docs(forms): record Form A privacy verification

www/reports/phase-9-jotform-integration-contract-2026-10-18.md

@@ -1,10 +1,10 @@
 # P9-03 Jotform integration contract
 
-**Contract ID:** P9-03-JF-2026-10-18 · **Version:** 1.2 · **Decision revision:** 2026-10-21
+**Contract ID:** P9-03-JF-2026-10-18 · **Version:** 1.3 · **Decision revision:** 2026-10-27
 
 **Status: documented planning architecture; implementation and activation NOT authorized.**
 
-This is the authoritative P9-03 planning contract for the owner decisions supplied on October 18 and revised on October 21. It supersedes conflicting *proposals* in the [October 17 inventory](phase-9-form-entry-point-inventory-2026-10-17.md), without rewriting that historical record. It does not supersede project policy, approve clinical/legal content, close the Phase 9 register, or authorize production changes. Future changes require an explicit owner decision, a version/change record and evidence links. Version 1.0 records the original planning instruction; version 1.1 adds the owner-supplied complete roster; version 1.2 supersedes the copy-based Form B proposal with three new blank forms without changing the three-form architecture or pending approvals. No future commit SHA is invented.
+This is the authoritative P9-03 planning contract for the owner decisions supplied on October 18 and revised through October 27. It supersedes conflicting *proposals* in the [October 17 inventory](phase-9-form-entry-point-inventory-2026-10-17.md), without rewriting that historical record. It does not supersede project policy, approve clinical/legal content beyond the Form A configuration scope recorded below, close the Phase 9 register, or authorize production changes. Future changes require an explicit owner decision, a version/change record and evidence links. Version 1.0 records the original planning instruction; version 1.1 adds the owner-supplied complete roster; version 1.2 supersedes the copy-based Form B proposal with three new blank forms; version 1.3 records limited owner-confirmed Form A configuration evidence. No future commit SHA is invented.
 
 Companions: [source-specific implementation plan](phase-9-jotform-implementation-plan-2026-10-18.md), [verification and approval ledger](phase-9-jotform-verification-checklist-2026-10-18.csv).
 
@@ -40,6 +40,18 @@ Evidence classes must remain distinct:
 - GA4, Google Ads, GTM, remarketing, enhanced conversions and user-data collection remain disabled/unapproved.
 - Contabo static hosting and approved non-PHI API functions, with Raspberry Pi fallback, remain planning preferences—not verified topology or deployment instructions.
 
+### 2.1 Form A owner-confirmed configuration evidence — 2026-10-27
+
+The owner supplied the following **Form A-specific configuration evidence** after a ChatGPT WebUI/Jotform review. The repository did not access the Jotform account, inspect submissions, or independently audit the Builder. Treat this as owner-confirmed evidence, not a blanket HIPAA certification and not proof of equivalent settings on Forms B, C, or any legacy form.
+
+- **Form A — General Enquiries** has form ID `262946078314059`. The ID is approved only for the gated Form A integration described in the current implementation and is **not production-activation authority**.
+- Form A's submitted fields are confirmed PHI-protected.
+- Form A's staff notification uses the approved generic, no-PHI template. It does not include submitted answers or a submission PDF attachment.
+- Form A has no webhooks or third-party integrations configured.
+- The owner reports privacy approval for these Form A controls and the direct-to-Jotform boundary.
+
+This confirmation includes owner-verified notification-recipient access and Form A submission-retention controls. The exact authorized roles and retention period remain account-policy information and are intentionally not copied into the repository. Conditional routing, reply-to/default-header behavior, autoresponder policy, redirect/thank-you behavior, EN/ES runtime behavior, spam/availability settings, and successful synthetic submission remain pending. It does not enable Form A, approve an iframe in a production artifact, or close P9-03, P9-05, P9-07, or Phase 10 release approval. Forms B and C remain separately planned and unverified.
+
 ## 3. Account assets and accounting for all 27
 
