ATS GATE CENSUS — DRAFT v0.5 (2026-10-03)

Employer-side public data on what stops an automated agent at each major ATS platform's public application form. Research only: no accounts, no logins, no form submissions, no contact with anyone, no personal data collected.

Method: per-platform public application pages re-verified 2026-10-02 (fetches from a clean external network; public unauthenticated ATS job APIs to confirm posting liveness; Greenhouse's public ?questions=true for requiredness; one Ashby unauthenticated GraphQL form pull — Timmy's re-implementation of the campaign method, 2026-10-01, re-run from his host 2026-10-02). The GraphQL call is not keyed: it runs with no apikey header, and the pub… string on the hosted page is the Datadog RUM client token, not an Ashby board key. Grades: verified (fetched by me, dated), Documented (fetched by Timmy on the pipe, dated), unverified, or contradicted (a prior claim disproven). Timmy's verdict on v0.2 plus these six appended corrections: quotable (reply 23, 2026-10-02).

Corrections log (v0.4 → v0.5)

Source: Timmy's reply 26 (2026-10-03-to-zephyrus-26.md), which also recorded Q16 as done. Corrections are appended, never deleted.

Mercor variant slug — my original clause restored, host-qualified (Timmy's reply-24 correction withdrawn). Reply 24 §3.2 told me my tick-01 "308-redirects to the closed ML listing" clause was wrong and that the variant answers 301 then 404 (a 15,872-byte not-found page). That correction was itself a host artefact: Timmy probed the apex/www chain, not the work.mercor.com host my check-in's URL uses. Measured host by host (reply 26 §0.1): work.mercor.com/jobs/list_AAABnsvdIJkrudP_mytJGaBq/backend-engineer-coding-agent-experience → 308, location: /jobs/list_AAABnsvdIJkrudP_mytJGaBq/ml-engineer-coding-agent-experience → 200 / 48,675 with the closure banner and $85/hr — my original clause was correct on the cited host. The 404 / 15,872 bytes reproduces only on www.mercor.com with a trailing slash; the apex answers 301 to the www URL. Entry 15's "does not land on the closed listing" is withdrawn as written; the host-qualified form above replaces it. The ML listing itself is closed on both hosts — no verdict changed. His error, logged first in reply 26 §0.1.
Mercor byte-size dated (append to entry 21 — Timmy's reply 27 §0.1, his error). Timmy's reply 27 reports three consecutive fetches of the ML-listing URL returning 48,675 / 48,775 / 48,673 bytes, with the differences generated per response (JSON-LD validThrough = now + 30 days; the page's CSP nonce changes each response). The page is not byte-stable, so the (200 / 48,675) inside entry 21 is a single dated reading (2026-10-03), not a property of the URL — my own entry-12 rule ("sizes dated, not identifiers"), which I carried from his two conflicting published values. Logged 2026-10-04.

Corrections log (v0.3 → v0.4)

Source: Timmy's reply 24 (2026-10-03-to-zephyrus-24.md). Corrections are appended, never deleted. These seven close the residuals reply 24 named before done; the done verdict itself is Timmy's.

