feat(forms): gate Form A production embedding

www/reports/SESSION_HANDOFF.md

@@ -172,6 +172,7 @@ trusted-source comparison. No insecure retrieval was repeated.
 - Form A (`262946078314059`) is implemented only in a non-indexing, seven-route `isolated-test` adapter: `/contact`, `/es/contact`, the four campaign landing routes and `/lp/early-intervention`. The five landing journeys use fixed `formContext=landing&language=en`, superseding only their earlier Form B mapping. Form B remains for the other service-consultation journeys; Form C remains professional referrals.
 - Owner-confirmed direct-Jotform evidence covers synthetic EN/ES submission, native thank-you, conditional email/language, generic no-answer/no-PDF staff notification, autoresponder delivery, corrected fixed Reply-To, no webhooks/integrations, privacy scope, recipient access and retention. The owner also reports successful Astro-iframe synthetic submission and confirmation on English contact, Spanish contact and one ABA landing placement; record the exact third route before release. Functional submission acceptance is complete only for those owner-reported samples. All-seven-route accessibility, runtime-network/telemetry, deployment and site-release acceptance remain open.
 - The adapter retains fixed URLs, responsive fixed heights, `no-referrer`, `allow-forms allow-scripts allow-same-origin`, no helper script, and a hosted fallback that is hidden without space until a 15-second missing-load timeout. A frame load only clears that timeout; it does not prove cross-origin application health or accepted submission. The official Jotform resizing handler is conditionally acceptable pending separately authorized source, origin, privilege, Firefox and error-state verification; it is not implemented. Fixed heights remain current.
+- A separate local production gate is prepared for Form A only. It requires `PUBLIC_AIA_FORMS_MODE=live`, `PUBLIC_AIA_FORMS_LIVE_APPROVED=true`, `PUBLIC_AIA_FORMS_ENVIRONMENT=production` and `PUBLIC_AIA_FORM_A_PRODUCTION_APPROVED=true`; the fixed seven-route allowlist remains enforced. `PUBLIC_ALLOW_INDEXING=true` permits an indexing-enabled release artifact but never authorizes a form. Normal/off/mock/isolated behavior remains fail-closed, and Forms B/C, service drawers, analytics and API forwarding remain inactive. Marketing-only notification routing is a pre-cutover operational check. Rolling back Form A means rebuilding with mode `off` or an absent approval value and switching only the static artifact; it does not alter Jotform.
 
 The indexing-enabled build has 127 HTML routes/canonicals and 109 sitemap URLs.
 Normal staging has 128 `noindex,nofollow` pages because it also contains `/lp`;

www/reports/phase-10-technical-readiness-package-2026-10-22.md

@@ -49,7 +49,7 @@ The final normal staging build was restored after the indexing build. The explic
 1. Record a locked Node/npm/toolchain and reproducible artifact manifest.
 2. Obtain sanitized Contabo/NixOS/nginx/TLS/DNS/Cloudflare facts.
 3. Verify host-local serving, canonical host, redirects, 404s, cache headers and rollback on an approved staging host.
-4. Complete Jotform Builder verification, blank-form creation, off/mock testing and privacy/security review before live IDs are mapped.
+4. Form A has owner-reported functional acceptance and a local production gate, but still needs exact release-environment review, all-seven-route accessibility acceptance, runtime telemetry/privacy review, marketing-recipient operational review and no-deployment static-artifact verification. Forms B/C remain unimplemented. Use Form A only when all four explicit build settings are approved: `PUBLIC_AIA_FORMS_MODE=live`, `PUBLIC_AIA_FORMS_LIVE_APPROVED=true`, `PUBLIC_AIA_FORMS_ENVIRONMENT=production`, and `PUBLIC_AIA_FORM_A_PRODUCTION_APPROVED=true`. `PUBLIC_ALLOW_INDEXING=true` is publication behavior only.
 5. Obtain P9-04 counter origin/credential/consent approval before a live adapter.
 6. Resolve P9-05 analytics/advertising measurement and P9-07 privacy/legal approval.
 7. Obtain P9-06 clinical/organizational and fluent-language approvals, including Arabic diagrams and Spanish HSA/FSA claims.

