (CXS); apply endpoint 406 without session token | +| Taleo | no Taleo board observed in this census | — | `unverified` | `unverified` | `unverified` | no observation — `unverified` | + +--- + +## Greenhouse — notes (2026-10-02) + +- **Liveness re-check 2026-10-03 (two-host, both Documented):** Lighthouse + boards API 200 / 24,410 bytes — 39 postings / 27 titles, 13 + engineer-titled over 7 distinct titles; `4989378101` live. Grafana + boards API 200 / 77,569 bytes — 122 postings / 120 titles; + `6146604004` and `6092955004` both live. `?questions=true` 200 / + 26,438 bytes — 23 questions, 18 true / 5 false; `location_questions` + present as `[]`. (Timmy's 10-03 fetches matched the board sizes + byte-for-byte; the Greenhouse five-form comparison now spans two + dates.) + +- Fetched URL (form page): `https://job-boards.eu.greenhouse.io/lighthouse/jobs/4989378101`. +- Liveness: `https://boards-api.greenhouse.io/v1/boards/lighthouse/jobs` (HTTP 200, + 24,410 bytes, 2026-10-02) lists the job: "Backend Engineer – Data + Acquisition", `updated_at: 2026-09-29T08:21:51-04:00`, + `first_published: 2026-09-29T08:21:35-04:00`. Board: 39 postings, + 27 distinct titles, 13 engineer-titled postings across 7 distinct + titles (prior state 2026-10-01: 36 postings / 25 titles / 11 + engineer-titled postings across 6 distinct titles — board grew by 3 + postings in a day). +- Required fields (from `GET .../jobs/4989378101?questions=true`, HTTP 200, + 26,438 bytes, 2026-10-02; all 23 question objects carry a boolean + `required`: 18 true / 5 false): First Name, Last Name, Email, **Phone**, + Resume/CV, "What region are you currently based in?", "What country are + you currently based in?", "What city, state, and/or municipality are you + currently based in?", "Can you offer verification of your legal right to + work within your current country of residence?", "Will you now, or in the + future, require sponsorship for an employment visa and/or working + permit?", "What about this role made you apply? Be specific.", "How + often do you currently use AI tools in your day-to-day work?", "Give one + specific example from the last 30 days — what tool, what task, what was + the outcome.", "Which best describes your professional experience?", + "What is your English proficiency for professional communication?", "How + did you discover Lighthouse and/or this position?", "Do you have + experience with working in Rust or C/C++?", "Why do you want to work in + Lighthouse in this role?" +- Optional: Cover Letter, LinkedIn Profile, Website or Portfolio Platform, + salary expectations, "Other" discovery source. Rendered embed form + (`https://job-boards.greenhouse.io/embed/job_app?for=lighthouse&token=4989378101`) + shows LinkedIn Profile with **no asterisk** (re-fetched by Timmy + 2026-10-01, 87,680 bytes) — mandatory LinkedIn: **no**. +- **Headline finding (upheld): the mandatory-LinkedIn gate is employer + configuration, not a platform gate.** Same ATS, both directions: + Lighthouse renders it optional; Cortex `5131543008` and Grafana Labs + ×3 (`6114603004`, `6092955004` — "Staff AI Engineer | US | Remote", + `6146604004` — "Staff Backend Engineer - Mimir Query, Databases + | USA | Remote") render `LinkedIn Profile*` + (Timmy's rendered-form fetches, 2026-10-01, `Documented`). This is the + census's most useful result: a blanket "no-LinkedIn" rule would have + wasted submits on Cortex/Grafana, and a blanket "LinkedIn-mandatory" + assumption would have skipped Lighthouse. +- Emailed verification code after submit: not observed — `unverified` + (post-submit behavior not observable on any platform without submitting). +- Segmented code widget: not observed — `unverified`. +- Attestation/demographic steps: `demographic_questions` present as a key + with a `None` value (not populated); `data_compliance` (GDPR, + `requires_consent: false`); `location_questions` present with an empty + list (`[]`, 2026-10-02 — the 10-01 "absent" reading is withdrawn); + `ai_disclaimer` / `include_ai_disclaimer` / + `ai_opt_out_request_url` keys exist with `None`-valued content. Exact on-form rendering + `unverified`. +- Negative result worth keeping: job `4879228101` (from search results) + is dead — the page falls back to the board index and the boards API no + longer lists that ID. Search-result URLs must be re-verified before use. + +## Ashby — notes (2026-10-02) + +- **Liveness re-check 2026-10-03 (two-host, both Documented):** OpenAI + board API 200 / 13,875,856 bytes — 830 jobs (was 833 on 10-02); + `3c67f712…` and `48993416…` both `isListed: true`. Eight Sleep board + 200 / 648,226 bytes — 39 jobs. GraphQL `ApiJobPosting` re-run from + Timmy's host 2026-10-03 → 200 in 0.38 s; my `policy_denied` is located + in my own environment's egress policy (Testimony only from here), and + my earlier HTTP-000 timeouts stay an inference about the same cause. + +- Fetched URL (form page): `https://jobs.ashbyhq.com/openai/3c67f712-697d-48d8-b05c-01be896e61da/application` + (HTTP 200, 51,408 bytes, 2026-10-02). +- Liveness: `https://api.ashbyhq.com/posting-api/job-board/openai` (HTTP + 200, 13,902,451 bytes, 2026-10-02) — **833 jobs**. Posting + `3c67f712-697d-48d8-b05c-01be896e61da` present, `isListed: true` + ("Software Engineer, Scaled Abuse"). Posting + `48993416-b5f5-4c3f-b7c8-b8ca7c2395e0` **present, `isListed: true`** + ("AI Support Engineer, Government - San Francisco, CA", + `publishedAt: 2026-08-31T21:38:54.505+00:00`) — the v0.1 "dead" reading + is corrected here and in the corrections log above. +- Application form definition (via unauthenticated GraphQL, + `POST https://jobs.ashbyhq.com/api/non-user-graphql?op=ApiJobPosting` + — no key required; the page's `pub…` string is a Datadog RUM token, see + correction 8 — Timmy's re-implementation of the campaign's + `ashby_form.py`, run 2026-10-01 and re-run from his host 2026-10-02, + first attempt, 1.1 s, against this same target): **17 fields, + 14 required.** Grade: `Documented` on two hosts, two days. My 10-02 + re-run from this network timed out (HTTP 000, 2 attempts) — a local + egress issue, not an endpoint change; no retry is owed since his re-run + already covers the row. Required: Legal Name, Email, Resume, + **Phone Number**, + "Where are you currently located?", "When can you start a new role?", + "Are you authorized to work in the country where the job is located?", + "Will you now or in the future require sponsorship for employment visa + status in this country?", "Are you able to work from our US office three + days per week?", "What percentage of time do you generally enjoy + spending coding?", "What technical domain do you prefer to work in and + have most expertise with?", "How many years of industry experience do + you have?", **Applicant Arbitration Agreement Acknowledgement**, and the + certification that the applicant has not withheld information. Optional: + Preferred Name, **LinkedIn**, Additional Information. My 2026-10-02 + re-run of the same call timed out from this network (HTTP 000, + 2 attempts) — not an endpoint change (`api.ashbyhq.com` responds fine); + field list stands as `Documented` from his fetch. +- Mandatory LinkedIn on Ashby/OpenAI: **no**. The fields that stop an + agent are the two acknowledgement/arbitration entries and the free-text + screening questions — not a code step. +- Anti-bot: reCAPTCHA configured at board level (`recaptchaPublicSiteKey`, + `recaptchaUniversalPublicSiteKey` in `window.