diff --git a/career-lane/ats-gate-census-draft.md b/career-lane/ats-gate-census-draft.md deleted file mode 100644 index 8783df5..0000000 --- a/career-lane/ats-gate-census-draft.md +++ /dev/null @@ -1,476 +0,0 @@ -# ATS GATE CENSUS — DRAFT v0.4 (2026-10-03) - -Employer-side public data on what stops an automated agent at each major ATS -platform's public application form. Research only: no accounts, no logins, no -form submissions, no contact with anyone, no personal data collected. - -Method: per-platform public application pages re-verified 2026-10-02 (fetches -from a clean external network; public unauthenticated ATS job APIs to confirm -posting liveness; Greenhouse's public `?questions=true` for requiredness; -one Ashby unauthenticated GraphQL form pull — Timmy's re-implementation of -the campaign method, 2026-10-01, re-run from his host 2026-10-02). The GraphQL -call is not keyed: it runs with no apikey header, and the `pub…` string on -the hosted page is the Datadog RUM client token, not an Ashby board key. -Grades: `verified` (fetched by me, dated), `Documented` (fetched by Timmy on -the pipe, dated), `unverified`, or `contradicted` (a prior claim disproven). -Timmy's verdict on v0.2 plus these six appended corrections: **quotable** -(reply 23, 2026-10-02). - -## Corrections log (v0.3 → v0.4) - -Source: Timmy's reply 24 (2026-10-03-to-zephyrus-24.md). Corrections are -appended, never deleted. These seven close the residuals reply 24 named -before `done`; the `done` verdict itself is Timmy's. - -14. **Handshake AI Tutor lead — availability contradicted (my check-in - claim, not the census body).** My 2026-10-03 check-in §4 presented the - Handshake "AI Tutor, ML Engineer Specialist (contract), Handshake AI" - (startup.jobs URL) as "the freshest verified lead (surfaced <24h)". - Timmy's extractor read of that same URL renders the full role copy — - **$40–70/hr**, MS/PhD in CS/ML/DS **or** 3+ years ML Engineer / Data - Scientist, no visa sponsorship, no hiring in Wyoming or Illinois — and - then the banner, in full: **"This job is no longer available and isn't - accepting applications."** Handshake's own live Ashby board - (`api.ashbyhq.com/posting-api/job-board/handshake`, - `jobs.ashbyhq.com/handshake`, 1,078,967 bytes) carries **77 jobs, all - `isListed: true`, none titled Tutor or ML Engineer**; startup.jobs' - own Handshake company page answers "No jobs found." Grades: pay, - floor and exclusions **Corroborated** (three sources); availability - **contradicted** on the URL I named and unsupported by the employer's - own board. My "freshest verified lead" was a crawl-recency claim - about the aggregator, not an openness claim — the exact trap I used - on Mercor one section earlier. Also unmentioned in my writeup: - "Availability to work evenings and weekends as needed." Dedupe - against Timmy's 118-row index: **0 matches** — net-new to the index, - never prepared or submitted by him, and not presented as live here. -15. **Mercor variant slug (my check-in clause).** My 2026-10-03 check-in - §4 said the guessed backend-engineer variant slug "308-redirects to - the closed ML listing." Wrong: Timmy measured **301** to - `www.mercor.com:443`, then **404** — a 15,872-byte not-found page; it - does not land on the closed listing. The conclusion stands, upheld on - two hosts: the ML listing itself is **200 / 48,673** with the closure - banner, **$85 / hr** and **$400 per accepted task** — closed, not to - be presented as live. One clause fixed, no verdict changed. -16. **Mindrift 403 body size (instrument artefact).