479 lines
31 KiB
Markdown
479 lines
31 KiB
Markdown
# AIA Astro Migration — Living Session Handoff
|
||
|
||
**Last updated:** October 30, 2026 (UTC)
|
||
**Repository:** `AIAMarketing/azinstitute4autism.com`
|
||
**Working branch:** `faithful-astro-migration`
|
||
**Last pushed checkpoint:** `55adb797051473c3067a0d454515153237e9b8d6` — completion handling and portal styling. The new commit containing this handoff simplifies Form A to default-live without rewriting that history.
|
||
**Previous accepted checkpoint:** P9-03 documentation, signed `537f9864a0a3d0806180cbeca909bf1d03200c6f`
|
||
**Implementation checkpoint:** the commit containing this handoff update; obtain its actual SHA from Git history after the signed checkpoint is created.
|
||
**Next milestone:** continue Phase 9 owner decisions and authorized integration batches; then Phase 10 — Final QA/Cutover Readiness.
|
||
|
||
The landing-page migration is technically completed for checkpoint purposes.
|
||
Editorial, accessibility, stakeholder and production-release approval remain
|
||
separate. This handoff does not authorize deployment or integration activation.
|
||
|
||
## Current decision — 2026-10-30: default-live Form A
|
||
|
||
The owner intentionally supersedes the earlier isolated-test and seven-route
|
||
production-gate architecture. `npm run dev` and `npm run build` now enable Form A
|
||
on exactly **16 approved placements**, including the publicly reachable
|
||
`aia.web3app.dev` environment. No additional approval flags or access restriction
|
||
are required. `PUBLIC_AIA_FORMS_MODE` is optional: absent/empty means `live`;
|
||
explicit `off` and `mock` remain available. Invalid/obsolete `isolated-test`
|
||
settings produce an actionable configuration error. The former approval flags
|
||
and form environment role are retired, not renamed.
|
||
|
||
Indexing and forms are independent. Both publication modes emit ten immediate
|
||
frames (two contact, five landing, three consultation) and six deferred bilingual
|
||
service-drawer frames. The bounded registry fixes ID `262946078314059`, HTTPS
|
||
origin, context and language. Forms B/C are not activated; physical B is retired.
|
||
|
||
Live drawers retain four-second/50%-scroll opening, shared 30-day suppression,
|
||
manual CTA override, deferred loading, verified completion acknowledgment for
|
||
five seconds, animated dismissal and fresh-form reopening. Off mode does not
|
||
automatically show inactive drawers. All iframe security/fallback behavior is
|
||
preserved. Employee-portal preview remains independently gated by explicit local
|
||
approval, valid private ciphertext input and non-indexing output; Form A cannot
|
||
authorize private content. No portal private resources enter normal artifacts.
|
||
|
||
This owner authorization does not modify Jotform, authorize site cutover or
|
||
complete pending consultation-language, provider-event, accessibility, runtime
|
||
telemetry/privacy, recipient-routing or hosting acceptance. See the
|
||
[current operating guide](../integrations/jotform/README.md) and
|
||
[implementation and validation report](phase-9-form-a-default-live-2026-10-30.md).
|
||
Earlier dated decisions and test results below are historical evidence, not
|
||
current environment setup instructions.
|
||
|
||
## Latest verified validation — 2026-10-30 default-live revision
|
||
|
||
206 tests pass; Astro check has zero diagnostics. Normal default-live staging:
|
||
128 routes, empty sitemap, zero hreflang, ten immediate plus six deferred Form A
|
||
frames. Indexing-enabled: 127 routes, 109 sitemap URLs, 180 hreflang links, the
|
||
same 16 placements. Explicit off/mock artifacts contain no real Form A frames.
|
||
Guarded browser regressions preserve drawer completion/suppression and portal
|
||
fixture behavior; 128/128 staging routes open. Link/image/blog audits have zero
|
||
findings. See the current default-live report for exact overlapping check counts,
|
||
network interception evidence and remaining owner acceptance. No deployment,
|
||
Jotform mutation or new real submission was performed.
|
||
|
||
## Authority and checkpoint history
|
||
|
||
Read repository-root `AGENTS.md`, `MIGRATION_BRIEF.md` and `AUTONOMOUS-CODEX.md`,
|
||
then this handoff and the relevant [migration summary](migration-summary.md).
