Raw

**The one thing to do today: send the architecture diagram.** It has been drafted since 11 August (risk register R-14) and it is the only compliance blocker Fernway owns — the 9 July sync agreed it must arrive before the next sync so the storage, encryption and logging questions can get a real answer (`sync-0709.md`; gate review Q7 was declined outright without it). Everything else on the track is waiting on Aldergate, and two items have been waiting long enough to need escalating by name rather than chasing again.

**Already answered, treat as settled.** A security review before production is mandatory (Q1). An internal hardening framework exists to build against, though conforming to it does not remove the review (Q2). An open-source policy exists (Q3). Work from Ireland is acceptable (Q6).

**Waiting on Aldergate, and overdue.** The approved-package list was promised by D. Mercer on 12 May and again by R. Whitcombe on 9 July, both times with no date — 98 days open as of 18 August (R-11). S. Okafor was named as information security owner on 9 July but has never joined a joint meeting; Whitcombe relays questions second-hand. Since two chase attempts through Whitcombe have produced nothing, ask for the list from Okafor directly, or for a date from Whitcombe in writing.

**Two answers Aldergate will not give in advance, and they hit the price.** Whether a penetration test is required is decided by the reviewer during the review, not before it (Q1), and dependency approval has no standard turnaround — it is case by case, assessed inside the same review (Q4, Q5). So the build-phase price cannot be fixed as a single number while R-07 stays open (open since 3 May): either price the build with the pen test and dependency-approval delay carved out as separately-priced items, or hold the price until the review is scheduled.

**One unresolved exposure worth raising yourself.** Fernway's PM said on 9 July that two engineers are based in Lisbon, and nobody from Aldergate responded. The gate review approves Ireland and mentions no other country (Q6). Silence in a meeting is not approval — put Lisbon in writing alongside the diagram, before those engineers are staffed on work that touches bank data.