Six test applications on real postings, and the facts they settled

JazzHR, BambooHR, Personio, Breezy, Teamtailor and Greenhouse, each on a
real posting with the test CV, nothing sent: 8 to 48 steps, under a cent
to a cent each. Five of the unknowns the plugins admitted to are now
facts.

The one worth saying once: a file input the page hides refuses the file,
and the upload goes to the button beside it, which the page labels. It
happened on Greenhouse and on Personio in the same run, so it is in the
rules every form gets, and each plugin keeps its own selector:
`[aria-labelledby='upload-label-resume'] button` on Greenhouse,
`[aria-labelledby="doc-label-cv"] button` on Personio, `a.resume` on
Breezy, `#resumator-resume-value` on JazzHR.

Also settled: a closed BambooHR posting sends the browser to the
company's whole list at /careers, which is that plugin's missing
closed-posting fact; Personio's company questions are
`#field-custom_attribute_<number>` and its send control is
`form button[type="submit"]`, with the page in English on some .com
postings; Breezy's send control is a `type="button"` and uploading fills
its summary field; Teamtailor's cookie banner is declined by its
aria-label in the page's language.

docs/sites.md records each run with its steps.

Co-Authored-By: Claude Opus 5 <[email protected]>

docs/sites.md

@@ -7,15 +7,15 @@ What AIHawk can do on each site, from the real forms it has been run on. Posting
 | Greenhouse (boards and job-boards hosts, EU too) | ~200k | sent and confirmed on a real form | One real send (one send only). Others stopped at required questions the CV and answers do not cover. A dry run on 2026-11-07 met a closed posting and said so in 33 seconds: the board sends a closed job to `/<company>?error=true`, which the plugin now names. |
 | Ashby (jobs.ashbyhq.com) | ~76k | sent and confirmed on a real form | One real send (one send only). Others stopped at required questions, or found a closed posting, or a Submit button that stayed disabled. A dry run on 2026-11-07 with a test CV filled the form in 40 steps and found the send control, which no id names. |
 | Lever (jobs.lever.co, jobs.eu.lever.co) | ~101k | sent and confirmed on a real form | One real send through the app as it is now: the page said "Application submitted!" at an address ending in `/thanks`. A dry run on 2026-11-07 with a test CV filled the form in 22 steps, the cheapest of any site, with no captcha shown. |
-| JazzHR (applytojob.com) | ~154k | stops at a captcha most of the time | reCAPTCHA did not pass with a click on 5 postings; it often turned into an image puzzle. A later run, with no limit on clicks: the whole form filled in about 2 minutes, then the same image puzzle. |
-| BambooHR (bamboohr.com) | ~87k | stops at a captcha most of the time | reCAPTCHA did not pass with a click on 5 postings; it often turned into an image puzzle. A later run reached the send button in about 5 minutes with no captcha shown; whether one shows on sending is not known. No send has gone. |
-| Personio (jobs.personio.de, jobs.personio.com) | ~64k | stops at a captcha about half the time | Turnstile passed on 2 of 4 postings. A real form ended blocked. |
+| JazzHR (applytojob.com) | ~154k | stops at a captcha most of the time | reCAPTCHA did not pass with a click on 5 postings; it often turned into an image puzzle. A later run, with no limit on clicks: the whole form filled in about 2 minutes, then the same image puzzle. A dry run on 2026-11-07 with a test CV filled a real form in 24 steps and under a cent, with no captcha shown on that posting, and settled where the CV goes. |
+| BambooHR (bamboohr.com) | ~87k | stops at a captcha most of the time | reCAPTCHA did not pass with a click on 5 postings; it often turned into an image puzzle. A later run reached the send button in about 5 minutes with no captcha shown; whether one shows on sending is not known. No send has gone. A dry run on 2026-11-07 met a closed posting and said so in 8 steps: a closed job sends the browser to the company's whole list at `/careers`. |
+| Personio (jobs.personio.de, jobs.personio.com) | ~64k | stops at a captcha about half the time | Turnstile passed on 2 of 4 postings. A real form ended blocked. A dry run on 2026-11-07 with a test CV filled a real form in 22 steps and under a cent, on an English `.com` posting, and settled the CV control and the send control. |
 | SmartRecruiters (jobs.smartrecruiters.com) | ~519k | reaches the send button, not always | One real form filled through every step in about 11 minutes, and the send button named. A later run stopped at 150 steps, pressing keys that scrolled nothing; with a rule against that, the next two runs reached the button, in about 10 and 7 minutes. No send has gone. A dry run on 2026-11-07 with a test CV filled the two-step form in 42 steps and 6 minutes, send control found, nothing sent. |
 | Recruitee (recruitee.com) | ~26k | sent and confirmed on a real form | One real send (one send only). Other forms stopped at required questions that test answers do not fit. |
-| Teamtailor (teamtailor.com) | ~30k | sent and confirmed on a real form | One real send (one send only). An earlier click was refused for its test phone number, so nothing went then. Other forms stopped at required questions. |
+| Teamtailor (teamtailor.com) | ~30k | sent and confirmed on a real form | One real send (one send only). An earlier click was refused for its test phone number, so nothing went then. Other forms stopped at required questions. A dry run on 2026-11-07 with a test CV filled a real form in 41 steps and a cent, in Italian; the phone's "Edit number" button refused a click. |
 | Workable (apply.workable.com) | ~35k | send clicked, not confirmed | One real form filled and sent: the button stayed on "Submitting…" beside an unticked Cloudflare box, and the browser was closed with no answer from the page. A dry run on 2026-11-07 with a test CV filled the form in 27 steps and under 3 minutes, send control found, nothing sent; a second posting had closed, and the model said so. |
 | Paylocity (recruiting.paylocity.com) | ~228k | reaches the send button, not always | One real form of 5 steps filled in about 27 minutes, and the send button named. A later run stopped at 150 steps, and the next two reached the button, in about 10 and 8 minutes. No send has gone. A dry run on 2026-11-07 with a test CV filled all four steps and found the send control, at 148 of the 150 steps allowed, 23 minutes: the demographic lists took most of them, and the plugin now says how to work them. |
-| Breezy (breezy.hr) | ~50k | sent and confirmed on a real form | One real send (one send only). |
+| Breezy (breezy.hr) | ~50k | sent and confirmed on a real form | One real send (one send only). A dry run on 2026-11-07 with a test CV filled a real form in 29 steps and a cent, and settled the CV link and the send control, which is a `type="button"`. |
 | Workday (myworkdayjobs.com, myworkdaysite.com) | ~1,481k | plugin written, not yet run on a real form | Needs an account on each company's site. The plugin was written from a real site read on 2026-11-07 up to the "Create Account" page: it signs in or creates the account with the candidate's email and a Workday password from the answers, and reads a verification code from the mail when the site asks for one. The steps after sign-in come from Workday's usual form, not from a run. |
 | iCIMS (icims.com) | ~622k | tried, no plugin | Needs an account: a form stops at the sign-in unless you are signed in. Not tried on a real form. |
 