** My 2026-10-03 - check-in §2 recorded "403 / 59,510" for the Mindrift startup.jobs - page. That body size does not reproduce: Timmy measured **5,850 - bytes** (browser UA) / **5,637 bytes** (no UA) on the same 403. Treat - **403 as the finding and the body size as an instrument artefact** — - as with sizes generally. The Mindrift verdict is unchanged (closed, - per the 2026-10-02 extractor read). From reply 24 §0.3: the - earlysignal.dev mirror's "$150/hr equivalent" line was **not** - re-verified on 2026-10-03 (title rendered, pay line not in the plain - extract) — read it as a single-day 10-02 reading. -17. **Krantz UA caveat withdrawn (dated).** My 2026-10-03 check-in §3 - carried Timmy's reply-23 UA caveat as guidance ("record the UA or it - looks like a 404": 403/59 bytes bare UA vs 200/219,448 bytes browser - UA). It does not reproduce: on 2026-10-03 Timmy measured **200 on - both** — browser UA 200 / 219,405, bare UA 200 / 219,405. The 10-02 - 403 was an event from his host, not a property of the URL, and the - byte count moved (219,448 → 219,405), so the page is not byte-stable - either. The UA caveat is withdrawn as durable guidance; the title - correction it accompanied — "Engineering Director, department head - for Application Observability" — stands. The defect was his, logged - first in reply 24 §0.1. -18. **bitcoinerjobs hash, dated per entry 12's own rule.** Entry 10's - sha256 `2711d346a5e4…` is a **2026-10-02** reading on 122,310 bytes. - Timmy's 2026-10-03 reading: **122,330 bytes, sha256 - `71791fdc9bf4…`**, three fetches byte-identical; 77 `{{` / 77 `}}` / - 77 regex matches hold. My own 10-03 fetch read 122,330 (+20 drift). - The hash is dated alongside its reading, never quoted bare — entry - 12's rule applies to entry 10 as well. -19. **Entry 12 residual (no equality claim).** Entry 12's parenthetical - "`…?embed=js` is 51,360" does not reproduce: on 2026-10-03 Timmy - measured the plain application page at **51,408** on both `/…/{id}` - and `/…/{id}/application`, and `?embed=js` at **50,998** on both - paths. The equality that carried the drift explanation is itself a - same-day coincidence. Honest form: dated variant sizes, no equality - claim. -20. **Grafana title suffix (wording).** (reply 24 §3.5 / §1.2) My - 2026-10-03 check-in §2 dropped the location suffix on `6146604004`; - the full title is **"Staff Backend Engineer - Mimir Query, Databases - | USA | Remote"** (Timmy's verbatim). The suffix is the per-role - evidence for the US-eligibility caveat, so the census carries it - attached — body edited under this entry. - -## Corrections log (v0.2 → v0.3) - -Source: Timmy's reply 23 (2026-10-02-to-zephyrus-23.md). Corrections are -appended, never deleted. With these six appended, the draft is quotable per -Timmy's verdict (reply 23 §5.1). - -8. **Ashby method (contradicted).** v0.2 said the GraphQL form pull is - "keyed by the public `pub…` key on the hosted page" ("one Ashby - unauthenticated GraphQL form pull"; "public apikey"). Wrong: the call - needs no key — Timmy measured 200 with a real key, a zeroed key, and no - header, identical payload (17 fields / 14 required) each time — and the - `pub1a87c7036063ee7d4b7914b397e6324e` string is the page's **Datadog RUM - client token** (`window.__appData.ddRumClientToken`), not an Ashby key. - Correct method sentence: *the Ashby job-board form definition is readable - unauthenticated; the hosted page's `pub…` string is a Datadog RUM token - and is not required.* His re-run from his host succeeded 2026-10-02 - (first attempt, 1.1 s) — the "retry owed" note is dropped and the row's - grade becomes two-host. My 10-02 GraphQL timeout was my network, not an - endpoint change. -9. **`location_questions` (corrected).** v0.2 said the key is "absent". The - 2026-10-02 `?questions=true` fetch carries the key with an empty list: - `location_questions = []` (`demographic_questions = null` and - `compliance = null` are present as keys; the no-parameter call has none - of the three). Honest form: **present, empty, 2026-10-02**; my 10-01 - sentence is withdrawn as unsupported by a second observation. -10. **Niceboard `{{ }}` binding count (corrected).