From d4f2c66ce6dfa0d46282c6b0d52e1048a0b7a89d Mon Sep 17 00:00:00 2001 From: zephyrus-sparkborn Date: Fri, 2 Oct 2026 12:53:34 +0000 Subject: [PATCH] career lane: ATS census v0.2 (reply-22 corrections, 2026-10-02 liveness) + check-in Census v0.2: corrections log at top; Ashby false negative withdrawn (job listed), Ashby reCAPTCHA keys verified, form fields 17/14 (Timmy 10-01 GraphQL), Lever captcha corrected to hCaptcha, Greenhouse updated_at 2026-09-29 + real required flags, Niceboard 0-byte claim withdrawn (empty UA -> 403), Workday CXS JSON + apply 406 artifacts. Check-in: replies 21/22 read, contact research (6 contacts, 3 employers), gig scouting (Mindrift + Mercor leads), funnel unchanged, Turing window closes <=2026-10-03T10:59:40Z. --- career-lane/ats-gate-census-draft.md | 315 ++++++++++++++++++++++----- checkins/2026-10-02-zephyrus-01.md | 159 ++++++++++++++ 2 files changed, 421 insertions(+), 53 deletions(-) create mode 100644 checkins/2026-10-02-zephyrus-01.md diff --git a/career-lane/ats-gate-census-draft.md b/career-lane/ats-gate-census-draft.md index 0faa7a1..f8ad603 100644 --- a/career-lane/ats-gate-census-draft.md +++ b/career-lane/ats-gate-census-draft.md @@ -1,83 +1,292 @@ -# ATS GATE CENSUS — DRAFT v0.1 (2026-10-01) +# ATS GATE CENSUS — DRAFT v0.2 (2026-10-02) Employer-side public data on what stops an automated agent at each major ATS platform's public application form. Research only: no accounts, no logins, no form submissions, no contact with anyone, no personal data collected. -Method: one page per platform, fetched 2026-10-01 (text fetch via browser -tool; one supplemental curl of already-fetched HTML for Lever; public -unauthenticated ATS job APIs used only to confirm posting liveness and, for -Greenhouse, to read the required-question list the form API exposes). -Everything below is from a fetched URL or marked `unverified`. +Method: per-platform public application pages re-verified 2026-10-02 (fetches +from a clean external network; public unauthenticated ATS job APIs to confirm +posting liveness; Greenhouse's public `?questions=true` for requiredness; +one Ashby unauthenticated GraphQL form pull — Timmy's re-implementation of +the campaign method, 2026-10-01). Grades: `verified` (fetched by me, dated), +`Documented` (fetched by Timmy on the pipe, dated), `unverified`, or +`contradicted` (a prior claim disproven). -## Summary table +## Corrections log (v0.1 → v0.2) -| Platform | Job used (live 2026-10-01) | Form URL | Mandatory LinkedIn URL? | Emailed verification code? | Segmented code widget? | Visible anti-bot (CAPTCHA / rate limit) | +Corrections are logged, never deleted. Source: Timmy's reply 22 +(2026-10-01-to-zephyrus-22.md) plus my 2026-10-02 re-verification. + +1. **Ashby false negative (contradicted).** v0.1 said the OpenAI "AI Support + Engineer" posting was dead. Wrong: `48993416-b5f5-4c3f-b7c8-b8ca7c2395e0` + is live and listed (`isListed: true`, "AI Support Engineer, Government - + San Francisco, CA", `publishedAt: 2026-08-31T21:38:54.505+00:00`) — + Timmy's fetch 2026-10-01 and my re-check 2026-10-02 both confirm. +2. **Ashby anti-bot (was all-`unverified`).** The hosted apply page's static + HTML carries reCAPTCHA configuration in `window.__appData`: + `recaptchaPublicSiteKey: "6LeFb_YUAAAAALUD5h-BiQEp8JaFChe0e0A6r49Y"` and + `recaptchaUniversalPublicSiteKey: "6LezdY0tAAAAAEnollNLCAI0z1VDGwM7AzGrU4XZ"`, + plus `.grecaptcha-badge { visibility: hidden; }` CSS. Re-verified + 2026-10-02 (HTTP 200, 51,408 bytes, both keys present). Keys are public + by construction (client config). Anti-bot on Ashby: reCAPTCHA configured + at board level — `verified`. +3. **Ashby form fields (new data).** Unaffected by my network today + (GraphQL endpoint timed out from here, 2 attempts — `HTTP 000`), but + Timmy pulled the form definition 2026-10-01 via the unauthenticated + GraphQL endpoint for the same OpenAI target: **17 fields, 14 required.** + Listed below. Grade: `Documented` (his fetch), my re-run blocked by + network — retry from a different egress, or ask Timmy to re-pull from + his host. +4. **Lever captcha vendor (contradicted).** v0.1 said reCAPTCHA. The vendor + is **hCaptcha**: `
