Raw

Compliance is not yet sufficient to price the build: send Aldergate the draft architecture today and secure named-owner responses on packages, architecture requirements, and Lisbon access.

Already answered: a security review is mandatory before production; any penetration test and critical-dependency assessment are decided within that review; an internal hardening framework and open-source policy exist; Ireland-based work is acceptable.

Still needed from Aldergate: the approved-package list (overdue since 12 May; now with R. Whitcombe), data-storage/encryption/logging requirements after the architecture walkthrough (contact S. Okafor), and explicit approval for Fernway engineers working from Lisbon. No standard dependency-approval turnaround is available.

```mermaid
flowchart TD
    A["Compliance is not yet sufficient to fix build pricing"] --> B1["Known review and dependency-policy rules"]
    A --> B2["Obtain the overdue approved-package list"]
    A --> B3["Obtain architecture-specific data controls"]
    A --> B4["Confirm whether Lisbon-based staff may work"]
    B1 --> C11["Security review is mandatory; Ireland is acceptable"]
    B2 --> C21["Promised 12 May and again 9 July"]
    B3 --> C31["Send existing draft architecture diagram today"]
    B4 --> C41["Lisbon was mentioned but not answered"]
```