Phase 9 — Form A isolated iframe campaign extension

Date: 2026-10-25 UTC Repository state: faithful-astro-migration at f41af1966e5fc46ff3fe37019c30826304997b67 before this unstaged extension Scope: initially extend the existing Form A isolated-test adapter to four approved English campaign routes; updated on 2026-10-26 to include /lp/early-intervention. This is not a live Jotform activation.

Owner decision and mapping

The owner supplied this revised decision: use Form A (262946078314059) for the five landing pages below, with fixed formContext=landing. It supersedes the earlier Form B mapping only for these five visitor journeys. Form B remains the planned destination for other service-consultation journeys that require its additional approved fields.

Route	Locale	Form A context	Fixed hosted URL
`/contact`	English	`contact`	`https://form.jotform.com/262946078314059?formContext=contact&language=en`
`/es/contact`	Spanish	`contact`	`https://form.jotform.com/262946078314059?formContext=contact&language=es`
`/lp/aba-therapy`	English	`landing`	`https://form.jotform.com/262946078314059?formContext=landing&language=en`
`/lp/aba-insurance`	English	`landing`	`https://form.jotform.com/262946078314059?formContext=landing&language=en`
`/lp/aba-ahcccs`	English	`landing`	`https://form.jotform.com/262946078314059?formContext=landing&language=en`
`/lp/aba-private-pay`	English	`landing`	`https://form.jotform.com/262946078314059?formContext=landing&language=en`
`/lp/early-intervention`	English	`landing`	`https://form.jotform.com/262946078314059?formContext=landing&language=en`

The 2026-10-26 owner decision supersedes the earlier exception for /lp/early-intervention. Its existing AIA-branded card keeps its off-mode controls and shows the embedded Form A adapter only when the same isolated-test gate permits it. There are no Spanish campaign routes in this implementation, so no Spanish landing parameter has been invented.

Supersession addendum — 2026-10-28

The earlier statement that Form B remained the destination for other service-consultation journeys is superseded. Physical Form B is retired. Those journeys are now future Form A consultation targets, subject to the separate Builder, clinical, privacy, synthetic-acceptance and Astro-allowlist work in the two-form integration specification. This addendum does not change the five current landing placements, their fixed landing context or the seven-route gate.

Implementation

src/utils/form-integration.ts now owns one typed route/locale/context allowlist for all seven Form A placements. resolveFormAIframe still requires every existing isolated-test gate:

PUBLIC_AIA_FORMS_MODE=isolated-test;
PUBLIC_AIA_FORMS_ENVIRONMENT=isolated-test;
PUBLIC_AIA_FORMS_ISOLATED_TEST_APPROVED=true; and
a non-indexing build.

Missing, malformed, mock, off, or live configuration continues to render the pre-existing non-submitting Astro surface. An indexing-enabled build also fails closed. An API URL, Jotform ID, route query, referrer, user value, or PUBLIC_AIA_FORMS_LIVE_APPROVED value cannot enable this adapter.

components/campaign/ConsultationForm.astro reuses JotformIframe.astro only when the resolver permits its four campaign routes. components/campaign/EarlyInterventionPage.astro uses the same resolver and embedded adapter inside its existing .lead-form card. Each page retains its existing section, heading, CTA context, telephone details, and form wrapper. The adapter's embedded variant removes its own card styling so it does not nest a second form card or duplicate availability notices. The Form A mock remains available only in explicit non-indexing mock builds. No external Astro-controlled submit button is used; Jotform's current native Submit label is left unchanged.

The adapter styles are route-local inline component CSS. This prevents a CSS asset shared by the main contact page and campaign layout from appearing in both route families, preserving the existing campaign-style isolation assertion.

The iframe still supplies its localized accessible title and direct hosted-form fallback. It uses referrerpolicy="no-referrer", no Jotform helper script, no allow feature policy, and the constrained sandbox allow-forms allow-scripts allow-same-origin. This is sufficient in principle for Jotform's in-frame controls and confirmation but is not proof that its current disabled runtime works. It intentionally withholds popups, modals, top navigation, downloads, and cross-origin parent control.

Documentation continuity

The versioned October P9-03 contract and implementation plan are not edited by this extension because documentation PR #2 is open. This report and the additive README section record the supersession without overwriting that in-review history. The accepted documentation update must change the five named landing routes from Form B to Form A while retaining Form B for all other service-consultation routes.

Local verification

Check	Result
`npm run check`	0 errors, 0 warnings, 0 hints
Focused Form A, preview, and nonproduction tests	14 passed
Markdown, publication, SEO, Library, and route suites	20, 33, 35, 53, and 10 passed respectively; publication and Library fixtures were rerun sequentially with `TMPDIR=/tmp` after an unsafe concurrent fixture collision
Campaign and artifact tests	18 passed
Normal staging build	128 HTML routes; every page `noindex,nofollow`; empty sitemap; zero hreflang; no Form A identifier or iframe
Explicit mock build	128 routes; no Form A identifier, iframe, external form request, or native form action
Fully gated isolated-test build	128 routes; adapter appears only at the seven allowlisted routes
Indexing-enabled build with every isolated-test value supplied	127 routes; 109 sitemap URLs; 180 hreflang links; `/lp` absent; no Form A identifier or iframe

Playwright 1.61.0 with Chromium exercised all seven placements on a loopback-only preview at 320px, 390px, 768px, and 1440px. The latest isolated-test mode completed 35 checks: all seven routes at every width and all seven with JavaScript disabled at 390px. The browser asserted a visible, responsive iframe, one direct fallback, keyboard focusability, no horizontal page overflow, and the campaign adapter as the single embedded surface inside the existing .form-wrap or the Early Intervention .lead-form, rather than the inactive or mock form.

The latest isolated run created 28 full-page screenshots and an evidence JSON outside the repository at /tmp/aia-form-a-iframe-AuhT7S. It attempted 35 fixed Jotform iframe GETs: ten contact and 25 landing URLs across the JavaScript and no-JavaScript runs. The request guard recorded and aborted every attempt before transmission. There were no attempted POST, DELETE, WebSocket, production API, analytics, advertising, conversion, form-submission, or Contabo requests. Existing Leaflet resource GETs on contact routes were likewise blocked before transmission.

Required acceptance before live activation

Owner-authorized synthetic testing must confirm the disabled form's actual EN/ES language behavior, formContext conditions, validation, confirmation, and native Submit controls using approved synthetic values only.
Privacy/security review must confirm Jotform configuration, PHI protections, notification recipients/templates, redirects, integrations, retention, and no HTTP POST forwarding to Astro or Contabo.
Accessibility review must confirm real iframe keyboard behavior, focus, screen-reader experience, frame height, mobile reflow, direct fallback, and blocked/slow resource handling at 320px, 390px, 768px, and 1440px.
Hosting/CSP/referrer review must approve the Jotform origin and sandbox for the intended deployment environment.
Operations, clinical, language, privacy, and release owners must approve the final Form A field contract and workflow. Analytics, advertising, webhooks, conversion events, and PHI forwarding remain prohibited.

No Jotform account access, form mutation, real submission, external network transmission, analytics, advertising, Contabo form endpoint, deployment, staging, commit, merge, or push occurred in this extension.

8.3 KiB Raw Permalink Blame History