|
||
Later Phase 6A ratification controls conflicting original recommendations.
|
||
|
||
- Phase 5C Team: `34d5394b3ce765028a27b9cddd9952de3f09bfe7`.
|
||
- Phase 6A proposal: `76a035424dc5245443476b168d8c91ea62eed27b`.
|
||
- Phase 6B.1 search: `b20c253383440598c2d07bf6f852906ac00c42df`.
|
||
- Phase 6B.2 pagination: `6f5ac3c0d233cee5fbbb62be79bc6909e6bec183`.
|
||
- Phase 6B.3 author archives: `8646792d46a8a117ef617f5dd2582c2550b45d19`.
|
||
- Phase 6B.4 URL/SEO: `8192ea71c47a7163b40a7fad144ebbd2523282d1`.
|
||
- Phase 6B.5 multilingual navigation/RTL: the signed replacement checkpoint
|
||
`a699d467f19fafbfdda5fce1ce6226baa6e5fc3c`; do not use its superseded unsigned SHA.
|
||
|
||
- Phase 6C Library/multilingual parity: signed checkpoint
|
||
`b5bc95bc2b8e36c58e8b4d8ab4b11391374a7883`.
|
||
|
||
- Phase 7 multilingual reconciliation: signed checkpoint
|
||
`8e64d322092b1fa6e0f648ddf26a665c80588198`.
|
||
|
||
- Phase 8 visual/accessibility implementation: signed checkpoint
|
||
`59911eb929579af7bcd6c42de6476128dab62289`.
|
||
- P9-03 Jotform contract and complete owner inventory: signed checkpoint
|
||
`537f9864a0a3d0806180cbeca909bf1d03200c6f`.
|
||
- Phase 9 landing-page integration: the commit containing this handoff update;
|
||
obtain its actual SHA from Git history. It does not resolve P9-01 through P9-10.
|
||
|
||
Phase 6B.5 visitor navigation remains independent of SEO hreflang. Published
|
||
locale destinations, explicit fallback notices, native language disclosure,
|
||
Arabic contact bidi isolation and the two-line shared address remain intact.
|
||
`/ar` remains unpublished with an explicit English-home fallback.
|
||
ContactObfuscation is unchanged; reversed no-JavaScript strings are intentional.
|
||
The earlier Phase 6B.5 manual acceptance does not cover subsequent Phase 6C work.
|
||
|
||
## Completed Phase 6C technical sequence
|
||
|
||
- **6C:** restored nine missing English articles and source-backed self-hosted
|
||
media; derived English Library and author page 6 from the catalog.
|
||
- **6C.1:** restored source-supported Halloween contextual links in English
|
||
self-advocacy and AAC articles.
|
||
- **6C.2:** reconciled three materially outdated English articles and current
|
||
published Spanish school readiness; replaced the obsolete Arabic
|
||
antecedent/consequence body with a complete translation; audited all 19
|
||
established translation relationships.
|
||
- **6C.3:** reconciled featured-image alternatives, source-supported headings,
|
||
truncated descriptions and supported modification dates; retained the new
|
||
Arabic guide's intentional modification-date omission; localized three diagrams.
|
||
- **6C.4:** reconciled contextual and external links, previous/next/related
|
||
relationships, image links and fragments; added localized self-advocacy
|
||
Halloween references while preserving the landing-page ownership gate.
|
||
- **6C.5:** audited all 74 articles, corrected narrow structural/accessibility
|
||
regressions, and verified metadata, links, FAQs, translation relationships,
|
||
pagination, search and publication policies. Technical readiness has
|
||
documented nontechnical release gates.
|
||
|
||
Detailed evidence and reviewer checklists are in the
|
||
[final acceptance report](phase-6c5-final-library-acceptance-2026-10-13.md).
|
||
The [checkpoint manifest](phase-6c5-checkpoint-manifest-2026-10-13.md) lists 148
|
||
implementation/evidence paths; that checkpoint included its handoff as path 149.
|
||
Historical phase records retain their original context.
|
||
|
||
## Completed Phase 7 technical sequence
|
||
|
||
- Recovered Spanish privacy policy with February 19, 2025 revision date,
|
||
localized metadata and reciprocal English/Spanish policy navigation.
