116 lines
7.0 KiB
Markdown
116 lines
7.0 KiB
Markdown
# Phase 10 — Technical Readiness Package
|
|
|
|
Date: 2026-10-22 UTC
|
|
Status: Technical handoff prepared; production gates remain open.
|
|
|
|
## Current decision — 2026-10-30: default-live Form A
|
|
|
|
The owner intentionally supersedes the earlier isolated-test and seven-route
|
|
production-gate architecture. `npm run dev` and `npm run build` now enable Form A
|
|
on exactly **16 approved placements**, including the publicly reachable
|
|
`aia.web3app.dev` environment. No additional approval flags or access restriction
|
|
are required. `PUBLIC_AIA_FORMS_MODE` is optional: absent/empty means `live`;
|
|
explicit `off` and `mock` remain available. Invalid/obsolete `isolated-test`
|
|
settings produce an actionable configuration error. The former approval flags
|
|
and form environment role are retired, not renamed.
|
|
|
|
Indexing and forms are independent. Both publication modes emit ten immediate
|
|
frames (two contact, five landing, three consultation) and six deferred bilingual
|
|
service-drawer frames. The bounded registry fixes ID `262946078314059`, HTTPS
|
|
origin, context and language. Forms B/C are not activated; physical B is retired.
|
|
|
|
Live drawers retain four-second/50%-scroll opening, shared 30-day suppression,
|
|
manual CTA override, deferred loading, verified completion acknowledgment for
|
|
five seconds, animated dismissal and fresh-form reopening. Off mode does not
|
|
automatically show inactive drawers. All iframe security/fallback behavior is
|
|
preserved. Employee-portal preview remains independently gated by explicit local
|
|
approval, valid private ciphertext input and non-indexing output; Form A cannot
|
|
authorize private content. No portal private resources enter normal artifacts.
|
|
|
|
This owner authorization does not modify Jotform, authorize site cutover or
|
|
complete pending consultation-language, provider-event, accessibility, runtime
|
|
telemetry/privacy, recipient-routing or hosting acceptance. See the
|
|
[current operating guide](../integrations/jotform/README.md) and
|
|
[implementation and validation report](phase-9-form-a-default-live-2026-10-30.md).
|
|
Earlier dated decisions and test results below are historical evidence, not
|
|
current environment setup instructions.
|
|
|
|
The following acceptance matrix records the original October 22 results; see the new report for October 30 validation.
|
|
|
|
## Acceptance matrix
|
|
|
|
| Area | Evidence | Result | Human/owner gate |
|
|
| --- | --- | --- | --- |
|
|
| Astro type/check | `npm run check` | Pass, 130 files, 0 diagnostics | None for local build |
|
|
| Content/publication | Markdown 20, publication 33, SEO 35, Library 53, routes 10 | Pass, 151 core tests | Content/clinical approvals remain separate |
|
|
| Phase 8/campaign/P9 isolation | Phase 8 5, campaign 11, P9 nonproduction 5 | Pass | Language, screen-reader and stakeholder review pending |
|
|
| Artifact integrity | staging/indexing verifier | Pass; 128/127 routes, staging 0/0 sitemap/hreflang | Hosting owner verification pending |
|
|
| Browser all-route | 128/128 opened | Pass | Non-Chromium and authorized visual review pending |
|
|
| Responsive | 110/110 checks | Pass | Human visual acceptance pending |
|
|
| Release rehearsal | Node loopback switch/rollback | Pass | nginx/Contabo rehearsal pending |
|
|
| Link/image/blog audits | all three audits | Pass, zero findings | None for local audit |
|
|
| Offline reconciliation | explicit 2026-10-22 evidence check | Pass; no fresh production crawl | Source freshness remains qualified |
|
|
| Screen reader | no real session in this environment | Pending | Authorized AT reviewer |
|
|
|
|
## Reproducible validation commands
|
|
|
|
From `www`:
|
|
|
|
```sh
|
|
TMPDIR=/tmp npm run check
|
|
npm run test:markdown
|
|
npm run test:publication
|
|
npm run test:seo
|
|
npm run test:library
|
|
npm run test:routes
|
|
node --test tools/phase8.test.mjs
|
|
node --test tools/campaign.test.mjs
|
|
node --test tools/phase9-nonproduction.test.mjs
|
|
node --test tools/phase10-artifact.test.mjs
|
|
npm run build
|
|
PUBLIC_ALLOW_INDEXING=true npm run build
|
|
node tools/phase10-artifact-verify.mjs --mode=indexing --forms=live
|
|
npm run build
|
|
npm run audit:links
|
|
npm run audit:images
|
|
npm run audit:blog
|
|
node tools/phase10-artifact-verify.mjs --mode=staging --forms=live
|
|
node tools/phase10-release-rehearsal.mjs
|
|
```
|
|
|
|
The final normal staging build was restored after the indexing build. The explicit offline route reconciliation `reports/route-reconciliation-2026-10-22-offline-05-10-47-827Z.json` passed its read-only consistency check using saved request evidence; no unrestricted crawl occurred.
