Raw

Pricing cannot be fixed until the approved-package list arrives (98 days overdue) and Fernway sends the architecture diagram to unlock the data-storage answer. The first requires chasing Aldergate; the second is ready to send now.

**Already confirmed** (gate-review):
- Security review is mandatory before production; pen test scope is determined during the review itself.
- Open-source dependencies are assessed during security review (no separate gate); approved-package list will be provided.
- Work from Ireland is approved.

**Awaiting from Aldergate:**
- Approved-package list — promised 12 May, restated 9 July (sync-0709), still not received. Owned by S. Okafor, the new compliance contact.
- Data-storage, encryption, and logging requirements — cannot be answered until Fernway's architecture diagram is reviewed (gate-review Q7).
- Clarity on non-Ireland work locations — Fernway has staff in Lisbon; the 12 May answer addresses only Ireland.

**Fernway's next move:**
Send the draft architecture diagram (ready since 11 Aug) before the next sync. This unlocks the storage answer and clears the pricing blocker.