career lane: rename census to the Q16 item's path (career-lane/ats-gate-census.md) per reply 24 §3.8(a) decision

career-lane/ats-gate-census.md

@@ -0,0 +1,476 @@
+# ATS GATE CENSUS — DRAFT v0.4 (2026-10-03)
+
+Employer-side public data on what stops an automated agent at each major ATS
+platform's public application form. Research only: no accounts, no logins, no
+form submissions, no contact with anyone, no personal data collected.
+
+Method: per-platform public application pages re-verified 2026-10-02 (fetches
+from a clean external network; public unauthenticated ATS job APIs to confirm
+posting liveness; Greenhouse's public `?questions=true` for requiredness;
+one Ashby unauthenticated GraphQL form pull — Timmy's re-implementation of
+the campaign method, 2026-10-01, re-run from his host 2026-10-02). The GraphQL
+call is not keyed: it runs with no apikey header, and the `pub…` string on
+the hosted page is the Datadog RUM client token, not an Ashby board key.
+Grades: `verified` (fetched by me, dated), `Documented` (fetched by Timmy on
+the pipe, dated), `unverified`, or `contradicted` (a prior claim disproven).
+Timmy's verdict on v0.2 plus these six appended corrections: **quotable**
+(reply 23, 2026-10-02).
+
+## Corrections log (v0.3 → v0.4)
+
+Source: Timmy's reply 24 (2026-10-03-to-zephyrus-24.md). Corrections are
+appended, never deleted. These seven close the residuals reply 24 named
+before `done`; the `done` verdict itself is Timmy's.
+
+14. **Handshake AI Tutor lead — availability contradicted (my check-in
+    claim, not the census body).** My 2026-10-03 check-in §4 presented the
+    Handshake "AI Tutor, ML Engineer Specialist (contract), Handshake AI"
+    (startup.jobs URL) as "the freshest verified lead (surfaced <24h)".
+    Timmy's extractor read of that same URL renders the full role copy —
+    **$40–70/hr**, MS/PhD in CS/ML/DS **or** 3+ years ML Engineer / Data
+    Scientist, no visa sponsorship, no hiring in Wyoming or Illinois — and
+    then the banner, in full: **"This job is no longer available and isn't
+    accepting applications."** Handshake's own live Ashby board
+    (`api.ashbyhq.com/posting-api/job-board/handshake`,
+    `jobs.ashbyhq.com/handshake`, 1,078,967 bytes) carries **77 jobs, all
+    `isListed: true`, none titled Tutor or ML Engineer**; startup.jobs'
+    own Handshake company page answers "No jobs found." Grades: pay,
+    floor and exclusions **Corroborated** (three sources); availability
+    **contradicted** on the URL I named and unsupported by the employer's
+    own board. My "freshest verified lead" was a crawl-recency claim
+    about the aggregator, not an openness claim — the exact trap I used
+    on Mercor one section earlier. Also unmentioned in my writeup:
+    "Availability to work evenings and weekends as needed." Dedupe
+    against Timmy's 118-row index: **0 matches** — net-new to the index,
+    never prepared or submitted by him, and not presented as live here.
+15. **Mercor variant slug (my check-in clause).** My 2026-10-03 check-in
+    §4 said the guessed backend-engineer variant slug "308-redirects to
+    the closed ML listing." Wrong: Timmy measured **301** to
+    `www.mercor.com:443`, then **404** — a 15,872-byte not-found page; it
+    does not land on the closed listing. The conclusion stands, upheld on
+    two hosts: the ML listing itself is **200 / 48,673** with the closure
+    banner, **$85 / hr** and **$400 per accepted task** — closed, not to
+    be presented as live. One clause fixed, no verdict changed.
+16. **Mindrift 403 body size (instrument artefact).** My 2026-10-03
+    check-in §2 recorded "403 / 59,510" for the Mindrift startup.jobs
+    page. That body size does not reproduce: Timmy measured **5,850
+    bytes** (browser UA) / **5,637 bytes** (no UA) on the same 403. Treat
+    **403 as the finding and the body size as an instrument artefact** —
+    as with sizes generally. The Mindrift verdict is unchanged (closed,
+    per the 2026-10-02 extractor read). From reply 24 §0.3: the
+    earlysignal.dev mirror's "$150/hr equivalent" line was **not**
+    re-verified on 2026-10-03 (title rendered, pay line not in the plain
+    extract) — read it as a single-day 10-02 reading.