|
||
- Localized actual Spanish form labels, options, instructions, disabled notices
|
||
and Contact map text using explicitly passed publication locale; no backend enabled.
|
||
- Translated the Spanish reinforcement tip without changing article identity,
|
||
dates or surrounding content; fluent/clinical approval remains pending.
|
||
- Localized Spanish/Arabic author headings and isolated Arabic BCBA/LBA text;
|
||
biographies, identities and archive SEO unchanged.
|
||
- Prepared the [nonproduction verification plan](phase-7-nonproduction-verification-plan-2026-10-14.md)
|
||
and [Phase 9 decision register](phase-9-decision-register-2026-10-14.md).
|
||
P9-01 through P9-10 all remain **Pending decision**.
|
||
|
||
See the [Phase 7 reconciliation report](phase-7-multilingual-reconciliation-2026-10-14.md)
|
||
and [checkpoint manifest](phase-7-checkpoint-manifest-2026-10-14.md).
|
||
The non-Library matrix excludes all three Library-root content records:
|
||
20 EN / 8 ES / 1 unpublished AR draft → 20 EN / 9 ES / 1 unpublished AR draft;
|
||
28 → 29 eligible pages and 8 → 9 English–Spanish pairs. The final matrix has
|
||
30 records including the draft. Whole pages-collection counts (including roots)
|
||
are 21/9/2 → 21/10/2, with 9 → 10 English–Spanish pairs. Do not mix populations.
|
||
|
||
## Completed Phase 8 technical sequence
|
||
|
||
- Static checks and guarded Chromium smoke covered all 122 generated routes.
|
||
The original browser pass captured 50 desktop/50 mobile full pages, checked
|
||
50 routes without JavaScript, and passed 40 focused interactions, with one
|
||
native-dialog review finding subsequently compared against a native control.
|
||
- Corrected prose/FAQ/contact/form link contrast and underlines, navigation,
|
||
language-menu, skip-link, byline and diagram focus treatments; fixed the
|
||
scoped homepage director-grid overflow at 320px.
|
||
- Localized Arabic article controls and bidi counts without changing the API
|
||
script. Corrected DTT/NET peer sections and consultation heading semantics
|
||
while preserving text, fragments and appearance. Native dialogs remain intact;
|
||
Chromium's browser-chrome boundary did not establish application focus escape.
|
||
- Corrected Phase 7 carryovers: Spanish HSA/FSA section after ESA/before financial
|
||
help, Spanish alternative text and APROBADO artwork; Spanish privacy's missing
|
||
information-collection H2 (eleven sections/four items), with no legal-text change.
|
||
The final Spanish badge preserves the original alpha and every pixel outside
|
||
its lettering rectangle; the English artwork is unchanged.
|
||
- Replaced flattened Tour Markdown with one MDX publication, structured nine-photo
|
||
data and accessible carousel: captions, thumbnails, wraparound, keyboard/focus,
|
||
restrained announcements, no auto-rotation, full no-JavaScript fallback and
|
||
restored consultation link. No new dependency or production integration.
|
||
- Bounded follow-up: 30 grouped Chromium checks. Consolidated pass: 21 grouped
|
||
checks, two contrast/reduced-motion probes, five distinct routes, 20 full-page
|
||
captures, native 200% zoom on Tour/privacy (26 overlapping frames), four crops.
|
||
Earlier follow-up also tested seven routes at native 200% zoom. Badge correction:
|
||
eight EN/ES checks/crops at 320/390/768/1440px. These are distinct evidence
|
||
populations, not additional unique-site-route totals.
|
||
- Loopback-only contexts allowed only local GET/HEAD, blocked external traffic,
|
||
WebSockets and website service workers. Map-resource attempts and a synthetic
|
||
fixture POST were prevented; no production API/like/form/conversion request
|
||
was transmitted. Disabled controls/noindex remain insufficient API isolation.
|
||
|
||
See [consolidated findings](phase-8-consolidated-followup-2026-10-15.md),
|
||
[browser results](phase-8-browser-verification-2026-10-15.md),
|
||
[badge correction evidence](phase-8-badge-correction-evidence-2026-10-15.json),
|
||
and the [Phase 8 checkpoint manifest and validation](phase-8-checkpoint-manifest-2026-10-15.md).
