Raw

The compliance track is stuck on Aldergate's side, not Fernway's — but you can unblock the biggest piece today by sending the architecture diagram, which has been sitting drafted since 11 August.

**Settled, no action needed:** a security review is mandatory before production (whether it includes a pen test is the reviewer's call, decided during the review itself); Aldergate's internal hardening framework doesn't replace that review; Lisbon is fine for Fernway staff to work from, same as Ireland — raised at the 9 July sync and never objected to.

**Blocking Fernway, ready to clear today:** the draft architecture diagram (`gate-review.xlsx` Q7, `sync-0709.md`) has existed since 11 August but hasn't been sent — send it now, since it's the one item entirely in Fernway's hands and it unlocks the storage/encryption/logging answer as well as dependency review, which also runs through the same security review (Q4).

**Blocking Aldergate, chase today:** the approved-package list has been promised twice with no delivery — 12 May by Mercer, 9 July by Whitcombe again "shortly," no date either time — and it's now open 98 days per the risk register (R-11); push for a firm date, ideally direct from S. Okafor, Aldergate's information security owner, who was named on 9 July but has never joined a call — Whitcombe has only been relaying to them. Dependency turnaround time is explicitly case-by-case, so don't wait on a timeline commitment there — go straight to the review.

**Net effect on pricing:** R-07 (build-phase price unconfirmed) stays open until the review happens, which itself is now gated on your diagram going out and Okafor engaging on the package list.