 The user reports that all 27 assets were classified and ENABLED during the October 18 connector inspection, without retrieving submitted answers. Enabled is an observed status at that time, not approval to use the asset.
@@ -89,7 +101,7 @@ Classifications are the **owner-supplied planning categories**, not verified Jot
 | `242236946264158` | Administration | AIA Technology Request Form - Scottsdale |
 | `240728578023156` | Administration | AIA Maintenance Request Form - Scottsdale |
 
-Validation: **27 rows, 27 unique IDs**. The four previously identified assets are included; the other 23 are now individually listed. The individual roster is no longer outstanding. This fills the metadata inventory gap only: JF-01 through JF-09 and all owner approvals remain pending. The October 17 worksheet and source evidence are preserved unchanged.
+Validation: **27 rows, 27 unique IDs**. The four previously identified assets are included; the other 23 are now individually listed. The individual roster is no longer outstanding. This fills the metadata inventory gap only. Form A's limited 2026-10-27 configuration evidence is recorded in section 2.1 and the ledger; all other JF and owner approval scope remains pending. The October 17 worksheet and source evidence are preserved unchanged.
 
 `250727122848156` is a **historical reference ID only**, never an approved production embed ID or blank-form source. Preserve every listed clinical, agreement, billing, event, HR, administrative and other operational workflow; no classification permits modification, repurposing or deletion. This roster contains no submitted answers, patient data, submission metadata or inferred field-level configuration.
 
@@ -172,9 +184,9 @@ Tour's actual CTA currently goes to `/client-consultation` (B destination). A is
 
 `/lp/early-intervention` and the provisional local `/client-consultation` substitution remain P9-01 decisions. Campaign landing pages outside this repository are out of scope. Phone/email legacy-target issues in the inventory remain unresolved; no target is silently replaced.
 
-## 6. Verification gates — all Pending / Unverified
+## 6. Verification gates — current disposition
 
-The connector supplied titles, IDs, enabled status, timestamps, labels and limited summaries—not a full Builder audit. Each gate must record the exact new-form ID when one exists, reviewer, date, sanitized evidence and disposition. A historical-form finding does not automatically pass a newly created blank form's gate.
+The connector supplied titles, IDs, enabled status, timestamps, labels and limited summaries—not a full Builder audit. Each gate must record the exact form ID when one exists, reviewer, date, sanitized evidence and disposition. A historical-form finding does not automatically pass a newly created blank form's gate. The Form A owner-confirmed portions are recorded below and in the CSV ledger; every unlisted portion remains pending.
 
 | Gate | Required verification | Owner / evidence |
 |---|---|---|
@@ -188,7 +200,7 @@ The connector supplied titles, IDs, enabled status, timestamps, labels and limit
 | JF-08 | Approved HTTPS origin, hosted/iframe URLs, dimensions/mobile, scripts, referrer, locale and fallback | Account/hosting/accessibility owners; exported code and later authorized runtime evidence |
 | JF-09 | Actual EN/ES synthetic submission, notifications, success/failure, redirects and privacy boundary | **Later separately authorized** isolated form/environment; never real patient data |
 
-No JF gate has passed. Read-only Builder review may complete configuration portions of JF-01–08; runtime portions remain pending until explicitly authorized. Generic vendor documentation does not close a gate. The [CSV ledger](phase-9-jotform-verification-checklist-2026-10-18.csv) also tracks owner approvals and the supplied complete roster and its pending configuration/usage verification.
+For Form A only, JF-01 (field PHI protection), JF-04 (generic no-PHI notification, recipient access and no PDF attachment), JF-06 (no webhooks/integrations), and the corresponding privacy/access/retention portions of JF-07/OA-05 are owner-verified as of 2026-10-27. Each is **partial**: the remaining verification listed in its row is still required. JF-02, JF-03, JF-05, JF-08 and JF-09 remain pending. Read-only Builder review may complete other configuration portions; runtime portions remain pending until explicitly authorized. Generic vendor documentation does not close a gate. The [CSV ledger](phase-9-jotform-verification-checklist-2026-10-18.csv) tracks the exact scope, remaining work and supplied complete roster.
 