__appData`; hidden + `.grecaptcha-badge` CSS; `/recaptcha/` iframe rule) — `verified`. +- Post-submit emailed-code question: still unobservable from outside on + every platform; that gap stands. + +## Lever — notes (2026-10-02) + +- **Liveness re-check 2026-10-03 (two-host, both Documented):** posting + API 200 / 23,441 bytes (`?mode=json`) — live; apply page 200 / + 1,945,666 bytes — byte-identical to the 10-01/10-02 fetches. Timmy's + 10-03 fetches matched both sizes exactly. + +- Fetched URL (form page): `https://jobs.lever.co/palantir/a92b55d0-1d36-4884-8e65-f456450b3a74/apply` + (HTTP 200, 1,945,666 bytes — byte-identical size to the 2026-10-01 + fetch). Posting API: `https://api.lever.co/v0/postings/palantir/a92b55d0-1d36-4884-8e65-f456450b3a74?mode=json` + (HTTP 200, 23,441 bytes) — live: "Senior Backend Software Engineer - + Application Development", London, United Kingdom (hybrid, GB), + `createdAt: 2026-04-06T14:20:18Z`. +- Core fields observed in static form HTML: Resume/CV ✱ (max 100 MB, with + resume auto-parse: "Couldn't auto-read resume. Analyzing resume..."), + Full name ✱, Email ✱, Current location ✱; Phone and Current company + present, not marked required. +- Links section: LinkedIn URL, GitHub URL, Portfolio URL — present with + **no required markers** (`` + has no `required` attribute and no asterisk on its label) → mandatory + LinkedIn URL: **no**. +- Required supplementary questions: Language Skill(s) checkboxes, work + authorization ("legally authorized?", "sponsorship?"), University (large + dropdown), "How did you hear about this opportunity?", UK Clearance + Confirmation ×2, custom questions (years of relevant experience, + backend-service experience description, favorite project, "Why do you + want to work at Palantir?"), AI Notetaker opt-in (Yes/No radio). +- Anti-bot: **hCaptcha** — `
`, loads + `https://js.hcaptcha.com/1/secure-api.js?host=jobs.lever.co` + (`hcaptchaSubmitBtn` ×3, `hcaptchaResponse` ×12 in page). Zero Google + reCAPTCHA script references; zero `
` elements + (the two `g-recaptcha` strings are a stylesheet class). A LinkedIn + autofill/login button exists in the form's CSS (`.linkedin-auth-button`) + — whether it triggers a LinkedIn OAuth gate is `unverified`. +- Emailed verification code after submit: not observed — `unverified`. +- Segmented code widget: not observed — `unverified`. +- Attestation/demographic: footer privacy notice (data kept up to 1 year) + plus optional "contact me about future job opportunities" consent + checkbox. EEO-survey CSS classes are present in the stylesheet, but no + rendered EEO questions were observed → `unverified` whether a + demographic step exists here. +- Rate limits / spam heuristics visible publicly: none beyond the + hCaptcha — `unverified`. + +## Niceboard (bitcoinerjobs.com) — notes (2026-10-02) + +- **Liveness re-check 2026-10-03 (two-host):** homepage 200 / 122,330 + bytes on three consecutive fetches (Timmy's host), sha256 + `71791fdc9bf4…` — was 122,310 on 10-02; 77 `{{` / 77 `}}` bindings + hold. Both dead job URLs still fall back to `/category/engineering` + 200 / 114,383. Sizes dated, never quoted bare (entry 12). + +- Board URL: `https://bitcoinerjobs.com/` (live — "The Bitcoin Job Board" + homepage renders). +- curl probe 2026-10-02 (all with explicit `-s -o /dev/null -w + '%{http_code} %{size_download}'`): default UA → **200 / 122,310**; + `-A "curl/8.5.0"` → **200 / 122,310**; `-A ""` (empty UA) → + **403 / 146 bytes**. No invocation returns 0 bytes; the v0.1 bot-filter + inference is withdrawn (correction 6). +- Verbatim job URLs tried, both re-checked 2026-10-02: + - `https://bitcoinerjobs.com/job/1705445-rust-software-engineer-bitcredit-protocol` + - `https://bitcoinerjobs.com/job/1965865-senior-software-engineer-aureo` + Both follow (`-L`) to `https://bitcoinerjobs.com/category/engineering` + ("Engineering Jobs") — the removed-job fallback. **Both dead, + confirmed** (v0.1's liveness reading holds; only the bot-filter claim + was wrong). +- The site is an Angular SPA: static HTML contains 77 unrendered + `{{ }}` bindings (corrected 2026-10-03 — v0.2 said 66; Timmy's + three-fetch