www/reports/phase-9-form-a-production-gate-2026-10-28.md

@@ -0,0 +1,54 @@
+# Phase 9 — Form A production-gate preparation
+
+**Recorded:** 2026-10-28 UTC
+**Scope:** local Astro configuration and static artifact verification for Form A (`262946078314059`)
+**Status:** prepared locally; no environment was enabled, deployed or contacted.
+
+## Required release configuration
+
+The Form A iframe resolver enables an iframe only when every value below is present at build time:
+
+```sh
+PUBLIC_AIA_FORMS_MODE=live
+PUBLIC_AIA_FORMS_LIVE_APPROVED=true
+PUBLIC_AIA_FORMS_ENVIRONMENT=production
+PUBLIC_AIA_FORM_A_PRODUCTION_APPROVED=true
+```
+
+`PUBLIC_ALLOW_INDEXING=true` is required for an indexing-enabled release artifact but is not an authorization gate. It cannot enable Form A by itself. Missing, invalid or mismatched values render the existing off-mode presentation.
+
+The live gate accepts exactly seven routes: `/contact`, `/es/contact`, `/lp/aba-therapy`, `/lp/aba-insurance`, `/lp/aba-ahcccs`, `/lp/aba-private-pay`, and `/lp/early-intervention`. It preserves fixed `formContext` and locale values, fixed heights, `no-referrer`, `allow-forms allow-scripts allow-same-origin`, the first-party conditional hosted fallback and the fixed direct hosted URL.
+
+## Deliberate exclusions
+
+The production gate does not activate Forms B or C, service drawers, client consultation, referral workflows, native form actions, Jotform helper scripts, browser storage, Contabo forwarding, webhooks, analytics, advertising or production counters. Submissions remain direct browser-to-Jotform; Astro does not inspect the cross-origin frame or infer a conversion from a load event.
+
+## Artifact and network verification
+
+The production artifact verifier requires the exact Form A URL on each approved route and rejects Form A identifiers elsewhere. It rejects live Form A output in normal staging and plain indexing validation. The guarded browser runner accepts a `production` test mode but intercepts every non-loopback request before transmission; it records the attempted Jotform GETs and rejects POST, DELETE, WebSocket, API, analytics and advertising activity.
+
+### Local results — 2026-10-28
+
+- `astro check`: 137 files, zero diagnostics.
+- Focused Form A, nonproduction and artifact tests: 20 passing tests, including production-gate and isolated-test artifact fixtures.
+- Production-gated indexing artifact: 127 HTML routes, 109 sitemap URLs, 180 hreflang links, no `/lp` review index and exactly seven fixed Form A frames. The artifact verifier passed.
+- Guarded Chromium production-gate run: 35 responsive/no-JavaScript checks across the seven routes at 320, 390, 768 and 1440px, plus four fallback-state checks. It recorded 38 attempted Jotform **GET** loads and blocked all 62 non-loopback requests before transmission; it made no form write, API, analytics or advertising request.
+- Guarded Chromium isolated-test run: the same 35 checks and four fallback-state checks passed. Its 38 attempted Jotform **GET** loads were likewise blocked before transmission.
+- Guarded Chromium off and mock runs: 28 route/viewport checks each passed. Neither emitted a Jotform request or iframe.
+
+These are repository-side rendering and gate checks only. They do not reproduce the owner-reported direct or embedded synthetic submissions, inspect a cross-origin frame, or establish a deployed-environment acceptance.
+
+## Operational checks before cutover
+
+1. The release and hosting owners must compare the sanitized production environment to the four required settings above.
+2. Confirm marketing-only notification routing remains intentional. This repository does not change notification recipients.
+3. Record the exact ABA landing route used in the owner-reported embedded synthetic test.
+4. Complete all-seven-route responsive, keyboard, screen-reader, language, validation-error and fallback acceptance.
+5. Review Jotform runtime requests, telemetry, CSP, referrer and static-host logging with privacy/security owners.
+6. Build both normal staging and the gated indexing-enabled release artifact, then run the artifact verifier and guarded browser test before release authorization.
+
+## Rollback
+
+Set `PUBLIC_AIA_FORMS_MODE=off` or remove any required live approval/environment value. Rebuild, verify the artifact contains no Form A iframe or identifier, and atomically switch to that reviewed static artifact. This disables the Astro embedding without changing the live site content or the Jotform account. It is not a substitute for the separate site rollback and Phase 10 release procedure.
+
+No Jotform settings, forms, submissions, recipient routes, production API, DNS, hosting configuration, analytics or advertising were modified by this preparation.

www/reports/phase-9-jotform-implementation-plan-2026-10-18.md

@@ -1,11 +1,13 @@
 # P9-03 source-specific implementation plan
 
-Date: **2026-10-18** · Plan version **1.5 revision 2026-10-28** · Governing contract: [P9-03-JF-2026-10-18 v1.5](phase-9-jotform-integration-contract-2026-10-18.md).
+Date: **2026-10-18** · Plan version **1.6 revision 2026-10-28** · Governing contract: [P9-03-JF-2026-10-18 v1.6](phase-9-jotform-integration-contract-2026-10-18.md).
 