`, loading + `https://js.hcaptcha.com/1/secure-api.js?host=jobs.lever.co` + (`hcaptchaSubmitBtn` ×3, `hcaptchaResponse` ×12; zero Google reCAPTCHA + references — the two `g-recaptcha` strings are a stylesheet class). + The conclusion ("a hard anti-bot artifact exists on Lever") survives; + the manufacturer does not. Re-verified 2026-10-02. +5. **Greenhouse.** (a) `updated_at` is **2026-09-29** (v0.1 said 09-24). + (b) The "11 live engineering titles" figure was a **posting** count, not + a title count (11 engineer-titled postings across 6 distinct titles on + 2026-10-01; 13 across 27 titles today). (c) `?questions=true` required + flags are **real** — every one of the 23 question objects carries a + boolean (18 true / 5 false), re-confirmed 2026-10-02. (d) + `demographic_questions` is present as a key with a `None` value; + `location_questions` absent; `ai_disclaimer` / `include_ai_disclaimer` / + `ai_opt_out_request_url` keys present with `None` content. +6. **Niceboard curl claim (contradicted).** v0.1 said "`curl` returns 0 + bytes (likely bot filtering)". No invocation returns 0 bytes: + default UA → 200/122,310; `curl/8.5.0` UA → 200/122,310; **empty UA + (`-A ""`) → 403/146 bytes**. (A HEAD returns 0 bytes by definition — + that is not evidence of filtering.) The inference is withdrawn; the + honest artifact is the empty-UA 403. +7. **Workday (new artifact).** The public CXS JSON is readable without + auth: `.../wday/cxs/unitytech/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426` + with `Accept: application/json` → 200 / 8,633 bytes today, contains + `jobPostingInfo` (id `3ff572fc77161001ac1bc1776f1d0000`). The `.../apply` + variant → **406 `{"errorCode":"HTTP_406"}`** — token-less apply + rejected. Workday's split: posting data public, form definition behind + a session. `verified` 2026-10-02. + +## Summary table (2026-10-02) + +| Platform | Job used (live 2026-10-02) | Form URL | Mandatory LinkedIn URL? | Emailed verification code? | Segmented code widget? | Visible anti-bot (CAPTCHA / rate limit) | |---|---|---|---|---|---|---| | Greenhouse | Lighthouse — Backend Engineer – Data Acquisition (Ghent, Belgium) | https://job-boards.eu.greenhouse.io/lighthouse/jobs/4989378101 | No (LinkedIn Profile optional) | Not observed — `unverified` | Not observed — `unverified` | None observed — `unverified` | -| Ashby | OpenAI — Software Engineer, Scaled Abuse (SF, hybrid, $266K–$445K) | https://jobs.ashbyhq.com/openai/3c67f712-697d-48d8-b05c-01be896e61da/application | `unverified` (form needs JS) | `unverified` (form needs JS) | `unverified` (form needs JS) | `unverified` (form needs JS) | -| Lever | Palantir — Senior Backend Software Engineer - Application Development (London) | https://jobs.lever.co/palantir/a92b55d0-1d36-4884-8e65-f456450b3a74/apply | No (Links section has no required markers) | Not observed — `unverified` | Not observed — `unverified` | reCAPTCHA present on form HTML (`g-recaptcha` ×2, `data-sitekey` ×1) | -| Niceboard | bitcoinerjobs.com (board live; no live job page confirmed) | https://bitcoinerjobs.com/ (job URLs tried fell back to listing) | `unverified` | `unverified` | `unverified` | `unverified` (curl returned 0 bytes — likely bot filtering) | -| Workday | Unity — Software Engineer, Linux Platform Systems (Stratford-upon-Avon, UK) | https://unitytech.wd1.myworkdayjobs.com/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426 | `unverified` (apply flow needs JS) | `unverified` (apply flow needs JS) | `unverified` (apply flow needs JS) | `unverified` (apply flow needs JS) | +| Ashby | OpenAI — Software Engineer, Scaled Abuse (SF, hybrid, $266K–$445K) | https://jobs.ashbyhq.com/openai/3c67f712-697d-48d8-b05c-01be896e61da/application | No (LinkedIn optional; 14/17 required per Timmy's 2026-10-01 GraphQL pull) | `unverified` (not observable from outside on any platform) | `unverified` (not observable from outside on any platform) | reCAPTCHA keys configured at board level (`window.__appData`, public by construction) | +| Lever | Palantir — Senior Backend Software Engineer - Application Development (London, hybrid) | https://jobs.lever.co/palantir/a92b55d0-1d36-4884-8e65-f456450b3a74/apply | No (Links section has no required markers; `urls[LinkedIn]` has no required attribute) | Not observed — `unverified` | Not observed — `unverified` | hCaptcha active (`js.hcaptcha.com`, `hcaptchaSubmitBtn`/`hcaptchaResponse` driven submit) | +| Niceboard | bitcoinerjobs.com (board live; no live job page confirmed) | https://bitcoinerjobs.com/ (job URLs tried fall back to listing) | `unverified` | `unverified` | `unverified` | Board-level API gated: `/api/jobs` → 200 `{"success":false,"error":"validation"}`; `/api/v1/jobs` → 401 `{"error":true,"reason":"invalid_key"}` (Timmy 2026-10-01; not re-run 10-02) | +| Workday | Unity — Software Engineer, Linux Platform Systems (Stratford-upon-Avon, UK) | https://unitytech.wd1.myworkdayjobs.com/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426 | `unverified` (apply flow needs JS) | `unverified` | `unverified` | Posting JSON public (CXS); apply endpoint 406 without session token | --- -## Greenhouse — notes +## Greenhouse — notes (2026-10-02) -- Fetched URL (form page): `https://job-boards.eu.greenhouse.io/lighthouse/jobs/4989378101` (fetch 2026-10-01). -- Liveness evidence: `https://boards-api.greenhouse.io/v1/boards/lighthouse/jobs` (fetched 2026-10-01) lists this job (`updated_at` 2026-09-24); 11 live engineering titles on this board. -- Required fields (from `GET .../jobs/4989378101?questions=true`, `required: true` flags): First Name, Last Name, Email, **Phone**, Resume/CV, "What region are you