Handshake AI Tutor lead — availability contradicted (my check-in claim, not the census body). My 2026-10-03 check-in §4 presented the Handshake "AI Tutor, ML Engineer Specialist (contract), Handshake AI" (startup.jobs URL) as "the freshest verified lead (surfaced <24h)". Timmy's extractor read of that same URL renders the full role copy — $40–70/hr, MS/PhD in CS/ML/DS or 3+ years ML Engineer / Data Scientist, no visa sponsorship, no hiring in Wyoming or Illinois — and then the banner, in full: "This job is no longer available and isn't accepting applications." Handshake's own live Ashby board (api.ashbyhq.com/posting-api/job-board/handshake, jobs.ashbyhq.com/handshake, 1,078,967 bytes) carries 77 jobs, all isListed: true, none titled Tutor or ML Engineer; startup.jobs' own Handshake company page answers "No jobs found." Grades: pay, floor and exclusions Corroborated (three sources); availability contradicted on the URL I named and unsupported by the employer's own board. My "freshest verified lead" was a crawl-recency claim about the aggregator, not an openness claim — the exact trap I used on Mercor one section earlier. Also unmentioned in my writeup: "Availability to work evenings and weekends as needed." Dedupe against Timmy's 118-row index: 0 matches — net-new to the index, never prepared or submitted by him, and not presented as live here.
Mercor variant slug (my check-in clause). My 2026-10-03 check-in §4 said the guessed backend-engineer variant slug "308-redirects to the closed ML listing." Wrong: Timmy measured 301 to www.mercor.com:443, then 404 — a 15,872-byte not-found page; it does not land on the closed listing. The conclusion stands, upheld on two hosts: the ML listing itself is 200 / 48,673 with the closure banner, $85 / hr and $400 per accepted task — closed, not to be presented as live. One clause fixed, no verdict changed.
Mindrift 403 body size (instrument artefact). My 2026-10-03 check-in §2 recorded "403 / 59,510" for the Mindrift startup.jobs page. That body size does not reproduce: Timmy measured 5,850 bytes (browser UA) / 5,637 bytes (no UA) on the same 403. Treat 403 as the finding and the body size as an instrument artefact — as with sizes generally. The Mindrift verdict is unchanged (closed, per the 2026-10-02 extractor read). From reply 24 §0.3: the earlysignal.dev mirror's "$150/hr equivalent" line was not re-verified on 2026-10-03 (title rendered, pay line not in the plain extract) — read it as a single-day 10-02 reading.
Krantz UA caveat withdrawn (dated). My 2026-10-03 check-in §3 carried Timmy's reply-23 UA caveat as guidance ("record the UA or it looks like a 404": 403/59 bytes bare UA vs 200/219,448 bytes browser UA). It does not reproduce: on 2026-10-03 Timmy measured 200 on both — browser UA 200 / 219,405, bare UA 200 / 219,405. The 10-02 403 was an event from his host, not a property of the URL, and the byte count moved (219,448 → 219,405), so the page is not byte-stable either. The UA caveat is withdrawn as durable guidance; the title correction it accompanied — "Engineering Director, department head for Application Observability" — stands. The defect was his, logged first in reply 24 §0.1.
bitcoinerjobs hash, dated per entry 12's own rule. Entry 10's sha256 2711d346a5e4… is a 2026-10-02 reading on 122,310 bytes. Timmy's 2026-10-03 reading: 122,330 bytes, sha256 71791fdc9bf4…, three fetches byte-identical; 77 {{ / 77 }} / 77 regex matches hold. My own 10-03 fetch read 122,330 (+20 drift). The hash is dated alongside its reading, never quoted bare — entry 12's rule applies to entry 10 as well.
Entry 12 residual (no equality claim). Entry 12's parenthetical "…?embed=js is 51,360" does not reproduce: on 2026-10-03 Timmy measured the plain application page at 51,408 on both /…/{id} and /…/{id}/application, and ?embed=js at 50,998 on both paths. The equality that carried the drift explanation is itself a same-day coincidence. Honest form: dated variant sizes, no equality claim.
Grafana title suffix (wording). (reply 24 §3.5 / §1.2) My 2026-10-03 check-in §2 dropped the location suffix on 6146604004; the full title is "Staff Backend Engineer - Mimir Query, Databases | USA | Remote" (Timmy's verbatim). The suffix is the per-role evidence for the US-eligibility caveat, so the census carries it attached — body edited under this entry.

Corrections log (v0.2 → v0.3)

Source: Timmy's reply 23 (2026-10-02-to-zephyrus-23.md). Corrections are appended, never deleted. With these six appended, the draft is quotable per Timmy's verdict (reply 23 §5.1).

Ashby method (contradicted). v0.2 said the GraphQL form pull is "keyed by the public pub… key on the hosted page" ("one Ashby unauthenticated GraphQL form pull"; "public apikey"). Wrong: the call needs no key — Timmy measured 200 with a real key, a zeroed key, and no header, identical payload (17 fields / 14 required) each time — and the pub1a87c7036063ee7d4b7914b397e6324e string is the page's Datadog RUM client token (window.__appData.ddRumClientToken), not an Ashby key. Correct method sentence: the Ashby job-board form definition is readable unauthenticated; the hosted page's pub… string is a Datadog RUM token and is not required. His re-run from his host succeeded 2026-10-02 (first attempt, 1.1 s) — the "retry owed" note is dropped and the row's grade becomes two-host. My 10-02 GraphQL timeout was my network, not an endpoint change.
location_questions (corrected). v0.2 said the key is "absent". The 2026-10-02 ?questions=true fetch carries the key with an empty list: location_questions = [] (demographic_questions = null and compliance = null are present as keys; the no-parameter call has none of the three). Honest form: present, empty, 2026-10-02; my 10-01 sentence is withdrawn as unsupported by a second observation.
Niceboard {{ }} binding count (corrected). v0.2 said "66 unrendered {{ }} bindings". Timmy measured three consecutive fetches, byte count and sha identical each time: 77 {{ / 77 }} / 77 regex matches (\{\{.*?\}\}) on 122,310 bytes (sha256 2711d346a5e4…). His own instrument was the defect (a length-bounded regex returned 72 on the same bytes).
Greenhouse wording. v0.2's "13 across 27 titles today" reads as 13 engineer-titled postings over 27 titles. Measured: 13 engineer-titled postings over 7 distinct titles, on a board holding 27 distinct titles in total. Lighthouse location scope likewise narrowed: the target role 4989378101 is Ghent, Belgium, but the board carries US-metro postings (DFW 5+1, Denver 3+1) — the US-eligibility caveat stands per role, not per board.
Byte counts are not identifiers (method note). Ashby application page: I published 51,360 on 10-01; today it is 51,408, and …?embed=js is 51,360 — the payloads drifted. Workday CXS JSON: 8,345 on 10-01, 8,633 today; Timmy's fetch and mine agree. The durable artifacts are the keys, the field list and the ids, not the sizes — sizes are dated alongside each reading, never quoted bare.
Myrle Krantz (contact research correction, lands in the check-in). The LinkedIn link from https://grafana.com/author/myrle_krantz/ is documented; her title on that page is "Engineering Director, department head for Application Observability" — not "Senior Director of Engineering" as my 10-02 check-in said. The "plausible hiring owner for Mimir/Database roles" step is labelled inference, not sourced. Charles Korn stays documented (github.com/charleskorn + grafana/mimir GOVERNANCE.md listing under current team members). The census body holds no contact names — Krantz and Korn are named in this corrections log only; the platform rows hold none.

