From 0b92ddf97e661679f0bb2a8c7d9cbad4b0bae0d4 Mon Sep 17 00:00:00 2001
From: "Aaron K. Clark" <cryptojones@owasp.org>
Date: Tue, 13 Oct 2026 05:21:40 -0500
Subject: [PATCH 1/2] fix(agent): turn Workday's Create Account over to Sign In
 before signing in (#450)

A tenant that opens step 1 on Create Account (finastra.wd3) draws the
same email and password boxes as its Sign In, plus Verify New Password
and a "Sign In" link that turns the form over. The saved account was
typed into Create Account and the link pressed as the sign-in button,
so the form flipped empty and the sign-in was judged refused, right
after the account creator had proved that password at the login page.

The way in now waits up to 30 s for whatever step 1 shows (it is drawn
~7 s after the flow page on that tenant), presses the Sign In link when
Create Account is what it shows, and waits for the sign-in form; the
same guard runs where the walk's own sign-ins start, before the visible
boxes are chosen. A fixture variant opens on Create Account, drawn late,
and the test signs in through its link and reaches Review.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015Xrsyx9xJYfnT2BzLMNFsB
---
 .../BrowserSubmitterTests.cs                  | 55 ++++++++++++++++++-
 .../Agent/Browser/BrowserSession.cs           | 31 ++++++++++-
 2 files changed, 84 insertions(+), 2 deletions(-)

diff --git a/api/ApplyTrack.Api.Tests/BrowserSubmitterTests.cs b/api/ApplyTrack.Api.Tests/BrowserSubmitterTests.cs
index 2cb3328..906efe5 100644
--- a/api/ApplyTrack.Api.Tests/BrowserSubmitterTests.cs
+++ b/api/ApplyTrack.Api.Tests/BrowserSubmitterTests.cs
@@ -578,6 +578,9 @@ function suggest(box) {
         // box, a drop-down button, a required radio group), Application Questions (a drop-down),
         // Voluntary Disclosures (a demographic drop-down, the terms box) and Review with Submit.
         _fixture.MapGet("/wd/en-US/Careers/job/Omaha/Engineer_R1/apply/applyManually", () => Results.Content(WorkdayWizardHtml, "text/html"));
+        // The same wizard as finastra.wd3 serves it (#450): step 1 opens on Create Account, drawn a
+        // while after the page, with a "Sign In" link that turns the form over to the sign-in.
+        _fixture.MapGet("/wd/en-US/Careers/job/Omaha/Engineer_R2/apply/applyManually", () => Results.Content(WorkdayWizardCreateFirstHtml, "text/html"));
         _fixture.MapPost("/wd/step", async (HttpRequest req) =>
         {
             using var reader = new StreamReader(req.Body);
@@ -1510,6 +1513,35 @@ Click the object that does not fit the column pattern
         </body></html>
         """;
 
