Raw

**Action Required Today:** Send the draft architecture diagram to Aldergate immediately to unlock the data storage and encryption answers, and escalate the approved-package list delay to force a delivery date; these are the only blockers preventing us from fixing the build-phase price.

**Outstanding Gaps**
• **Data storage & encryption:** Aldergate declined to answer without an architecture diagram (Gate Review Q7). A draft exists since 11 August but was not shared at the 9 July sync. Sending this diagram is the prerequisite for the storage answer.
• **Approved-package list:** 98 days overdue. First promised 12 May by D. Mercer, reiterated 9 July by R. Whitcombe with no date attached. Whitcombe reports it is "being prepared". We need a firm delivery date.
• **Remote work locations:** Aldergate confirmed Ireland is acceptable but gave no response when the PM noted two engineers are based in Lisbon. Lisbon approval is pending.
• **Dependency turnaround:** No standard turnaround time exists; assessments are case-by-case. The impact on project timeline and cost remains unknown.

**Confirmed Requirements**
• **Security review:** Mandatory before production. Whether a penetration test is needed is decided during the review by the assigned reviewer.
• **Hardening framework:** An internal framework exists, but a review is still required regardless of conformance.
• **Dependencies:** Usage is assessed during the security review.
• **Contacts:** Compliance contact is S. Okafor (information security owner); package list owner is D. Mercer.