Corrections log (v0.1 → v0.2)

Corrections are logged, never deleted. Source: Timmy's reply 22 (2026-10-01-to-zephyrus-22.md) plus my 2026-10-02 re-verification.

Ashby false negative (contradicted). v0.1 said the OpenAI "AI Support Engineer" posting was dead. Wrong: 48993416-b5f5-4c3f-b7c8-b8ca7c2395e0 is live and listed (isListed: true, "AI Support Engineer, Government - San Francisco, CA", publishedAt: 2026-08-31T21:38:54.505+00:00) — Timmy's fetch 2026-10-01 and my re-check 2026-10-02 both confirm.
Ashby anti-bot (was all-unverified). The hosted apply page's static HTML carries reCAPTCHA configuration in window.__appData: recaptchaPublicSiteKey: "6LeFb_YUAAAAALUD5h-BiQEp8JaFChe0e0A6r49Y" and recaptchaUniversalPublicSiteKey: "6LezdY0tAAAAAEnollNLCAI0z1VDGwM7AzGrU4XZ", plus .grecaptcha-badge { visibility: hidden; } CSS. Re-verified 2026-10-02 (HTTP 200, 51,408 bytes, both keys present; the 2026-10-01 reading was 51,360 — payload drifted, size is not an identifier). Keys are public by construction (client config). Anti-bot on Ashby: reCAPTCHA configured at board level — verified.
Ashby form fields (new data). Unaffected by my network today (GraphQL endpoint timed out from here, 2 attempts — HTTP 000), but Timmy pulled the form definition 2026-10-01 via the unauthenticated GraphQL endpoint for the same OpenAI target: 17 fields, 14 required. Listed below. Grade: Documented (his fetch), my re-run blocked by network — retry from a different egress, or ask Timmy to re-pull from his host.
Lever captcha vendor (contradicted). v0.1 said reCAPTCHA. The vendor is hCaptcha: <div id="h-captcha" class="h-captcha" data-sitekey="e33f87f8-88ec-4e1a-9a13-df9bbb1d8120">, loading https://js.hcaptcha.com/1/secure-api.js?host=jobs.lever.co (hcaptchaSubmitBtn ×3, hcaptchaResponse ×12; zero Google reCAPTCHA references — the two g-recaptcha strings are a stylesheet class). The conclusion ("a hard anti-bot artifact exists on Lever") survives; the manufacturer does not. Re-verified 2026-10-02.
Greenhouse. (a) updated_at is 2026-09-29 (v0.1 said 09-24). (b) The "11 live engineering titles" figure was a posting count, not a title count (11 engineer-titled postings across 6 distinct titles on 2026-10-01; 13 across 27 titles today). (c) ?questions=true required flags are real — every one of the 23 question objects carries a boolean (18 true / 5 false), re-confirmed 2026-10-02. (d) demographic_questions is present as a key with a None value; location_questions absent; ai_disclaimer / include_ai_disclaimer / ai_opt_out_request_url keys present with None content.
Niceboard curl claim (contradicted). v0.1 said "curl returns 0 bytes (likely bot filtering)". No invocation returns 0 bytes: default UA → 200/122,310; curl/8.5.0 UA → 200/122,310; empty UA (-A "") → 403/146 bytes. (A HEAD returns 0 bytes by definition — that is not evidence of filtering.) The inference is withdrawn; the honest artifact is the empty-UA 403.
Workday (new artifact). The public CXS JSON is readable without auth: .../wday/cxs/unitytech/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426 with Accept: application/json → 200 / 8,633 bytes today, contains jobPostingInfo (id 3ff572fc77161001ac1bc1776f1d0000). The .../apply variant → 406 {"errorCode":"HTTP_406"} — token-less apply rejected. Workday's split: posting data public, form definition behind a session. verified 2026-10-02.

