aia-website/www/reports/phase-9-form-a-production-gate-2026-10-28.md

Phase 9 — Form A production-gate preparation

Recorded: 2026-10-28 UTC Scope: local Astro configuration and static artifact verification for Form A (262946078314059) Status: prepared locally; no environment was enabled, deployed or contacted.

Required release configuration

The Form A iframe resolver enables an iframe only when every value below is present at build time:

PUBLIC_AIA_FORMS_MODE=live
PUBLIC_AIA_FORMS_LIVE_APPROVED=true
PUBLIC_AIA_FORMS_ENVIRONMENT=production
PUBLIC_AIA_FORM_A_PRODUCTION_APPROVED=true

PUBLIC_ALLOW_INDEXING=true is required for an indexing-enabled release artifact but is not an authorization gate. It cannot enable Form A by itself. Missing, invalid or mismatched values render the existing off-mode presentation.

The live gate accepts exactly seven routes: /contact, /es/contact, /lp/aba-therapy, /lp/aba-insurance, /lp/aba-ahcccs, /lp/aba-private-pay, and /lp/early-intervention. It preserves fixed formContext and locale values, fixed heights, no-referrer, allow-forms allow-scripts allow-same-origin, the first-party conditional hosted fallback and the fixed direct hosted URL.

Deliberate exclusions

The production gate does not activate Forms B or C, service drawers, client consultation, referral workflows, native form actions, Jotform helper scripts, browser storage, Contabo forwarding, webhooks, analytics, advertising or production counters. Submissions remain direct browser-to-Jotform; Astro does not inspect the cross-origin frame or infer a conversion from a load event.

Artifact and network verification

The production artifact verifier requires the exact Form A URL on each approved route and rejects Form A identifiers elsewhere. It rejects live Form A output in normal staging and plain indexing validation. The guarded browser runner accepts a production test mode but intercepts every non-loopback request before transmission; it records the attempted Jotform GETs and rejects POST, DELETE, WebSocket, API, analytics and advertising activity.

Local results — 2026-10-28

• astro check: 137 files, zero diagnostics.
• Focused Form A, nonproduction and artifact tests: 20 passing tests, including production-gate and isolated-test artifact fixtures.
• Production-gated indexing artifact: 127 HTML routes, 109 sitemap URLs, 180 hreflang links, no /lp review index and exactly seven fixed Form A frames. The artifact verifier passed.
• Guarded Chromium production-gate run: 35 responsive/no-JavaScript checks across the seven routes at 320, 390, 768 and 1440px, plus four fallback-state checks. It recorded 38 attempted Jotform GET loads and blocked all 62 non-loopback requests before transmission; it made no form write, API, analytics or advertising request.
• Guarded Chromium isolated-test run: the same 35 checks and four fallback-state checks passed. Its 38 attempted Jotform GET loads were likewise blocked before transmission.
• Guarded Chromium off and mock runs: 28 route/viewport checks each passed. Neither emitted a Jotform request or iframe.

These are repository-side rendering and gate checks only. They do not reproduce the owner-reported direct or embedded synthetic submissions, inspect a cross-origin frame, or establish a deployed-environment acceptance.

Operational checks before cutover

1. The release and hosting owners must compare the sanitized production environment to the four required settings above.
2. Confirm marketing-only notification routing remains intentional. This repository does not change notification recipients.
3. Record the exact ABA landing route used in the owner-reported embedded synthetic test.
4. Complete all-seven-route responsive, keyboard, screen-reader, language, validation-error and fallback acceptance.
5. Review Jotform runtime requests, telemetry, CSP, referrer and static-host logging with privacy/security owners.
6. Build both normal staging and the gated indexing-enabled release artifact, then run the artifact verifier and guarded browser test before release authorization.

Rollback

Set PUBLIC_AIA_FORMS_MODE=off or remove any required live approval/environment value. Rebuild, verify the artifact contains no Form A iframe or identifier, and atomically switch to that reviewed static artifact. This disables the Astro embedding without changing the live site content or the Jotform account. It is not a substitute for the separate site rollback and Phase 10 release procedure.

No Jotform settings, forms, submissions, recipient routes, production API, DNS, hosting configuration, analytics or advertising were modified by this preparation.