+    private const string WorkdayWizardChoicesHtml = """
+        <div id="choices">
+          <h2>Sign In</h2>
+          <button type="button" data-automation-id="GoogleSignInButton">Sign in with Google</button>
+          <button type="submit" data-automation-id="SignInWithEmailButton" onclick="show('signin');return false">Sign in with email</button>
+        </div>
+        """;
+
+    private const string WorkdayWizardCreateFirstHtml_Entry = """
+        <div id="create" style="display:none">
+          <h2>Create Account</h2>
+          <label for="ce">Email Address</label><input id="ce" data-automation-id="email" type="text" />
+          <label for="cp">Password</label><input id="cp" data-automation-id="password" type="password" />
+          <label for="cv">Verify New Password</label><input id="cv" data-automation-id="verifyPassword" type="password" />
+          <input type="checkbox" data-automation-id="createAccountCheckbox" />
+          <div style="position:relative">
+            <button type="button" data-automation-id="createAccountSubmitButton">Create Account</button>
+            <div role="button" tabindex="0" aria-label="Create Account" data-automation-id="click_filter" style="position:absolute;inset:0"
+                 onclick="document.getElementById('cerr').textContent='An account with this email address already exists'"></div>
+          </div>
+          <div id="cerr" role="alert"></div>
+          <button type="button" data-automation-id="signInLink" onclick="show('signin')">Sign In</button>
+          <button type="button" data-automation-id="forgotPasswordLink">Forgot your password?</button>
+        </div>
+        <script>setTimeout(() => { if (!sessionStorage.getItem('wd')) show('create'); }, 1200)</script>
+        """;
+
+    private static readonly string WorkdayWizardCreateFirstHtml = WorkdayWizardHtml.Replace(WorkdayWizardChoicesHtml, WorkdayWizardCreateFirstHtml_Entry);
+
     private const string WorkdayWizardHtml = """
         <html><body>
         <div id="choices">
@@ -1579,7 +1611,7 @@ Click the object that does not fit the column pattern
         <div id="done" style="display:none"><h2>Application Submitted</h2><p>Your application has been successfully submitted.</p></div>
         <ul role="listbox" id="menu" style="display:none"></ul>
         <script>
-          const show = id => { for (const el of document.querySelectorAll('.step, #choices, #signin, #done')) el.style.display = 'none'; document.getElementById(id).style.display = 'block'; };
+          const show = id => { for (const el of document.querySelectorAll('.step, #choices, #create, #signin, #done')) el.style.display = 'none'; document.getElementById(id).style.display = 'block'; };
           const state = () => JSON.stringify({ source: [...document.querySelectorAll('#chips li')].map(c => c.textContent), previous: document.querySelector('input[name=candidateIsPreviousWorker]:checked')?.value || '', country: document.getElementById('country--country').textContent, first: document.getElementById('name--legalName--firstName').value, last: document.getElementById('name--legalName--lastName').value, authorized: document.getElementById('q1').textContent, ethnicity: document.getElementById('eth').textContent, terms: document.getElementById('terms').checked });
           const report = step => fetch('/wd/step', { method: 'POST', body: step + ' ' + state() });
           const chip = text => { if (!text) return; const li = document.createElement('li'); li.setAttribute('role', 'option'); li.setAttribute('data-automation-id', 'selectedItem'); li.textContent = /linkedin/i.test(text) ? 'Linkedin Jobs' : text; document.getElementById('chips').appendChild(li); };
@@ -3110,6 +3142,27 @@ public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Except
             Console.WriteLine($"LIVE LOG [{logLevel}] {formatter(state, exception)}");
     }
 
+    /// <summary>
+    /// finastra.wd3 (2026-10-13): step 1 opens on Create Account, drawn late, and its "Sign In"
+    /// link turns the form over. The saved account signs in through that link, and the walk
+    /// goes on to Review (#450).
+    /// </summary>
+    [SkippableFact]
+    public async Task A_workday_wizard_that_opens_on_create_account_is_turned_over_to_sign_in()
+    {
+        Skip.IfNot(Available, "Node Playwright is not installed (npm ci)");
+        var url = $"{_fixtureUrl}/wd/en-US/Careers/job/Omaha/Engineer_R2/apply/applyManually";
+        var account = new BoardAccount(new Uri(_fixtureUrl).Host, "ada@example.com", "pw");
+        lock (_wdSteps) _wdSteps.Clear();
+        var outcome = await Submitter().RunAsync(url, WorkdayPacket(authorized: true), (Pdf, "resume.pdf"), dryRun: true, accounts: [account]);
+        Assert.True(outcome.Filled, outcome.Error);
+        Assert.False(outcome.Submitted);
+        Assert.Empty(outcome.Unmapped);
+        string[] steps;
+        lock (_wdSteps) steps = [.. _wdSteps];
+        Assert.Contains(steps, s => s.StartsWith("step4 "));
+    }
+
     [SkippableFact]
     public async Task A_workday_posting_with_no_saved_account_names_the_host_that_needs_one()
     {
diff --git a/api/ApplyTrack.Api/Agent/Browser/BrowserSession.cs b/api/ApplyTrack.Api/Agent/Browser/BrowserSession.cs
index c2f1b00..247d5ea 100644
--- a/api/ApplyTrack.Api/Agent/Browser/BrowserSession.cs
+++ b/api/ApplyTrack.Api/Agent/Browser/BrowserSession.cs
@@ -172,6 +172,11 @@ public async Task EnterWorkdayAsync()
                 await Auto(Page, "SignInWithEmailButton").First.ClickAsync(new() { Timeout = 5_000 });
                 await WaitVisibleAsync(Page.Locator("input[type='password']"), 8_000);
             }
+            // Step 1 of the flow is fetched after the flow page is drawn — blank for ~7 s on
+            // finastra.wd3 — so whatever it shows is waited for, not glanced at (#450).
+            await WaitVisibleAsync(Page.Locator("[data-automation-id='signInSubmitButton'], [data-automation-id='verifyPassword'], "
+                + "[data-automation-id='SignInWithEmailButton'], [data-automation-id='pageFooterNextButton']"), 30_000);
+            await FlipWorkdayCreateAccountToSignInAsync(Page);
             // The form is drawn before its script is listening: filled the instant the password
             // box appears, Sign In sent nothing and the page stayed as it was, with no complaint
             // (checked against nvidia.wd5 — a 2.5 s settle, or typing key by key, and it signs in).
@@ -182,6 +187,27 @@ public async Task EnterWorkdayAsync()
         catch (TimeoutException) { /* ditto */ }
     }
 
