fix: refresh dependencies with a compatible pyee pin

.github/requirements-security.txt

@@ -1,3 +1,3 @@
 bandit==1.9.4
 pip-audit==2.10.1
-ruff==0.17.1
+ruff==0.17.3

CHANGELOG.md

@@ -9,8 +9,21 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+### Fixed
+
+- Native phased login accepts final sessions after any submission and skips
+  optional phases when a later state is proven. Preserve one durable attempt,
+  fresh OTP resolution and verification-only resume.
+
 ### Changed
 
+- Refresh runtime and test dependency pins, including Playwright 1.64.1.
+  Keep pyee 13.0.1 within Playwright's required >=13,<15 range so the
+  dependency batch installs successfully.
+
+- Update pypdf to 6.21.4 for seven security fixes. Align the packaged image
+  qualifier and parser documentation; preserve the `pdf-graph-v1` revision rule.
+
 - Separate durable login and document request pacing via generic engine gates. Preserve the Bourse Direct 60-second login floor; configure document pacing through Settings (default 5 seconds). No DB or recipe schema change.
 - Download All uses the recipe history limit; incremental collection keeps its
   task date window. Install the Bourse Direct recipe from the recipe catalog.
@@ -29,6 +42,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Added
 
+- Explicit `bourse_direct_adapter` catalog boundary with native login, fixed run
+  dates, C3 load/save/run-start validation, frozen trusted source and bounded
+  authenticated original reads. Existing `bourse_direct` catalogs keep their
+  current contract. The additive recipe schema must be compared and explicitly
+  promoted by Infra before a new catalog action is adopted. Provider
+  qualification and deployment remain separate.
+
 - One Infra runtime contract for consume-folder delivery, exact vault lookup,
   schema promotion, DB/configuration handoffs and daemon-path qualification.
   Provider docs and harness boundaries now refer to it. No runtime, recipe-schema

Dockerfile

@@ -61,6 +61,10 @@ COPY --chown=${APP_UID}:${APP_GID} apps/. .
 # non-root app user
 RUN mkdir -p /apps/Downloads "$HOME" && chown -R ${APP_UID}:${APP_GID} /apps "$HOME"
 
+# Trusted catalog application code must not be group/world writable.
+RUN find /apps/recipes_playwright -type f -name 'bourse_direct_adapter.py' \
+    -exec chmod go-w {} +
+
 # Keep the schema available when recipes are mounted as mutable configuration.
 COPY apps/recipes_playwright/recipe-pw-schema.yaml /opt/billcollector/recipe-pw-schema.yaml
 

README.md

@@ -22,7 +22,7 @@ Compose service includes a pinned seccomp profile. See
     - [Vault of Secrets](#vault-of-secrets)
     - [Enabling DNS and HTTPS with Let's Encrypt certs](#enabling-dns-and-https-with-lets-encrypt-certs)
   - [Installing the Daemon](#installing-the-daemon)
-  - [Pause notifications (ntfy)](#pause-notifications-ntfy)
+  - [Notifications (ntfy)](#notifications-ntfy)
 - [Daemon Mode](#daemon-mode)
   - [Environment Variables](#environment-variables)
   - [Container Semantics](#container-semantics)
@@ -224,7 +224,7 @@ Now that we have done a good job installing all the prerequisites, we are focusi
 
 8. Collect your first document: on the **Dashboard** press **Run now** for an enabled task - watch the run live (session page, noVNC tab) until it reaches `success`; the document appears on the Downloads page and in the consumer folder. Every step is driven from the browser, no shell access to the daemon needed.
 
-### Pause notifications (ntfy)
+### Notifications (ntfy)
 
 A fresh installation sends no notifications: the `ntfy topic` setting (`ntfy_topic` in Settings) starts empty. Paused runs, blocked logins, and failed or interrupted daemon runs only push when you set a topic. To opt in, open **Settings** and set an **ntfy topic** - choose your own topic name, it is the install-specific destination the pushes are sent to.
 