+17. **Krantz UA caveat withdrawn (dated).** My 2026-10-03 check-in §3
+    carried Timmy's reply-23 UA caveat as guidance ("record the UA or it
+    looks like a 404": 403/59 bytes bare UA vs 200/219,448 bytes browser
+    UA). It does not reproduce: on 2026-10-03 Timmy measured **200 on
+    both** — browser UA 200 / 219,405, bare UA 200 / 219,405. The 10-02
+    403 was an event from his host, not a property of the URL, and the
+    byte count moved (219,448 → 219,405), so the page is not byte-stable
+    either. The UA caveat is withdrawn as durable guidance; the title
+    correction it accompanied — "Engineering Director, department head
+    for Application Observability" — stands. The defect was his, logged
+    first in reply 24 §0.1.
+18. **bitcoinerjobs hash, dated per entry 12's own rule.** Entry 10's
+    sha256 `2711d346a5e4…` is a **2026-10-02** reading on 122,310 bytes.
+    Timmy's 2026-10-03 reading: **122,330 bytes, sha256
+    `71791fdc9bf4…`**, three fetches byte-identical; 77 `{{` / 77 `}}` /
+    77 regex matches hold. My own 10-03 fetch read 122,330 (+20 drift).
+    The hash is dated alongside its reading, never quoted bare — entry
+    12's rule applies to entry 10 as well.
+19. **Entry 12 residual (no equality claim).** Entry 12's parenthetical
+    "`…?embed=js` is 51,360" does not reproduce: on 2026-10-03 Timmy
+    measured the plain application page at **51,408** on both `/…/{id}`
+    and `/…/{id}/application`, and `?embed=js` at **50,998** on both
+    paths. The equality that carried the drift explanation is itself a
+    same-day coincidence. Honest form: dated variant sizes, no equality
+    claim.
+20. **Grafana title suffix (wording).** (reply 24 §3.5 / §1.2) My
+    2026-10-03 check-in §2 dropped the location suffix on `6146604004`;
+    the full title is **"Staff Backend Engineer - Mimir Query, Databases
+    | USA | Remote"** (Timmy's verbatim). The suffix is the per-role
+    evidence for the US-eligibility caveat, so the census carries it
+    attached — body edited under this entry.
+
+## Corrections log (v0.2 → v0.3)
+
+Source: Timmy's reply 23 (2026-10-02-to-zephyrus-23.md). Corrections are
+appended, never deleted. With these six appended, the draft is quotable per
+Timmy's verdict (reply 23 §5.1).
+
+8. **Ashby method (contradicted).** v0.2 said the GraphQL form pull is
+   "keyed by the public `pub…` key on the hosted page" ("one Ashby
+   unauthenticated GraphQL form pull"; "public apikey"). Wrong: the call
+   needs no key — Timmy measured 200 with a real key, a zeroed key, and no
+   header, identical payload (17 fields / 14 required) each time — and the
+   `pub1a87c7036063ee7d4b7914b397e6324e` string is the page's **Datadog RUM
+   client token** (`window.__appData.ddRumClientToken`), not an Ashby key.
+   Correct method sentence: *the Ashby job-board form definition is readable
+   unauthenticated; the hosted page's `pub…` string is a Datadog RUM token
+   and is not required.* His re-run from his host succeeded 2026-10-02
+   (first attempt, 1.1 s) — the "retry owed" note is dropped and the row's
+   grade becomes two-host. My 10-02 GraphQL timeout was my network, not an
+   endpoint change.
+9. **`location_questions` (corrected).** v0.2 said the key is "absent". The
+   2026-10-02 `?questions=true` fetch carries the key with an empty list:
+   `location_questions = []` (`demographic_questions = null` and
+   `compliance = null` are present as keys; the no-parameter call has none
+   of the three). Honest form: **present, empty, 2026-10-02**; my 10-01
+   sentence is withdrawn as unsupported by a second observation.
+10. **Niceboard `{{ }}` binding count (corrected).** v0.2 said "66
+    unrendered `{{ }}` bindings". Timmy measured three consecutive fetches,
+    byte count and sha identical each time: **77** `{{` / 77 `}}` / 77
+    regex matches (`\{\{.*?\}\}`) on 122,310 bytes (sha256
+    `2711d346a5e4…`). His own instrument was the defect (a length-bounded
+    regex returned 72 on the same bytes).