+    /// <summary>
+    /// A tenant that opens step 1 on Create Account (finastra.wd3, 2026-10-13) draws the same
+    /// email and password boxes as its Sign In, plus "Verify New Password" and a "Sign In" link
+    /// that turns the form over. Typed into as it stood, the saved password went into Create
+    /// Account and the link was pressed as the sign-in button, so the form flipped empty and
+    /// the sign-in was judged refused (#450). The link is pressed first, and the sign-in waited for.
+    /// </summary>
+    internal static async Task FlipWorkdayCreateAccountToSignInAsync(IPage page)
+    {
+        try
+        {
+            var verify = page.Locator("[data-automation-id='verifyPassword']");
+            var link = page.Locator("[data-automation-id='signInLink']");
+            if (await verify.CountAsync() == 0 || !await verify.First.IsVisibleAsync() || await link.CountAsync() == 0) return;
+            await link.First.ClickAsync(new() { Timeout = 5_000 });
+            await WaitVisibleAsync(page.Locator("[data-automation-id='signInSubmitButton']"), 8_000);
+        }
+        catch (PlaywrightException) { /* judged by what the sign-in finds */ }
+        catch (TimeoutException) { /* ditto */ }
+    }
+
     /// <summary>A page drawn by Workday's career site, wherever it is served from: its way in and
     /// its wizard footer carry the same data-automation-ids on every tenant.</summary>
     private static async Task<bool> LooksLikeWorkdayAsync(IPage page)
@@ -1189,6 +1215,10 @@ private async Task<bool> TrySignInAsync(BoardAccount? with = null)
             // The username box, best name first — a CSS list is matched in DOM order, and the
             // careers site's search box comes before the sign-in on the page. Never a widget's.
             const string notWidget = ":not([type='search']):not([name*='search' i]):not([id*='search' i]):not([placeholder*='search' i]):not([class*='search' i])";
+            // Workday's Create Account carries the same boxes as its Sign In: turned over first,
+            // so the visible boxes found below are the sign-in's (#450).
+            var typed = IsWorkday(host) || await LooksLikeWorkdayAsync(Page);
+            if (typed) await FlipWorkdayCreateAccountToSignInAsync(Page);
             ILocator? userBox = null;
             foreach (var sel in new[]
                      {
@@ -1212,7 +1242,6 @@ private async Task<bool> TrySignInAsync(BoardAccount? with = null)
             }
             // Workday's form takes what is typed, key by key, every time; a fill — the value set
             // in one go — it sometimes never hears, and Sign In then sends nothing (#443).
-            var typed = IsWorkday(host) || await LooksLikeWorkdayAsync(Page);
             if (typed)
             {
                 await userBox.ClickAsync(new() { Timeout = 5_000 });

From 1330a334b094bac8c5907778819003d2cc7cfdfd Mon Sep 17 00:00:00 2001
From: "Aaron K. Clark" <cryptojones@owasp.org>
Date: Tue, 13 Oct 2026 05:21:46 -0500
Subject: [PATCH 2/2] chore: prepare v1.68.3 release

