Raw

You can lock in the build-phase price once you submit the draft architecture diagram to Aldergate and receive their approved-package list. Aldergate’s compliance office finished its initial questionnaire on 12 May and confirmed the baseline review process, but critical storage and dependency requirements remain blocked pending that diagram, and the package list has missed two deadlines without a new date.

**Confirmed requirements**
- A security review is mandatory before production, regardless of whether you use the internal hardening framework or undergo a penetration test `(gate-review.xlsx)`
- Critical dependencies are assessed case-by-case during the review rather than pre-approved `(gate-review.xlsx)`
- Remote work in Ireland is permitted, though Aldergate has not yet responded to your note about extending this to Lisbon `(gate-review.xlsx; sync-0709.md)`

**Outstanding items requiring action**
- Storage location, encryption standards, and logging specs are formally declined until you provide the architecture diagram and design walkthrough `(gate-review.xlsx; sync-0709.md)`
- The approved-package list remains outstanding; originally promised by D. Mercer on 12 May and reiterated by R. Whitcombe on 9 July, with no current ETA `(gate-review.xlsx; sync-0709.md; risk register)`
- Direct compliance access is restricted: S. Okafor owns information security but does not attend joint meetings, so all follow-ups must route through Whitcombe or be attached to the diagram submission `(sync-0709.md)`