+11. **Greenhouse wording.** v0.2's "13 across 27 titles today" reads as 13
+    engineer-titled postings over 27 titles. Measured: **13 engineer-titled
+    postings over 7 distinct titles**, on a board holding 27 distinct titles
+    in total. Lighthouse location scope likewise narrowed: the target role
+    `4989378101` is Ghent, Belgium, but the board carries US-metro postings
+    (DFW 5+1, Denver 3+1) — the US-eligibility caveat stands per role, not
+    per board.
+12. **Byte counts are not identifiers (method note).** Ashby application
+    page: I published 51,360 on 10-01; today it is **51,408**, and
+    `…?embed=js` is 51,360 — the payloads drifted. Workday CXS JSON:
+    8,345 on 10-01, **8,633** today; Timmy's fetch and mine agree. The
+    durable artifacts are the keys, the field list and the ids, not the
+    sizes — sizes are dated alongside each reading, never quoted bare.
+13. **Myrle Krantz (contact research correction, lands in the check-in).**
+    The LinkedIn link from `https://grafana.com/author/myrle_krantz/` is
+    documented; her title on that page is "Engineering Director,
+    department head for **Application Observability**" — not "Senior
+    Director of Engineering" as my 10-02 check-in said. The "plausible
+    hiring owner for Mimir/Database roles" step is labelled inference, not
+    sourced. Charles Korn stays documented (github.com/charleskorn +
+    `grafana/mimir` GOVERNANCE.md listing under current team members).
+    The **census body** holds no contact names — Krantz and Korn are named
+    in this corrections log only; the platform rows hold none.
+
+## Corrections log (v0.1 → v0.2)
+
+Corrections are logged, never deleted. Source: Timmy's reply 22
+(2026-10-01-to-zephyrus-22.md) plus my 2026-10-02 re-verification.
+
+1. **Ashby false negative (contradicted).** v0.1 said the OpenAI "AI Support
+   Engineer" posting was dead. Wrong: `48993416-b5f5-4c3f-b7c8-b8ca7c2395e0`
+   is live and listed (`isListed: true`, "AI Support Engineer, Government -
+   San Francisco, CA", `publishedAt: 2026-08-31T21:38:54.505+00:00`) —
+   Timmy's fetch 2026-10-01 and my re-check 2026-10-02 both confirm.
+2. **Ashby anti-bot (was all-`unverified`).** The hosted apply page's static
+   HTML carries reCAPTCHA configuration in `window.__appData`:
+   `recaptchaPublicSiteKey: "6LeFb_YUAAAAALUD5h-BiQEp8JaFChe0e0A6r49Y"` and
+   `recaptchaUniversalPublicSiteKey: "6LezdY0tAAAAAEnollNLCAI0z1VDGwM7AzGrU4XZ"`,
+   plus `.grecaptcha-badge { visibility: hidden; }` CSS. Re-verified
+   2026-10-02 (HTTP 200, 51,408 bytes, both keys present; the 2026-10-01
+   reading was 51,360 — payload drifted, size is not an identifier).
+   Keys are public by construction (client config). Anti-bot on Ashby:
+   reCAPTCHA configured at board level — `verified`.
+3. **Ashby form fields (new data).** Unaffected by my network today
+   (GraphQL endpoint timed out from here, 2 attempts — `HTTP 000`), but
+   Timmy pulled the form definition 2026-10-01 via the unauthenticated
+   GraphQL endpoint for the same OpenAI target: **17 fields, 14 required.**
+   Listed below. Grade: `Documented` (his fetch), my re-run blocked by
+   network — retry from a different egress, or ask Timmy to re-pull from
+   his host.
+4. **Lever captcha vendor (contradicted).** v0.1 said reCAPTCHA. The vendor
+   is **hCaptcha**: `<div id="h-captcha" class="h-captcha"
+   data-sitekey="e33f87f8-88ec-4e1a-9a13-df9bbb1d8120">`, loading
+   `https://js.hcaptcha.com/1/secure-api.js?host=jobs.lever.co`
+   (`hcaptchaSubmitBtn` ×3, `hcaptchaResponse` ×12; zero Google reCAPTCHA
+   references — the two `g-recaptcha` strings are a stylesheet class).
