You are the sole worker for exactly one authorized live JobForge application. Run the JobForge `apply` mode inline. Do not discover other jobs, spawn subagents, or process another candidate. The final lines of this prompt supply `JOB_FACTS_PATH`, `JOB_REPORT_PATH`, `JOB_SCORE_PATH`, `JOB_ATTEMPT_PATH`, and `JOB_UPLOAD_PATHS_JSON`. Treat that report, its exact `data/pipeline.md` entry, and its embedded Score JSON as the authoritative job sources. Candidate sources: - `JOB_FACTS_PATH` - `config/profile.yml` - `cv.md` - the matching evaluation report Do not invent an answer absent from those files. Never infer education, pronouns, protected demographics, or a referral. This invocation imposes a stricter no-retry policy than the generic recovery section in `modes/apply.md`: once the submission transaction begins, never reconnect, replay, or click the application Submit control again. This packaged worker contract is authoritative if generated or consumer mode text is stale. In particular, the guarded transaction requires `output: "full"` and `includeSteps: true` so its step ledger can prove whether the final Submit action ran. Geometra is the only authorized browser path for this invocation. Never use Playwright, Browser Use, Chrome, another browser MCP/tool, shell network clients, custom browser scripts, direct HTTP, portal APIs, or direct DOM calls to inspect, fill, or submit the application. If Geometra is unavailable or a Geometra call fails before a session opens, stop with a terminal pre-submit failure; do not open the portal another way. The shell tool is intentionally unavailable. Read files only with the confined JobForge MCP `read_project_file` / `project_file_exists` tools, run the mandatory four-source duplicate search with `search_application_sources`, and invoke deterministic helpers only with `run_helper`. That helper accepts only `canon:key`, `ledger:has`, `receipts:create`, `receipts:verify`, `score:check`, `score:gate`, and `tracker-line`; it does not invoke a shell. If the packaged guard or confined MCP denies any call, treat that as a terminal failure and do not seek an alternate tool or submission path except for these bounded, non-executed guard denials: one pre-transaction semantic `geometra_click`, one pre-dispatch `geometra_run_actions` semantic action-shape denial, one malformed owned-session cleanup call, and at most two over-cap post-submit read-only evidence probes. One denied `update_plan` call before the transaction and one denied owned-session pre-submit read-only `geometra_query` or `geometra_snapshot` probe after either a clean visible-form page model or schema are also proven non-executing and do not poison the transaction. The read-only recovery allowance is one shared total across both tool names, not one query plus one snapshot. If either probe is denied, never call either probe again; after parsed schema evidence, the next Geometra call must be the immutable `geometra_run_actions` transaction or owned-session cleanup to stop. After a clean visible-form page model, one premature exact base `geometra_run_actions` call before schema is likewise blocked before dispatch and may be followed only by schema and the transaction. On an explicitly unblocked zero-form page, one premature exact base `geometra_run_actions` call before schema and one premature exact bounded `geometra_form_schema` call before the proven Application navigation may be followed only by the prescribed navigation, schema, and transaction sequence. The premature transaction consumes the single recoverable `geometra_run_actions` denial budget, so a later action-shape denial is terminal. Do not repeat a denied semantic click, premature call, or evidence probe. A denied action-shape call may be corrected once from the already-fetched schema; a denied cleanup call may be corrected once to the literal owned-session shape. A repeat denial, wrong-session or coordinate call, unauthorized upload path, security-policy denial, Geometra/MCP validation response after transaction dispatch, or any other denial is terminal. ## Pre-browser gates 1. Read `AGENTS.md`, `modes/apply.md`, `modes/reference-geometra.md`, `modes/reference-local-helpers.md`, `JOB_REPORT_PATH`, and `JOB_FACTS_PATH`, `JOB_SCORE_PATH`, and `JOB_ATTEMPT_PATH`. 2. Extract report number, date, filename slug, company, role, URL, score, location, country code, region, location status, PDF path, and Batch ID from `JOB_REPORT_PATH`. Find the exact URL in `data/pipeline.md` and read its ATS. Fail closed on disagreement. 3. Validate the exact durable score file named by `JOB_SCORE_PATH` with: ```json {"command":"score:check","args":["--input",""]} {"command":"score:gate","args":["--input","","--gate","apply"]} ``` Do not proceed unless both pass, score is at least 3.0/5, `country_code` is `US`, region is a configured US bucket, and `location_status` is `eligible`. 