 ## 7. Future integration-mode contract
 
@@ -212,7 +224,7 @@ Answers must not enter Astro handlers, Contabo endpoints, unreviewed webhooks, r
 
 ## 8. Initial notification contract
 
-Proposed exact initial template (activation still pending JF-04 and privacy approval):
+The following generic template is owner-verified for Form A; activation and delivery acceptance remain pending:
 
 ```text
 Subject: New AIA form submission
@@ -223,7 +235,7 @@ Sign in to AIA's authorized Jotform account to review it.
 
 No dynamic answer tags, PDFs or other submission attachments, respondent reply-to, patient/family names, submitted email/phone, clinical data, submission ID, individual submission/edit link, unreviewed CC/BCC or automatic forwarding of responses. Do not disable PHI protection to expose a field. Check sender, headers, footer, hidden/default fields and all-field tokens as well as visible body. Arizona-local date/time and source/campaign labels are **deferred**, not optional additions for the implementer. No respondent autoresponder is authorized by this generic staff notification.
 
-Jotform's [HIPAA email guidance](https://www.jotform.com/help/504-how-to-use-notification-and-autoresponder-emails-in-hipaa-accounts/) describes excluding protected fields; its [field-protection guidance](https://www.jotform.com/help/518-How-to-set-PHI-fields-on-your-forms/) requires proper field classification. These do not prove a current template is safe. Inspect the actual copy, approved recipient roles and delivered synthetic message later. Never create a Contabo webhook receiving full answers to generate a generic email.
+Jotform's [HIPAA email guidance](https://www.jotform.com/help/504-how-to-use-notification-and-autoresponder-emails-in-hipaa-accounts/) describes excluding protected fields; its [field-protection guidance](https://www.jotform.com/help/518-How-to-set-PHI-fields-on-your-forms/) requires proper field classification. The owner-verified Form A template, PHI protection, recipient access and retention controls are recorded in section 2.1; headers/defaults and delivered synthetic-message behavior still require review. Never create a Contabo webhook receiving full answers to generate a generic email.
 
 ## 9. Blank-form creation safety and success measurement
 
@@ -267,3 +279,5 @@ Version 1.0, 2026-10-18: records the owner's three-form/direct-Jotform/no-bookin
 Version 1.1, 2026-10-18: adds the complete owner-supplied 27-ID roster and distinguishes reported metadata from planning classifications. Removes superseded missing-roster statements. Architecture, source-template restrictions, implementation authority and pending approval statuses are unchanged. No Jotform access or mutation occurred during this reconciliation.
 
 Version 1.2, 2026-10-21: records the owner's decision to create three new blank Jotform forms from scratch. Supersedes the earlier working-copy proposal for `250727122848156`; preserves that ID as historical reference evidence only. Adds the owner-reported legacy-form remediation summary, retains all existing workflows, changes Batch B and OA-03 to blank-form creation, and leaves JF-01–09 and all owner approvals Pending/Unverified. No Jotform access or mutation occurred during this documentation revision.
+
+Version 1.3, 2026-10-27: records owner-confirmed Form A (`262946078314059`) evidence from the owner’s ChatGPT WebUI/Jotform review: field PHI protection, the generic no-PHI notification template, no submission-PDF attachment, no webhooks/integrations, and privacy approval for that configuration scope. It marks only the corresponding Form A portions of JF-01, JF-04, JF-06, JF-07 and OA-05 in the ledger. Recipient access and retention are owner-verified; routing/defaults, runtime acceptance and activation remain open; no account access, mutation, submission, deployment or tracking occurred in this repository update.