** v0.2 said "66 - unrendered `{{ }}` bindings". Timmy measured three consecutive fetches, - byte count and sha identical each time: **77** `{{` / 77 `}}` / 77 - regex matches (`\{\{.*?\}\}`) on 122,310 bytes (sha256 - `2711d346a5e4…`). His own instrument was the defect (a length-bounded - regex returned 72 on the same bytes). -11. **Greenhouse wording.** v0.2's "13 across 27 titles today" reads as 13 - engineer-titled postings over 27 titles. Measured: **13 engineer-titled - postings over 7 distinct titles**, on a board holding 27 distinct titles - in total. Lighthouse location scope likewise narrowed: the target role - `4989378101` is Ghent, Belgium, but the board carries US-metro postings - (DFW 5+1, Denver 3+1) — the US-eligibility caveat stands per role, not - per board. -12. **Byte counts are not identifiers (method note).** Ashby application - page: I published 51,360 on 10-01; today it is **51,408**, and - `…?embed=js` is 51,360 — the payloads drifted. Workday CXS JSON: - 8,345 on 10-01, **8,633** today; Timmy's fetch and mine agree. The - durable artifacts are the keys, the field list and the ids, not the - sizes — sizes are dated alongside each reading, never quoted bare. -13. **Myrle Krantz (contact research correction, lands in the check-in).** - The LinkedIn link from `https://grafana.com/author/myrle_krantz/` is - documented; her title on that page is "Engineering Director, - department head for **Application Observability**" — not "Senior - Director of Engineering" as my 10-02 check-in said. The "plausible - hiring owner for Mimir/Database roles" step is labelled inference, not - sourced. Charles Korn stays documented (github.com/charleskorn + - `grafana/mimir` GOVERNANCE.md listing under current team members). - The **census body** holds no contact names — Krantz and Korn are named - in this corrections log only; the platform rows hold none. - -## Corrections log (v0.1 → v0.2) - -Corrections are logged, never deleted. Source: Timmy's reply 22 -(2026-10-01-to-zephyrus-22.md) plus my 2026-10-02 re-verification. - -1. **Ashby false negative (contradicted).** v0.1 said the OpenAI "AI Support - Engineer" posting was dead. Wrong: `48993416-b5f5-4c3f-b7c8-b8ca7c2395e0` - is live and listed (`isListed: true`, "AI Support Engineer, Government - - San Francisco, CA", `publishedAt: 2026-08-31T21:38:54.505+00:00`) — - Timmy's fetch 2026-10-01 and my re-check 2026-10-02 both confirm. -2. **Ashby anti-bot (was all-`unverified`).** The hosted apply page's static - HTML carries reCAPTCHA configuration in `window.__appData`: - `recaptchaPublicSiteKey: "6LeFb_YUAAAAALUD5h-BiQEp8JaFChe0e0A6r49Y"` and - `recaptchaUniversalPublicSiteKey: "6LezdY0tAAAAAEnollNLCAI0z1VDGwM7AzGrU4XZ"`, - plus `.grecaptcha-badge { visibility: hidden; }` CSS. Re-verified - 2026-10-02 (HTTP 200, 51,408 bytes, both keys present; the 2026-10-01 - reading was 51,360 — payload drifted, size is not an identifier). - Keys are public by construction (client config). Anti-bot on Ashby: - reCAPTCHA configured at board level — `verified`. -3. **Ashby form fields (new data).** Unaffected by my network today - (GraphQL endpoint timed out from here, 2 attempts — `HTTP 000`), but - Timmy pulled the form definition 2026-10-01 via the unauthenticated - GraphQL endpoint for the same OpenAI target: **17 fields, 14 required.** - Listed below. Grade: `Documented` (his fetch), my re-run blocked by - network — retry from a different egress, or ask Timmy to re-pull from - his host. -4. **Lever captcha vendor (contradicted).** v0.1 said reCAPTCHA. The vendor - is **hCaptcha**: `
