Raw

The build-phase price still can't be fixed: three compliance items have sat open for months, and the one thing that would unblock two of them — the architecture diagram — has been sitting drafted on our side since 11 August without being sent.

**Send the architecture diagram now, and chase Mercer/Whitcombe/Okafor for the package list.** Sending the diagram is fully in our control and directly unblocks R-14 and, through it, the data-storage/encryption/logging question (gate review Q7) — the only requirement Aldergate hasn't just delayed but structurally can't answer without it. The dependency list, by contrast, has been "coming shortly" since 12 May (Mercer) and again 9 July (Whitcombe) with no date attached either time — 98 days open (R-11) — and Okafor, the actual information security owner, has never joined a call; Whitcombe has just been relaying. Worth asking Whitcombe to loop Okafor in directly rather than going through a third round of "shortly."

Two things are confirmed and need no further chasing: a security review before production is mandatory (pen-testing decided later, by the reviewer), and Ireland is an approved work location for our staff. One thing is a live risk, not yet raised: Whitcombe never responded when our PM mentioned the two Lisbon-based engineers on 9 July — worth confirming explicitly that Lisbon is fine before it surfaces as a problem at the review itself.

Bottom line for today: diagram out the door, and a direct push to get Okafor engaged on the package list — those are the two actions that move R-07 (the price-blocking risk) forward.