|
||
Historical failed browser attempts remain recorded. System Playwright 1.61.0 /
|
||
Chromium 151.0.7922.75 now work; the optional Nix browser-shell realization is
|
||
not independently verified. No real screen-reader session or owner sign-off occurred.
|
||
|
||
Tour's public source passed normal TLS but was cache-qualified. Spanish privacy's
|
||
capture used a certificate-insecure fallback after validation failed. Neither
|
||
establishes current origin freshness; Spanish policy additionally requires a
|
||
trusted-source comparison. No insecure retrieval was repeated.
|
||
|
||
## Completed Phase 9 landing-page integration
|
||
|
||
- Imported four independently styled campaign routes from the sibling landing-page
|
||
repository: `/lp/aba-therapy`, `/lp/aba-insurance`, `/lp/aba-ahcccs` and
|
||
`/lp/aba-private-pay`. Their local fonts, images, components, metadata and
|
||
source noindex policy are isolated from ordinary site pages.
|
||
- Migrated the branded public `/lp/early-intervention` route with its compact
|
||
header/footer, source section order, existing byte-identical local imagery and
|
||
cache-qualified source evidence. It is self-canonical and adds one sitemap URL.
|
||
- Omitted the sibling project's API, tracking, success-state and attribution
|
||
runtime. Normal staging and indexing artifacts keep all five lead panels inactive,
|
||
with no native POST, live Jotform or conversion behavior. The later seven-route
|
||
Form A isolated-test adapter is separately gated and remains outside those artifacts.
|
||
P9-01, P9-03, P9-05 and P9-07 remain open.
|
||
- Added `/lp` as a temporary staging/testing index linking the five pages. It is
|
||
always `noindex,nofollow`, sitemap/hreflang-excluded and omitted entirely when
|
||
`PUBLIC_ALLOW_INDEXING=true`. This build gate is not access control.
|
||
- Detailed evidence is in the
|
||
[integration report](phase-9-campaign-page-integration-2026-10-20.md),
|
||
[sanitized evidence JSON](phase-9-campaign-integration-evidence-2026-10-20.json),
|
||
[early-intervention source record](phase-9-early-intervention-source-2026-10-20.json)
|
||
and [final offline reconciliation](route-reconciliation-2026-10-20-offline-18-37-43-828Z.json).
|
||
Earlier October 20 reconciliations remain superseded local evidence outside
|
||
the checkpoint.
|
||
|
||
### Current two-form status — 2026-10-29
|
||
|
||
- Form A uses one 16-placement live registry: two contact, five landing, three standalone consultation and six EN/ES service drawers. Mode defaults to live; off/mock are explicit options. See the current decision above and the two-form specification.
|
||
- Owner-confirmed direct-Jotform evidence covers synthetic EN/ES submission, native thank-you, conditional email/language, generic no-answer/no-PDF staff notification, autoresponder delivery, corrected fixed Reply-To, no webhooks/integrations, privacy scope, recipient access and retention. The owner also reports successful Astro-iframe synthetic submission and confirmation on English contact, Spanish contact and one ABA landing placement; record the exact third route before release. Functional submission acceptance is complete only for those owner-reported samples. All-sixteen-route accessibility, runtime-network/telemetry, deployment and site-release acceptance remain open.
|
||
- The adapter retains fixed URLs, responsive fixed heights, `no-referrer`, `allow-forms allow-scripts allow-same-origin`, no helper script, and a hosted fallback that is hidden without space until a 15-second missing-load timeout. A frame load only clears that timeout; it does not prove cross-origin application health or accepted submission. The official Jotform resizing handler is conditionally acceptable pending separately authorized source, origin, privilege, Firefox and error-state verification; it is not implemented. Fixed heights remain current.
|
||
- No additional Form A approval/environment flags remain. Indexing does not authorize or disable forms. Marketing-only notification routing remains a pre-cutover operational check. Rollback requires explicit mode `off`, rebuild and artifact verification; merely removing the mode restores live. Form C, counters, analytics and API forwarding remain inactive.
|
||
|
||
The indexing-enabled build has 127 HTML routes/canonicals and 109 sitemap URLs.