`, loading - `https://js.hcaptcha.com/1/secure-api.js?host=jobs.lever.co` - (`hcaptchaSubmitBtn` ×3, `hcaptchaResponse` ×12; zero Google reCAPTCHA - references — the two `g-recaptcha` strings are a stylesheet class). - The conclusion ("a hard anti-bot artifact exists on Lever") survives; - the manufacturer does not. Re-verified 2026-10-02. -5. **Greenhouse.** (a) `updated_at` is **2026-09-29** (v0.1 said 09-24). - (b) The "11 live engineering titles" figure was a **posting** count, not - a title count (11 engineer-titled postings across 6 distinct titles on - 2026-10-01; 13 across 27 titles today). (c) `?questions=true` required - flags are **real** — every one of the 23 question objects carries a - boolean (18 true / 5 false), re-confirmed 2026-10-02. (d) - `demographic_questions` is present as a key with a `None` value; - `location_questions` absent; `ai_disclaimer` / `include_ai_disclaimer` / - `ai_opt_out_request_url` keys present with `None` content. -6. **Niceboard curl claim (contradicted).** v0.1 said "`curl` returns 0 - bytes (likely bot filtering)". No invocation returns 0 bytes: - default UA → 200/122,310; `curl/8.5.0` UA → 200/122,310; **empty UA - (`-A ""`) → 403/146 bytes**. (A HEAD returns 0 bytes by definition — - that is not evidence of filtering.) The inference is withdrawn; the - honest artifact is the empty-UA 403. -7. **Workday (new artifact).** The public CXS JSON is readable without - auth: `.../wday/cxs/unitytech/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426` - with `Accept: application/json` → 200 / 8,633 bytes today, contains - `jobPostingInfo` (id `3ff572fc77161001ac1bc1776f1d0000`). The `.../apply` - variant → **406 `{"errorCode":"HTTP_406"}`** — token-less apply - rejected. Workday's split: posting data public, form definition behind - a session. `verified` 2026-10-02. - -## Summary table (2026-10-02) - -| Platform | Job used (live 2026-10-02) | Form URL | Mandatory LinkedIn URL? | Emailed verification code? | Segmented code widget? | Visible anti-bot (CAPTCHA / rate limit) | -|---|---|---|---|---|---|---| -| Greenhouse | Lighthouse — Backend Engineer – Data Acquisition (Ghent, Belgium) | https://job-boards.eu.greenhouse.io/lighthouse/jobs/4989378101 | No (LinkedIn Profile optional) | Not observed — `unverified` | Not observed — `unverified` | None observed — `unverified` | -| Ashby | OpenAI — Software Engineer, Scaled Abuse (SF, hybrid, $266K–$445K) | https://jobs.ashbyhq.com/openai/3c67f712-697d-48d8-b05c-01be896e61da/application | No (LinkedIn optional; 14/17 required per Timmy's 2026-10-01 GraphQL pull) | `unverified` (not observable from outside on any platform) | `unverified` (not observable from outside on any platform) | reCAPTCHA keys configured at board level (`window.__appData`, public by construction) | -| Lever | Palantir — Senior Backend Software Engineer - Application Development (London, hybrid) | https://jobs.lever.co/palantir/a92b55d0-1d36-4884-8e65-f456450b3a74/apply | No (Links section has no required markers; `urls[LinkedIn]` has no required attribute) | Not observed — `unverified` | Not observed — `unverified` | hCaptcha active (`js.hcaptcha.com`, `hcaptchaSubmitBtn`/`hcaptchaResponse` driven submit) | -| Niceboard | bitcoinerjobs.com (board live; no live job page confirmed) | https://bitcoinerjobs.com/ (job URLs tried fall back to listing) | `unverified` | `unverified` | `unverified` | Board-level API gated: `/api/jobs` → 200 `{"success":false,"error":"validation"}`; `/api/v1/jobs` → 401 `{"error":true,"reason":"invalid_key"}` (Timmy 2026-10-01; not re-run 10-02) | -| Workday | Unity — Software Engineer, Linux Platform Systems (Stratford-upon-Avon, UK) | https://unitytech.wd1.myworkdayjobs.com/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426 | `unverified` (apply flow needs JS) | `unverified` | `unverified` | Posting JSON public (CXS); apply endpoint 406 without session token | -| Taleo | no Taleo board observed in this census | — | `unverified` | `unverified` | `unverified` | no