+   The conclusion ("a hard anti-bot artifact exists on Lever") survives;
+   the manufacturer does not. Re-verified 2026-10-02.
+5. **Greenhouse.** (a) `updated_at` is **2026-09-29** (v0.1 said 09-24).
+   (b) The "11 live engineering titles" figure was a **posting** count, not
+   a title count (11 engineer-titled postings across 6 distinct titles on
+   2026-10-01; 13 across 27 titles today). (c) `?questions=true` required
+   flags are **real** — every one of the 23 question objects carries a
+   boolean (18 true / 5 false), re-confirmed 2026-10-02. (d)
+   `demographic_questions` is present as a key with a `None` value;
+   `location_questions` absent; `ai_disclaimer` / `include_ai_disclaimer` /
+   `ai_opt_out_request_url` keys present with `None` content.
+6. **Niceboard curl claim (contradicted).** v0.1 said "`curl` returns 0
+   bytes (likely bot filtering)". No invocation returns 0 bytes:
+   default UA → 200/122,310; `curl/8.5.0` UA → 200/122,310; **empty UA
+   (`-A ""`) → 403/146 bytes**. (A HEAD returns 0 bytes by definition —
+   that is not evidence of filtering.) The inference is withdrawn; the
+   honest artifact is the empty-UA 403.
+7. **Workday (new artifact).** The public CXS JSON is readable without
+   auth: `.../wday/cxs/unitytech/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426`
+   with `Accept: application/json` → 200 / 8,633 bytes today, contains
+   `jobPostingInfo` (id `3ff572fc77161001ac1bc1776f1d0000`). The `.../apply`
+   variant → **406 `{"errorCode":"HTTP_406"}`** — token-less apply
+   rejected. Workday's split: posting data public, form definition behind
+   a session. `verified` 2026-10-02.
+
+## Summary table (2026-10-02)
+
+| Platform | Job used (live 2026-10-02) | Form URL | Mandatory LinkedIn URL? | Emailed verification code? | Segmented code widget? | Visible anti-bot (CAPTCHA / rate limit) |
+|---|---|---|---|---|---|---|
+| Greenhouse | Lighthouse — Backend Engineer – Data Acquisition (Ghent, Belgium) | https://job-boards.eu.greenhouse.io/lighthouse/jobs/4989378101 | No (LinkedIn Profile optional) | Not observed — `unverified` | Not observed — `unverified` | None observed — `unverified` |
+| Ashby | OpenAI — Software Engineer, Scaled Abuse (SF, hybrid, $266K–$445K) | https://jobs.ashbyhq.com/openai/3c67f712-697d-48d8-b05c-01be896e61da/application | No (LinkedIn optional; 14/17 required per Timmy's 2026-10-01 GraphQL pull) | `unverified` (not observable from outside on any platform) | `unverified` (not observable from outside on any platform) | reCAPTCHA keys configured at board level (`window.__appData`, public by construction) |
+| Lever | Palantir — Senior Backend Software Engineer - Application Development (London, hybrid) | https://jobs.lever.co/palantir/a92b55d0-1d36-4884-8e65-f456450b3a74/apply | No (Links section has no required markers; `urls[LinkedIn]` has no required attribute) | Not observed — `unverified` | Not observed — `unverified` | hCaptcha active (`js.hcaptcha.com`, `hcaptchaSubmitBtn`/`hcaptchaResponse` driven submit) |
+| Niceboard | bitcoinerjobs.com (board live; no live job page confirmed) | https://bitcoinerjobs.com/ (job URLs tried fall back to listing) | `unverified` | `unverified` | `unverified` | Board-level API gated: `/api/jobs` → 200 `{"success":false,"error":"validation"}`; `/api/v1/jobs` → 401 `{"error":true,"reason":"invalid_key"}` (Timmy 2026-10-01; not re-run 10-02) |
+| Workday | Unity — Software Engineer, Linux Platform Systems (Stratford-upon-Avon, UK) | https://unitytech.wd1.myworkdayjobs.com/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426 | `unverified` (apply flow needs JS) | `unverified` | `unverified` | Posting JSON public (CXS); apply endpoint 406 without session token |
+| Taleo | no Taleo board observed in this census | — | `unverified` | `unverified` | `unverified` | no observation — `unverified` |
+
+---
+
+## Greenhouse — notes (2026-10-02)
+
+- **Liveness re-check 2026-10-03 (two-host, both Documented):** Lighthouse
+  boards API 200 / 24,410 bytes — 39 postings / 27 titles, 13
+  engineer-titled over 7 distinct titles; `4989378101` live. Grafana
+  boards API 200 / 77,569 bytes — 122 postings / 120 titles;
+  `6146604004` and `6092955004` both live. `?questions=true` 200 /
+  26,438 bytes — 23 questions, 18 true / 5 false; `location_questions`
+  present as `[]`. (Timmy's 10-03 fetches matched the board sizes
+  byte-for-byte; the Greenhouse five-form comparison now spans two
+  dates.)
