Raw

Bottom line: the confirmed items define the security-review path, but build-phase pricing is blocked until you send the architecture diagram and obtain the package list, data-storage answer, and Lisbon ruling (gate-review Q1–Q7; sync-0709; risks R-07, R-11, R-14).

**Already answered**
- Security review is mandatory before production; whether a penetration test is needed is decided by the assigned reviewer during the review (gate-review Q1).
- An internal hardening framework exists, but a review is still required even if the build conforms to it (gate-review Q2).
- An open-source policy exists; dependency usage is assessed during the security review, with no standard individual-approval turnaround (gate-review Q3–Q5).
- Work from Ireland is acceptable; no other country was confirmed (gate-review Q6).

**Still needed from Aldergate**
- Customer-data storage, encryption, and logging requirements, declined until an architecture diagram and design walkthrough are provided (gate-review Q7).
- The approved-package list, promised by Mercer on 12 May and re-promised by Whitcombe on 9 July, still not received and open 98 days (gate-review Q3; sync-0709; risk R-11).
- A dated commitment for the package list and a scheduled design walkthrough; S. Okafor is the named information-security owner but has not attended a joint meeting (sync-0709; gate-review Q7).
- Confirmation for the two Fernway engineers based in Lisbon, raised on 9 July with no Aldergate response (sync-0709; gate-review Q6).

**Do today**
- Send the draft architecture diagram, existing since 11 August and agreed at the 9 July sync, to unblock the data-storage answer (risk R-14; sync-0709).
- Ask Whitcombe/Okafor for a dated package-list delivery, a walkthrough slot, and written confirmation on Lisbon (sync-0709; risk R-11; gate-review Q6).