|
||
Normal staging has 128 `noindex,nofollow` pages because it also contains `/lp`;
|
||
its sitemap and hreflang are empty. Existing 180 hreflang links across 55 routes,
|
||
25 translation sets, 74 Library articles, nine author archives and nine redirect
|
||
definitions are unchanged. Guarded Chromium covered the four campaign routes at
|
||
320/390/768/1440px, the branded route at those widths plus no-JavaScript checks,
|
||
and `/lp` at 320/1440px. Real screen-reader, non-Chromium and authorized visual,
|
||
clinical, privacy and organizational acceptance remain pending.
|
||
|
||
## Verified technical baseline
|
||
|
||
| Metric | Result |
|
||
|---|---:|
|
||
| Library articles / locale search records | 55 EN / 12 ES / 7 AR = 74 |
|
||
| Indexing-enabled HTML routes / unique canonical targets | 127 / 127 |
|
||
| Normal staging HTML routes, including temporary `/lp` | 128 |
|
||
| Author archive routes | 9 |
|
||
| Indexing-enabled sitemap URLs | 109 |
|
||
| Hreflang links / participating routes | 180 / 55 |
|
||
| Validated page/article translation sets | 25 |
|
||
| Repository redirect definitions | 9, not activated on deployed hosts |
|
||
| Visible/schema-aligned FAQ answers / articles | 182 / 30 |
|
||
|
||
English Library and author pagination is `10/10/10/10/10/5`; Spanish is `10/2`,
|
||
Arabic is one seven-article root. Page 6 is derived, with no page 7 or page-one
|
||
HTML alias. Search remains locale-scoped, metadata-only and demand-loaded.
|
||
Publication ordering uses original dates, not modification dates. Existing
|
||
syndicated external-canonical/noindex exceptions remain unchanged.
|
||
|
||
Normal staging output is **128 `noindex,nofollow` HTML pages, an empty sitemap
|
||
and no hreflang**. Indexing-enabled validation is local only. No deployment,
|
||
redirect activation, form submission or production integration is authorized.
|
||
|
||
Final source-matching offline evidence is the
|
||
[October 20 reconciliation](route-reconciliation-2026-10-20-offline-18-37-43-828Z.json):
|
||
138 dispositions, 128 local generated routes, 70 reused historical production
|
||
requests and schema 2. Use this explicit evidence path for read-only checks.
|
||
Earlier Phase 8 and October 20 reports remain historical evidence, not the
|
||
current source fingerprint. No fresh production crawl was performed.
|
||
|
||
The historical Phase 6C.5 parity classifications were 10 confirmed, 58 with accepted intentional
|
||
deviations, one minor discrepancy, five requiring human review, zero material
|
||
discrepancies and zero insufficient-verification records against the selected
|
||
evidence. Findings rely on dated, sometimes cached/prerendered public HubSpot
|
||
representations; they do not establish independent current origin freshness.
|
||
The newer Arabic antecedent/consequence translation intentionally supersedes
|
||
its outdated public Arabic body. Machine-assisted work is not professional approval.
|
||
|
||
Phase 8 checkpoint preparation revalidation on October 15 passed sequentially
|
||
with `TMPDIR=/tmp`: Astro check (101 files, zero diagnostics), Markdown 20,
|
||
publication 33, SEO 35, **Library 53**, routes 10 and Phase 8 5 tests: **156 total**.
|
||
Both build modes and link/image/blog audits pass. The final normal staging build
|
||
and explicit offline consistency check retain the publication safeguards above.
|
||
Git identity/signing remains the user’s host-terminal responsibility.
|
||
|
||
## Outstanding Stakeholder Review and Production Release Gates
|
||
|
||
- **Clinical/organizational — AIA:** approve eligibility and program-specific
|
||
ranges against general ABA eligibility of **18 months through eight years**;
|
||
resolve the summer-routine age discrepancy. Review Preparatory Academy ages
|
||
2–6 and 1:2 delivery ratio, ABA versus education, Arizona educational guidance,
|
||
functional assessment, behavior intervention, reinforcement, extinction,
|
||
aggression, self-injury, safety, treatment/outcome claims and author roles,
|
||
credentials and biographies, including Arabic physician-like wording versus
|
||
English “clinician.” Source publication alone is not clinical approval.
|
||
- **Fluent Spanish/Arabic and clinical review:** revised Spanish school readiness,
|
||
rewritten Arabic antecedent/consequence guidance and terminology, all three
|
||
localized Arabic diagrams, localized self-advocacy Halloween additions,
|
||
operational labels and cross-language notices remain pending.
