Raw

Two items are blocking the build-phase price: the architecture diagram Fernway has not yet sent, and the approved-package list Aldergate has not yet delivered. Everything else on compliance is set.

**Confirmed rules:**
Security review is mandatory; penetration test scope is decided during the review (Q1, gate-review.xlsx). Dependency approval is case by case with no standard turnaround (Q4–Q5). Ireland-based work is approved; Lisbon is not mentioned in their policy and needs confirmation with S. Okafor, information security owner (Q6, sync-0709.md).

**Your move:**
The draft architecture diagram (ready since 11 August) unlocks Aldergate's answers on data storage, encryption, and logging—they said these "cannot be answered without an architecture diagram and design walkthrough" (Q7, gate-review.xlsx). Send it to S. Okafor.

**Their move:**
The approved-package list was promised 12 May and restated 9 July. It is 98 days overdue as of 18 August (R-11, risk register). Original owner D. Mercer; escalate through S. Okafor since R. Whitcombe has been the message relay (sync-0709.md).