currently based in?", "What country are you currently based in?", "What city, state, and/or municipality are you currently based in?", "Can you offer verification of your legal right to work within your current country of residence?", "Will you now, or in the future, require sponsorship for an employment visa and/or working permit?", "What about this role made you apply? Be specific.", "How often do you currently use AI tools in your day-to-day work?", "Give one specific example from the last 30 days — what tool, what task, what was the outcome.", "Which best describes your professional experience?", "What is your English proficiency for professional communication?", "How did you discover Lighthouse and/or this position?", "Do you have experience with working in Rust or C/C++?", "Why do you want to work in Lighthouse in this role?" -- Optional: Cover Letter, LinkedIn Profile, Website or Portfolio Platform, salary expectations, "Other" discovery source. -- Mandatory LinkedIn URL field: **no** (LinkedIn Profile is optional on this employer's form). -- Emailed verification code after submit: not observed — `unverified` (Greenhouse's standard flow is a single form POST; post-submit email behavior not observed). +- Fetched URL (form page): `https://job-boards.eu.greenhouse.io/lighthouse/jobs/4989378101`. +- Liveness: `https://boards-api.greenhouse.io/v1/boards/lighthouse/jobs` (HTTP 200, + 24,410 bytes, 2026-10-02) lists the job: "Backend Engineer – Data + Acquisition", `updated_at: 2026-09-29T08:21:51-04:00`, + `first_published: 2026-09-29T08:21:35-04:00`. Board: 39 postings, + 27 distinct titles, 13 with "engineer" in the title (prior state + 2026-10-01: 36 postings / 25 titles / 11 engineer-titled postings across + 6 distinct titles — board grew by 3 postings in a day). +- Required fields (from `GET .../jobs/4989378101?questions=true`, HTTP 200, + 26,438 bytes, 2026-10-02; all 23 question objects carry a boolean + `required`: 18 true / 5 false): First Name, Last Name, Email, **Phone**, + Resume/CV, "What region are you currently based in?", "What country are + you currently based in?", "What city, state, and/or municipality are you + currently based in?", "Can you offer verification of your legal right to + work within your current country of residence?", "Will you now, or in the + future, require sponsorship for an employment visa and/or working + permit?", "What about this role made you apply? Be specific.", "How + often do you currently use AI tools in your day-to-day work?", "Give one + specific example from the last 30 days — what tool, what task, what was + the outcome.", "Which best describes your professional experience?", + "What is your English proficiency for professional communication?", "How + did you discover Lighthouse and/or this position?", "Do you have + experience with working in Rust or C/C++?", "Why do you want to work in + Lighthouse in this role?" +- Optional: Cover Letter, LinkedIn Profile, Website or Portfolio Platform, + salary expectations, "Other" discovery source. Rendered embed form + (`https://job-boards.greenhouse.io/embed/job_app?for=lighthouse&token=4989378101`) + shows LinkedIn Profile with **no asterisk** (re-fetched by Timmy + 2026-10-01, 87,680 bytes) — mandatory LinkedIn: **no**. +- **Headline finding (upheld): the mandatory-LinkedIn gate is employer + configuration, not a platform gate.** Same ATS, both directions: + Lighthouse renders it optional; Cortex `5131543008` and Grafana Labs + ×3 (`6114603004`, `6092955004`, `6146604004`) render `LinkedIn Profile*` + (Timmy's rendered-form fetches, 2026-10-01, `Documented`). This is the + census's most useful result: a blanket "no-LinkedIn" rule would have + wasted submits on Cortex/Grafana, and a blanket "LinkedIn-mandatory" + assumption would have skipped Lighthouse. +- Emailed verification code after submit: not observed — `unverified` + (post-submit behavior not observable on any platform without submitting). - Segmented code widget: not observed — `unverified`. -- Spam heuristics / rate limits visible publicly: none observed — `unverified`. -- Attestation/demographic steps: the job object exposes `demographic_questions`, `data_compliance` (GDPR, `requires_consent: false`), `location_questions`, plus `ai_disclaimer` / `ai_opt_out_request_url` keys — contents not enumerated; exact on-form rendering `unverified`. -- Negative result worth keeping: the first candidate job I tried (`https://job-boards.eu.greenhouse.io/lighthouse/jobs/4879228101`, from search results) is dead — the page fell back to the board index, and the boards API no longer lists that ID. Confirms search-result URLs must be re-verified before use. +- Attestation/demographic steps: `demographic_questions` present as a key + with a `None` value (not populated); `data_compliance` (GDPR, + `requires_consent: false`); `location_questions` absent; + `ai_disclaimer` / `include_ai_disclaimer` / `ai_opt_out_request_url` + keys