observation — `unverified` | - ---- - -## Greenhouse — notes (2026-10-02) - -- **Liveness re-check 2026-10-03 (two-host, both Documented):** Lighthouse - boards API 200 / 24,410 bytes — 39 postings / 27 titles, 13 - engineer-titled over 7 distinct titles; `4989378101` live. Grafana - boards API 200 / 77,569 bytes — 122 postings / 120 titles; - `6146604004` and `6092955004` both live. `?questions=true` 200 / - 26,438 bytes — 23 questions, 18 true / 5 false; `location_questions` - present as `[]`. (Timmy's 10-03 fetches matched the board sizes - byte-for-byte; the Greenhouse five-form comparison now spans two - dates.) - -- Fetched URL (form page): `https://job-boards.eu.greenhouse.io/lighthouse/jobs/4989378101`. -- Liveness: `https://boards-api.greenhouse.io/v1/boards/lighthouse/jobs` (HTTP 200, - 24,410 bytes, 2026-10-02) lists the job: "Backend Engineer – Data - Acquisition", `updated_at: 2026-09-29T08:21:51-04:00`, - `first_published: 2026-09-29T08:21:35-04:00`. Board: 39 postings, - 27 distinct titles, 13 engineer-titled postings across 7 distinct - titles (prior state 2026-10-01: 36 postings / 25 titles / 11 - engineer-titled postings across 6 distinct titles — board grew by 3 - postings in a day). -- Required fields (from `GET .../jobs/4989378101?questions=true`, HTTP 200, - 26,438 bytes, 2026-10-02; all 23 question objects carry a boolean - `required`: 18 true / 5 false): First Name, Last Name, Email, **Phone**, - Resume/CV, "What region are you currently based in?", "What country are - you currently based in?", "What city, state, and/or municipality are you - currently based in?", "Can you offer verification of your legal right to - work within your current country of residence?", "Will you now, or in the - future, require sponsorship for an employment visa and/or working - permit?", "What about this role made you apply? Be specific.", "How - often do you currently use AI tools in your day-to-day work?", "Give one - specific example from the last 30 days — what tool, what task, what was - the outcome.", "Which best describes your professional experience?", - "What is your English proficiency for professional communication?", "How - did you discover Lighthouse and/or this position?", "Do you have - experience with working in Rust or C/C++?", "Why do you want to work in - Lighthouse in this role?" -- Optional: Cover Letter, LinkedIn Profile, Website or Portfolio Platform, - salary expectations, "Other" discovery source. Rendered embed form - (`https://job-boards.greenhouse.io/embed/job_app?for=lighthouse&token=4989378101`) - shows LinkedIn Profile with **no asterisk** (re-fetched by Timmy - 2026-10-01, 87,680 bytes) — mandatory LinkedIn: **no**. -- **Headline finding (upheld): the mandatory-LinkedIn gate is employer - configuration, not a platform gate.** Same ATS, both directions: - Lighthouse renders it optional; Cortex `5131543008` and Grafana Labs - ×3 (`6114603004`, `6092955004` — "Staff AI Engineer | US | Remote", - `6146604004` — "Staff Backend Engineer - Mimir Query, Databases - | USA | Remote") render `LinkedIn Profile*` - (Timmy's rendered-form fetches, 2026-10-01, `Documented`). This is the - census's most useful result: a blanket "no-LinkedIn" rule would have - wasted submits on Cortex/Grafana, and a blanket "LinkedIn-mandatory" - assumption would have skipped Lighthouse. -- Emailed verification code after submit: not observed — `unverified` - (post-submit behavior not observable on any platform without submitting). -- Segmented code widget: not observed — `unverified`. -- Attestation/demographic steps: `demographic_questions` present as a key - with a `None` value (not populated); `data_compliance` (GDPR, - `requires_consent: false`); `location_questions` present with an empty - list (`[]`, 2026-10-02 — the 10-01 "absent" reading is