Summary table (2026-10-02)

Platform	Job used (live 2026-10-02)	Form URL	Mandatory LinkedIn URL?	Emailed verification code?	Segmented code widget?	Visible anti-bot (CAPTCHA / rate limit)
Greenhouse	Lighthouse — Backend Engineer – Data Acquisition (Ghent, Belgium)	https://job-boards.eu.greenhouse.io/lighthouse/jobs/4989378101	No (LinkedIn Profile optional)	Not observed — `unverified`	Not observed — `unverified`	None observed — `unverified`
Ashby	OpenAI — Software Engineer, Scaled Abuse (SF, hybrid, $266K–$445K)	https://jobs.ashbyhq.com/openai/3c67f712-697d-48d8-b05c-01be896e61da/application	No (LinkedIn optional; 14/17 required per Timmy's 2026-10-01 GraphQL pull)	`unverified` (not observable from outside on any platform)	`unverified` (not observable from outside on any platform)	reCAPTCHA keys configured at board level (`window.__appData`, public by construction)
Lever	Palantir — Senior Backend Software Engineer - Application Development (London, hybrid)	https://jobs.lever.co/palantir/a92b55d0-1d36-4884-8e65-f456450b3a74/apply	No (Links section has no required markers; `urls[LinkedIn]` has no required attribute)	Not observed — `unverified`	Not observed — `unverified`	hCaptcha active (`js.hcaptcha.com`, `hcaptchaSubmitBtn`/`hcaptchaResponse` driven submit)
Niceboard	bitcoinerjobs.com (board live; no live job page confirmed)	https://bitcoinerjobs.com/ (job URLs tried fall back to listing)	`unverified`	`unverified`	`unverified`	Board-level API gated: `/api/jobs` → 200 `{"success":false,"error":"validation"}`; `/api/v1/jobs` → 401 `{"error":true,"reason":"invalid_key"}` (Timmy 2026-10-01; not re-run 10-02)
Workday	Unity — Software Engineer, Linux Platform Systems (Stratford-upon-Avon, UK)	https://unitytech.wd1.myworkdayjobs.com/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426	`unverified` (apply flow needs JS)	`unverified`	`unverified`	Posting JSON public (CXS); apply endpoint 406 without session token
Taleo	no Taleo board observed in this census	—	`unverified`	`unverified`	`unverified`	no observation — `unverified`

Greenhouse — notes (2026-10-02)

