---
name: crm-bmby-browser-reader
description: "Read Bmby CRM source and lead reports through an authorized workspace browser session with verified project Source Label composition, dates, loading and hierarchy reconciliation. Use as a shared CRM extraction capability for reporting; never infer source mappings, guess project IDs, or mutate CRM records."
---

# Bmby browser reader

**Version:** 1.1.0-rc.3. Reconstructed from supplied browser specification and the explicitly approved
Source Label control; new package live execution remains NOT_PROVEN until tested per workspace.

This is a platform extraction capability, not report business logic or general access doctrine.
Use `outloop-access-fallback` for actual browser selection and managed login; browser tools listed
in a session do not prove the authorized profile is live.

1. Load the approved workspace binding and expected Bmby project identity/Source Label composition
   from tenant truth. Use its approved profile. Never guess, enumerate or probe project IDs.
2. Open only the approved start resource, check session/login state, and navigate by observed
   semantic labels to the requested source/lead report. See [the extraction contract](references/extraction.md).
3. After the view loads, verify the expected Source Label composition and absence of known foreign
   labels using `identity_control` in `scripts/validate_extract.py`. Do not consume/persist returned client report data
   until the approved control passes. No deliberately opening another client for tests.
4. When live tenant policy approves Source Label verification with the workspace/profile binding,
   that control is sufficient for report identity. Without that approval, remain unverified.
   Do not impose a dedicated user/profile or stronger pre-read signal as a new activation blocker.
   This is a scoped approved control, not a guarantee of physical tenant isolation. Empty/ambiguous
   evidence is unresolved, not automatic PASS. On mismatch use `BROWSER_RESOURCE_MISMATCH`.
5. Set exact dates/filters, wait for a completion signal and confirm rendered dates match the request.
   Detect stale results and partial/asynchronous loading before extracting counts. Bounded retries
   must change a meaningful condition; don't loop endlessly.
6. Extract raw labels and approved count fields with hierarchy levels. Reconcile top-level totals
   without summing parent and child rows together. Aggregate `--`/blank rows aren't media channels.
   Preserve duplicates vs unique/effective definitions exactly; don't invent relevance or mappings.
7. Return normalized counts, raw labels, exact window/timezone, capture stamp, identity-control
   evidence, completeness/reconciliation and any missing data. Business consumers own attribution.

No Bmby write path is claimed proven by this reader. A session-expiry recovery re-verifies identity.
A UI change uses semantic rediscovery on the approved resource, not random unrelated navigation.