Compliance is partly defined, but Fernway cannot fix build pricing until Aldergate confirms architecture-specific controls and releases its approved-package list. **Already answered** - A security review is mandatory before production; the assigned reviewer will decide during that review whether a penetration test is required. (`gate-review.xlsx`, Q1) - Aldergate has an internal hardening framework, but meeting it does not replace the required review. (`gate-review.xlsx`, Q2) - Ireland-based ...
$npx -y skills add welltraum/minto --skill raw --agent claude-code
Installs into .claude/skills of the current project.
Are you the author of Raw?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/welltraum-raw-3b587fdd)
Compliance is partly defined, but Fernway cannot fix build pricing until Aldergate confirms architecture-specific controls and releases its approved-package list.
**Already answered**
- A security review is mandatory before production; the assigned reviewer will decide during that review whether a penetration test is required. (`gate-review.xlsx`, Q1)
- Aldergate has an internal hardening framework, but meeting it does not replace the required review. (`gate-review.xlsx`, Q2)
- Ireland-based work is acceptable. (`gate-review.xlsx`, Q6)
- Dependency use, including critical dependencies, will be assessed in the security review; there is no standard turnaround time for approval. (`gate-review.xlsx`, Q4–Q5)
**Still needed from Aldergate**
- The approved-package list. It was first due from D. Mercer on 12 May and was again described as forthcoming by R. Whitcombe on 9 July, but remains outstanding after 98 days. (`gate-review.xlsx`, Q3; `sync-0709.md`; risk register R-11)
- Architecture-specific requirements for customer-data storage, encryption, and logging. Aldergate will not answer without an architecture diagram and design walkthrough. (`gate-review.xlsx`, Q7)
- Confirmation whether Lisbon-based Fernway engineers may work on the engagement; Aldergate only explicitly approved Ireland, and did not respond when Lisbon was raised. (`gate-review.xlsx`, Q6; `sync-0709.md`)
- Direct engagement with S. Okafor, the information-security owner, rather than relying on questions passed through Whitcombe. (`sync-0709.md`)
**Action today**
- Send the existing draft architecture diagram to Aldergate and request a design walkthrough with Okafor. The diagram has been ready since 11 August and currently blocks the storage-control answer. (risk register R-14)
- Ask Whitcombe/Okafor for a dated commitment on the approved-package list and written confirmation on Portugal-based staff.