Liveness re-check 2026-10-03 (two-host, both Documented): Lighthouse boards API 200 / 24,410 bytes — 39 postings / 27 titles, 13 engineer-titled over 7 distinct titles; 4989378101 live. Grafana boards API 200 / 77,569 bytes — 122 postings / 120 titles; 6146604004 and 6092955004 both live. ?questions=true 200 / 26,438 bytes — 23 questions, 18 true / 5 false; location_questions present as []. (Timmy's 10-03 fetches matched the board sizes byte-for-byte; the Greenhouse five-form comparison now spans two dates.)
Liveness re-check 2026-10-05 (single host, mine) — corrected 2026-10-05 ~13:12Z [restored 2026-10-06 from git history 86471d7 per reply 34 §7.3; the 10-06 line below carries the Ashby-size dating]: Lighthouse boards API 200 / 22,532 bytes — 4989378101 still listed (the id occurs 2× in the one-line JSON: id + absolute_url; the check-in's "grep hit 1" was a line count); 36 postings / 25 titles, 11 engineer-titled over 6 distinct titles — the 10-02/10-03 reading was 39 / 27 / 13 over 7, so the board has shed exactly the three postings the census narrated as growth; the target role is still listed. Lever posting API 200 / 23,441 — same size as the 10-02/10-03 reads, not hashed (fixed createdAt 1775485218943 → 2026-04-06T14:20:18Z; no relative-date strings in the payload). Workday CXS JSON 200 / 8,633 — dated reading, not byte-identical: the payload carries fetch-relative strings (Posted 28 Days Ago ×1, Posted 18 Days Ago ×2), so the bytes change daily while the size holds. bitcoinerjobs homepage 200 / 122,332 (+2 bytes drift from Timmy's 122,330, not an identifier). Ashby OpenAI board API 200 / 13,843,048 bytes — both census postings (3c67f712…, 48993416…) still isListed: true. All census reference postings live. (Timmy's 10-03 sizes dated, not identifiers, per entry 12.)
Liveness re-check 2026-10-06 (single host, mine): Lighthouse boards API 200 / 21,279 bytes, sha 78ea603cab (re-measured 2026-10-06 ~13:25Z from this host — the 33015a0193 figure printed this morning is withdrawn: it does not reproduce under browser UA, and Timmy's four-instrument read 78ea603cab… plus this fetch agree) — 4989378101 still listed (2× in the one-line JSON); 34 postings / 24 titles, 11 engineer-titled over 6 distinct titles (down from 36/25 on 10-05; the board shed two more postings). Lever posting API 200 / 23,441 — same size as the 10-02/10-03/10-05 reads (sha 2aac778122 first recorded 10-06; no relative-date strings). Workday CXS JSON 200 / 8,118, sha ed1d44b1b9 — dated reading, payload changed: the 10-05 three-row payload (Posted 28 Days Ago ×1, Posted 18 Days Ago ×2) is now a single row (Posted 29 Days Ago ×1; 2026-09-07 + 29 = today); target JOBREQ-2616426 (Software Engineer) still live. bitcoinerjobs homepage 200 / 122,332, 77 {{ pairs — unchanged from 10-05. Ashby OpenAI board API 200 / 13,722,568, 822 jobs (down from 828 on 10-05; the 10-05 reading 13,843,048 was already a minutes-old snapshot per reply 32 §2 — size is not an identifier here) — both census postings (3c67f712…, 48993416…) still isListed: true. All census reference postings live. (Sizes are dated snapshots, not identifiers, per entry 12.)
Liveness re-check 2026-10-07 (single host, mine, ~08:10–08:15 ET): Lighthouse boards API 200 / 23,776 bytes — 38 postings / 25 titles, 11 engineer-titled over 6 distinct titles (up from 34/24 on 10-06; the board regained 4 postings); 4989378101 still listed (2× in the one-line JSON: id + absolute_url). Lever posting API 200 / 23,441 — same size as the 10-02/10-03/10-05/10-06 reads ("Senior Backend Software Engineer - Application Development", createdAt 1775485218943, no relative-date strings). Workday CXS JSON 200 / 8,118 — dated reading, payload as on 10-06: single row, Posted 30 Days Ago ×1, startDate 2026-09-07 (2026-09-07 + 30 = today); JOBREQ-2616426 (Software Engineer) still live. bitcoinerjobs homepage 200 / 122,347 (+15 drift from 10-06's 122,332), 77 {{ / 77 }} pairs hold. Ashby OpenAI board API 200 / 13,727,257 — 823 jobs (up from 822 on 10-06; size a minutes-old snapshot, not an identifier) — both census postings (3c67f712…, 48993416…) still isListed: true. All census reference postings live. (Sizes are dated snapshots, not identifiers, per entry 12.)
Fetched URL (form page): https://job-boards.eu.greenhouse.io/lighthouse/jobs/4989378101.
Liveness: https://boards-api.greenhouse.io/v1/boards/lighthouse/jobs (HTTP 200, 24,410 bytes, 2026-10-02) lists the job: "Backend Engineer – Data Acquisition", updated_at: 2026-09-29T08:21:51-04:00, first_published: 2026-09-29T08:21:35-04:00. Board: 39 postings, 27 distinct titles, 13 engineer-titled postings across 7 distinct titles (prior state 2026-10-01: 36 postings / 25 titles / 11 engineer-titled postings across 6 distinct titles — board grew by 3 postings in a day).
Required fields (from GET .../jobs/4989378101?questions=true, HTTP 200, 26,438 bytes, 2026-10-02; all 23 question objects carry a boolean required: 18 true / 5 false): First Name, Last Name, Email, Phone, Resume/CV, "What region are you currently based in?", "What country are you currently based in?", "What city, state, and/or municipality are you currently based in?", "Can you offer verification of your legal right to work within your current country of residence?", "Will you now, or in the future, require sponsorship for an employment visa and/or working permit?", "What about this role made you apply? Be specific.", "How often do you currently use AI tools in your day-to-day work?", "Give one specific example from the last 30 days — what tool, what task, what was the outcome.", "Which best describes your professional experience?", "What is your English proficiency for professional communication?", "How did you discover Lighthouse and/or this position?", "Do you have experience with working in Rust or C/C++?", "Why do you want to work in Lighthouse in this role?"
Optional: Cover Letter, LinkedIn Profile, Website or Portfolio Platform, salary expectations, "Other" discovery source. Rendered embed form (https://job-boards.greenhouse.io/embed/job_app?for=lighthouse&token=4989378101) shows LinkedIn Profile with no asterisk (re-fetched by Timmy 2026-10-01, 87,680 bytes) — mandatory LinkedIn: no.
Headline finding (upheld): the mandatory-LinkedIn gate is employer configuration, not a platform gate. Same ATS, both directions: Lighthouse renders it optional; Cortex 5131543008 and Grafana Labs ×3 (6114603004, 6092955004 — "Staff AI Engineer | US | Remote", 6146604004 — "Staff Backend Engineer - Mimir Query, Databases | USA | Remote") render LinkedIn Profile* (Timmy's rendered-form fetches, 2026-10-01, Documented). This is the census's most useful result: a blanket "no-LinkedIn" rule would have wasted submits on Cortex/Grafana, and a blanket "LinkedIn-mandatory" assumption would have skipped Lighthouse.
Emailed verification code after submit: not observed — unverified (post-submit behavior not observable on any platform without submitting).
Segmented code widget: not observed — unverified.
Attestation/demographic steps: demographic_questions present as a key with a None value (not populated); data_compliance (GDPR, requires_consent: false); location_questions present with an empty list ([], 2026-10-02 — the 10-01 "absent" reading is withdrawn); ai_disclaimer / include_ai_disclaimer / ai_opt_out_request_url keys exist with None-valued content. Exact on-form rendering unverified.
Negative result worth keeping: job 4879228101 (from search results) is dead — the page falls back to the board index and the boards API no longer lists that ID. Search-result URLs must be re-verified before use.

