Job application browser integration
Candidate-bound browser execution for qualified application forms. The package keeps CDP connection values behind the existing opaque browser-session manager, injects approved encrypted references without exposing their values, detects interactive challenges, and reconciles ambiguous submit outcomes.
CAPTCHA, MFA, device attestation, and access-control challenges are takeover boundaries. This package does not solve or bypass them.
jobApplicationExecutionCapabilityMatrixV1 is the executable 17-source × 7-capability truth table. Deterministic qualification never implies live qualification.
renderJobApplicationExecutionMatrixMarkdownV1 feeds the linked public matrix;
bun run osint:job-matrices:check prevents source/application documentation drift.
Controlled clone profiles qualify form discovery, encrypted value and document application, fenced submission, reconciliation, and challenge takeover for Ashby, Flatchr, Greenhouse, iCIMS, Lever, Recruitee, SmartRecruiters, Teamtailor, WeRecruit, Workable, and Workday. Every supported profile runs in bounded batches against an HTTP-served clone through a real headless Chromium process, including upload where supported, fenced submit, reconciliation where supported, and CAPTCHA takeover. Clone drivers remain test-only and are not exported as production execution adapters. Live qualification still requires an authorized board/account and a persisted receipt.
CmonAlternance account creation has a separate controlled qualification based on its public registration surface. Email verification remains unqualified until the source behavior is proven through an authorized account; the generic Resend runtime is not treated as source-specific evidence.
ISCOD's public quick-application modal qualifies email-form discovery, fenced submission, and challenge takeover. File upload, account creation, email verification, and reconciliation remain unqualified because the observed public step does not prove those behaviors.
PlaywrightApplicationBrowserDriverV1 is the concrete production CDP bridge. It connects only to the immutable Bright Data, Browserbase, or Massive endpoint manifest through an opaque handle, captures a sanitized field schema, resolves approved encrypted values/documents transiently, and records metadata-only evidence. It never records resolved values or document bytes. CAPTCHA, MFA, and device signals remain takeover boundaries in the headless executor.
PlaywrightApplicationAccountDriverV1 executes only immutable, fingerprinted, signature-verified account workflows bound to the exact application, source, Connect decision, Runtime work order, work item, lease owner, and browser origin. Workflows may fill only the opaque username alias or credential references and click explicitly signed selectors. Resolved values remain transient. Challenges stop interaction, cross-origin navigation fails closed, and email verification stays exclusively in the fenced email integration. Detected account challenges now also return a typed, expiring takeover receipt. It binds the account, source, challenge, durable worker claim, and preserved browser session by digest; raw session handles and fencing tokens never enter the receipt or browser evidence.
createQualifiedBrowserApplicationEffectsV1 binds headless submission and reconciliation effects to the exact candidate/application browser binding.
QualifiedApplicationAccountExecutorV1 accepts only opaque session handles and forwards no credential value. Deployments compose these adapters behind an allowlisted effect module; the shared worker keeps killed effects by default.
Before capturing a page, the executor now binds the exact HTTPS destination to the candidate mandate allowlist. An unmandated destination fails before any browser interaction.
