Skip to content

fix(jobs): verify application availability conservatively #11 - #12

Merged
yashiels merged 2 commits into
mainfrom
agent/application-status
Oct 2, 2026
Merged

yashiels merged 2 commits into
mainfrom
agent/application-status

Conversation

@yashiels

@yashiels yashiels commented Oct 2, 2026

Copy link
Copy Markdown
Owner

Closes #11

Changes

  • Conservative accepting/closed/unverified application metadata with evidence, timestamps and observed employer links.
  • Read-only lnk job <id> --check-apply; narrow anonymous Lever/Workday verification with bounded HTTPS reads and non-public destination guards.
  • Closed-job submission guard and clean backwards-compatible apply JSON.
  • HTML5 form parsing, order-independent LinkedIn metadata, regression coverage and canonical LinkedIn skill updates.

Verification

  • make ci passed (vet, formatting, race tests).
  • golangci-lint run --new-from-rev origin/main ./...: 0 new issues. Full-repo lint retains 20 pre-existing findings; Makefile falls back to go vet.
  • GOOS=linux go vet ./..., go mod verify and scratch build passed.
  • Read-only live checks reproduced suspended/closed listings and challenge-blocked employer verification remaining unverified. No account writes.
  • Independent review R1 identified 5 major findings; R2 resolved all 5. Final independent delta review passed SHA 725707b with no findings.
  • Local commit signature verified; one commit on branch.
  • act unavailable on this host, so the GitHub Actions workflow could not run locally. Its exact vet/race-test/gofmt steps passed locally; Ubuntu execution is gated by PR CI.

Limits

Workday HTML and unsupported ATS destinations remain unverified. Free-text deadlines and candidate suitability require separate checks. LinkedIn Easy Apply status describes observed current metadata, not a completed submission.

@sentinel-skyner sentinel-skyner Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛡️ Sentinel review

Three material issues can produce unsafe requests or false availability results.

3 inline comments below.

Automated review via cursorbridge:gpt-5.6-sol. Findings only — not an approval. Push new commits to re-review.

Comment thread internal/api/application.go
Comment thread internal/api/application_html.go
Comment thread internal/api/jobdetail.go Outdated
Comment thread internal/api/application.go
Comment thread internal/api/application_html.go
Comment thread internal/api/jobdetail.go Outdated
@yashiels
yashiels merged commit 8436767 into main Oct 2, 2026
1 check passed
@yashiels
yashiels deleted the agent/application-status branch October 2, 2026 12:40

@sentinel-skyner sentinel-skyner Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛡️ Sentinel review

Multi-address ATS hosts may be incorrectly reported as unverified.

1 inline comment below.

Automated review via cursorbridge:gpt-5.6-sol. Findings only — not an approval. Push new commits to re-review.

if isPublicApplicationIP(ip) {
return (&net.Dialer{Timeout: employerCheckTimeout}).DialContext(ctx, network, net.JoinHostPort(ip.String(), port))
}
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛡️ Medium dialContext returns after dialing the first public DNS address, even when that dial fails. It never tries remaining A/AAAA records, so an unreachable IPv6 address or stale first record causes verification to fail despite another resolved address being reachable.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(jobs): distinguish closed and unverified applications and expose real apply links

1 participant