Bump all five version files to 1.68.3 and add #450 to BACKLOG.md.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015Xrsyx9xJYfnT2BzLMNFsB
---
 .env.production.example                  | 2 +-
 BACKLOG.md                               | 1 +
 api/ApplyTrack.Api/ApplyTrack.Api.csproj | 2 +-
 pyproject.toml                           | 2 +-
 src/applytrack/__init__.py               | 2 +-
 uv.lock                                  | 2 +-
 6 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/.env.production.example b/.env.production.example
index bd24c4e..4d700f2 100644
--- a/.env.production.example
+++ b/.env.production.example
@@ -1,7 +1,7 @@
 # Production deployments intentionally have no working secret defaults.
 # Copy this file to .env.production, replace every CHANGE-ME value, keep the
 # result out of version control, and pin a released OSApplyTrack version.
-OSAPPLYTRACK_VERSION=1.68.2
+OSAPPLYTRACK_VERSION=1.68.3
 POSTGRES_USER=applytrack
 POSTGRES_PASSWORD=CHANGE-ME-use-a-long-random-password
 POSTGRES_DB=applytrack
diff --git a/BACKLOG.md b/BACKLOG.md
index efb9332..6027616 100644
--- a/BACKLOG.md
+++ b/BACKLOG.md
@@ -178,6 +178,7 @@ review items and unsupported forms still need human attention.
 - [x] [#443 — Agent: drive Workday's application wizard end to end](https://github.com/CryptoJones/OSApplyTrack/issues/443) (`BrowserCanSubmit` refused Workday, so #277's account recipe never got a run to fire in; NVIDIA JR2023533 was walked by hand on 2026-10-12. **1.68.0:** Workday is driven. The application starts at the manual flow (`…/apply/applyManually`, never the résumé autofill, whose parse explodes an "earlier roles" list into rows with no company); the way in presses Apply Manually and "Sign in with email" — the password box sits behind that choice — and the sign-in types the saved account key by key (a fill Workday sometimes never hears), presses the click_filter overlay beside the aria-hidden Sign In, waits for a complaint rather than a spinner, and loads the address again afterwards, because a sign-in from inside the flow draws "Something went wrong — please refresh". A step is read only once its controls have held still (the address and phone arrive a second after the names). Discovery and the sweep now see Workday's drop-down buttons (`aria-haspopup=listbox`, named by their label, their group, or — for a named button — the text above them), its search boxes (chips beside the input are the answer, committed with Enter), and radio groups required on their wrapper; the page header's own menus are never questions. The walk reads each step's menus so a question handed back carries its choices, ticks the terms box, attaches the résumé to the file input the packet never saw, declines a demographic drop-down Workday requires an answer to (never a guess), leaves a question the draft already answers alone, waits out the Save and Continue Workday disables while it autosaves, and hands back only starred fields when Next stays disabled. My Experience's Work Experience and Education rows are filled from the structured résumé (three jobs, every school: title, company, month/year spinbuttons, "I currently work here", description; school, Degree menu, Field of Study, years) and rows a draft already holds are completed, not duplicated. A long menu (Country) is typed at so the listbox jumps to the entry. The drafter's phone rule no longer answers "Phone Device Type" with the number. Verified live on nvidia.wd5 as a dry run: three rounds — page 2's rows and page 3's authorization pair handed back and answered — then every step to Review.)
 - [x] [#446 — Agent role cannot write board_accounts: every judging pass has died since 2026-10-10](https://github.com/CryptoJones/OSApplyTrack/issues/446) (`agent_role.sql` granted the agent INSERT/UPDATE on its own tables but not on `board_accounts`, which it writes when it takes a Sign in now, keeps a renewed session, or saves an account #277 just made; `RenewSessionsAsync` runs before the judging pass, so once greenhouse.io's session came due the pass died on every tick and the Ready reconciler, the verdicts and portal renewal all stopped — the last `agent_events` row was 2026-10-09. **1.68.1:** the grant is re-applied on boot, and `DbRoleTests` proves the three writes and that a delete is still refused.)