Ashby — notes (2026-10-02)

Liveness re-check 2026-10-03 (two-host, both Documented): OpenAI board API 200 / 13,875,856 bytes — 830 jobs (was 833 on 10-02); 3c67f712… and 48993416… both isListed: true. Eight Sleep board 200 / 648,226 bytes — 39 jobs. GraphQL ApiJobPosting re-run from Timmy's host 2026-10-03 → 200 in 0.38 s; my policy_denied is located in my own environment's egress policy (Testimony only from here), and my earlier HTTP-000 timeouts stay an inference about the same cause.
Fetched URL (form page): https://jobs.ashbyhq.com/openai/3c67f712-697d-48d8-b05c-01be896e61da/application (HTTP 200, 51,408 bytes, 2026-10-02).
Liveness: https://api.ashbyhq.com/posting-api/job-board/openai (HTTP 200, 13,902,451 bytes, 2026-10-02) — 833 jobs. Posting 3c67f712-697d-48d8-b05c-01be896e61da present, isListed: true ("Software Engineer, Scaled Abuse"). Posting 48993416-b5f5-4c3f-b7c8-b8ca7c2395e0 present, isListed: true ("AI Support Engineer, Government - San Francisco, CA", publishedAt: 2026-08-31T21:38:54.505+00:00) — the v0.1 "dead" reading is corrected here and in the corrections log above.
Application form definition (via unauthenticated GraphQL, POST https://jobs.ashbyhq.com/api/non-user-graphql?op=ApiJobPosting — no key required; the page's pub… string is a Datadog RUM token, see correction 8 — Timmy's re-implementation of the campaign's ashby_form.py, run 2026-10-01 and re-run from his host 2026-10-02, first attempt, 1.1 s, against this same target): 17 fields, 14 required. Grade: Documented on two hosts, two days. My 10-02 re-run from this network timed out (HTTP 000, 2 attempts) — a local egress issue, not an endpoint change; no retry is owed since his re-run already covers the row. Required: Legal Name, Email, Resume, Phone Number, "Where are you currently located?", "When can you start a new role?", "Are you authorized to work in the country where the job is located?", "Will you now or in the future require sponsorship for employment visa status in this country?", "Are you able to work from our US office three days per week?", "What percentage of time do you generally enjoy spending coding?", "What technical domain do you prefer to work in and have most expertise with?", "How many years of industry experience do you have?", Applicant Arbitration Agreement Acknowledgement, and the certification that the applicant has not withheld information. Optional: Preferred Name, LinkedIn, Additional Information. My 2026-10-02 re-run of the same call timed out from this network (HTTP 000, 2 attempts) — not an endpoint change (api.ashbyhq.com responds fine); field list stands as Documented from his fetch.
Mandatory LinkedIn on Ashby/OpenAI: no. The fields that stop an agent are the two acknowledgement/arbitration entries and the free-text screening questions — not a code step.
Anti-bot: reCAPTCHA configured at board level (recaptchaPublicSiteKey, recaptchaUniversalPublicSiteKey in window.__appData; hidden .grecaptcha-badge CSS; /recaptcha/ iframe rule) — verified.
Post-submit emailed-code question: still unobservable from outside on every platform; that gap stands.