|
|
|
|
## Phase 10 cutover prerequisites
|
|
|
|
1. Record a locked Node/npm/toolchain and reproducible artifact manifest.
|
|
2. Obtain sanitized Contabo/NixOS/nginx/TLS/DNS/Cloudflare facts.
|
|
3. Verify host-local serving, canonical host, redirects, 404s, cache headers and rollback on an approved staging host.
|
|
4. Default-live Form A is owner-authorized on exactly 16 placements, including public development hosting. No approval flags remain; indexing is independent. Final accessibility, Spanish options/provider-event, runtime privacy and marketing-recipient operational review remain open. Form C remains unimplemented. Site cutover still needs release authorization.
|
|
5. Obtain P9-04 counter origin/credential/consent approval before a live adapter.
|
|
6. Resolve P9-05 analytics/advertising measurement and P9-07 privacy/legal approval.
|
|
7. Obtain P9-06 clinical/organizational and fluent-language approvals, including Arabic diagrams and Spanish HSA/FSA claims.
|
|
8. Complete real screen-reader and authorized visual/non-Chromium acceptance.
|
|
9. Name release/rollback owners and record backup/monitoring readiness.
|
|
10. Obtain P9-10 go/no-go authorization; then run Phase 10 cutover and post-cutover smoke checks.
|
|
|
|
## Decision status
|
|
|
|
P9-01 through P9-10 remain **Pending decision**. No technical feasibility result in this package is an approval. Default-live Form A is explicitly owner-authorized. Counters, analytics, advertising, Form C, private portal serving and hosting activation remain separate and unauthorized by this package.
|
|
|
|
## Recommended checkpoint boundaries
|
|
|
|
Keep the existing Phase 9 implementation, audit tooling and reports as one owner-reviewed technical batch. If a signed checkpoint is requested, stage exact paths only after reviewing the final status and reports. Keep any subsequent host rehearsal, Jotform configuration, counter live adapter and measurement work in separately authorized commits.
|
|
|
|
## 2026-10-30 portal and secrets preparation addendum
|
|
|
|
The local portal compatibility implementation does not close P9-02 or P9-09.
|
|
The owner must supply legitimate codes privately to collect and classify legacy
|
|
resources, accept the two decrypted views, approve delivery per resource and
|
|
verify server-side staff/management separation. SOPS preparation is an inactive
|
|
[module and operational guide](../integrations/nixos/README.md), not deployed
|
|
infrastructure. Real age recipients, host topology, access policy, recovery and
|
|
runtime key provisioning remain pending. Do not copy `private/` into a release.
|
|
The artifact verifier now rejects private resource paths and portal ciphertext
|
|
from release artifacts. A local ciphertext preview is deliberately not a
|
|
releasable artifact. No site cutover authorization is implied.
|