Raw

Compliance is not ready to support a fixed build-phase price: the mandatory review path is clear, but Aldergate must still provide the approved-package list and architecture-specific data controls, and confirm whether Lisbon-based staff may work on the project. [risk register R-07, R-11, R-14]

**Already answered**

- A security review is mandatory before production; the reviewer will decide whether a penetration test is needed. Conformance with Aldergate’s internal hardening framework does not replace that review. [gate review Q1–Q2]
- Dependencies will be assessed during the review, with no standard turnaround time. [gate review Q4–Q5]
- Fernway staff may work from Ireland. [gate review Q6]

**Obtain from Aldergate**

- The approved-package list: it was first promised for 12 May and was still only “being prepared” on 9 July; it remained outstanding for 98 days as of 18 August. Ask Whitcombe to secure a dated delivery commitment from the security owner, S. Okafor. [gate review Q3; sync-0709; risk register R-11]
- Storage, encryption, and logging requirements: Aldergate will not answer without an architecture diagram and design walkthrough. Fernway already has a draft dated 11 August, so send it now and request the walkthrough. [gate review Q7; sync-0709; risk register R-14]
- A ruling on Portugal: only Ireland is explicitly approved; Aldergate did not respond when two Lisbon-based engineers were mentioned. Get written confirmation before assigning them. [gate review Q6; sync-0709]