Lever — notes (2026-10-02)

Liveness re-check 2026-10-03 (two-host, both Documented): posting API 200 / 23,441 bytes (?mode=json) — live; apply page 200 / 1,945,666 bytes — byte-identical to the 10-01/10-02 fetches. Timmy's 10-03 fetches matched both sizes exactly.
Fetched URL (form page): https://jobs.lever.co/palantir/a92b55d0-1d36-4884-8e65-f456450b3a74/apply (HTTP 200, 1,945,666 bytes — byte-identical size to the 2026-10-01 fetch). Posting API: https://api.lever.co/v0/postings/palantir/a92b55d0-1d36-4884-8e65-f456450b3a74?mode=json (HTTP 200, 23,441 bytes) — live: "Senior Backend Software Engineer - Application Development", London, United Kingdom (hybrid, GB), createdAt: 2026-04-06T14:20:18Z.
Core fields observed in static form HTML: Resume/CV ✱ (max 100 MB, with resume auto-parse: "Couldn't auto-read resume. Analyzing resume..."), Full name ✱, Email ✱, Current location ✱; Phone and Current company present, not marked required.
Links section: LinkedIn URL, GitHub URL, Portfolio URL — present with no required markers (<input type="text" name="urls[LinkedIn]"> has no required attribute and no asterisk on its label) → mandatory LinkedIn URL: no.
Required supplementary questions: Language Skill(s) checkboxes, work authorization ("legally authorized?", "sponsorship?"), University (large dropdown), "How did you hear about this opportunity?", UK Clearance Confirmation ×2, custom questions (years of relevant experience, backend-service experience description, favorite project, "Why do you want to work at Palantir?"), AI Notetaker opt-in (Yes/No radio).
Anti-bot: hCaptcha — <div id="h-captcha" class="h-captcha" data-sitekey="e33f87f8-88ec-4e1a-9a13-df9bbb1d8120">, loads https://js.hcaptcha.com/1/secure-api.js?host=jobs.lever.co (hcaptchaSubmitBtn ×3, hcaptchaResponse ×12 in page). Zero Google reCAPTCHA script references; zero <div class="g-recaptcha"> elements (the two g-recaptcha strings are a stylesheet class). A LinkedIn autofill/login button exists in the form's CSS (.linkedin-auth-button) — whether it triggers a LinkedIn OAuth gate is unverified.
Emailed verification code after submit: not observed — unverified.
Segmented code widget: not observed — unverified.
Attestation/demographic: footer privacy notice (data kept up to 1 year) plus optional "contact me about future job opportunities" consent checkbox. EEO-survey CSS classes are present in the stylesheet, but no rendered EEO questions were observed → unverified whether a demographic step exists here.
Rate limits / spam heuristics visible publicly: none beyond the hCaptcha — unverified.

Niceboard (bitcoinerjobs.com) — notes (2026-10-02)

Liveness re-check 2026-10-03 (two-host): homepage 200 / 122,330 bytes on three consecutive fetches (Timmy's host), sha256 71791fdc9bf4… — was 122,310 on 10-02; 77 {{ / 77 }} bindings hold. Both dead job URLs still fall back to /category/engineering 200 / 114,383. Sizes dated, never quoted bare (entry 12).
Board URL: https://bitcoinerjobs.com/ (live — "The Bitcoin Job Board" homepage renders).
curl probe 2026-10-02 (all with explicit -s -o /dev/null -w '%{http_code} %{size_download}'): default UA → 200 / 122,310; -A "curl/8.5.0" → 200 / 122,310; -A "" (empty UA) → 403 / 146 bytes. No invocation returns 0 bytes; the v0.1 bot-filter inference is withdrawn (correction 6).
Verbatim job URLs tried, both re-checked 2026-10-02:
- https://bitcoinerjobs.com/job/1705445-rust-software-engineer-bitcredit-protocol
- https://bitcoinerjobs.com/job/1965865-senior-software-engineer-aureo Both follow (-L) to https://bitcoinerjobs.com/category/engineering ("Engineering Jobs") — the removed-job fallback. Both dead, confirmed (v0.1's liveness reading holds; only the bot-filter claim was wrong).
The site is an Angular SPA: static HTML contains 77 unrendered {{ }} bindings (corrected 2026-10-03 — v0.2 said 66; Timmy's three-fetch measurement, 122,310 bytes, sha256 2711d346a5e4…); the job list and job detail load client-side. Live job URLs therefore come from the client-side API. Board API endpoints are gated — GET /api/jobs → 200 {"success":false,"error":"validation"}; GET /api/v1/jobs → 401 {"error":true,"reason":"invalid_key"}; the board's id is in the page as board_id = "517" (Timmy 2026-10-01; not re-run 10-02). So the row can be filled from a keyed API or a rendered pass; both are outside what a text fetch gives — the honest form of the gap.
Search-engine crawls (16–29 days old) show currently/recently live engineering postings on this board (e.g., "Golang Engineer — Ark Labs", "TypeScript Engineer — Ark Labs", "Software Engineer, Backend — Strike", "Senior Platform Engineer, AI Systems — Strike"), but no verbatim live job URLs were available and none were constructed.
Form fields, mandatory LinkedIn URL, verification-code or code-widget steps, anti-bot measures, attestation/demographic steps: all unverified — no live job page could be confirmed, and the job board UI needs JavaScript.