|
||
- **Spanish tip review:** Phase 7 corrected the English tip at
|
||
`/es/library/positive-reinforcement-techniques`. Its fluent-Spanish and
|
||
clinical/editorial acceptance remains open; historical Phase 6C findings remain intact.
|
||
- **Privacy/legal and trusted-source approval — P9-07:** both policy claims need
|
||
AIA privacy/legal approval. Spanish privacy was recovered from a cache-qualified
|
||
response after standard TLS certificate validation failed; fallback disabled
|
||
certificate verification. Matching captured text does not prove authenticated
|
||
origin fidelity. Before production, compare against a certificate-validated
|
||
source or owner-supplied authoritative export with provenance; no trusted
|
||
comparison is available yet. Fluent Spanish approval remains mandatory.
|
||
Do not repeat insecure retrieval or rewrite policies to hide this limitation.
|
||
- **Browser/accessibility:** guarded Chromium automation now covers desktop/mobile,
|
||
keyboard, no-JavaScript, RTL/diagram scrolling and actual 200% zoom. Authorized
|
||
visual/source-fidelity acceptance, non-Chromium coverage, native-dialog AT
|
||
behavior, Arabic visual-language acceptance and real screen-reader testing
|
||
remain pending. Earlier failed attempts remain historical; browser automation
|
||
and DOM inspection do not constitute reviewer or assistive-technology approval.
|
||
- **Spanish HSA/FSA financial claims:** fluent-Spanish and organizational/financial
|
||
review of wording, account use, pre-tax and tuition claims remains pending.
|
||
Localized artwork is not financial eligibility or reimbursement approval.
|
||
- **Landing-page integration — Phase 9 owner gate:** presentation for the four
|
||
campaign routes and `/lp/early-intervention` is now imported under explicit
|
||
owner authorization. The Library CTA remains provisionally
|
||
`/client-consultation`; its equivalence to `/lp/early-intervention`, campaign
|
||
routing, redirects and live form behavior are not approved. Do not activate
|
||
submissions or production redirects without separate authorization.
|
||
- **Employee portal — P9-02:** staff/management access separation, authentication,
|
||
authorization and employee/clinical data security remain unresolved; current
|
||
metadata-only route is not a completed portal. See the
|
||
[portal brief](employee-portal-migration-brief-2026-10-08.md).
|
||
- **Likes/views API — P9-04:** the uncommitted local implementation now defaults
|
||
to explicit fail-closed `off`, with deterministic local `mock` behavior and
|
||
no live adapter. A future live adapter still requires separate API-origin,
|
||
credential, cookie, consent and production-approval evidence.
|
||
- **Author SEO:** keep archives self-canonical, `noindex,follow` in indexing-enabled
|
||
builds, sitemap-excluded and hreflang-excluded. Changes require explicit approval.
|
||
- **Forms/privacy/analytics/advertising:** approve form destinations and submission
|
||
APIs, HIPAA/privacy safeguards, consent/analytics, Google Ads conversion tracking
|
||
and each production integration's activation. No new PHI flow is authorized.
|
||
- **Hosting/release:** separately verify Contabo/NixOS deployment assumptions,
|
||
HTTPS, canonical host, slashless URLs, query preservation, redirect targets and
|
||
loops, real 404 responses, asset delivery, sitemap/robots, reproducible deployment,
|
||
rollback and organizational release approval. The temporary Docker/nginx
|
||
trailing-slash HTTPS-to-HTTP-to-HTTPS chain remains explicitly deferred.
|
||
Static-build success does not verify these deployed behaviors.
|
||
|
||
## Uncommitted extended Phase 10 technical QA — 2026-10-22
|
||
|
||
The signed baseline remains `e874b26bb9dc24beb6bce2e83a10e7800e7e12b9` on
|
||
`faithful-astro-migration`; this section records uncommitted verification and
|
||
must not be treated as an accepted checkpoint. The local Phase 9 batches for
|
||
counter isolation, off/mock form infrastructure and Contabo release planning
|
||
were revalidated. Two bounded responsive defects were corrected: mobile
|
||
PageHero headings now fit their available width, and the Library two-column
|
||
grid allows its primary track to shrink at tablet width.