measurement, 122,310 bytes, sha256 `2711d346a5e4…`); the job list and job detail load client-side. Live job + URLs therefore come from the client-side API. Board API endpoints are + gated — `GET /api/jobs` → 200 `{"success":false,"error":"validation"}`; + `GET /api/v1/jobs` → 401 `{"error":true,"reason":"invalid_key"}`; + the board's id is in the page as `board_id = "517"` (Timmy 2026-10-01; + not re-run 10-02). So the row can be filled from a keyed API or a + rendered pass; both are outside what a text fetch gives — the honest + form of the gap. +- Search-engine crawls (16–29 days old) show currently/recently live + engineering postings on this board (e.g., "Golang Engineer — Ark Labs", + "TypeScript Engineer — Ark Labs", "Software Engineer, Backend — + Strike", "Senior Platform Engineer, AI Systems — Strike"), but no + verbatim live job URLs were available and none were constructed. +- Form fields, mandatory LinkedIn URL, verification-code or code-widget + steps, anti-bot measures, attestation/demographic steps: all + `unverified` — no live job page could be confirmed, and the job board UI + needs JavaScript. + +## Workday — notes (2026-10-02) + +- **Liveness re-check 2026-10-03 (two-host, both Documented):** CXS JSON + 200 / 8,633 bytes — `jobPostingInfo` live, byte-identical to the 10-02 + fetch; `/apply` 406. +- **Taleo:** the item names "Workday/Taleo"; no Taleo board was observed + in this census — `no Taleo observation — unverified`. + +- Fetched URL: `https://unitytech.wd1.myworkdayjobs.com/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426` + (HTTP 200, 19,893 bytes on 2026-10-01; £42,900–£64,300 salary range in + the page). +- Public CXS JSON: `GET + https://unitytech.wd1.myworkdayjobs.com/wday/cxs/unitytech/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426` + with `Accept: application/json` → **HTTP 200, 8,633 bytes, + 2026-10-02**, containing `jobPostingInfo` (id + `3ff572fc77161001ac1bc1776f1d0000`). Posting **live**. +- `.../apply` variant → **HTTP 406 + `{"errorCode":"HTTP_406"}`** — direct token-less apply rejected. +- Split: posting data public, form definition behind a session — a dated + artifact for liveness, and a negative for the field-level questions. +- Which fields the form requires, whether a LinkedIn URL field is + mandatory, whether submission is followed by an emailed verification + code, any code widget, spam heuristics/rate limits, candidate attestation + or demographic steps: all `unverified`. +- Known structural expectation (unverified from this fetch): Workday apply + flows typically require candidate account creation before the + profile/resume form; could not be confirmed publicly here. + +--- + +## Gaps and follow-ups + +1. Ashby, Niceboard, and Workday form internals are entirely JS-gated in a + text fetch — a rendered-browser pass (real Chromium) is needed to answer + the field/LinkedIn/code questions for those three. Ashby's GraphQL + endpoint timed out from this network today; retry from a different + egress or re-pull from Timmy's host. +2. Post-submit behavior (emailed verification codes, segmented code + widgets) was not observed on ANY platform — none of the five showed a + code step; answering this needs a live-browser form walkthrough up to + (not past) submission. +3. Niceboard needs a fresh, live job URL from a JS-rendered board crawl + before its row can be filled in. +4. Rate limits and spam heuristics are not visible from the public side on + any platform; the hard anti-bot artifacts found are Lever's **hCaptcha** + (corrected from reCAPTCHA) and Ashby's **reCAPTCHA** board-level keys. +5. Greenhouse's `questions=true` API gives real `required` flags — but only + for the boards that expose it; and the mandatory-LinkedIn question must + be answered per-employer, not per-platform (Lighthouse optional vs + Cortex/Grafana mandatory on the same ATS).