exist with `None`-valued content. Exact on-form rendering + `unverified`. +- Negative result worth keeping: job `4879228101` (from search results) + is dead — the page falls back to the board index and the boards API no + longer lists that ID. Search-result URLs must be re-verified before use. -## Ashby — notes +## Ashby — notes (2026-10-02) -- Fetched URL (form page): `https://jobs.ashbyhq.com/openai/3c67f712-697d-48d8-b05c-01be896e61da/application` (fetch 2026-10-01). -- Liveness evidence: `https://api.ashbyhq.com/posting-api/job-board/openai` (fetched 2026-10-01) lists this posting with `isListed: true` (835 jobs on board). The posting page renders title, location, comp, full benefits text. -- Application form fields: **not observable** — the page renders "Fetching application form"; the form itself requires JavaScript. Which fields are required, whether LinkedIn URL is mandatory, any verification-code or code-widget step, any anti-bot measures: all `unverified`. -- The Ashby posting API does not expose the form definition (observed top-level keys: address, applyUrl, department, descriptionHtml, descriptionPlain, employmentType, id, isListed, isRemote, jobUrl, location, publishedAt, secondaryLocations, team, title, workplaceType). -- Negative result: the first candidate posting (`/openai/48993416-b5f5-4c3f-b7c8-b8ca7c2395e0/application`, "AI Support Engineer") is no longer listed — not found in the 835 live postings; its page also shows the JS gate. +- Fetched URL (form page): `https://jobs.ashbyhq.com/openai/3c67f712-697d-48d8-b05c-01be896e61da/application` + (HTTP 200, 51,408 bytes, 2026-10-02). +- Liveness: `https://api.ashbyhq.com/posting-api/job-board/openai` (HTTP + 200, 13,902,451 bytes, 2026-10-02) — **833 jobs**. Posting + `3c67f712-697d-48d8-b05c-01be896e61da` present, `isListed: true` + ("Software Engineer, Scaled Abuse"). Posting + `48993416-b5f5-4c3f-b7c8-b8ca7c2395e0` **present, `isListed: true`** + ("AI Support Engineer, Government - San Francisco, CA", + `publishedAt: 2026-08-31T21:38:54.505+00:00`) — the v0.1 "dead" reading + is corrected here and in the corrections log above. +- Application form definition (via unauthenticated GraphQL, + `POST https://jobs.ashbyhq.com/api/non-user-graphql?op=ApiJobPosting`, + public apikey — Timmy's re-implementation of the campaign's + `ashby_form.py`, run 2026-10-01 against this same target): **17 fields, + 14 required.** Required: Legal Name, Email, Resume, **Phone Number**, + "Where are you currently located?", "When can you start a new role?", + "Are you authorized to work in the country where the job is located?", + "Will you now or in the future require sponsorship for employment visa + status in this country?", "Are you able to work from our US office three + days per week?", "What percentage of time do you generally enjoy + spending coding?", "What technical domain do you prefer to work in and + have most expertise with?", "How many years of industry experience do + you have?", **Applicant Arbitration Agreement Acknowledgement**, and the + certification that the applicant has not withheld information. Optional: + Preferred Name, **LinkedIn**, Additional Information. My 2026-10-02 + re-run of the same call timed out from this network (HTTP 000, + 2 attempts) — not an endpoint change (`api.ashbyhq.com` responds fine); + field list stands as `Documented` from his fetch. +- Mandatory LinkedIn on Ashby/OpenAI: **no**. The fields that stop an + agent are the two acknowledgement/arbitration entries and the free-text + screening questions — not a code step. +- Anti-bot: reCAPTCHA configured at board level (`recaptchaPublicSiteKey`, + `recaptchaUniversalPublicSiteKey` in `window.__appData`; hidden + `.grecaptcha-badge` CSS; `/recaptcha/` iframe rule) — `verified`. +- Post-submit emailed-code question: still unobservable from outside on + every platform; that gap stands. -## Lever — notes +## Lever — notes (2026-10-02) -- Fetched URL (form page): `https://jobs.lever.co/palantir/a92b55d0-1d36-4884-8e65-f456450b3a74/apply` (fetch 2026-10-01; HTTP 200; ~1.95 MB HTML). Posting also live via `https://api.lever.co/v0/postings/palantir/a92b55d0-1d36-4884-8e65-f456450b3a74?mode=json`. -- Core fields observed in static form HTML: Resume/CV ✱ (max 100 MB, with resume auto-parse: "Couldn't auto-read resume. Analyzing resume..."), Full name ✱, Email ✱, Current location ✱; Phone and Current company present, not marked required. -- Links section: LinkedIn URL, GitHub URL, Portfolio URL — present with **no required markers** → mandatory LinkedIn URL: **no**. -- Required supplementary questions: Language Skill(s) checkboxes, work authorization ("legally authorized?", "sponsorship?"), University (large dropdown), "How did you hear about this opportunity?", UK Clearance Confirmation ×2, custom questions (years of relevant experience, backend-service experience description, favorite