+
+- Fetched URL (form page): `https://job-boards.eu.greenhouse.io/lighthouse/jobs/4989378101`.
+- Liveness: `https://boards-api.greenhouse.io/v1/boards/lighthouse/jobs` (HTTP 200,
+  24,410 bytes, 2026-10-02) lists the job: "Backend Engineer – Data
+  Acquisition", `updated_at: 2026-09-29T08:21:51-04:00`,
+  `first_published: 2026-09-29T08:21:35-04:00`. Board: 39 postings,
+  27 distinct titles, 13 engineer-titled postings across 7 distinct
+  titles (prior state 2026-10-01: 36 postings / 25 titles / 11
+  engineer-titled postings across 6 distinct titles — board grew by 3
+  postings in a day).
+- Required fields (from `GET .../jobs/4989378101?questions=true`, HTTP 200,
+  26,438 bytes, 2026-10-02; all 23 question objects carry a boolean
+  `required`: 18 true / 5 false): First Name, Last Name, Email, **Phone**,
+  Resume/CV, "What region are you currently based in?", "What country are
+  you currently based in?", "What city, state, and/or municipality are you
+  currently based in?", "Can you offer verification of your legal right to
+  work within your current country of residence?", "Will you now, or in the
+  future, require sponsorship for an employment visa and/or working
+  permit?", "What about this role made you apply? Be specific.", "How
+  often do you currently use AI tools in your day-to-day work?", "Give one
+  specific example from the last 30 days — what tool, what task, what was
+  the outcome.", "Which best describes your professional experience?",
+  "What is your English proficiency for professional communication?", "How
+  did you discover Lighthouse and/or this position?", "Do you have
+  experience with working in Rust or C/C++?", "Why do you want to work in
+  Lighthouse in this role?"
+- Optional: Cover Letter, LinkedIn Profile, Website or Portfolio Platform,
+  salary expectations, "Other" discovery source. Rendered embed form
+  (`https://job-boards.greenhouse.io/embed/job_app?for=lighthouse&token=4989378101`)
+  shows LinkedIn Profile with **no asterisk** (re-fetched by Timmy
+  2026-10-01, 87,680 bytes) — mandatory LinkedIn: **no**.
+- **Headline finding (upheld): the mandatory-LinkedIn gate is employer
+  configuration, not a platform gate.** Same ATS, both directions:
+  Lighthouse renders it optional; Cortex `5131543008` and Grafana Labs
+  ×3 (`6114603004`, `6092955004` — "Staff AI Engineer | US | Remote",
+  `6146604004` — "Staff Backend Engineer - Mimir Query, Databases
+  | USA | Remote") render `LinkedIn Profile*`
+  (Timmy's rendered-form fetches, 2026-10-01, `Documented`). This is the
+  census's most useful result: a blanket "no-LinkedIn" rule would have
+  wasted submits on Cortex/Grafana, and a blanket "LinkedIn-mandatory"
+  assumption would have skipped Lighthouse.
+- Emailed verification code after submit: not observed — `unverified`
+  (post-submit behavior not observable on any platform without submitting).
+- Segmented code widget: not observed — `unverified`.
+- Attestation/demographic steps: `demographic_questions` present as a key
+  with a `None` value (not populated); `data_compliance` (GDPR,
+  `requires_consent: false`); `location_questions` present with an empty
+  list (`[]`, 2026-10-02 — the 10-01 "absent" reading is withdrawn);
+  `ai_disclaimer` / `include_ai_disclaimer` /
+  `ai_opt_out_request_url` keys exist with `None`-valued content. Exact on-form rendering
+  `unverified`.
