aia-website/www/reports/phase-9-jotform-verification-checklist-2026-10-18.csv

1	gate_id	subject	verification_required	owner_role	evidence_source	status	approval_date	authorization_required
2	JF-01	Question properties	Types, required flags, defaults, exact options, visibility, internal identifiers, field-level PHI	Account owner + operations/privacy; Builder properties, no answers	Owner-confirmed 2026-10-27 ChatGPT WebUI/Jotform review: Form A (262946078314059) submitted fields are PHI-protected; all other properties remain unverified	Partially verified — Form A field PHI protection only	2026-10-27	Separate batch authorization; no action authorized by this checklist
3	JF-02	Conditions	Show/hide, skip, calculations, update-field logic, conditional recipients and submission routing	Account owner; sanitized Conditions settings	Sanitized Builder configuration and owner approval; authorized runtime evidence where required	Pending/Unverified		Separate batch authorization; no action authorized by this checklist
4	JF-03	Languages	EN/ES support, complete translation, default/selector, errors, conditional logic, confirmation and embed locale behavior	Account owner + fluent reviewers; Builder plus later authorized runtime tests; never assume `?language=es`	Owner-confirmed 2026-10-28 direct-Jotform tests: English and Spanish rendering, language handling, and conditional email requirement verified; embedded-iframe language/validation/confirmation remains open	Partially verified — Form A direct language and conditional-email behavior	2026-10-28	Separate batch authorization; no action authorized by this checklist
5	JF-04	Emails	Notifications/autoresponders, recipient roles, subject/body/dynamic tags, attachments, reply-to, conditional routes, default IDs/links, inherited production recipients or defaults	Account/privacy owner; sanitized settings, no recipient addresses in public reports	Owner-confirmed 2026-10-28 direct-Jotform tests: generic staff notification contained no submitted answers or PDF attachment; staff notification and family autoresponder delivered; fixed hidden Reply-To verified in Thunderbird. Recipient roles, routing/defaults and embedded-runtime acceptance remain open	Partially verified — Form A generic messages, delivery and fixed Reply-To	2026-10-28	Separate batch authorization; no action authorized by this checklist
6	JF-05	Thank-you behavior	Native confirmation, redirects, answer echo, all targets, HTTP POST forwarding	Account/privacy owner; Builder; submission-data POST to Astro/Contabo OFF	Owner-confirmed 2026-10-28 direct-Jotform tests: native thank-you behavior verified. Redirect, answer echo, POST-forwarding settings and Astro-embedded confirmation remain open	Partially verified — Form A direct native thank-you	2026-10-28	Separate batch authorization; no action authorized by this checklist
7	JF-06	Integrations	Integrations, webhooks, exports, destinations, Google/analytics, protected-data flows	Account/security/privacy owner; actual integration inventory, not cloning assumptions	Owner-confirmed 2026-10-27 ChatGPT WebUI/Jotform review: Form A has no webhooks or integrations; export/default/vendor behaviors beyond that reported review remain unverified	Verified — Form A webhooks/integrations absent	2026-10-27	Separate batch authorization; no action authorized by this checklist
8	JF-07	Security and availability	HIPAA/form/field protection, spam, availability, prefill, save/continue, access, retention, limits and duplicates	Account/privacy/security owner; settings and approved operational policy	Owner-verified 2026-10-27: privacy approval covers Form A PHI protection, generic no-PHI notification, no PDF attachment, no webhooks/integrations, recipient access and retention/deletion; other security/availability controls remain unverified	Partially verified — Form A approved configuration, access and retention scope	2026-10-27	Separate batch authorization; no action authorized by this checklist
9	JF-08	Embedding	Approved HTTPS origin, hosted/iframe URLs, dimensions/mobile, scripts, referrer, locale and fallback	Account/hosting/accessibility owners; exported code and later authorized runtime evidence	Repository evidence 2026-10-28: fixed Form A origin/URLs, no-referrer policy, minimal sandbox, localized conditional hosted fallback and seven-route isolated-test gate. Owner reports embedded synthetic submission/confirmation on EN contact, ES contact and one ABA landing placement; exact third route and all-seven-route keyboard/responsive/runtime-network acceptance remain open	Partially verified — owner-reported sampled embedded acceptance plus adapter/fallback	2026-10-28	Separate batch authorization; no action authorized by this checklist
10	JF-09	Controlled synthetic acceptance	Actual EN/ES synthetic submission, notifications, success/failure, redirects and privacy boundary	Later separately authorized isolated form/environment; never real patient data	Owner-confirmed 2026-10-28 direct-Jotform EN/ES and sampled Astro-iframe synthetic submissions with native thank-you and notification/autoresponder delivery. Functional submission acceptance is complete for the reported samples; exact ABA landing route, all-seven-route runtime/privacy and production-release acceptance remain open	Owner-verified — Form A functional submission samples	2026-10-28	Separate batch authorization; no action authorized by this checklist