src/aihawk/apply.py

@@ -91,7 +91,8 @@ You fill in one job application form in a browser, for the candidate, from the C
 - Decline optional demographic questions (gender, ethnicity, disability, veteran status) with the form's "prefer not
   to say" option unless the answers text gives an answer.
 - Upload the CV file at the path given to you to the resume field. Read the page with browser_snapshot before acting
-  on it.
+  on it. A file input the page hides refuses the file, and the tool says so: give it instead to the button or label
+  that opens the chooser, which is often `[aria-labelledby="<the input's label id>"] button`.
 - Do not send the application yourself. When every required field is filled, call finish_form with status ready and the
   CSS selector of the submit control. Status ready needs that selector: with no selector for it, report blocked.
 - An action that leaves the page as it was will not work the second time: never repeat it, do something else. A key that

src/aihawk/plugins/bamboohr.md

@@ -2,7 +2,7 @@
 name: bamboohr
 hosts: [bamboohr.com]
 ---
-The careers page shows the job. Click the "Apply for This Job" button; the form opens on the same page (the URL does not change). There is no sign-in.
+The careers page shows the job. A posting that has closed sends the browser to the company's whole list at `/careers`, with no job on it: call finish_form with status blocked and say the posting is closed. Click the "Apply for This Job" button; the form opens on the same page (the URL does not change). There is no sign-in.
 
 Stable ids: `#firstName`, `#lastName`, `#email`, `#phone`, `#desiredPay`, `#websiteUrl`, `#linkedinUrl`. Labels are the reliable way to find the rest, because `FabricTextField-<n>` and `fab-select<n>` ids change between postings.
 

src/aihawk/plugins/breezy.md

@@ -7,7 +7,7 @@ The page follows the browser's language, so labels may not be in English: go by
 
 Fields are named `cName`, `cEmail` and `cPhoneNumber`, which is one text field with no country list. `cAddress` and a desired salary, with its currency and period beside it, may be required. Some forms also have `cSummary` for a summary of experience and `cCoverLetter`. A required summary may be written only from the CV's own words. Leave `smsConsent` unticked unless the answers file says otherwise. Do not use the Indeed or LinkedIn links.
 