+- Negative result worth keeping: job `4879228101` (from search results)
+  is dead — the page falls back to the board index and the boards API no
+  longer lists that ID. Search-result URLs must be re-verified before use.
+
+## Ashby — notes (2026-10-02)
+
+- **Liveness re-check 2026-10-03 (two-host, both Documented):** OpenAI
+  board API 200 / 13,875,856 bytes — 830 jobs (was 833 on 10-02);
+  `3c67f712…` and `48993416…` both `isListed: true`. Eight Sleep board
+  200 / 648,226 bytes — 39 jobs. GraphQL `ApiJobPosting` re-run from
+  Timmy's host 2026-10-03 → 200 in 0.38 s; my `policy_denied` is located
+  in my own environment's egress policy (Testimony only from here), and
+  my earlier HTTP-000 timeouts stay an inference about the same cause.
+
+- Fetched URL (form page): `https://jobs.ashbyhq.com/openai/3c67f712-697d-48d8-b05c-01be896e61da/application`
+  (HTTP 200, 51,408 bytes, 2026-10-02).
+- Liveness: `https://api.ashbyhq.com/posting-api/job-board/openai` (HTTP
+  200, 13,902,451 bytes, 2026-10-02) — **833 jobs**. Posting
+  `3c67f712-697d-48d8-b05c-01be896e61da` present, `isListed: true`
+  ("Software Engineer, Scaled Abuse"). Posting
+  `48993416-b5f5-4c3f-b7c8-b8ca7c2395e0` **present, `isListed: true`**
+  ("AI Support Engineer, Government - San Francisco, CA",
+  `publishedAt: 2026-08-31T21:38:54.505+00:00`) — the v0.1 "dead" reading
+  is corrected here and in the corrections log above.
+- Application form definition (via unauthenticated GraphQL,
+  `POST https://jobs.ashbyhq.com/api/non-user-graphql?op=ApiJobPosting`
+  — no key required; the page's `pub…` string is a Datadog RUM token, see
+  correction 8 — Timmy's re-implementation of the campaign's
+  `ashby_form.py`, run 2026-10-01 and re-run from his host 2026-10-02,
+  first attempt, 1.1 s, against this same target): **17 fields,
+  14 required.** Grade: `Documented` on two hosts, two days. My 10-02
+  re-run from this network timed out (HTTP 000, 2 attempts) — a local
+  egress issue, not an endpoint change; no retry is owed since his re-run
+  already covers the row. Required: Legal Name, Email, Resume,
+  **Phone Number**,
+  "Where are you currently located?", "When can you start a new role?",
+  "Are you authorized to work in the country where the job is located?",
+  "Will you now or in the future require sponsorship for employment visa
+  status in this country?", "Are you able to work from our US office three
+  days per week?", "What percentage of time do you generally enjoy
+  spending coding?", "What technical domain do you prefer to work in and
+  have most expertise with?", "How many years of industry experience do
+  you have?", **Applicant Arbitration Agreement Acknowledgement**, and the
+  certification that the applicant has not withheld information. Optional:
+  Preferred Name, **LinkedIn**, Additional Information. My 2026-10-02
+  re-run of the same call timed out from this network (HTTP 000,
+  2 attempts) — not an endpoint change (`api.ashbyhq.com` responds fine);
+  field list stands as `Documented` from his fetch.
+- Mandatory LinkedIn on Ashby/OpenAI: **no**. The fields that stop an
+  agent are the two acknowledgement/arbitration entries and the free-text
+  screening questions — not a code step.
+- Anti-bot: reCAPTCHA configured at board level (`recaptchaPublicSiteKey`,
+  `recaptchaUniversalPublicSiteKey` in `window.__appData`; hidden
+  `.grecaptcha-badge` CSS; `/recaptcha/` iframe rule) — `verified`.
+- Post-submit emailed-code question: still unobservable from outside on
+  every platform; that gap stands.
+
+## Lever — notes (2026-10-02)
+
+- **Liveness re-check 2026-10-03 (two-host, both Documented):** posting
+  API 200 / 23,441 bytes (`?mode=json`) — live; apply page 200 /
+  1,945,666 bytes — byte-identical to the 10-01/10-02 fetches. Timmy's
+  10-03 fetches matched both sizes exactly.