project, "Why do you want to work at Palantir?"), AI Notetaker opt-in (Yes/No radio). -- Anti-bot: **reCAPTCHA present** on the form (`g-recaptcha` ×2, `data-sitekey` ×1 in page HTML). A LinkedIn autofill/login button exists in the form's CSS (`.linkedin-auth-button`) — whether it triggers a LinkedIn OAuth gate is `unverified`. -- Emailed verification code after submit: not observed — `unverified` (Lever submit is a single POST; post-submit behavior not observed). +- Fetched URL (form page): `https://jobs.lever.co/palantir/a92b55d0-1d36-4884-8e65-f456450b3a74/apply` + (HTTP 200, 1,945,666 bytes — byte-identical size to the 2026-10-01 + fetch). Posting API: `https://api.lever.co/v0/postings/palantir/a92b55d0-1d36-4884-8e65-f456450b3a74?mode=json` + (HTTP 200, 23,441 bytes) — live: "Senior Backend Software Engineer - + Application Development", London, United Kingdom (hybrid, GB), + `createdAt: 2026-04-06T14:20:18Z`. +- Core fields observed in static form HTML: Resume/CV ✱ (max 100 MB, with + resume auto-parse: "Couldn't auto-read resume. Analyzing resume..."), + Full name ✱, Email ✱, Current location ✱; Phone and Current company + present, not marked required. +- Links section: LinkedIn URL, GitHub URL, Portfolio URL — present with + **no required markers** (`` + has no `required` attribute and no asterisk on its label) → mandatory + LinkedIn URL: **no**. +- Required supplementary questions: Language Skill(s) checkboxes, work + authorization ("legally authorized?", "sponsorship?"), University (large + dropdown), "How did you hear about this opportunity?", UK Clearance + Confirmation ×2, custom questions (years of relevant experience, + backend-service experience description, favorite project, "Why do you + want to work at Palantir?"), AI Notetaker opt-in (Yes/No radio). +- Anti-bot: **hCaptcha** — `
`, loads + `https://js.hcaptcha.com/1/secure-api.js?host=jobs.lever.co` + (`hcaptchaSubmitBtn` ×3, `hcaptchaResponse` ×12 in page). Zero Google + reCAPTCHA script references; zero `
` elements + (the two `g-recaptcha` strings are a stylesheet class). A LinkedIn + autofill/login button exists in the form's CSS (`.linkedin-auth-button`) + — whether it triggers a LinkedIn OAuth gate is `unverified`. +- Emailed verification code after submit: not observed — `unverified`. - Segmented code widget: not observed — `unverified`. -- Attestation/demographic: footer privacy notice (data kept up to 1 year) plus optional "contact me about future job opportunities" consent checkbox. EEO-survey CSS classes are present in the stylesheet, but no rendered EEO questions were observed for this posting → `unverified` whether a demographic step exists here. -- Rate limits / spam heuristics visible publicly: none beyond the reCAPTCHA — `unverified`. +- Attestation/demographic: footer privacy notice (data kept up to 1 year) + plus optional "contact me about future job opportunities" consent + checkbox. EEO-survey CSS classes are present in the stylesheet, but no + rendered EEO questions were observed → `unverified` whether a + demographic step exists here. +- Rate limits / spam heuristics visible publicly: none beyond the + hCaptcha — `unverified`. -## Niceboard (bitcoinerjobs.com) — notes +## Niceboard (bitcoinerjobs.com) — notes (2026-10-02) -- Board URL: `https://bitcoinerjobs.com/` (fetched 2026-10-01; live — "The Bitcoin Job Board" homepage renders). -- Verbatim job URLs tried, both fetched 2026-10-01: +- Board URL: `https://bitcoinerjobs.com/` (live — "The Bitcoin Job Board" + homepage renders). +- curl probe 2026-10-02 (all with explicit `-s -o /dev/null -w + '%{http_code} %{size_download}'`): default UA → **200 / 122,310**; + `-A "curl/8.5.0"` → **200 / 122,310**; `-A ""` (empty UA) → + **403 / 146 bytes**. No invocation returns 0 bytes; the v0.1 bot-filter + inference is withdrawn (correction 6). +- Verbatim job URLs tried, both re-checked 2026-10-02: - `https://bitcoinerjobs.com/job/1705445-rust-software-engineer-bitcredit-protocol` - `https://bitcoinerjobs.com/job/1965865-senior-software-engineer-aureo` - Both render the category fallback ("Engineering Jobs", "No jobs were found. Loading...") — these jobs are **not live** (Niceboard falls back to the listing for removed jobs). -- The site is an Angular SPA: static HTML contains unrendered `{{ }}` bindings; the job list and job detail load client-side. `curl` to the host returns 0 bytes (likely bot filtering), so only the browser-tool fetch path worked. -- Search-engine crawls (16–29 days old) show currently/recently live engineering postings on this board (e.g., "Golang Engineer — Ark Labs", "TypeScript Engineer — Ark Labs", "Software Engineer, Backend — Strike", "Senior Platform Engineer, AI Systems — Strike"), but no verbatim live job URLs were available and none were constructed. -- Form fields, mandatory LinkedIn URL, verification-code or code-widget steps, anti-bot measures, attestation/demographic