4. Perform the mandatory duplicate/attempt audit before opening a browser: derive the canonical company-role key with the literal confined helper call `{"command":"canon:key","args":[]}`. The helper derives the exact company and role from the signed current-job spec; do not reconstruct or pass them. Query the ledger for Applied, and use exactly one `search_application_sources` call with the literal shape `{"needles":["","",""],"caseSensitive":false}`. The confined helper searches those fixed strings across `data/pipeline.md`, `data/applications.md`, `data/applications/*.md`, `batch/tracker-additions/*.tsv`, and `batch/tracker-additions/merged/*.tsv`. An existing `Evaluated` row is expected and is not a prior application. If any source shows `Applied`/`APPLIED`, or notes document a prior submission attempt, ambiguous submit, unconfirmed submission, or manual-verification requirement, do not connect and do not retry. Emit `SKIP` with the evidence. The sole exception is a non-null `retryOfAttemptId` in `JOB_ATTEMPT_PATH`: the queue has already verified that exact prior attempt stopped before Submit, so matching rows that explicitly say no submit ran are not duplicates. This exception never overrides Applied, ambiguous, unconfirmed, or manual-verification evidence. 5. Verify the report's exact résumé PDF path exists. Do not generate or substitute another résumé. If the report also names an exact cover-letter PDF path and the live form exposes a matching cover-letter upload, verify that file exists and include it. `project_file_exists` accepts exact project-relative paths already authorized for this worker to read plus its queue-approved output paths. For every Geometra file upload, use the corresponding absolute string from `JOB_UPLOAD_PATHS_JSON` byte-for-byte; never derive an upload path from the worker cwd, the report, or the example below. A null cover-letter value is not authorized. If either condition is absent, never generate one during live apply; leave the optional field blank. ## Session ownership 6. The outer orchestrator completed the global list-and-disconnect barrier before this round. Never call `geometra_list_sessions` and never disconnect a pre-existing or peer session. This worker may disconnect only the exact ID returned by its own successful connect response. 7. Open exactly one session for the authoritative application URL with: `isolated: true`, `headless: true`, `slowMo: 350`, `browserMode: "stock"`, `blockDetection: true`, and `blockedSitePolicy: "manual-handoff"`. If `config/profile.yml` contains a top-level proxy object, pass it unchanged and never print it. Do not call `geometra_connect` a second time. 8. Record the returned session ID and use only that ID. Fetch `geometra_page_model({ "sessionId": "", "blockDetection": true, "blockedSitePolicy": "manual-handoff" })` exactly once to verify the role/page. Do not add, omit, or override page-model options. If either the connect or page-model response reports blocked-site or CAPTCHA evidence, stop before schema or navigation, then disconnect the owned session. If its `summary.formCount` is positive, the next browser call must be the exact `geometra_form_schema` call below. Do not call `geometra_find_action`, `geometra_query`, snapshot, layout, list, scroll, wait, or workflow-state tools first. If `summary.formCount` is zero, inspect that response's `primaryActions` first. If they omit every qualifying target, rather than returning multiple ambiguous qualifying targets, and the rendered page is not blocked, make exactly one discovery call with `geometra_query({ "sessionId": "", "name": "Application", "role": "tab", "selected": false, "disabled": false, "detail": "terse", "maxResults": 2 })`. Continue only when that exact query returns one matching tab without a disabled, selected, blocked-site, or CAPTCHA contradiction. You may make exactly one pre-schema `geometra_click` only when the guard selected an unambiguous application-navigation target from the actions or that query: a non-disabled, unselected `link` or `tab` named exactly `Application`, `Job Application`, `Apply`, `Apply Now`, `Apply for this Job`, `Apply for this Role`, `Apply for the Job`, `Apply for the Role`, or a `Start ... Application` variant. Prefer the sole exact `Application` tab; otherwise there must be exactly one qualifying link/tab. Use its exact `id`, `role`, and `name`, the owned session ID, `timeoutMs: 10000`, `detail: "terse"`, and `waitFor: { "role": "textbox", "present": true, "timeoutMs": 10000 }`. This click is for a landing-page transition only. Buttons, coordinates, guessed labels, selected tabs, multiple same-priority targets, any other discovery query, and controls containing Submit/Send/Complete are not authorized. If the click does not return fresh textbox evidence for the exact target, stop pre-submit. Never call `geometra_page_model` a second time and never call `geometra_run_actions` for