Raw

Compliance is not yet ready to price: the mandatory review is confirmed, but Fernway still needs the approved-package list and architecture-specific data controls from Aldergate.

**Already answered**

- A security review is mandatory before production; the assigned reviewer will decide during that review whether penetration testing is required. Conformance with Aldergate’s internal hardening framework does not replace the review. [gate-review.xlsx, Q1–Q2]
- Dependency use, including critical dependencies, will be assessed in the security review. Work from Ireland is acceptable. [gate-review.xlsx, Q4, Q6]
- Aldergate has an open-source policy and an approved-package list exists in principle. [gate-review.xlsx, Q3]

**Obtain from Aldergate now**

- Get the approved-package list, with a committed delivery date and named accountable owner. It was first due from D. Mercer on 12 May and was still only “being prepared” on 9 July; it remains open after 98 days. [gate-review.xlsx, Q3; sync-0709.md; risk register R-11]
- Send the draft architecture diagram to unlock Aldergate’s answer on permitted data storage, encryption, and logging. The diagram has existed since 11 August but has not been sent; without it, Aldergate declined to specify these controls. [gate-review.xlsx, Q7; sync-0709.md; risk register R-14]
- Ask S. Okafor, Aldergate’s information-security owner, directly to confirm the architecture requirements, expected review path, and dependency-review turnaround. No standard turnaround exists, and questions have so far been relayed through delivery rather than answered by Okafor. [gate-review.xlsx, Q5; sync-0709.md]
- Obtain an explicit ruling on Fernway’s Lisbon-based engineers. Ireland is approved, but the sources provide no approval for Portugal and Aldergate did not respond when Lisbon staffing was raised. [gate-review.xlsx, Q6; sync-0709.md]

Until these points are closed, the build-phase price cannot be fixed. [risk register R-07]