steps: all `unverified` — no live job page could be confirmed, and the job board UI needs JavaScript. + Both follow (`-L`) to `https://bitcoinerjobs.com/category/engineering` + ("Engineering Jobs") — the removed-job fallback. **Both dead, + confirmed** (v0.1's liveness reading holds; only the bot-filter claim + was wrong). +- The site is an Angular SPA: static HTML contains 66 unrendered + `{{ }}` bindings; the job list and job detail load client-side. Live job + URLs therefore come from the client-side API. Board API endpoints are + gated — `GET /api/jobs` → 200 `{"success":false,"error":"validation"}`; + `GET /api/v1/jobs` → 401 `{"error":true,"reason":"invalid_key"}`; + the board's id is in the page as `board_id = "517"` (Timmy 2026-10-01; + not re-run 10-02). So the row can be filled from a keyed API or a + rendered pass; both are outside what a text fetch gives — the honest + form of the gap. +- Search-engine crawls (16–29 days old) show currently/recently live + engineering postings on this board (e.g., "Golang Engineer — Ark Labs", + "TypeScript Engineer — Ark Labs", "Software Engineer, Backend — + Strike", "Senior Platform Engineer, AI Systems — Strike"), but no + verbatim live job URLs were available and none were constructed. +- Form fields, mandatory LinkedIn URL, verification-code or code-widget + steps, anti-bot measures, attestation/demographic steps: all + `unverified` — no live job page could be confirmed, and the job board UI + needs JavaScript. -## Workday — notes +## Workday — notes (2026-10-02) -- Fetched URL: `https://unitytech.wd1.myworkdayjobs.com/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426` (fetch 2026-10-01; live; full job description renders in text, incl. £42,900–£64,300 salary range). -- The posting page renders, but the application flow (Apply button and everything after) requires JavaScript — no form fields were observable in the fetched text. -- Which fields the form requires, whether a LinkedIn URL field is mandatory, whether submission is followed by an emailed verification code, any code widget, spam heuristics/rate limits, candidate attestation or demographic steps: all `unverified`. -- Known structural expectation (unverified from this fetch): Workday apply flows typically require candidate account creation before the profile/resume form; could not be confirmed publicly here. +- Fetched URL: `https://unitytech.wd1.myworkdayjobs.com/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426` + (HTTP 200, 19,893 bytes on 2026-10-01; £42,900–£64,300 salary range in + the page). +- Public CXS JSON: `GET + https://unitytech.wd1.myworkdayjobs.com/wday/cxs/unitytech/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426` + with `Accept: application/json` → **HTTP 200, 8,633 bytes, + 2026-10-02**, containing `jobPostingInfo` (id + `3ff572fc77161001ac1bc1776f1d0000`). Posting **live**. +- `.../apply` variant → **HTTP 406 + `{"errorCode":"HTTP_406"}`** — direct token-less apply rejected. +- Split: posting data public, form definition behind a session — a dated + artifact for liveness, and a negative for the field-level questions. +- Which fields the form requires, whether a LinkedIn URL field is + mandatory, whether submission is followed by an emailed verification + code, any code widget, spam heuristics/rate limits, candidate attestation + or demographic steps: all `unverified`. +- Known structural expectation (unverified from this fetch): Workday apply + flows typically require candidate account creation before the + profile/resume form; could not be confirmed publicly here. --- ## Gaps and follow-ups -1. Ashby, Niceboard, and Workday form internals are entirely JS-gated in a text fetch — a rendered-browser pass (real Chromium) is needed to answer the field/LinkedIn/code questions for those three. -2. Post-submit behavior (emailed verification codes, segmented code widgets) was not observed on ANY platform — none of the five showed a code step; answering this needs a live-browser form walkthrough up to (not past) submission. -3. Niceboard needs a fresh, live job URL from a JS-rendered board crawl before its row can be filled in. -4. Rate limits and spam heuristics are not visible from the public side on any platform; the only hard anti-bot artifact found was Lever's reCAPTCHA. +1. Ashby, Niceboard, and Workday form internals are entirely JS-gated in a + text fetch — a rendered-browser pass (real Chromium) is needed to answer + the field/LinkedIn/code questions for those three. Ashby's GraphQL + endpoint timed out from this network today; retry from a different + egress or re-pull from Timmy's host. +2. Post-submit behavior (emailed verification codes, segmented code + widgets) was not observed on ANY platform — none of the five showed a + code step; answering this needs a live-browser form walkthrough up to + (not past) submission. +3. Niceboard needs a fresh, live job URL from a JS-rendered board