55 lines
4.6 KiB
Markdown
55 lines
4.6 KiB
Markdown
# Phase 9 — Form A production-gate preparation
|
|
|
|
**Recorded:** 2026-10-28 UTC
|
|
**Scope:** local Astro configuration and static artifact verification for Form A (`262946078314059`)
|
|
**Status:** prepared locally; no environment was enabled, deployed or contacted.
|
|
|
|
## Required release configuration
|
|
|
|
The Form A iframe resolver enables an iframe only when every value below is present at build time:
|
|
|
|
```sh
|
|
PUBLIC_AIA_FORMS_MODE=live
|
|
PUBLIC_AIA_FORMS_LIVE_APPROVED=true
|
|
PUBLIC_AIA_FORMS_ENVIRONMENT=production
|
|
PUBLIC_AIA_FORM_A_PRODUCTION_APPROVED=true
|
|
```
|
|
|
|
`PUBLIC_ALLOW_INDEXING=true` is required for an indexing-enabled release artifact but is not an authorization gate. It cannot enable Form A by itself. Missing, invalid or mismatched values render the existing off-mode presentation.
|
|
|
|
The live gate accepts exactly seven routes: `/contact`, `/es/contact`, `/lp/aba-therapy`, `/lp/aba-insurance`, `/lp/aba-ahcccs`, `/lp/aba-private-pay`, and `/lp/early-intervention`. It preserves fixed `formContext` and locale values, fixed heights, `no-referrer`, `allow-forms allow-scripts allow-same-origin`, the first-party conditional hosted fallback and the fixed direct hosted URL.
|
|
|
|
## Deliberate exclusions
|
|
|
|
The production gate does not activate Forms B or C, service drawers, client consultation, referral workflows, native form actions, Jotform helper scripts, browser storage, Contabo forwarding, webhooks, analytics, advertising or production counters. Submissions remain direct browser-to-Jotform; Astro does not inspect the cross-origin frame or infer a conversion from a load event.
|
|
|
|
## Artifact and network verification
|
|
|
|
The production artifact verifier requires the exact Form A URL on each approved route and rejects Form A identifiers elsewhere. It rejects live Form A output in normal staging and plain indexing validation. The guarded browser runner accepts a `production` test mode but intercepts every non-loopback request before transmission; it records the attempted Jotform GETs and rejects POST, DELETE, WebSocket, API, analytics and advertising activity.
|
|
|
|
### Local results — 2026-10-28
|
|
|
|
- `astro check`: 137 files, zero diagnostics.
|
|
- Focused Form A, nonproduction and artifact tests: 20 passing tests, including production-gate and isolated-test artifact fixtures.
|
|
- Production-gated indexing artifact: 127 HTML routes, 109 sitemap URLs, 180 hreflang links, no `/lp` review index and exactly seven fixed Form A frames. The artifact verifier passed.
|
|
- Guarded Chromium production-gate run: 35 responsive/no-JavaScript checks across the seven routes at 320, 390, 768 and 1440px, plus four fallback-state checks. It recorded 38 attempted Jotform **GET** loads and blocked all 62 non-loopback requests before transmission; it made no form write, API, analytics or advertising request.
|
|
- Guarded Chromium isolated-test run: the same 35 checks and four fallback-state checks passed. Its 38 attempted Jotform **GET** loads were likewise blocked before transmission.
|
|
- Guarded Chromium off and mock runs: 28 route/viewport checks each passed. Neither emitted a Jotform request or iframe.
|
|
|
|
These are repository-side rendering and gate checks only. They do not reproduce the owner-reported direct or embedded synthetic submissions, inspect a cross-origin frame, or establish a deployed-environment acceptance.
|
|
|
|
## Operational checks before cutover
|
|
|
|
1. The release and hosting owners must compare the sanitized production environment to the four required settings above.
|
|
2. Confirm marketing-only notification routing remains intentional. This repository does not change notification recipients.
|
|
3. Record the exact ABA landing route used in the owner-reported embedded synthetic test.
|
|
4. Complete all-seven-route responsive, keyboard, screen-reader, language, validation-error and fallback acceptance.
|
|
5. Review Jotform runtime requests, telemetry, CSP, referrer and static-host logging with privacy/security owners.
|
|
6. Build both normal staging and the gated indexing-enabled release artifact, then run the artifact verifier and guarded browser test before release authorization.
|
|
|
|
## Rollback
|
|
|
|
Set `PUBLIC_AIA_FORMS_MODE=off` or remove any required live approval/environment value. Rebuild, verify the artifact contains no Form A iframe or identifier, and atomically switch to that reviewed static artifact. This disables the Astro embedding without changing the live site content or the Jotform account. It is not a substitute for the separate site rollback and Phase 10 release procedure.
|
|
|
|
No Jotform settings, forms, submissions, recipient routes, production API, DNS, hosting configuration, analytics or advertising were modified by this preparation.
|