Raw

Aldergate has settled the basic review mechanics (gate-review Q1–Q5), but build-phase pricing has been blocked since 3 May (risk R-07); the approved-package list, architecture-dependent data rules, and Lisbon access are still open (risk R-11, R-14; sync-0709).

**Settled**
- Security review is mandatory before production; any penetration test is decided during the review by the assigned reviewer (gate-review Q1).
- An internal hardening framework exists, but conformance does not remove the review requirement (gate-review Q2).
- A dependency policy exists; dependency usage is assessed during the security review, with no standard approval turnaround (gate-review Q3–Q5).
- Work from Ireland is acceptable; no other country was confirmed (gate-review Q6).

**Still needed from Aldergate**
- The approved-package list, promised by D. Mercer on 12 May and repeated by R. Whitcombe on 9 July without a date; risk R-11 is open at 98 days (gate-review Q3; sync-0709; risk R-11).
- A real answer on customer-data storage, encryption, and logging, which compliance declined to give without an architecture diagram and design walkthrough (gate-review Q7).
- Confirmation that Fernway engineers based in Lisbon may work on the project; the 9 July remark went unanswered, and Ireland is the only location confirmed (sync-0709; gate-review Q6).
- A direct route to S. Okafor, the information-security owner, who has not attended joint meetings while Whitcombe passes questions along (sync-0709).

**Do today**
- Send the draft architecture diagram, which has existed since 11 August, to unblock the storage/encryption answer (risk R-14; sync-0709).
- Ask Whitcombe for a dated commitment from Mercer on the approved-package list (risk R-11).
- Request written confirmation on Lisbon access and add Okafor to the security-review thread (sync-0709).