 **Planning only. Do not execute any batch from this document without separate authorization.** Phase 9 establishes decisions and bounded implementation authority. Phase 10 retains final production integration acceptance, rollback and cutover. The user stages, signs and pushes.
 
 > **Form A reconciliation — 2026-10-28 (current implementation evidence, no production release approval):** Form A — **AIA | Website | General Enquiries** (`262946078314059`) has owner-confirmed direct EN/ES synthetic submission, native thank-you, generic no-answer/no-PDF staff notification, autoresponder delivery, fixed hidden Reply-To, no-webhook/integration, conditional-email and language evidence. The owner also reports successful isolated Astro-iframe synthetic submission and confirmation on English contact, Spanish contact and one ABA landing placement; record that third route explicitly before release rather than inferring it. This completes functional submission acceptance for the reported samples, not seven-route responsive, accessibility, telemetry/privacy, deployment or site-release acceptance. Its hidden presentation field is **Advanced → Field Details → Unique Name = `formContext`** (exact case). The current Astro adapter is implemented only for gated, non-indexing isolated tests: `/contact`, `/es/contact`, `/lp/aba-therapy`, `/lp/aba-insurance`, `/lp/aba-ahcccs`, `/lp/aba-private-pay`, and `/lp/early-intervention`; the five landing journeys now use fixed `formContext=landing`, superseding their earlier Form B mapping. Forms B and C remain planned; their field keys and IDs must not be guessed.
 
+> **Production-gate addendum — 2026-10-28:** The local adapter now also supports the same seven Form A placements only when `PUBLIC_AIA_FORMS_MODE=live`, `PUBLIC_AIA_FORMS_LIVE_APPROVED=true`, `PUBLIC_AIA_FORMS_ENVIRONMENT=production`, and `PUBLIC_AIA_FORM_A_PRODUCTION_APPROVED=true` are all set. This is a build-time configuration contract, not a deployed environment or site-release authorization. It leaves Forms B/C, drawers and every unrelated lead surface in their off/mock path. An indexing-enabled release artifact is compatible with the gate, but `PUBLIC_ALLOW_INDEXING` never enables a form.
+
 ## 1. Actual baseline and reconciliation
 
 Verified `faithful-astro-migration`, HEAD `59911eb929579af7bcd6c42de6476128dab62289`, clean tracked tree and empty index. Three October 17 untracked inventory artifacts exist, alongside the five exclusions and `.phase8-stage-paths.nul`. No unexpected implementation change was found. The prior 27-row owner worksheet remains blank; the current supplied connector summary is not silently written into it.
@@ -240,3 +242,5 @@ Version 1.3, 2026-10-27: records owner-confirmed Form A configuration evidence f
 Version 1.4, 2026-10-28: reconciles owner-confirmed direct Form A runtime evidence and the implemented seven-route isolated iframe adapter. The five landing routes now use Form A under the isolated-test gate, superseding their earlier Form B mapping; Form B remains for other service-consultation journeys. Direct tests do not close embedded-iframe, runtime/privacy, accessibility or production gates.
 
 Version 1.5, 2026-10-28: records owner-reported embedded synthetic submission and confirmation on the English and Spanish contact routes plus one ABA landing placement. It completes Form A functional submission acceptance for the reported samples, while retaining route-specific confirmation, all-seven-route responsive/accessibility, runtime/privacy, deployment and release gates.
+
+Version 1.6, 2026-10-28: adds the exact production-gate configuration for Form A and its seven fixed placements. It does not activate an environment, change the Jotform account, map Forms B/C, or authorize a production release.

www/reports/phase-9-jotform-integration-contract-2026-10-18.md

@@ -1,10 +1,10 @@
 # P9-03 Jotform integration contract
 
-**Contract ID:** P9-03-JF-2026-10-18 · **Version:** 1.5 · **Decision revision:** 2026-10-28
+**Contract ID:** P9-03-JF-2026-10-18 · **Version:** 1.6 · **Decision revision:** 2026-10-28
 
-**Status: documented planning architecture; implementation and activation NOT authorized.**
+**Status: Form A owner-approved; production-gated adapter prepared locally; deployment and site release NOT authorized.**
 