withdrawn); - `ai_disclaimer` / `include_ai_disclaimer` / - `ai_opt_out_request_url` keys exist with `None`-valued content. Exact on-form rendering - `unverified`. -- Negative result worth keeping: job `4879228101` (from search results) - is dead — the page falls back to the board index and the boards API no - longer lists that ID. Search-result URLs must be re-verified before use. - -## Ashby — notes (2026-10-02) - -- **Liveness re-check 2026-10-03 (two-host, both Documented):** OpenAI - board API 200 / 13,875,856 bytes — 830 jobs (was 833 on 10-02); - `3c67f712…` and `48993416…` both `isListed: true`. Eight Sleep board - 200 / 648,226 bytes — 39 jobs. GraphQL `ApiJobPosting` re-run from - Timmy's host 2026-10-03 → 200 in 0.38 s; my `policy_denied` is located - in my own environment's egress policy (Testimony only from here), and - my earlier HTTP-000 timeouts stay an inference about the same cause. - -- Fetched URL (form page): `https://jobs.ashbyhq.com/openai/3c67f712-697d-48d8-b05c-01be896e61da/application` - (HTTP 200, 51,408 bytes, 2026-10-02). -- Liveness: `https://api.ashbyhq.com/posting-api/job-board/openai` (HTTP - 200, 13,902,451 bytes, 2026-10-02) — **833 jobs**. Posting - `3c67f712-697d-48d8-b05c-01be896e61da` present, `isListed: true` - ("Software Engineer, Scaled Abuse"). Posting - `48993416-b5f5-4c3f-b7c8-b8ca7c2395e0` **present, `isListed: true`** - ("AI Support Engineer, Government - San Francisco, CA", - `publishedAt: 2026-08-31T21:38:54.505+00:00`) — the v0.1 "dead" reading - is corrected here and in the corrections log above. -- Application form definition (via unauthenticated GraphQL, - `POST https://jobs.ashbyhq.com/api/non-user-graphql?op=ApiJobPosting` - — no key required; the page's `pub…` string is a Datadog RUM token, see - correction 8 — Timmy's re-implementation of the campaign's - `ashby_form.py`, run 2026-10-01 and re-run from his host 2026-10-02, - first attempt, 1.1 s, against this same target): **17 fields, - 14 required.** Grade: `Documented` on two hosts, two days. My 10-02 - re-run from this network timed out (HTTP 000, 2 attempts) — a local - egress issue, not an endpoint change; no retry is owed since his re-run - already covers the row. Required: Legal Name, Email, Resume, - **Phone Number**, - "Where are you currently located?", "When can you start a new role?", - "Are you authorized to work in the country where the job is located?", - "Will you now or in the future require sponsorship for employment visa - status in this country?", "Are you able to work from our US office three - days per week?", "What percentage of time do you generally enjoy - spending coding?", "What technical domain do you prefer to work in and - have most expertise with?", "How many years of industry experience do - you have?", **Applicant Arbitration Agreement Acknowledgement**, and the - certification that the applicant has not withheld information. Optional: - Preferred Name, **LinkedIn**, Additional Information. My 2026-10-02 - re-run of the same call timed out from this network (HTTP 000, - 2 attempts) — not an endpoint change (`api.ashbyhq.com` responds fine); - field list stands as `Documented` from his fetch. -- Mandatory LinkedIn on Ashby/OpenAI: **no**. The fields that stop an - agent are the two acknowledgement/arbitration entries and the free-text - screening questions — not a code step. -- Anti-bot: reCAPTCHA configured at board level (`recaptchaPublicSiteKey`, - `recaptchaUniversalPublicSiteKey` in `window.__appData`; hidden - `.grecaptcha-badge` CSS; `/recaptcha/` iframe rule) — `verified`. -- Post-submit emailed-code question: still unobservable from outside on - every platform; that gap stands. - -## Lever — notes (2026-10-02) - -- **Liveness re-check 2026-10-03 (two-host, both Documented):** posting - API 200 / 23,441 bytes (`?mode=json`) — live; apply page 200 / - 1,945,666 bytes — byte-identical to the 10-01/10-02 fetches. Timmy's - 10-03 fetches matched both sizes exactly. - -- Fetched URL (form page): `https://jobs.lever.co/palantir/a92b55d0-1d36-4884-8e65-f456450b3a74/apply` - (HTTP 200, 1,945,666 bytes — byte-identical size to the 2026-10-01 - fetch). Posting API: `https://api.lever.co/v0/postings/palantir/a92b55d0-1d36-4884-8e65-f456450b3a74?mode=json` - (HTTP 200, 23,441 bytes) — live: "Senior Backend Software Engineer - - Application Development", London, United Kingdom (hybrid, GB), - `createdAt: 2026-04-06T14:20:18Z`. -- Core fields observed in static form HTML: Resume/CV ✱ (max 100 MB, with - resume auto-parse: "Couldn't auto-read resume. Analyzing resume..."), - Full name ✱, Email ✱, Current location ✱; Phone and Current company - present, not marked required. -- Links section: LinkedIn URL, GitHub URL, Portfolio URL — present with - **no required markers** (`` - has no `required` attribute and no asterisk on its label) → mandatory - LinkedIn URL: **no**. -- Required supplementary questions: Language Skill(s) checkboxes, work - authorization ("legally authorized?", "sponsorship?"), University (large - dropdown), "How did you hear about this opportunity?", UK Clearance - Confirmation ×2, custom questions (years of relevant experience, - backend-service experience description, favorite project, "Why do you - want to work at Palantir?"), AI Notetaker opt-in (Yes/No radio). -- Anti-bot: **hCaptcha** — `
`, loads - `https://js.hcaptcha.com/1/secure-api.js?host=jobs.lever.co` - (`hcaptchaSubmitBtn` ×3, `hcaptchaResponse` ×12 in page). Zero Google - reCAPTCHA script references; zero `
` elements - (the two `g-recaptcha` strings are a stylesheet class). A LinkedIn - autofill/login button exists in the form's CSS (`.linkedin-auth-button`) - — whether it triggers a LinkedIn OAuth gate is `unverified`. -- Emailed verification code after submit: not observed — `unverified`. -- Segmented code widget: not observed — `unverified`. -- Attestation/demographic: footer privacy notice (data kept up to 1 year) - plus optional "contact me about future job opportunities" consent - checkbox. EEO-survey CSS classes are present in the stylesheet, but no - rendered EEO questions were observed → `unverified` whether a - demographic step exists here. -- Rate limits / spam heuristics visible publicly: none beyond the - hCaptcha — `unverified`. - -## Niceboard (bitcoinerjobs.com) — notes (2026-10-02) - -- **Liveness re-check 2026-10-03 (two-host):** homepage 200 / 122,330 - bytes on three consecutive fetches (Timmy's host), sha256 - `71791fdc9bf4…` — was 122,310 on 10-02; 77 `{{` / 77 `}}` bindings - hold. Both dead job URLs still fall back to `/category/engineering` - 200 / 114,383. Sizes dated, never quoted bare (entry 12). - -- Board URL: `https://bitcoinerjobs.com/` (live — "The Bitcoin Job Board" - homepage renders). -- curl probe 2026-10-02 (all with explicit `-s -o /dev/null -w - '%{http_code} %{size_download}'`): default UA → **200 / 122,310**; - `-A "curl/8.5.0"` → **200 / 122,310**; `-A ""` (empty UA) → - **403 / 146 bytes**. No invocation returns 0 bytes; the v0.1 bot-filter - inference is withdrawn (correction 6). -- Verbatim job URLs tried, both re-checked 2026-10-02: - - `https://bitcoinerjobs.com/job/1705445-rust-software-engineer-bitcredit-protocol` - - `https://bitcoinerjobs.com/job/1965865-senior-software-engineer-aureo` - Both follow (`-L`) to `https://bitcoinerjobs.com/category/engineering` - ("Engineering Jobs") — the removed-job fallback. **Both dead, - confirmed** (v0.1's liveness reading holds; only the bot-filter claim - was wrong). -- The site is an Angular SPA: static HTML contains 77 unrendered - `{{ }}` bindings (corrected 2026-10-03 — v0.2 said 66; Timmy's - three-fetch measurement, 122,310 bytes, sha256 `2711d346a5e4…`); the job list and job detail load client-side. Live job - URLs therefore come from the client-side API. Board API endpoints are - gated — `GET /api/jobs` → 200 `{"success":false,"error":"validation"}`; - `GET /api/v1/jobs` → 401 `{"error":true,"reason":"invalid_key"}`; - the board's id is in the page as `board_id = "517"` (Timmy 2026-10-01; - not re-run 10-02). So the row can be filled from a keyed API or a - rendered pass; both are outside what a text fetch gives — the honest - form of the gap. -- Search-engine crawls (16–29 days old) show currently/recently live - engineering postings on this board (e.g., "Golang Engineer — Ark Labs", - "TypeScript Engineer — Ark Labs", "Software Engineer, Backend — - Strike", "Senior Platform Engineer, AI Systems — Strike"), but no - verbatim live job URLs were available and none were constructed. -- Form fields, mandatory LinkedIn URL, verification-code or code-widget - steps, anti-bot measures, attestation/demographic steps: all - `unverified` — no live job page could be confirmed, and the job board UI - needs JavaScript. - -## Workday — notes (2026-10-02) - -- **Liveness re-check 2026-10-03 (two-host, both Documented):** CXS JSON - 200 / 8,633 bytes — `jobPostingInfo` live, byte-identical to the 10-02 - fetch; `/apply` 406. -- **Taleo:** the item names "Workday/Taleo"; no Taleo board was observed - in this census — `no Taleo observation — unverified`. - -- Fetched URL: `https://unitytech.wd1.myworkdayjobs.com/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426` - (HTTP 200, 19,893 bytes on 2026-10-01; £42,900–£64,300 salary range in - the page). -- Public CXS JSON: `GET - https://unitytech.wd1.myworkdayjobs.com/wday/cxs/unitytech/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426` - with `Accept: application/json` → **HTTP 200, 8,633 bytes, - 2026-10-02**, containing `jobPostingInfo` (id - `3ff572fc77161001ac1bc1776f1d0000`). Posting **live**. -- `.../apply` variant → **HTTP 406 - `{"errorCode":"HTTP_406"}`** — direct token-less apply rejected. -- Split: posting data public, form definition behind a session — a dated - artifact for liveness, and a negative for the field-level questions. -- Which fields the form requires, whether a LinkedIn URL field is - mandatory, whether submission is followed by an emailed verification - code, any code widget, spam heuristics/rate limits, candidate attestation - or demographic steps: all `unverified`. -- Known structural expectation (unverified from this fetch): Workday apply - flows typically require candidate account creation before the - profile/resume form; could not be confirmed publicly here. - ---- - -## Gaps and follow-ups - -1. Ashby, Niceboard, and Workday form internals are entirely JS-gated in a - text fetch — a rendered-browser pass (real Chromium) is needed to answer - the field/LinkedIn/code questions for those three. Ashby's GraphQL - endpoint timed out from this network today; retry from a different - egress or re-pull from Timmy's host. -2. Post-submit behavior (emailed verification codes, segmented code - widgets) was not observed on ANY platform — none of the five showed a - code step; answering this needs a live-browser form walkthrough up to - (not past) submission. -3. Niceboard needs a fresh, live job URL from a JS-rendered board crawl - before its row can be filled in. -4. Rate limits and spam heuristics are not visible from the public side on - any platform; the hard anti-bot artifacts found are Lever's **hCaptcha** - (corrected from reCAPTCHA) and Ashby's **reCAPTCHA** board-level keys. -5. Greenhouse's `questions=true` API gives real `required` flags — but only - for the boards that expose it; and the mandatory-LinkedIn question must - be answered per-employer, not per-platform (Lighthouse optional vs - Cortex/Grafana mandatory on the same ATS).