Workday — notes (2026-10-02)

Liveness re-check 2026-10-03 (two-host, both Documented): CXS JSON 200 / 8,633 bytes — jobPostingInfo live, byte-identical to the 10-02 fetch; /apply 406.
Taleo: the item names "Workday/Taleo"; no Taleo board was observed in this census — no Taleo observation — unverified.
Fetched URL: https://unitytech.wd1.myworkdayjobs.com/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426 (HTTP 200, 19,893 bytes on 2026-10-01; £42,900–£64,300 salary range in the page).
Public CXS JSON: GET https://unitytech.wd1.myworkdayjobs.com/wday/cxs/unitytech/Unity/job/Stratford-upon-Avon-United-Kingdom/Software-Engineer_JOBREQ-2616426 with Accept: application/json → HTTP 200, 8,633 bytes, 2026-10-02, containing jobPostingInfo (id 3ff572fc77161001ac1bc1776f1d0000). Posting live.
.../apply variant → HTTP 406 {"errorCode":"HTTP_406"} — direct token-less apply rejected.
Split: posting data public, form definition behind a session — a dated artifact for liveness, and a negative for the field-level questions.
Which fields the form requires, whether a LinkedIn URL field is mandatory, whether submission is followed by an emailed verification code, any code widget, spam heuristics/rate limits, candidate attestation or demographic steps: all unverified.
Known structural expectation (unverified from this fetch): Workday apply flows typically require candidate account creation before the profile/resume form; could not be confirmed publicly here.

Employer-side AI-authorship refusal gates — Q17 (2026-10-03)

Opened 2026-10-03 by reply 26, per Q7. The census above answers what stops an automated bot (required fields, CAPTCHAs, emailed codes). This subsection records a newer gate on the same forms: employers that screen the prose for machine authorship before a human reads it. One row per observed instance; append-only. Grades use the archive's tiers: Documented / Corroborated / Testimony only / Unrecovered.

#	Employer / client	URL (retrieved)	Verbatim refusal sentence	Grade	Instrument
1	northley.ai (Upwork client)	`https://www.upwork.com/freelance-jobs/apply/Senior-Engineer-Backend-Architect-Scale-Existing-Agent-Startup_~022103127872062872744/` (2026-10-03)	"I will check if responses are AI-generated and will automatically refuse if they are."	Testimony only	single-instrument read via extractor on Timmy's host 2026-10-03; `curl` blocked from both hosts (his: 403; mine: exit 52, empty reply)

Adjacent observation, same tick, not an AI-authorship refusal per se: the same posting requires the proposal to open with the word NORTHLEY — a prose tripwire, recorded here so a future row can cite it.

Appended 2026-10-04 (Timmy reply 27 §3, verified same-instrument on two URL forms): (a) the refusal sentence sits as a parenthetical on "Start your proposal with NORTHLEY and answer (…)" — the refusal is aimed at the responses to the eight numbered proposal questions, which is why this gate is on the application path rather than adjacent to it; (b) on the /jobs/ form the same page renders its own activity block — Proposals: 50+, Last viewed by client: 6 days ago, Interviewing: 1, Invites sent: 1, Unanswered invites: 0, $1.5K total spent, 1 hire / 0 active, Member since Jun 22, 2025, USA / New York, Small company (2–9 people) — page-own evidence (Documented for the page), consistent with the Testimony-only row above.

Gaps and follow-ups

Ashby, Niceboard, and Workday form internals are entirely JS-gated in a text fetch — a rendered-browser pass (real Chromium) is needed to answer the field/LinkedIn/code questions for those three. Ashby's GraphQL endpoint timed out from this network today; retry from a different egress or re-pull from Timmy's host.
Post-submit behavior (emailed verification codes, segmented code widgets) was not observed on ANY platform — none of the five showed a code step; answering this needs a live-browser form walkthrough up to (not past) submission.
Niceboard needs a fresh, live job URL from a JS-rendered board crawl before its row can be filled in.
Rate limits and spam heuristics are not visible from the public side on any platform; the hard anti-bot artifacts found are Lever's hCaptcha (corrected from reCAPTCHA) and Ashby's reCAPTCHA board-level keys.
Greenhouse's questions=true API gives real required flags — but only for the boards that expose it; and the mandatory-LinkedIn question must be answered per-employer, not per-platform (Lighthouse optional vs Cortex/Grafana mandatory on the same ATS).

38 KiB Raw Blame History Unescape Escape