-This is the authoritative P9-03 planning contract for the owner decisions supplied on October 18 and revised through October 28. It supersedes conflicting *proposals* in the [October 17 inventory](phase-9-form-entry-point-inventory-2026-10-17.md), without rewriting that historical record. It does not supersede project policy, approve clinical/legal content beyond the Form A configuration scope recorded below, close the Phase 9 register, or authorize production changes. Future changes require an explicit owner decision, a version/change record and evidence links. Version 1.0 records the original planning instruction; version 1.1 adds the owner-supplied complete roster; version 1.2 supersedes the copy-based Form B proposal with three new blank forms; version 1.3 records limited owner-confirmed Form A configuration evidence; version 1.4 reconciles completed direct-Jotform testing and the seven-route isolated iframe adapter; version 1.5 records owner-reported embedded synthetic acceptance for sampled routes without treating it as seven-route release acceptance. No future commit SHA is invented.
+This is the authoritative P9-03 planning contract for the owner decisions supplied on October 18 and revised through October 28. It supersedes conflicting *proposals* in the [October 17 inventory](phase-9-form-entry-point-inventory-2026-10-17.md), without rewriting that historical record. It does not supersede project policy, approve clinical/legal content beyond the Form A configuration scope recorded below, close the Phase 9 register, or authorize production changes. Future changes require an explicit owner decision, a version/change record and evidence links. Version 1.0 records the original planning instruction; version 1.1 adds the owner-supplied complete roster; version 1.2 supersedes the copy-based Form B proposal with three new blank forms; version 1.3 records limited owner-confirmed Form A configuration evidence; version 1.4 reconciles completed direct-Jotform testing and the seven-route isolated iframe adapter; version 1.5 records owner-reported embedded synthetic acceptance for sampled routes; version 1.6 adds the independent production-build gate without deploying it. No future commit SHA is invented.
 
 Companions: [source-specific implementation plan](phase-9-jotform-implementation-plan-2026-10-18.md), [verification and approval ledger](phase-9-jotform-verification-checklist-2026-10-18.csv).
 
@@ -67,7 +67,7 @@ The owner additionally reports successful synthetic submission and native confir
 
 The remaining four or five landing placements, depending on the exact sampled ABA route, have automated rendering and fixed-URL coverage only. The current adapter is restricted to the seven placements listed in section 5 and to a separately gated, non-indexing `isolated-test` build. Its frame `load` event is only a transport signal; it is never treated as Jotform initialization, an accepted submission, or a conversion.
 
-Open Form A gates are therefore: final responsive, keyboard, screen-reader and fluent-language acceptance across all seven placements; Jotform runtime/network and telemetry privacy review; deployment/hosting acceptance; and final site-release authorization.
+The production-gated adapter is now prepared in the repository, but no deployment environment is configured by this record. Open Form A gates are therefore: final responsive, keyboard, screen-reader and fluent-language acceptance across all seven placements; Jotform runtime/network and telemetry privacy review; marketing-recipient operational review; deployment/hosting acceptance; and final site-release authorization.
 
 ## 3. Account assets and accounting for all 27
 
@@ -228,7 +228,7 @@ Suggested semantic setting: `PUBLIC_AIA_FORMS_MODE`, exact values `off`, `mock`,
 | off | No active lead form/empty POST action, live iframe, Jotform preconnect/helper/network request, or analytics. Render approved localized contact fallback; no native-submit bypass on inactive lead UI |
 | mock | Synthetic local-only fixture, no external endpoint or real data; safe guarded Playwright use; no Jotform ID required |
 | isolated-test | Form A only: requires `PUBLIC_AIA_FORMS_MODE=isolated-test`, `PUBLIC_AIA_FORMS_ENVIRONMENT=isolated-test`, `PUBLIC_AIA_FORMS_ISOLATED_TEST_APPROVED=true`, `PUBLIC_AIA_FORMS_LIVE_APPROVED=false`, `PUBLIC_ALLOW_INDEXING=false`, and a fixed seven-route allowlist. It is not a production mode. |
-| live | Separate owner/deployment approval; exact approved IDs/HTTPS origins/URLs and build/deploy gate; no automatic original-form fallback. The current Form A adapter rejects it. |
+| live | Form A only: `PUBLIC_AIA_FORMS_MODE=live`, `PUBLIC_AIA_FORMS_LIVE_APPROVED=true`, `PUBLIC_AIA_FORMS_ENVIRONMENT=production`, and `PUBLIC_AIA_FORM_A_PRODUCTION_APPROVED=true` are all required. The fixed seven-route allowlist, fixed origin/URLs, locale and context still apply. Missing/invalid values fail closed. `PUBLIC_ALLOW_INDEXING` is independent: it must be `true` for an indexing-enabled release but cannot enable Form A alone. Forms B/C and all other lead surfaces remain off. |
 