@@ -298,7 +298,7 @@ All pages require sign-in (a session cookie set on `/login`).
 - **Dashboard** (`/`) - all tasks with their status (color-coded, `waiting` rows highlighted), last/next run, latest download, a Login column (available / pending / blocked for tasks with a phased login), and a `[N waiting]` badge for paused runs; a live log pane following the active run and a step-screenshot strip; per row **Run now** (works for disabled tasks as a manual one-off, schedule untouched; disabled while the login is blocked), **Stop**, and **Edit** (cron + enabled); toolbar **Run (filtered)** (enqueues all enabled tasks in the filtered set, skipping blocked ones) and **Add task**.
 - **Task detail** (`/tasks/<id>`) - the run history of one task with the per-step records, step screenshots, and downloads; for a phased login the budget state (unproven attempts / limit) and, while idle and locked, a **Clear login block** button (grants exactly one further attempt, profile and schedule preserved).
 - **Session** (`/runs/<id>`) - the live view of one run (the ntfy deep-link target): while it runs, you watch the progress; while it is paused, you get the "Copilot" view - a screenshot, the numbered interactive elements, click/fill/press/drag actions, and Resume / Cancel - plus a noVNC tab that shows the actual browser window. A step that failed and paused also offers a Repair link into the recipe editor.
-- **Recipe editor** (`/recipes/<service>`) - edit the YAML recipe with schema validation, and optionally auto-commit the change to git (Settings switch).
+- **Recipe editor** (`/recipes/<service>`) - edit the YAML recipe with schema and method-chain validation (see [recipe method contract](doc/RECIPE_METHODS.md)), and optionally auto-commit the change to git (Settings switch).
 - **Downloads** (`/downloads`) - the downloaded files of all runs; a file whose sha256 was already seen for the same task is marked as a duplicate (the consumer hook is not re-run for it). See [download recovery](doc/DOWNLOAD_RECOVERY.md) for staged publication, recovery and the at-least-once consumer contract.
 - **Settings** (`/settings`) - UI password, ntfy topic, pause deadline, max concurrency, display start, download directory, UI base URL, VNC password, the vault API URL/host, and the git auto-commit switch. Each field writes its own Settings row on save, so an invalid value only fails that field.
 