-The CV upload is a link, "Carica Curriculum" on an Italian page and "Attached" once a file is in place, near the top, with no file input and no id: select it by that text. It carries a "Required" mark when the CV is required. Uploading may fill fields from the CV, so read the page again afterwards and correct them.
+The CV goes to `a.resume`, the link labelled "Carica Curriculum" in Italian, and the page then shows "Allegato" beside it. Uploading fills `cSummary` from the CV's own words. The upload is a link, "Carica Curriculum" on an Italian page and "Attached" once a file is in place, near the top, with no file input and no id: select it by that text. It carries a "Required" mark when the CV is required. Uploading may fill fields from the CV, so read the page again afterwards and correct them.
 
 "Aggiungi posizione" (add position) and "Aggiungi Studi e formazione" (add education) are links that add an entry: leave them empty unless required.
 

src/aihawk/plugins/greenhouse.md

@@ -12,7 +12,7 @@ Gender, ethnicity, veteran and disability questions are lists too (`#gender`, `#
 
 Education can repeat: "Add another" adds a row (`#school--0`, `#degree--0`, `#discipline--0`). Its months are lists (`#start-month--0`) and its years are number fields (`#start-year--0`).
 
-A closed posting sends the browser to the board's own page at `/<company>?error=true`, which says the job is no longer open, in the page's language: call finish_form with status blocked and say the posting is closed.
+The CV goes to `[aria-labelledby='upload-label-resume'] button`; the input `#resume` is hidden and refuses the file. The send control is `button[type='submit']`. A closed posting sends the browser to the board's own page at `/<company>?error=true`, which says the job is no longer open, in the page's language: call finish_form with status blocked and say the posting is closed.
 
 A field's error goes in an element with the id `<field>-error`, which the field names in `aria-describedby`: after a send that did not go through, read those elements and fix the fields they name.
 

src/aihawk/plugins/personio.md

@@ -5,12 +5,12 @@ apply_path: /apply
 ---
 The form needs no sign-in.
 
-Fields by name: `first_name`, `last_name`, `email`, `phone`, `birthday`, `available_from`, `salary_expectations` (ids `field-<name>`). `gender` is a native select: choose by label.
+Fields by name: `first_name`, `last_name`, `email`, `phone`, `birthday`, `available_from`, `salary_expectations` (ids `field-<name>`). The company's own questions are `#field-custom_attribute_<number>`. `gender` is a native select: choose by label.
 The language switcher in the header is a custom combobox (`role="combobox"`): not part of the form, leave it alone.
-Upload the CV with the "Datei hinzufügen" control: read the page to find the file input behind it.
+The CV goes to `[aria-labelledby="doc-label-cv"] button`, the control under "Datei hinzufügen". The input behind it, `#doc-input-cv`, is hidden and refuses the file.
 `birthday`, `available_from` and `salary_expectations` take the format their own placeholder shows.
 
-The submit control is "Bewerbung senden", or the same control in the page's language on a `jobs.personio.com` posting. It stays disabled until the required fields are filled.
+The submit control is `form button[type="submit"]`, labelled "Bewerbung senden" or the same in the page's language, which is English on some `jobs.personio.com` postings. It stays disabled until the required fields are filled.
 
 A Cloudflare Turnstile box can sit above the send control, and it passed on two postings of four. If the send control stays disabled with every required field filled, call finish_form with status blocked and say whether a Turnstile box was there and whether it was ticked.
 

src/aihawk/plugins/teamtailor.md

@@ -11,6 +11,6 @@ Phone: `input[name="candidate[phone]"]`, with the country set by the button "Cha
 
 A tag field (Skills, for example) turns each typed skill into a chip when Enter is pressed in its input. The chips are what the form sends; text left in the input is not sent.
 
-Upload the CV to `#candidate_resume_remote_url` ("Upload resume"). Do not click "Apply with LinkedIn". The cookie banner is open on the page: decline or leave it, do not treat it as a question. Sign-in is not needed. The send control is `input[name=commit]`, "Submit application": report ready only on the page before it.
+Upload the CV to `#candidate_resume_remote_url` ("Upload resume"). Do not click "Apply with LinkedIn". The cookie banner's decline button is found by its `aria-label` in the page's language, such as `[aria-label='Rifiuta tutti i cookie non necessari']`. The banner is open on the page: decline or leave it, do not treat it as a question. Sign-in is not needed. The send control is `input[name=commit]`, "Submit application": report ready only on the page before it.
 
 After sending: the address gains `/thanks/` and the page says it received the application, in Spanish "Gracias por la solicitud" and "Hemos recibido tu solicitud". Read the page: if the form is still there, the application was not received.