|
||
|
||
The final guarded Chromium pass opened 128/128 staging routes. The responsive
|
||
matrix passed 110/110 checks across 22 routes at 320/390/768/1024/1440px.
|
||
Four Leaflet GET requests were intercepted before transmission; no production
|
||
API, Jotform, Contabo form, analytics, advertising or WebSocket request was
|
||
transmitted. The normal staging artifact has 128 noindex,nofollow pages, an
|
||
empty sitemap and zero hreflang; the indexing artifact has 127 pages, 109
|
||
sitemap URLs and 180 hreflang links, with the temporary `/lp` review index
|
||
excluded.
|
||
|
||
New local verification tools and reports are described in the Phase 10 audit,
|
||
browser, release-rehearsal and technical-readiness reports. A loopback Node
|
||
release rehearsal passed atomic switch and rollback. nginx, Contabo topology,
|
||
real screen-reader, non-Chromium, fluent-language, clinical, privacy/legal and
|
||
all P9 owner decisions remain pending. No checkpoint SHA is assigned to this
|
||
uncommitted work; the next signed SHA must come from the user's Git history.
|
||
|
||
## Next: Phase 9 — Human-Decision Gates
|
||
|
||
Begin from the commit containing this handoff update; obtain its actual SHA from
|
||
Git history and verify branch, history and working tree. Review
|
||
[P9-01 through P9-10](phase-9-decision-register-2026-10-14.md)
|
||
and gather evidence/owner decisions before proposing bounded implementation:
|
||
landing-page ownership; portal security/access; forms/APIs; likes/views isolation;
|
||
analytics/consent/Ads; clinical/organizational claims; policy/legal/provenance;
|
||
author SEO; hosting/rollback; production authorization. All ten remain **Pending decision**.
|
||
Do not infer approval from a technically feasible option or this checkpoint.
|
||
|
||
Use the [nonproduction plan](phase-7-nonproduction-verification-plan-2026-10-14.md)
|
||
and [reviewer procedure](phase-8-host-browser-verification-2026-10-14.md) for remaining
|
||
human acceptance. No hosted preview before approved fail-closed integration
|
||
isolation. Phase 10 retains final QA, deployed routing/integration tests,
|
||
rollback rehearsal and cutover readiness. Neither phase is authorized for live
|
||
changes by this handoff. The user separately authorizes each implementation scope.
|
||
|
||
## Working protocol and protected local files
|
||
|
||
Preserve the Markdown-first manifest-driven architecture, explicit translation
|
||
relationships and ratified publication policies. Implement only authorized scope;
|
||
report evidence and structural diffs before checkpoint actions. Follow
|
||
`AUTONOMOUS-CODEX.md`; do not repair identity/signing or bypass sandbox restrictions.
|
||
|
||
Do not read, modify, move, delete, stage or checksum root `merge-plan.md`.
|
||
|
||
### Reconciliation archive — 2026-10-28
|
||
|
||
The owner explicitly superseded the former local-preservation instruction for
|
||
the seven untracked reconciliation artifacts below. They were all confirmed
|
||
untracked and moved, without overwrite, to the local archive outside this Git
|
||
repository:
|
||
|
||
`/home/alice/projects/wrk/aia/local-archives/azinstitute4autism-route-reconciliation-2026-10-28`
|
||
|
||
- `route-reconciliation-2026-10-11-offline.json`
|
||
- `route-reconciliation-2026-10-12-offline.json`
|
||
- `route-reconciliation-2026-10-13-offline.json`
|
||
- `route-reconciliation-2026-10-13-offline-06-16-06-857Z.json`
|
||
- `route-reconciliation-2026-10-20-offline.json`
|
||
- `route-reconciliation-2026-10-20-offline-18-04-39-776Z.json`
|
||
- `route-reconciliation-2026-10-22-offline.json`
|
||
|
||
They remain excluded from Git because they are superseded intermediate or
|
||
local-only evidence. Filename-reference review found historical report links
|
||
only; no runtime, test, build or audit dependency. The tracked final evidence
|
||
remains `route-reconciliation-2026-10-20-offline-18-37-43-828Z.json` and
|
||
`route-reconciliation-2026-10-22-offline-05-10-47-827Z.json`. Historical
|
||
reports may retain filename references as their contemporaneous record; no
|
||
active dependency remains unresolved. The four October 11–13 files were moved
|
||
under this explicit authorization without parsing or checksumming their
|
||
contents.