11	OA-01	Intake/operations	Minimum fields, required flags/contact preference consistency, follow-up/callback expectations, Tour/fundraising scope	Intake/operations	Dated owner approval with scope and sanitized supporting evidence	Pending/Unverified		Separate batch authorization; no action authorized by this checklist
12	OA-02	Clinical leadership	Eligibility, service/evaluation availability, private-pay Social Club distinction, referral boundary and approved claims	Clinical leadership	Dated owner approval with scope and sanitized supporting evidence	Pending/Unverified		Separate batch authorization; no action authorized by this checklist
13	OA-03	Jotform account owner	JF-01–08 for Form A consultation and Form C, Form C blank-form creation, actual configuration/ID and preservation of all existing forms	Jotform account owner	Dated owner approval with scope and sanitized supporting evidence	Pending/Unverified		Separate batch authorization; no action authorized by this checklist
14	OA-04	English/Spanish reviewer	Labels, errors, instructions, confirmations and locale switching; no automatic translation approval	English/Spanish reviewer	Dated owner approval with scope and sanitized supporting evidence	Pending/Unverified		Separate batch authorization; no action authorized by this checklist
15	OA-05	Privacy/legal/security	Protected fields, generic email/headers/recipients, embeds/referrers, vendor flows, access/retention and tracking boundaries	Privacy/legal/security	Owner-verified 2026-10-27 privacy approval for Form A PHI protection, generic no-PHI notification, no PDF attachment, no webhooks/integrations, recipient access and retention/deletion; embed/referrer runtime review and tracking boundaries remain open	Partially verified — Form A configuration, access and retention scope	2026-10-27	Separate batch authorization; no action authorized by this checklist
16	OA-06	Marketing	Deferred attribution categories and redesigned successful-submission semantics	Marketing	Dated owner approval with scope and sanitized supporting evidence	Pending/Unverified		Separate batch authorization; no action authorized by this checklist
17	OA-07	Hosting owner	Static/API separation, compile/deploy gates, CSP/referrer/log policy, preview isolation and fallback topology	Hosting owner	Dated owner approval with scope and sanitized supporting evidence	Pending/Unverified		Separate batch authorization; no action authorized by this checklist
18	OA-08	Release owner	Phase 10 integration activation, go/no-go, artifact/vendor rollback and deployment	Release owner	Dated owner approval with scope and sanitized supporting evidence	Pending/Unverified		Separate batch authorization; no action authorized by this checklist
19	FA-PRD-01	Form A production build gate	Confirm live mode, existing live approval, production environment role and independent Form A production approval are all set only in the intended release environment; verify no Form C or unrelated surface activates	Release + hosting owner	Repository configuration resolver and production-artifact test; no deployed environment configured	Implemented locally — deployment verification pending	2026-10-28	Phase 10 deployment authorization and sanitized environment review
20	FA-CONS-01	Form A consultation context	Verify fixed `consultation` presentation value, required service-interest question, five approved choices, conditional email/phone behavior, EN/ES translations and no additional collection; no diagnostic-evaluation explanatory note	Account + operations + clinical + privacy owners	Owner reports connected-app configuration; sanitized Builder configuration and approved synthetic test evidence still required; no ID/condition inferred by repository	Owner-reported configured — browser acceptance pending	2026-10-29	No Jotform mutation by repository; isolated-test route acceptance is separate from production authorization
21	FC-01	Form C referral initiation	Create only after authorization, then verify minimum professional fields, no patient data instruction, PHI controls, notification/retention and protected-workflow handoff	Account + operations + privacy owners	Sanitized Form C Builder configuration and approved synthetic test evidence	Pending/Unverified		Separate creation and synthetic-test authorization required
22	INV-01	Supplied roster provenance and remaining verification	Complete 27-ID roster received and uniqueness checked; verify uncertain generic titles and relevant operational classification with account owner without inferring usage or retrieving submissions	Jotform account owner	Owner-supplied read-only connector roster; contract v1.2 section 3 lists all 27 unique IDs; individual roster no longer outstanding; new-form configuration and usage verification pending	Pending/Unverified		Read-only metadata review authorization; no account mutation