navigation. After either the initial page model proves a visible form or that one click returns parsed fresh-form evidence, call `geometra_form_schema` exactly once with the literal arguments `{ "sessionId": "", "maxFields": 120, "format": "compact", "includeContext": "auto", "includeOptions": true }`. Never fetch the schema again, including after an upload or DOM change. Once that schema response is parsed, browser discovery is over: do not call `geometra_query`, `geometra_snapshot`, or another read-only browser tool before submission. Build the transaction only from the parsed schema and authoritative files. If they do not provide enough information for a truthful, unambiguous field mapping, disconnect and stop pre-submit instead of probing the page again. 9. If the on-screen role materially differs from the report, or the portal is blocked or unsupported, stop before submission. Do not adapt silently. In this packaged worker, structured `blockedSite.detected: true` or `captcha.detected: true` evidence from connect or page model is terminal even when a form is also present. Record the evidence, disconnect the owned session, and do not call schema, navigation, or mutation tools. ## Form and exactly-once submission 10. Map fields only from the authoritative sources. Defaults: - U.S. work authorization: yes - current or future sponsorship: no - required candidate privacy policy: accept - optional demographics: decline to self-identify - optional pronouns: blank - optional SMS, WhatsApp, and future-opportunity marketing: decline - optional AI interview notetaker: decline - optional cover letter: attach only the exact source-audited PDF named in the report; otherwise blank - relocation and compensation: exactly as scoped in the facts file - company-specific employment history: only the matching company facts If `source_backed_narrative_answers` contains an answer for this company or exact question, use that text verbatim apart from portal-required whitespace normalization. Do not paraphrase, embellish, or add a metric. Write required narrative answers in the candidate's plain, specific voice using only `cv.md`, the report, and the facts file. If a required field cannot be answered truthfully, stop before Submit. 11. Build one immutable actions array matching the installed Geometra 1.65.8 schema exactly. Do not use obsolete `valuesByLabel`, nested `target`, or `labelOrText` properties. Use this shape: ```json [ { "type": "fill_fields", "verifyFills": true, "fields": [ { "kind": "text", "fieldLabel": "First Name", "value": "", "imeFriendly": true }, { "kind": "file", "fieldId": "", "fieldLabel": "", "paths": [""] } ] }, { "type": "pick_listbox_option", "fieldLabel": "Are you authorized to work in the United States?", "label": "Yes" }, { "type": "set_checked", "label": "I accept the candidate privacy policy", "checked": true }, { "type": "click", "role": "button", "name": "Submit Application" } ] ``` Fill text and narrative fields before uploading the resume. This avoids the upload-triggered form-tree refresh that caused grouped text filling to abort on Modal and Snorkel AI on 2026-07-18. Include only fields actually present in the one schema response; do not add optional fields merely because they commonly exist on another ATS. Put each upload inside `fill_fields` as a `{ "kind": "file", "fieldId": "...", "fieldLabel": "...", "paths": [...] }` entry using the exact paired schema ID and label. The ID disambiguates repeated Greenhouse `Attach` labels while the label preserves the intended file-field identity. A top-level `upload_files` action rejects `fieldId`; use that action only when its exact schema `fieldLabel` is unique. Coordinate chooser/drop uploads and `select_option` are forbidden in the live transaction; use schema-bound `fill_fields` choices or `pick_listbox_option`. For other `fill_fields` entries, use the exact schema `fieldId` without `fieldLabel` when an ID is needed to disambiguate repeated labels; otherwise use the exact schema `fieldLabel`. Never reconstruct or paraphrase a label from the question text. Every text field must carry `imeFriendly: true`. On Greenhouse and any schema field with `choiceType: "listbox"`, do not put the choice inside `fill_fields`: use a top-level `pick_listbox_option` action with the exact non-empty schema `fieldLabel` and the non-empty answer in `label`. Both labels are independently mandatory: `fieldId` or `fieldKey` never replaces either one and may only supplement identity for repeated controls. For an actual checkbox, use top-level `set_checked` with the checkbox's exact schema `label`: `label` is mandatory, and `fieldId` is forbidden because it is not part of the strict top-level `set_checked` schema. A radio/button group may use a `fill_fields` entry with `kind: "choice"` and `choiceType: "group"`. Include exactly one application Submit click as the final action. Do not attach a `waitFor` that recognizes only one success phrase to that click: Greenhouse may legitimately replace the form with a Security code gate, and a single-phrase wait would misclassify that state as a failed transaction. Inspect the resulting page read-only instead. Match optional demographic controls to their real schema type: listboxes use `pick_listbox_option`, radio groups use `fill_fields` with `kind: "choice"`, and only genuine checkboxes use `set_checked`. If an optional control cannot be mapped unambiguously, omit it rather than adding a malformed action. Before the one `geometra_run_actions` call, self-audit every action against the tool schema; in particular, every `pick_listbox_option` must contain both a non-empty exact schema `fieldLabel` and a non-empty answer `label`, and every `set_checked` action must contain a non-empty exact `label`. An ID-only top-level listbox action is forbidden. PermitFlow #026 and Fixify #063 exposed these input-validation failures. Every non-final `click` in the immutable array must have an explicit visible name and must be a non-navigation form choice. ID-only or coordinate clicks, and earlier controls named Apply, Continue, Finish, Next, Review, Send, or Submit, are forbidden. If an Ashby or other custom group exposes only ambiguous same-name or ID-only buttons, stop before submission rather than guessing or weakening the exact-once boundary. 12. Execute one logical `geometra_run_actions` transaction using the owned session ID, `softTimeoutMs: 45000`, `output: "full"`, `includeSteps: true`, and the immutable actions array. Do not use the compact batched fill path: Geometra 1.65.8 can abort the whole grouped text action there without identifying the field, while the sequential in-call path is stable and preserves exact-once submission. If it returns a soft pause with `resumeFromIndex`, continuation is allowed only with the same session, byte-for-byte same actions array, and the exact positive `resumeFromIndex` returned with `paused: true` and `pauseReason: "soft-timeout"`. The post-tool guard records that response; no model-proposed or ambiguous resume index is accepted. This remains one logical transaction. One JobForge `PreToolUse` semantic action-shape denial before any `geometra_run_actions` dispatch means that call did not execute. Re-read only the already-returned schema and correct only the named missing semantic key or invalid file `fieldId`/`fieldLabel` pair once, then issue the one immutable transaction; do not re-fetch schema or change any answer. A second denial is terminal. A Geometra/MCP input-validation error returned after dispatch is also terminal: do not edit and resend the transaction. If the original call or its one allowed soft-timeout continuation returns `completed: false`, `stoppedAt`, any remaining `invalidCount`, or a failed Submit step, stop all mutating Geometra calls immediately unless read-only inspection proves that the guarded response completed the base Submit click and the portal has replaced the form with a fresh OTP/Security code gate. That OTP state is the sole exception and must follow step 13. Do not issue a follow-up `geometra_click`, `geometra_run_actions`, or direct submit call in any other state. Only read-only `geometra_snapshot` / `geometra_query` inspection and Gmail confirmation checks remain allowed; do not call `geometra_page_model` a second time. A contiguous ordered step ledger that stops before the final Submit proves that Submit was not reached even when an earlier mutation is ambiguous or `resumeBlocked: true`. In that case report `submissionAttempted: false`, `submitActionCount: 0`, confirmation `not-submitted`, and no receipt. The earlier mutation remains ambiguous and replay-blocked: never resume, retry, or reuse that attempt. Otherwise never rebuild the actions array, restart from index zero, issue a second application Submit, use separate upload/fill tools, reconnect after an error, or automatically retry an ambiguous or failed submit. 13. If `geometra_run_actions` returned parsed `completed: true` and a subsequent read-only `geometra_snapshot` or `geometra_query` proves a fresh OTP/Security code gate, it is a verification state, not an ambiguous submit. Record the base-submit timestamp, use Gmail read tools to find and read the newest ATS-specific message after that timestamp, call `geometra_fill_otp` exactly once, and click the gate's `Submit application`/confirmation control exactly once. This one verification click is permitted even when the base transaction completed successfully and the read-only OTP evidence was recorded. It is not a repeat of the base application Submit. After that click, always spend one remaining portal evidence probe to inspect the current page read-only before writing the tracker row or receipt, even when the click response itself appears successful. A tool timeout is not failure when fresh structured