|
||
|
||
Exclude root `merge-plan.md` and temporary `.phase8-stage-paths.nul` as well.
|
||
The old `.phase7-stage-paths.nul` is absent; do not recreate it.
|
||
The staging aid is for the user's host terminal only; never stage it or use a
|
||
broad Git add. The actual future checkpoint SHA comes from Git after the user
|
||
signs; do not amend merely to insert it here.
|
||
|
||
## Consolidated service drawers and portal checkpoint, 2026-10-30
|
||
|
||
This section supersedes earlier explicit-only drawer behavior. The checkpoint
|
||
containing this update adds four-second/50%-scroll consultation opening, one
|
||
shared 30-day localStorage expiry preference, manual override through the six
|
||
existing EN/ES service CTAs, and typed bilingual service introductions. The
|
||
Academy configuration is prepared without a new page. The fixed seven production
|
||
and separate nine consultation-test route lists remain unchanged. Consultation
|
||
indexing approval must explicitly be `false`.
|
||
|
||
The employee route now has a locked, local-decryption UI and a private owner-run
|
||
collection/rewrite utility. Real passphrases were unavailable: real portal
|
||
content/resource inventory and collection remain blocked pending the owner-run
|
||
step. Do not claim approximately 43 resources as a measured inventory. Do not
|
||
commit the original source, ciphertext, decrypted views or private resources.
|
||
`www/private/employee-portal/` is ignored and outside Astro public output.
|
||
The accepted Jotform CSS backup and reconciliation archives are unchanged.
|
||
|
||
SOPS/age/sops-nix preparation is inactive, with no generated production identity,
|
||
recipient, deployed module or server-access activation. Portal browser encryption
|
||
remains access friction; internal resources require separate server-enforced
|
||
staff/management authorization. See
|
||
[consolidated implementation and validation](phase-9-service-portal-consolidated-2026-10-30.md)
|
||
and [owner utility instructions](../integrations/employee-portal/README.md).
|
||
The actual checkpoint SHA is the commit containing this section; obtain it from
|
||
Git history. No push, deployment or cutover is authorized by this work.
|
||
|
||
## Focused completion, portal styling and Spanish diagnostic — 2026-10-30
|
||
|
||
Authorized consultation drawers now accept only the documented
|
||
`submission-completed` / `formID` envelope from their activated iframe window
|
||
at the exact configured Jotform origin while the drawer is open. Object and
|
||
bounded JSON-string envelopes are supported; other actions/messages are ignored.
|
||
Completion writes the existing global 30-day expiry immediately, reveals EN/ES
|
||
acknowledgment, then starts slide-out after five seconds. Manual dismissal or
|
||
navigation cancels the countdown. Duplicate completion cannot restart it.
|
||
The next deliberate opening replaces the completed iframe; incomplete forms
|
||
remain intact across ordinary close/reopen. Load remains fallback-only, never
|
||
submission evidence. Real provider-message acceptance requires one owner-run
|
||
synthetic submission; automated tests use intercepted local fixtures only.
|
||
|
||
Portal presentation now restores scoped blue headings, spacing, directories,
|
||
orange report buttons and accessible contact accents without retaining arbitrary
|
||
classes, styles or scripts. Two synthetic encrypted views are verified. Private
|
||
source exposed no plaintext class/CSS semantics, and real view codes were not
|
||
available; exact legacy button recognition and visual parity require owner review.
|
||
No private content/resource or ciphertext was added to Git or public output.
|
||
|
||
The reported seven-option Spanish consultation dropdown is an unresolved
|
||
Jotform configuration issue: generated EN/ES URLs have identical form ID and
|
||
`formContext=consultation`, differing only in `language`. Astro neither supplies
|
||
nor edits child dropdown options. Owner should compare the direct hosted Spanish
|
||
form and review multilingual option translations/Update Options conditions.
|
||
No account changes or real submissions were performed. Seven production and
|
||
nine isolated-test placements remain unchanged; production consultation, portal
|
||
cutover and site cutover remain unauthorized. See the
|
||
[focused correction evidence](phase-9-drawer-portal-corrections-2026-10-30.md).
|