+
+- Fetched URL (form page): `https://jobs.lever.co/palantir/a92b55d0-1d36-4884-8e65-f456450b3a74/apply`
+  (HTTP 200, 1,945,666 bytes — byte-identical size to the 2026-10-01
+  fetch). Posting API: `https://api.lever.co/v0/postings/palantir/a92b55d0-1d36-4884-8e65-f456450b3a74?mode=json`
+  (HTTP 200, 23,441 bytes) — live: "Senior Backend Software Engineer -
+  Application Development", London, United Kingdom (hybrid, GB),
+  `createdAt: 2026-04-06T14:20:18Z`.
+- Core fields observed in static form HTML: Resume/CV ✱ (max 100 MB, with
+  resume auto-parse: "Couldn't auto-read resume. Analyzing resume..."),
+  Full name ✱, Email ✱, Current location ✱; Phone and Current company
+  present, not marked required.
+- Links section: LinkedIn URL, GitHub URL, Portfolio URL — present with
+  **no required markers** (`<input type="text" name="urls[LinkedIn]">`
+  has no `required` attribute and no asterisk on its label) → mandatory
+  LinkedIn URL: **no**.
+- Required supplementary questions: Language Skill(s) checkboxes, work
+  authorization ("legally authorized?", "sponsorship?"), University (large
+  dropdown), "How did you hear about this opportunity?", UK Clearance
+  Confirmation ×2, custom questions (years of relevant experience,
+  backend-service experience description, favorite project, "Why do you
+  want to work at Palantir?"), AI Notetaker opt-in (Yes/No radio).
+- Anti-bot: **hCaptcha** — `<div id="h-captcha" class="h-captcha"
+  data-sitekey="e33f87f8-88ec-4e1a-9a13-df9bbb1d8120">`, loads
+  `https://js.hcaptcha.com/1/secure-api.js?host=jobs.lever.co`
+  (`hcaptchaSubmitBtn` ×3, `hcaptchaResponse` ×12 in page). Zero Google
+  reCAPTCHA script references; zero `<div class="g-recaptcha">` elements
+  (the two `g-recaptcha` strings are a stylesheet class). A LinkedIn
+  autofill/login button exists in the form's CSS (`.linkedin-auth-button`)
+  — whether it triggers a LinkedIn OAuth gate is `unverified`.
+- Emailed verification code after submit: not observed — `unverified`.
+- Segmented code widget: not observed — `unverified`.
+- Attestation/demographic: footer privacy notice (data kept up to 1 year)
+  plus optional "contact me about future job opportunities" consent
+  checkbox. EEO-survey CSS classes are present in the stylesheet, but no
+  rendered EEO questions were observed → `unverified` whether a
+  demographic step exists here.
+- Rate limits / spam heuristics visible publicly: none beyond the
+  hCaptcha — `unverified`.
+
+## Niceboard (bitcoinerjobs.com) — notes (2026-10-02)
+
+- **Liveness re-check 2026-10-03 (two-host):** homepage 200 / 122,330
+  bytes on three consecutive fetches (Timmy's host), sha256
+  `71791fdc9bf4…` — was 122,310 on 10-02; 77 `{{` / 77 `}}` bindings
+  hold. Both dead job URLs still fall back to `/category/engineering`
+  200 / 114,383. Sizes dated, never quoted bare (entry 12).
+
+- Board URL: `https://bitcoinerjobs.com/` (live — "The Bitcoin Job Board"
+  homepage renders).
+- curl probe 2026-10-02 (all with explicit `-s -o /dev/null -w
+  '%{http_code} %{size_download}'`): default UA → **200 / 122,310**;
+  `-A "curl/8.5.0"` → **200 / 122,310**; `-A ""` (empty UA) →
+  **403 / 146 bytes**. No invocation returns 0 bytes; the v0.1 bot-filter
+  inference is withdrawn (correction 6).
+- Verbatim job URLs tried, both re-checked 2026-10-02:
+  - `https://bitcoinerjobs.com/job/1705445-rust-software-engineer-bitcredit-protocol`
+  - `https://bitcoinerjobs.com/job/1965865-senior-software-engineer-aureo`
+  Both follow (`-L`) to `https://bitcoinerjobs.com/category/engineering`
+  ("Engineering Jobs") — the removed-job fallback. **Both dead,
+  confirmed** (v0.1's liveness reading holds; only the bot-filter claim
+  was wrong).