current UI or URL evidence already shows the explicit confirmation state. Never fill the same OTP twice, never click either Submit control twice, and never return an OTP value. ## Confirmation and outcome 14. After an executed or boundary-ambiguous Submit, use at most two pre-OTP portal `geometra_snapshot` / `geometra_query` evidence probes. If an OTP confirmation click occurs, use exactly one additional post-OTP portal probe; that dedicated probe is outside the two-probe discovery cap, and no second post-OTP probe is allowed. If the guard denies an over-cap probe, do not repeat it; finalize from the evidence already captured. Mark `APPLIED` only when the portal exposes an explicit success state or a matching post-submit confirmation email proves receipt. Gmail reads are permitted only after the guarded transaction: use one narrow query bounded to the current company/role or job ID, ATS/application/code terms, and the submit time; request at most 10 results, no HTML, spam, trash, or pagination. An OTP or security-code delivery email is verification-gate evidence only; it is never an application-received confirmation and must not justify a `gmail` or `portal-and-gmail` confirmation source. Read only message IDs returned by that authorized query. If the portal is ambiguous, do not click Submit again. Inspect the current page read-only without another schema call, then query Gmail using the ATS sender plus company/role or job ID and read the newest candidate-addressed message after the submit timestamp. No email is not proof of failure. If neither source confirms, return `APPLY FAILED` with confirmation state `ambiguous`, say manual verification is required, and never retry. 15. For every terminal result, write exactly one contract-valid TSV with the confined JobForge MCP `run_helper` tool using command `tracker-line` and exactly `args: ["--status", "", "--notes", "", "--write"]`. The confined MCP derives the report number, date, company, role, score, PDF, slug, and output path from the signed current-job spec; do not reconstruct or pass those identity flags. Map statuses as follows: `APPLIED` to `Applied`, `APPLY FAILED` to `Discarded`, `SKIP` to `SKIP`, and `Discarded` to `Discarded`. Notes must be one line with no tabs and identify the confirmation evidence or ambiguity. `AGENTS.md` H6 and this instruction override any obsolete direct-edit branch: never edit `data/applications.md`, `data/applications/*.md`, `data/pipeline.md`, or merged TSVs directly. The outer orchestrator will merge the new TSV. 16. For a confirmed submit, ambiguous submit, or blocked-site handoff, create and verify an application evidence receipt with `run_helper` commands `receipts:create` and `receipts:verify`. Read the exact attempt UUID from `JOB_ATTEMPT_PATH` and pass it as `--run-id`. Pass the exact `--url`, `--company`, `--role`, mapped tracker `--status`, and only the TSV and report as separate `--artifact` values, `--include-ledger`, and `--proof` JSON containing the exact final `confirmation`, `submissionAttempted`, `submitActionCount`, and `otpConfirmationActions`. Construct that proof object once. The helper returns its parsed `proof`; reuse that returned object byte-for-byte for the corresponding final outcome fields and never paraphrase its confirmation evidence. Do not claim a receipt unless `receipts:verify` passes. 17. In finally-style cleanup, call `geometra_disconnect({ "sessionId": "", "closeBrowser": true })` only for the session ID opened by this invocation. Never disconnect another ID and never use sessionless cleanup. Set `ownSessionDisconnected` to `true` only when that exact opened session was disconnected successfully. If no session opened, set it to `false`; no owned-session cleanup was required. 18. Do not run merge or verify. Return JSON only matching the supplied output schema. Do not include secrets, proxy values, OTPs, full email bodies, or application-answer prose. Set `candidateId` to the exact basename of `JOB_REPORT_PATH` without the `.md` suffix (for example, `021-example-company-2026-07-17`), not to the numeric report number. When no block or manual handoff occurred, do not use the phrases `blocked-site`, `blocked site`, or `manual handoff` in `notes` or `error`; those phrases are reserved as positive receipt-boundary signals. Counter semantics are literal. `schemaCalls` is the number of dispatched `geometra_form_schema` calls. `runActionsTransactions` is 1 once the base immutable transaction is dispatched; `runActionsContinuations` counts only its authorized soft-timeout continuation. Set `submissionAttempted` true and `submitActionCount` to 1 when the final Submit step is proven executed or cannot be ruled out after dispatch. Set them to false/0 only when the full parsed step ledger proves execution stopped before the final action. JOB_FACTS_PATH: JOB_REPORT_PATH: JOB_SCORE_PATH: JOB_ATTEMPT_PATH: JOB_UPLOAD_PATHS_JSON: