From 98c2b0091c73246ce257eaf1de02841806aa8bbb Mon Sep 17 00:00:00 2001
From: "Aaron K. Clark" <cryptojones@owasp.org>
Date: Tue, 13 Oct 2026 04:11:17 -0500
Subject: [PATCH 1/2] fix(agent): wait for each step of Workday's way in before
 creating an account (#448)

RegisterWorkdayAsync pressed Apply and Apply Manually with a glance the
instant the posting's HTML landed. Workday draws Apply only once its
script has run (about 8 s on finastra.wd3), so nothing was pressed and
the first 1.68.1 Workday run on pluto ended in "Workday showed no Create
Account form after Apply". Step 1 of the flow, "Create Account/Sign In",
is fetched after the flow page is drawn too, blank for ~7 s there.

Each step is now waited for: Apply, Apply Manually, then whichever of
Create Account, Sign In or "Sign in with email" the tenant shows, with a
30 s budget for the lazy step. The fixture draws Apply after 800 ms and
the form 1.5 s after Apply Manually, so a glance fails the test.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015Xrsyx9xJYfnT2BzLMNFsB
---
 .../BrowserSubmitterTests.cs                  |  6 ++--
 .../Agent/Browser/AccountCreator.cs           | 36 ++++++++++++++++---
 2 files changed, 36 insertions(+), 6 deletions(-)

diff --git a/api/ApplyTrack.Api.Tests/BrowserSubmitterTests.cs b/api/ApplyTrack.Api.Tests/BrowserSubmitterTests.cs
index 327cce4..2cb3328 100644
--- a/api/ApplyTrack.Api.Tests/BrowserSubmitterTests.cs
+++ b/api/ApplyTrack.Api.Tests/BrowserSubmitterTests.cs
@@ -1490,8 +1490,10 @@ Click the object that does not fit the column pattern
         <html><body>
         <div id="notice"><button data-automation-id="legalNoticeAcceptButton" onclick="document.getElementById('notice').remove()">Accept Cookies</button></div>
         <h1>Engineer</h1>
-        <a href="#" data-automation-id="adventureButton" onclick="document.getElementById('how').style.display='block';return false">Apply</a>
-        <div id="how" style="display:none"><a href="#" data-automation-id="applyManually" onclick="document.getElementById('create').style.display='block';return false">Apply Manually</a></div>
+        <!-- Drawn late, as a tenant draws them: Apply once the script has run, step 1 of the flow a while after Apply Manually (finastra.wd3, #448). -->
+        <a href="#" id="apply" data-automation-id="adventureButton" style="display:none" onclick="document.getElementById('how').style.display='block';return false">Apply</a>
+        <script>setTimeout(() => document.getElementById('apply').style.display = 'inline', 800)</script>
+        <div id="how" style="display:none"><a href="#" data-automation-id="applyManually" onclick="setTimeout(() => document.getElementById('create').style.display='block', 1500);return false">Apply Manually</a></div>
         <form id="create" method="post" action="/wd/register" style="display:none">
           <h2>Create Account</h2>
           <label for="e">Email Address</label><input id="e" name="email" data-automation-id="email" type="text" />
diff --git a/api/ApplyTrack.Api/Agent/Browser/AccountCreator.cs b/api/ApplyTrack.Api/Agent/Browser/AccountCreator.cs
index 328764e..e64f984 100644
--- a/api/ApplyTrack.Api/Agent/Browser/AccountCreator.cs
+++ b/api/ApplyTrack.Api/Agent/Browser/AccountCreator.cs
@@ -136,14 +136,24 @@ public async Task<AccountCreation> CreateAsync(string host, string postingLink,
     {
         static ILocator Auto(IPage p, string id) => p.Locator($"[data-automation-id='{id}']");
         await ClickIfVisibleAsync(Auto(page, "legalNoticeAcceptButton"));
-        await ClickIfVisibleAsync(Auto(page, "adventureButton"));
-        await ClickIfVisibleAsync(Auto(page, "applyManually"));
+        // The posting page draws Apply once its script has run — a glance the instant the HTML
+        // landed saw nothing on finastra.wd3 (2026-10-13), so no click, no form, "check the
+        // posting" — and step 1 of the flow, "Create Account/Sign In", is fetched after the flow
+        // page is drawn: blank for ~7 s on that tenant. Each step is waited for, not glanced at (#448).
+        if (await WaitAnyVisibleAsync(page, 10_000, "adventureButton", "applyManually", "SignInWithEmailButton", "createAccountLink", "verifyPassword") == "adventureButton")
+            await ClickIfVisibleAsync(Auto(page, "adventureButton"));
+        if (await WaitVisibleAsync(Auto(page, "applyManually"), 8_000))
+            await ClickIfVisibleAsync(Auto(page, "applyManually"));
+        var seen = await WaitAnyVisibleAsync(page, 30_000, "verifyPassword", "createAccountLink", "SignInWithEmailButton");
         // A tenant that offers Google and LinkedIn puts the email sign-in behind a choice
         // (NVIDIA, 2026-10-12): "Sign in with email" first, then the form (#443).
-        if (await WaitVisibleAsync(Auto(page, "SignInWithEmailButton"), 4_000))
+        if (seen == "SignInWithEmailButton")
+        {
             await ClickIfVisibleAsync(Auto(page, "SignInWithEmailButton"));
+            seen = await WaitAnyVisibleAsync(page, 10_000, "verifyPassword", "createAccountLink");
+        }
         // Sign In is shown first on some tenants; its "Create Account" link turns the form over.
-        if (!await WaitVisibleAsync(Auto(page, "verifyPassword"), 5_000))
+        if (seen == "createAccountLink")
             await ClickIfVisibleAsync(Auto(page, "createAccountLink"));
         if (!await WaitVisibleAsync(Auto(page, "verifyPassword"), 10_000))
             return new(null, "Workday showed no Create Account form after Apply — check the posting");
@@ -364,6 +374,24 @@ private static async Task ClickIfVisibleAsync(ILocator locator)
         catch (TimeoutException) { /* not on this tenant */ }
     }
 
+    /// <summary>The first of <paramref name="ids"/> (data-automation-id) to be drawn visible within
+    /// <paramref name="ms"/>, or null — for a page that shows one of several things next.</summary>
+    private static async Task<string?> WaitAnyVisibleAsync(IPage page, int ms, params string[] ids)
+    {
+        var until = DateTime.UtcNow.AddMilliseconds(ms);
+        do
+        {
+            foreach (var id in ids)
+            {
+                try { if (await page.Locator($"[data-automation-id='{id}']").First.IsVisibleAsync()) return id; }
+                catch (PlaywrightException) { /* mid-navigation */ }
+            }
+            await page.WaitForTimeoutAsync(250);
+        }
+        while (DateTime.UtcNow < until);
+        return null;
+    }
+
     private static async Task<bool> WaitVisibleAsync(ILocator locator, int ms)
     {
         try { await locator.First.WaitForAsync(new() { State = WaitForSelectorState.Visible, Timeout = ms }); return true; }

From f46604072dd425df40af551565ad70dc192f802a Mon Sep 17 00:00:00 2001
From: "Aaron K. Clark" <cryptojones@owasp.org>
Date: Tue, 13 Oct 2026 04:11:21 -0500
Subject: [PATCH 2/2] chore: prepare v1.68.2 release

Bump all five version files to 1.68.2 and add #448 to BACKLOG.md.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015Xrsyx9xJYfnT2BzLMNFsB
---
 .env.production.example                  | 2 +-
 BACKLOG.md                               | 1 +
 api/ApplyTrack.Api/ApplyTrack.Api.csproj | 2 +-
 pyproject.toml                           | 2 +-
 src/applytrack/__init__.py               | 2 +-
 uv.lock                                  | 2 +-
 6 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/.env.production.example b/.env.production.example
index d61431e..bd24c4e 100644
--- a/.env.production.example
+++ b/.env.production.example
@@ -1,7 +1,7 @@
 # Production deployments intentionally have no working secret defaults.
 # Copy this file to .env.production, replace every CHANGE-ME value, keep the
 # result out of version control, and pin a released OSApplyTrack version.
-OSAPPLYTRACK_VERSION=1.68.1
+OSAPPLYTRACK_VERSION=1.68.2
 POSTGRES_USER=applytrack
 POSTGRES_PASSWORD=CHANGE-ME-use-a-long-random-password
 POSTGRES_DB=applytrack
diff --git a/BACKLOG.md b/BACKLOG.md
index 4ab6707..efb9332 100644
--- a/BACKLOG.md
+++ b/BACKLOG.md
@@ -177,6 +177,7 @@ review items and unsupported forms still need human attention.
 - [ ] [#440 — Agent: Manatal (careers-page.com) Radix selects and checkbox are not driven](https://github.com/CryptoJones/OSApplyTrack/issues/440) (Yo AI Labs: after #436 the résumé attaches and the hidden questions are found, but the Nationalities / years / salary Radix selects and the terms checkbox are custom widgets neither discovered nor driven)
 - [x] [#443 — Agent: drive Workday's application wizard end to end](https://github.com/CryptoJones/OSApplyTrack/issues/443) (`BrowserCanSubmit` refused Workday, so #277's account recipe never got a run to fire in; NVIDIA JR2023533 was walked by hand on 2026-10-12. **1.68.0:** Workday is driven. The application starts at the manual flow (`…/apply/applyManually`, never the résumé autofill, whose parse explodes an "earlier roles" list into rows with no company); the way in presses Apply Manually and "Sign in with email" — the password box sits behind that choice — and the sign-in types the saved account key by key (a fill Workday sometimes never hears), presses the click_filter overlay beside the aria-hidden Sign In, waits for a complaint rather than a spinner, and loads the address again afterwards, because a sign-in from inside the flow draws "Something went wrong — please refresh". A step is read only once its controls have held still (the address and phone arrive a second after the names). Discovery and the sweep now see Workday's drop-down buttons (`aria-haspopup=listbox`, named by their label, their group, or — for a named button — the text above them), its search boxes (chips beside the input are the answer, committed with Enter), and radio groups required on their wrapper; the page header's own menus are never questions. The walk reads each step's menus so a question handed back carries its choices, ticks the terms box, attaches the résumé to the file input the packet never saw, declines a demographic drop-down Workday requires an answer to (never a guess), leaves a question the draft already answers alone, waits out the Save and Continue Workday disables while it autosaves, and hands back only starred fields when Next stays disabled. My Experience's Work Experience and Education rows are filled from the structured résumé (three jobs, every school: title, company, month/year spinbuttons, "I currently work here", description; school, Degree menu, Field of Study, years) and rows a draft already holds are completed, not duplicated. A long menu (Country) is typed at so the listbox jumps to the entry. The drafter's phone rule no longer answers "Phone Device Type" with the number. Verified live on nvidia.wd5 as a dry run: three rounds — page 2's rows and page 3's authorization pair handed back and answered — then every step to Review.)
 - [x] [#446 — Agent role cannot write board_accounts: every judging pass has died since 2026-10-10](https://github.com/CryptoJones/OSApplyTrack/issues/446) (`agent_role.sql` granted the agent INSERT/UPDATE on its own tables but not on `board_accounts`, which it writes when it takes a Sign in now, keeps a renewed session, or saves an account #277 just made; `RenewSessionsAsync` runs before the judging pass, so once greenhouse.io's session came due the pass died on every tick and the Ready reconciler, the verdicts and portal renewal all stopped — the last `agent_events` row was 2026-10-09. **1.68.1:** the grant is re-applied on boot, and `DbRoleTests` proves the three writes and that a delete is still refused.)
+- [x] [#448 — Account creator glances for Workday's Apply instead of waiting: finastra.wd3 gets "no Create Account form after Apply"](https://github.com/CryptoJones/OSApplyTrack/issues/448) (the first Workday run after #446, finastra.wd3 on 2026-10-13: `RegisterWorkdayAsync` pressed Apply and Apply Manually with a glance the instant the posting's HTML landed, and Workday draws Apply only once its script has run — ~8 s there — so nothing was pressed and no form came; step 1 of the flow is fetched after the flow page is drawn too, blank for ~7 s. **1.68.2:** each step of the way in is waited for — Apply, Apply Manually, then whichever of Create Account, Sign In or "Sign in with email" the tenant shows, with 30 s for the lazy step — and the fixture draws Apply and the form late so a glance fails the test.)
 - [x] [#417 — Agent: a résumé dropzone whose wrapping label is only "Click or drag & drop PDF" is never recognised as the résumé (Ethos) — fixed in 1.67.0: dropzone text never names a file field; its row's title does](https://github.com/CryptoJones/OSApplyTrack/issues/417)
 - [x] [#418 — Agent: an application form folded behind "Easy Apply" is never revealed (N-iX) — fixed in 1.67.0: "Easy/Quick/One-click Apply" open the form (N-iX itself then ends at a reCAPTCHA v2 handoff)](https://github.com/CryptoJones/OSApplyTrack/issues/418)
 - [x] [#419 — Agent: a footer newsletter signup (mc4wp) is discovered as an application question (Tecbrains) — fixed in 1.67.0: newsletter forms are page widgets](https://github.com/CryptoJones/OSApplyTrack/issues/419)
diff --git a/api/ApplyTrack.Api/ApplyTrack.Api.csproj b/api/ApplyTrack.Api/ApplyTrack.Api.csproj
index 47b783e..450f8ef 100644
--- a/api/ApplyTrack.Api/ApplyTrack.Api.csproj
+++ b/api/ApplyTrack.Api/ApplyTrack.Api.csproj
@@ -5,7 +5,7 @@
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
     <RootNamespace>ApplyTrack.Api</RootNamespace>
-    <Version>1.68.1</Version>
+    <Version>1.68.2</Version>
     <Authors>Aaron K. Clark</Authors>
     <Copyright>Copyright 2026 Aaron K. Clark</Copyright>
     <PackageLicenseExpression>Apache-2.0</PackageLicenseExpression>
diff --git a/pyproject.toml b/pyproject.toml
index f66fb16..9dcd882 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "applytrack-poller"
-version = "1.68.1"
+version = "1.68.2"
 description = "Discovery poller for OSApplyTrack — fetches and scores remote job leads into shared Postgres."
 requires-python = ">=3.10"
 license = { text = "Apache-2.0" }
diff --git a/src/applytrack/__init__.py b/src/applytrack/__init__.py
index 171a205..b2f0824 100644
--- a/src/applytrack/__init__.py
+++ b/src/applytrack/__init__.py
@@ -2,4 +2,4 @@
 # Copyright 2026 Aaron K. Clark
 """applytrack — a local, markdown-backed job-application tracker."""
 
-__version__ = "1.68.1"
+__version__ = "1.68.2"
diff --git a/uv.lock b/uv.lock
index c86310c..f839574 100644
--- a/uv.lock
+++ b/uv.lock
@@ -43,7 +43,7 @@ wheels = [
 
 [[package]]
 name = "applytrack-poller"
-version = "1.68.1"
+version = "1.68.2"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography" },