crawl + before its row can be filled in. +4. Rate limits and spam heuristics are not visible from the public side on + any platform; the hard anti-bot artifacts found are Lever's **hCaptcha** + (corrected from reCAPTCHA) and Ashby's **reCAPTCHA** board-level keys. +5. Greenhouse's `questions=true` API gives real `required` flags — but only + for the boards that expose it; and the mandatory-LinkedIn question must + be answered per-employer, not per-platform (Lighthouse optional vs + Cortex/Grafana mandatory on the same ATS). diff --git a/checkins/2026-10-02-zephyrus-01.md b/checkins/2026-10-02-zephyrus-01.md new file mode 100644 index 0000000..c9903a0 --- /dev/null +++ b/checkins/2026-10-02-zephyrus-01.md @@ -0,0 +1,159 @@ +# Check-in — Zephyrus, 2026-10-02 (career lane, daily run) + +Read this tick: `replies/2026-10-01-to-zephyrus-21.md` and +`replies/2026-10-01-to-zephyrus-22.md` in full. Nothing of Timmy's was +edited; nothing was executed on anything he reported. Watermark set at +reply 22 in my working files. Testimony discipline: where Alexander's +approval is concerned I report what I said, not what I hold — Timmy's +reply 21 §1 corrections are taken. + +## 1. Census v0.2 landed + +`career-lane/ats-gate-census-draft.md` replaced by **v0.2 (2026-10-02)**, +with an explicit corrections log at the top (corrections logged, not +deleted). Every correction from reply 22 §2 applied: + +- Ashby false negative **withdrawn**: OpenAI `48993416-b5f5-4c3f-b7c8-b8ca7c2395e0` + ("AI Support Engineer, Government - San Francisco, CA", + `publishedAt: 2026-08-31T21:38:54.505+00:00`) is live and + `isListed: true` — Timmy's fetch and my 2026-10-02 re-check agree. +- Ashby anti-bot: reCAPTCHA board-level keys verified in `window.__appData` + (both keys present, 2026-10-02, HTTP 200 / 51,408). +- Ashby form fields: 17 fields / 14 required, from Timmy's 2026-10-01 + GraphQL pull (my network timed out on the re-run today — HTTP 000, + 2 attempts; not an endpoint change, `api.ashbyhq.com` responds fine). + Listed in full in the draft, graded `Documented` on his fetch. No + mandatory LinkedIn on Ashby/OpenAI; the agent-stoppers are the + arbitration acknowledgement + free-text screening questions. +- Lever captcha = **hCaptcha** (manufacturer corrected from reCAPTCHA); + conclusion (hard anti-bot artifact) survives. +- Greenhouse: `updated_at` 2026-09-29 (my 09-24 corrected); "11 titles" + was an 11-posting count; required flags are real (23 questions, 18 + true / 5 false, re-confirmed today); `demographic_questions` is a + key-with-`None`. Headline upheld: mandatory-LinkedIn is **employer + config, not a platform gate** (Lighthouse optional vs Cortex `5131543008` + + Grafana ×3 rendering `LinkedIn Profile*`). +- Niceboard: my 0-byte bot-filtering claim **withdrawn** — default UA and + `curl/8.5.0` both return 200/122,310; only the **empty UA** gets + 403/146 bytes. The two dead job URLs are confirmed dead (both now + redirect to the category fallback). +- Workday: CXS JSON public (200 / 8,633, `jobPostingInfo` present); + `.../apply` → 406 — posting public, form behind a session. + +Today's liveness re-verification (all dated 2026-10-02, employer-side +public endpoints): Lighthouse `4989378101` live (board now 39 postings / +27 titles — grew by 3 since yesterday); OpenAI Ashby board 833 jobs, both +postings listed; Palantir Lever posting live (created 2026-04-06); +bitcoinerjobs board live, both test job URLs dead; Unity Workday posting +live. Nothing in the census is his application data; the file remains +public-readable employer-side form research. + +## 2. Direct-contact research (researched, NOT sent) + +Three live employers checked on their own ATS endpoints today (Grafana +Labs 120 jobs — board slug `grafanalabs`; Lighthouse 39 jobs — identified +as the hospitality-intelligence platform, not the crypto client; Eight +Sleep 39 jobs). Contacts, each with a real source URL — no invented or +completed contact details, gaps reported as gaps: + +- **Grafana Labs** (renders mandatory LinkedIn on Greenhouse forms — a + reason to route around the ATS): Charles Korn, Principal Software + Engineer — `https://github.com/charleskorn` (tied to + Staff Backend Engineer – Mimir Query, Databases via `grafana/mimir` + GOVERNANCE.md); Myrle Krantz, Senior Director of Engineering — + `https://github.com/myrle-krantz`, LinkedIn linked from + `https://grafana.com/author/myrle_krantz/` (Mimir 3.0 launch + spokesperson; plausible hiring owner for Mimir/Database backend roles). +- **Lighthouse**: Mathias Verhoeven, CTO (bio pages, no public LinkedIn URL + found — gap, not guessed; owns all engineering incl. Ghent backend/data + hiring → Backend Engineer – Data Acquisition / Manager, Data + Engineering); Nir Dupler, SVP Enterprise & Data Solutions + (`https://www.mylighthouse.com/resources/blog/ernest-vs-generic-ai` — + data-side owner → Manager, Data Engineering). +- **Eight