 - [x] [#448 — Account creator glances for Workday's Apply instead of waiting: finastra.wd3 gets "no Create Account form after Apply"](https://github.com/CryptoJones/OSApplyTrack/issues/448) (the first Workday run after #446, finastra.wd3 on 2026-10-13: `RegisterWorkdayAsync` pressed Apply and Apply Manually with a glance the instant the posting's HTML landed, and Workday draws Apply only once its script has run — ~8 s there — so nothing was pressed and no form came; step 1 of the flow is fetched after the flow page is drawn too, blank for ~7 s. **1.68.2:** each step of the way in is waited for — Apply, Apply Manually, then whichever of Create Account, Sign In or "Sign in with email" the tenant shows, with 30 s for the lazy step — and the fixture draws Apply and the form late so a glance fails the test.)
+- [x] [#450 — Workday tenants that open step 1 on Create Account: the saved password is typed into Create Account and the sign-in is judged refused (finastra.wd3)](https://github.com/CryptoJones/OSApplyTrack/issues/450) (after #448 the creator made, proved and saved a finastra.wd3 account, and the re-run was "refused": Finastra's step 1 opens on Create Account — the same email and password boxes as Sign In plus Verify New Password and a "Sign In" link — so the saved account was typed into Create Account and the link pressed as the sign-in button, flipping the form empty. **1.68.3:** the way in waits up to 30 s for whatever step 1 shows, turns a Create Account over to Sign In through its link before any typing, and the same guard runs where the walk's own sign-ins start; a fixture variant that opens on Create Account, drawn late, signs in through the link and reaches Review.)
 - [x] [#417 — Agent: a résumé dropzone whose wrapping label is only "Click or drag & drop PDF" is never recognised as the résumé (Ethos) — fixed in 1.67.0: dropzone text never names a file field; its row's title does](https://github.com/CryptoJones/OSApplyTrack/issues/417)
 - [x] [#418 — Agent: an application form folded behind "Easy Apply" is never revealed (N-iX) — fixed in 1.67.0: "Easy/Quick/One-click Apply" open the form (N-iX itself then ends at a reCAPTCHA v2 handoff)](https://github.com/CryptoJones/OSApplyTrack/issues/418)
 - [x] [#419 — Agent: a footer newsletter signup (mc4wp) is discovered as an application question (Tecbrains) — fixed in 1.67.0: newsletter forms are page widgets](https://github.com/CryptoJones/OSApplyTrack/issues/419)
diff --git a/api/ApplyTrack.Api/ApplyTrack.Api.csproj b/api/ApplyTrack.Api/ApplyTrack.Api.csproj
index 450f8ef..0488731 100644
--- a/api/ApplyTrack.Api/ApplyTrack.Api.csproj
+++ b/api/ApplyTrack.Api/ApplyTrack.Api.csproj
@@ -5,7 +5,7 @@
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
     <RootNamespace>ApplyTrack.Api</RootNamespace>
-    <Version>1.68.2</Version>
+    <Version>1.68.3</Version>
     <Authors>Aaron K. Clark</Authors>
     <Copyright>Copyright 2026 Aaron K. Clark</Copyright>
     <PackageLicenseExpression>Apache-2.0</PackageLicenseExpression>
diff --git a/pyproject.toml b/pyproject.toml
index 9dcd882..3a6fe17 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "applytrack-poller"
-version = "1.68.2"
+version = "1.68.3"
 description = "Discovery poller for OSApplyTrack — fetches and scores remote job leads into shared Postgres."
 requires-python = ">=3.10"
 license = { text = "Apache-2.0" }
diff --git a/src/applytrack/__init__.py b/src/applytrack/__init__.py
index b2f0824..2f00b1f 100644
--- a/src/applytrack/__init__.py
+++ b/src/applytrack/__init__.py
@@ -2,4 +2,4 @@
 # Copyright 2026 Aaron K. Clark
 """applytrack — a local, markdown-backed job-application tracker."""
 
-__version__ = "1.68.2"
+__version__ = "1.68.3"
diff --git a/uv.lock b/uv.lock
index f839574..3fbe879 100644
--- a/uv.lock
+++ b/uv.lock
@@ -43,7 +43,7 @@ wheels = [
 
 [[package]]
 name = "applytrack-poller"
-version = "1.68.2"
+version = "1.68.3"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography" },