aia-website/www/reports/phase-10-technical-readiness-package-2026-10-22.md

Phase 10 — Technical Readiness Package

Date: 2026-10-22 UTC Status: Technical handoff prepared; production gates remain open.

Current decision — 2026-10-30: default-live Form A

The owner intentionally supersedes the earlier isolated-test and seven-route production-gate architecture. npm run dev and npm run build now enable Form A on exactly 16 approved placements, including the publicly reachable aia.web3app.dev environment. No additional approval flags or access restriction are required. PUBLIC_AIA_FORMS_MODE is optional: absent/empty means live; explicit off and mock remain available. Invalid/obsolete isolated-test settings produce an actionable configuration error. The former approval flags and form environment role are retired, not renamed.

Indexing and forms are independent. Both publication modes emit ten immediate frames (two contact, five landing, three consultation) and six deferred bilingual service-drawer frames. The bounded registry fixes ID 262946078314059, HTTPS origin, context and language. Forms B/C are not activated; physical B is retired.

Live drawers retain four-second/50%-scroll opening, shared 30-day suppression, manual CTA override, deferred loading, verified completion acknowledgment for five seconds, animated dismissal and fresh-form reopening. Off mode does not automatically show inactive drawers. All iframe security/fallback behavior is preserved. Employee-portal preview remains independently gated by explicit local approval, valid private ciphertext input and non-indexing output; Form A cannot authorize private content. No portal private resources enter normal artifacts.

This owner authorization does not modify Jotform, authorize site cutover or complete pending consultation-language, provider-event, accessibility, runtime telemetry/privacy, recipient-routing or hosting acceptance. See the current operating guide and implementation and validation report. Earlier dated decisions and test results below are historical evidence, not current environment setup instructions.

The following acceptance matrix records the original October 22 results; see the new report for October 30 validation.

Acceptance matrix

Area	Evidence	Result	Human/owner gate
Astro type/check	npm run check	Pass, 130 files, 0 diagnostics	None for local build
Content/publication	Markdown 20, publication 33, SEO 35, Library 53, routes 10	Pass, 151 core tests	Content/clinical approvals remain separate
Phase 8/campaign/P9 isolation	Phase 8 5, campaign 11, P9 nonproduction 5	Pass	Language, screen-reader and stakeholder review pending
Artifact integrity	staging/indexing verifier	Pass; 128/127 routes, staging 0/0 sitemap/hreflang	Hosting owner verification pending
Browser all-route	128/128 opened	Pass	Non-Chromium and authorized visual review pending
Responsive	110/110 checks	Pass	Human visual acceptance pending
Release rehearsal	Node loopback switch/rollback	Pass	nginx/Contabo rehearsal pending
Link/image/blog audits	all three audits	Pass, zero findings	None for local audit
Offline reconciliation	explicit 2026-10-22 evidence check	Pass; no fresh production crawl	Source freshness remains qualified
Screen reader	no real session in this environment	Pending	Authorized AT reviewer

Reproducible validation commands

From www:

TMPDIR=/tmp npm run check
npm run test:markdown
npm run test:publication
npm run test:seo
npm run test:library
npm run test:routes
node --test tools/phase8.test.mjs
node --test tools/campaign.test.mjs
node --test tools/phase9-nonproduction.test.mjs
node --test tools/phase10-artifact.test.mjs
npm run build
PUBLIC_ALLOW_INDEXING=true npm run build
node tools/phase10-artifact-verify.mjs --mode=indexing --forms=live
npm run build
npm run audit:links
npm run audit:images
npm run audit:blog
node tools/phase10-artifact-verify.mjs --mode=staging --forms=live
node tools/phase10-release-rehearsal.mjs

The final normal staging build was restored after the indexing build. The explicit offline route reconciliation reports/route-reconciliation-2026-10-22-offline-05-10-47-827Z.json passed its read-only consistency check using saved request evidence; no unrestricted crawl occurred.

Phase 10 cutover prerequisites

1. Record a locked Node/npm/toolchain and reproducible artifact manifest.
2. Obtain sanitized Contabo/NixOS/nginx/TLS/DNS/Cloudflare facts.
3. Verify host-local serving, canonical host, redirects, 404s, cache headers and rollback on an approved staging host.
4. Default-live Form A is owner-authorized on exactly 16 placements, including public development hosting. No approval flags remain; indexing is independent. Final accessibility, Spanish options/provider-event, runtime privacy and marketing-recipient operational review remain open. Form C remains unimplemented. Site cutover still needs release authorization.
5. Obtain P9-04 counter origin/credential/consent approval before a live adapter.
6. Resolve P9-05 analytics/advertising measurement and P9-07 privacy/legal approval.
7. Obtain P9-06 clinical/organizational and fluent-language approvals, including Arabic diagrams and Spanish HSA/FSA claims.
8. Complete real screen-reader and authorized visual/non-Chromium acceptance.
9. Name release/rollback owners and record backup/monitoring readiness.
10. Obtain P9-10 go/no-go authorization; then run Phase 10 cutover and post-cutover smoke checks.

Decision status

P9-01 through P9-10 remain Pending decision. No technical feasibility result in this package is an approval. Default-live Form A is explicitly owner-authorized. Counters, analytics, advertising, Form C, private portal serving and hosting activation remain separate and unauthorized by this package.

Recommended checkpoint boundaries

Keep the existing Phase 9 implementation, audit tooling and reports as one owner-reviewed technical batch. If a signed checkpoint is requested, stage exact paths only after reviewing the final status and reports. Keep any subsequent host rehearsal, Jotform configuration, counter live adapter and measurement work in separately authorized commits.

2026-10-30 portal and secrets preparation addendum

The local portal compatibility implementation does not close P9-02 or P9-09. The owner must supply legitimate codes privately to collect and classify legacy resources, accept the two decrypted views, approve delivery per resource and verify server-side staff/management separation. SOPS preparation is an inactive module and operational guide, not deployed infrastructure. Real age recipients, host topology, access policy, recovery and runtime key provisioning remain pending. Do not copy private/ into a release. The artifact verifier now rejects private resource paths and portal ciphertext from release artifacts. A local ciphertext preview is deliberately not a releasable artifact. No site cutover authorization is implied.