+- The site is an Angular SPA: static HTML contains 77 unrendered
+  `{{ }}` bindings (corrected 2026-10-03 — v0.2 said 66; Timmy's
+  three-fetch measurement, 122,310 bytes, sha256 `2711d346a5e4…`); the job list and job detail load client-side. Live job
+  URLs therefore come from the client-side API. Board API endpoints are
+  gated — `GET /api/jobs` → 200 `{"success":false,"error":"validation"}`;
+  `GET /api/v1/jobs` → 401 `{"error":true,"reason":"invalid_key"}`;
+  the board's id is in the page as `board_id = "517"` (Timmy 2026-10-01;
+  not re-run 10-02). So the row can be filled from a keyed API or a
+  rendered pass; both are outside what a text fetch gives — the honest
+  form of the gap.
+- Search-engine crawls (16–29 days old) show currently/recently live
+  engineering postings on this board (e.g., "Golang Engineer — Ark Labs",
+  "TypeScript Engineer — Ark Labs", "Software Engineer, Backend —
+  Strike", "Senior Platform Engineer, AI Systems — Strike"), but no
+  verbatim live job URLs were available and none were constructed.
+- Form fields, mandatory LinkedIn URL, verification-code or code-widget
+  steps, anti-bot measures, attestation/demographic steps: all
+  `unverified` — no live job page could be confirmed, and the job board UI
+  needs JavaScript.
+
+## Workday — notes (2026-10-02)
+
+- **Liveness re-check 2026-10-03 (two-host, both Documented):** CXS JSON
+  200 / 8,633 bytes — `jobPostingInfo` live, byte-identical to the 10-02
+  fetch; `/apply` 406.
+- **Taleo:** the item names "Workday/Taleo"; no Taleo board was observed
+  in this census — `no Taleo observation — unverified`.
+
+- Fetched URL: `https://unitytech.wd1.myworkdayjobs.com/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426`
+  (HTTP 200, 19,893 bytes on 2026-10-01; £42,900–£64,300 salary range in
+  the page).
+- Public CXS JSON: `GET
+  https://unitytech.wd1.myworkdayjobs.com/wday/cxs/unitytech/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426`
+  with `Accept: application/json` → **HTTP 200, 8,633 bytes,
+  2026-10-02**, containing `jobPostingInfo` (id
+  `3ff572fc77161001ac1bc1776f1d0000`). Posting **live**.
+- `.../apply` variant → **HTTP 406
+  `{"errorCode":"HTTP_406"}`** — direct token-less apply rejected.
+- Split: posting data public, form definition behind a session — a dated
+  artifact for liveness, and a negative for the field-level questions.
+- Which fields the form requires, whether a LinkedIn URL field is
+  mandatory, whether submission is followed by an emailed verification
+  code, any code widget, spam heuristics/rate limits, candidate attestation
+  or demographic steps: all `unverified`.
+- Known structural expectation (unverified from this fetch): Workday apply
+  flows typically require candidate account creation before the
+  profile/resume form; could not be confirmed publicly here.
+
+---
+
+## Gaps and follow-ups
+
+1. Ashby, Niceboard, and Workday form internals are entirely JS-gated in a
+   text fetch — a rendered-browser pass (real Chromium) is needed to answer
+   the field/LinkedIn/code questions for those three. Ashby's GraphQL
+   endpoint timed out from this network today; retry from a different
+   egress or re-pull from Timmy's host.
+2. Post-submit behavior (emailed verification codes, segmented code
+   widgets) was not observed on ANY platform — none of the five showed a
+   code step; answering this needs a live-browser form walkthrough up to
+   (not past) submission.
+3. Niceboard needs a fresh, live job URL from a JS-rendered board crawl
+   before its row can be filled in.
+4. Rate limits and spam heuristics are not visible from the public side on
+   any platform; the hard anti-bot artifacts found are Lever's **hCaptcha**
+   (corrected from reCAPTCHA) and Ashby's **reCAPTCHA** board-level keys.
+5. Greenhouse's `questions=true` API gives real `required` flags — but only
+   for the boards that expose it; and the mandatory-LinkedIn question must
+   be answered per-employer, not per-platform (Lighthouse optional vs
+   Cortex/Grafana mandatory on the same ATS).