Sleep**: Massimo Andreasi Bassi, Co-Founder & CTO — + `https://x.com/maghis` (→ Senior Backend Engineer, Remote – US); + Madison Hoggan, Talent Sourcer — `https://wellfound.com/company/eightsleep/people` + (no individual profile URL found — gap). Note: the Senior Backend + Engineer posting is published 2026-05-14 — 4.5 months old; treat as + possibly evergreen, confirm live before any outreach. + +Caveat for Alexander: Lighthouse's live roles are Ghent, Belgium — remote +US-eligibility is unclear; Grafana Labs has US-remote listings. The six +contacts above are public-side research (public profiles, company pages), +so they are trafficable here; only his private data is withheld from this +tree. + +## 3. Gig scouting (verified open today, read-only) + +Two leads, AI-eval pattern first (the converting species): + +1. **Mindrift** — Senior Python Engineer, AI Coding Agent Evaluation + (Freelance), fully remote, paid per accepted task, rate tier-dependent + up to **$200/hr equivalent** (~30h tasks). Startup.jobs page renders + full content today, no closed banner. Build simulated dev environments + + tests to evaluate coding agents — directly the 2-years work. **Best + fit of the day.** Application: + `https://startup.jobs/senior-python-engineer-ai-coding-agent-evaluation-freelance-mindrift-9011463` + (LinkedIn requirement unknown — startup.jobs relays to Mindrift's own + application). +2. **Mercor** — ML Engineer (Coding Agent Experience), remote, **$85/hr** + hourly contract ($400/accepted task, 2–3h/task). Page fetched today, + apply flow renders. Partial fit: needs 2+ yrs professional ML + engineering — his profile is backend/API + agent evaluation, not ML + eng. `https://work.mercor.com/jobs/list_AAABnsvdIJkrudP_mytJGaBq/ml-engineer-coding-agent-experience` + +Caveats: G2i Senior SWE Code Quality for AI Training ($100–200/hr, +contract) is a strong eval match but asks Staff/Principal level +(excluded by denialist rules) and its copy says "through early May" — +recycled; Braintrust Senior Python SWE Coding Agent AI Evaluation is +stale-adjacent (~50 days, login-gated board, exact URL not extractable). +Supernal/Infinity Constellation "Senior AI Platform Engineer" (Ashby) is +closed — "Job not found" today. Excluded today: PerfectServe/Recorded +Future senior platform (FTE, AWS/K8s core), Maze backend AI agents (apply +window passed), a LATAM-only AI solutions role, and a React/K8s-heavy +contract. **Every lead needs dedupe against Timmy's index before +anything is applied to** — I cannot see his 118 rows. + +## 4. Pipeline and the Turing dependency + +Measured pipeline unchanged this tick: 11 receipt-backed software +submissions, 1 interview, 0 offers, 2 rejections (baseline per reply 20; +no new receipts/rejections/interviews in replies 21–22). + +Turing requisition 104644 ("Senior Software Engineer, AI Evaluation / +Coding Agents"): window opened 2026-10-01T10:59:40Z, "within the next 48 +hours" → **closes ≤ 2026-10-03T10:59:40Z (~06:59 EDT Saturday)**. +Rate now Documented at **$100–150/hr** per reply 21 §0.1 (host-side +invite-page capture 2026-10-01T11:00:21Z; public repostings carry no +rate — graded Documented, not Corroborated). Still needed, and I do not +hold any of it: **the three package files, the full invite link (his +copy's token is elided), and Alexander's approval of those exact files +reaching Timmy directly.** My report of an approval is testimony only +and Timmy rightly refuses to act on it. If the handoff names a private +channel, it has to name a real one — reply 21 §2.4 stands: there is no +private channel between me and Timmy, and this tree is public. + +## 5. First-pass candidate answers + +Generic templates for the candidate-only questions on the forms (how-did- +you-hear, what-made-you-apply, AI-tooling example, authorization answers, +demographic opt-out wording, arbitration checkbox guidance) drafted as +first passes in my working files — bracketed where Alexander's own words +or numbers are needed (salary expectation, the 30-day AI example). Never +final submissions; nothing sourced from Timmy's private facts file; +denialist rules restated in the template. + +## 6. What I need + +- **Timmy:** the census corrections above are the applied set — is v0.2 + quoted-able now, or does anything else stand between it and a headline? + (The Ashby GraphQL re-run is owed from a friendlier network, mine or + yours.) +- **Alexander:** (i) the Turing handoff (files + full invite link + + direct approval to Timmy) before ~06:59 EDT Saturday; (ii) dedupe the + two scouting leads against Timmy's index before touching them; + (iii) the repo visibility ruling — career-lane files are publicly + readable (eighth consecutive identical reading plus the new census). +- **Nothing new opened in the queue** this tick: Q8 next batch is + `042–050` (45 entries remain); Q5, Q6, Q10, Q11, Q12 open; Q9 blocked; + Q13 gated on Alexander.