@@ -356,7 +356,8 @@ The BillCollector configuration for each web service from which you want to retr
      - One recipe per web portal identified by the yaml element `serviceName` and its filename `recipe-pw__<serviceName>`.
      - Each recipe is structured in numbered `steps`, executed in ascending `step` order.
      - Each step is a chain of `methods`: Playwright Page/Locator calls executed in order. Locator methods (`locator` for CSS selectors, `get_by_role`, `get_by_label`, `get_by_text`, `get_by_title`, `get_by_placeholder`, `get_by_test_id`) yield a locator that is chained into the following action (`click`, `fill`, `press`, `first`). Page-level methods include `goto` (open the start URL), `content_frame` (enter an iframe) and `close`.
-     - Downloads: a step with the `expect_download` method wraps the nested `steps` that trigger the download; the file is saved into the Downloads folder. A re-downloaded file that is byte-identical to one already tracked for the same task (same sha256) is recorded as a duplicate and the consumer hook is not re-run for it.
+     - Downloads: a step with the `expect_download` method wraps the nested `steps` that trigger the download; the file is saved into the Downloads folder. A re-downloaded file that is byte-identical to one already tracked for the same task (same sha256) is recorded as a duplicate and the consumer hook is not re-run for it. An opt-in `notice_identity` step option switches a download step from byte-hash deduplication to source-scoped identity plus a conservative PDF revision digest; see [notice identity](doc/NOTICE_IDENTITY.md).
+     - Catalog adapter: use the standalone daemon-only [`bourse_direct_adapter` action](doc/BOURSE_DIRECT_ADAPTER.md) after native login. The existing locator-prefixed `bourse_direct` catalog contract remains separate.
      - Bounded pagination: use one page locator followed by `click_until_absent`. Its single options object requires `progress_selector`, `max_clicks`, and `timeout_ms`. `timeout_ms` is the total browser-action budget. Every click must increase the visible progress count or make the pager absent or hidden. This action supports cumulative "load more" controls. It rejects page-replacement pagination and virtualized lists because their visible item count does not increase. For monthly replacement calendars, use the daemon's [replacement_calendar action](doc/REPLACEMENT_CALENDARS.md).
      - Bounded collections: use one page locator followed by `download_all`. Its single options object requires `key_attribute`, `max_items`, `timeout_ms`, and `event_window_ms`. `timeout_ms` bounds the browser actions and observations for the whole collection. Persistence (`save_as`, hashing, consumers, and SQLite) remains synchronous and cannot be preempted by that browser deadline. `event_window_ms` is the full attribution window observed after each click, so `timeout_ms` must exceed the actual item count multiplied by `event_window_ms`, with additional time for browser actions. The engine reports the required and remaining budgets before its first click when the minimum attribution-window budget cannot fit. The key must be non-empty and unique for every item. The ordered key set must remain stable while each control produces exactly one download. `download_all` also rejects a suggested filename already saved earlier in the run instead of overwriting it.
      - Incremental collections: `"incremental": true` in the `download_all` options records each item key (`<key_attribute>=<key>`) with its download. Later runs of the same task skip known keys without clicking them, so only the first run collects everything. Use it only with a key that is stable per document across sessions (for example an invoice number); a constant or session-bound key misses or repeats documents. `"unpack": "pdf"` publishes the single PDF member of a ZIP download unchanged under its member name and deduplicates on the PDF; any other archive content fails without publication. Both options require the daemon runner.
@@ -386,8 +387,8 @@ The BillCollector configuration for each web service from which you want to retr
        exact-key credential substitution remain unchanged.
      - `graceful: true` on a step: a failure of that step is recorded (log + DB) and the run continues with the next step; without it, a failure aborts the service's run (after three attempts, in daemon mode the run pauses for your help instead - see [Using the Web UI](#using-the-web-ui)).
      - A `wait_user` step: an explicit pause point for operator input (e.g., a CAPTCHA you have to solve by hand). It can carry an optional `prompt` and an optional `until` locator (the pause completes when that element appears, or on resume); the step is consumed, not re-executed.
-     - There is a YAML schema named `recipe-pw-schema.yaml` which includes the rules to be followed by the YAML recipes.
-   - In daemon mode the recipe can also be edited in the UI [recipe editor](#using-the-web-ui) (schema validation, optional git auto-commit) - handy when a portal changes and a paused run links you straight to the failing recipe.
+     - There is a YAML schema named `recipe-pw-schema.yaml` which includes the rules to be followed by the YAML recipes. In daemon mode, validation goes beyond the schema: every method chain is checked against the installed Playwright (method names, argument names and types, properties, reserved `wait_user` options), and unknown methods and unsupported variables are rejected before vault or browser access, with errors that identify the service and step without argument values - the supported surface is documented in the [recipe method contract](doc/RECIPE_METHODS.md).
+   - In daemon mode the recipe can also be edited in the UI [recipe editor](#using-the-web-ui) (schema and method-chain validation, optional git auto-commit) - handy when a portal changes and a paused run links you straight to the failing recipe.
 
 > 💡 **Tip**  
 > When creating new recipes, make use of AI, e.g., let yourself be helped by Copilot - that speeds up creating the YAML recipe 🚀.

apps/BillCollectorServices_pw.py

@@ -285,7 +285,7 @@ def run_step(step, *, nested=False):
                             if isinstance(entry, dict)
                         }
                         if nested and methods & {
-                            "click_until_absent", "download_all", "replacement_calendar"
+                            "click_until_absent", "download_all", "replacement_calendar", "bourse_direct_adapter"
                         }:
                             raise StepAbortError(
                                 "bounded collection actions cannot be nested "
@@ -459,7 +459,7 @@ def transform_step_to_json(step):
 
     if graceful and any(
         isinstance(entry, dict)
-        and entry.get("method") in {"click_until_absent", "download_all", "replacement_calendar"}
+        and entry.get("method") in {"click_until_absent", "download_all", "replacement_calendar", "bourse_direct_adapter"}
         for entry in methods
     ):
         message = "bounded collection actions cannot be graceful"