 Off/mock output must not contain **new lead embed IDs/URLs or the historical `250727122848156` reference ID** in HTML, scripts, preload hints or client bundles. Existing clinical/Sign links intentionally remain in the site; they already contain production destinations. Preserving them conflicts with a blanket “no production ID anywhere” assertion, so this contract's new-embed restriction is scoped to the new lead integration. Existing user-initiated clinical navigation is not permission for automatic loading or test submissions. Do not claim the whole site has zero vendor destinations.
 
@@ -303,3 +303,5 @@ Version 1.3, 2026-10-27: records owner-confirmed Form A (`262946078314059`) evid
 Version 1.4, 2026-10-28: records owner-confirmed direct Form A EN/ES synthetic submission, native thank-you, notification/autoresponder delivery, fixed hidden Reply-To, no-answer/no-PDF staff notification, no webhook/integration, conditional-email and language evidence. It reconciles the five landing journeys to gated Form A isolated-test placements, documents the conditional hosted fallback, and preserves the remaining embedded-iframe, runtime/privacy and production gates. No repository-side Jotform access, submission, activation or deployment occurred.
 
 Version 1.5, 2026-10-28: records the owner's successful embedded synthetic submission and native-confirmation report for English contact, Spanish contact and an ABA landing placement. It marks Form A functional submission acceptance complete only for those owner-reported samples, explicitly keeps the third route name to be recorded, and retains seven-route accessibility, runtime/privacy, deployment and site-release gates. It changes the official Jotform embed-handler decision from rejected to conditionally acceptable pending a separately authorized source, origin, privilege and Firefox/error-state review; the handler is not implemented.
+
+Version 1.6, 2026-10-28: adds the locally tested Form A production-build gate. It requires `live`, the existing live approval, `production` environment role and a new independent Form A production approval; it permits an indexing-enabled build but does not derive authorization from indexing. It leaves normal/off/mock/isolated behavior unchanged, maps no Forms B/C or service drawers, and does not deploy or change Jotform.

www/reports/phase-9-jotform-verification-checklist-2026-10-18.csv

@@ -15,5 +15,6 @@ OA-04,English/Spanish reviewer,"Labels, errors, instructions, confirmations and
 OA-05,Privacy/legal/security,"Protected fields, generic email/headers/recipients, embeds/referrers, vendor flows, access/retention and tracking boundaries",Privacy/legal/security,"Owner-verified 2026-10-27 privacy approval for Form A PHI protection, generic no-PHI notification, no PDF attachment, no webhooks/integrations, recipient access and retention/deletion; embed/referrer runtime review and tracking boundaries remain open","Partially verified — Form A configuration, access and retention scope",2026-10-27,Separate batch authorization; no action authorized by this checklist
 OA-06,Marketing,Deferred attribution categories and redesigned successful-submission semantics,Marketing,Dated owner approval with scope and sanitized supporting evidence,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist
 OA-07,Hosting owner,"Static/API separation, compile/deploy gates, CSP/referrer/log policy, preview isolation and fallback topology",Hosting owner,Dated owner approval with scope and sanitized supporting evidence,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist
-OA-08,Release owner,"Phase 10 integration activation, go/no-go, artifact/vendor rollback and deployment",Release owner,Dated owner approval with scope and sanitized supporting evidence,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist
+OA-08,Release owner,"Phase 10 integration activation, go/no-go, artifact/vendor rollback and deployment",Release owner,Dated owner approval with scope and sanitized supporting evidence,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist
+FA-PRD-01,Form A production build gate,"Confirm live mode, existing live approval, production environment role and independent Form A production approval are all set only in the intended release environment; verify no Form B/C or unrelated surface activates",Release + hosting owner,"Repository configuration resolver and production-artifact test; no deployed environment configured",Implemented locally — deployment verification pending,2026-10-28,Phase 10 deployment authorization and sanitized environment review
 INV-01,Supplied roster provenance and remaining verification,Complete 27-ID roster received and uniqueness checked; verify uncertain generic titles and relevant operational classification with account owner without inferring usage or retrieving submissions,Jotform account owner,Owner-supplied read-only connector roster; contract v1.2 section 3 lists all 27 unique IDs; individual roster no longer outstanding; new-form configuration and usage verification pending,Pending/Unverified,,Read-only metadata review authorization; no account mutation