Raw

Compliance is not yet ready to support a fixed build-phase price: the mandatory review is confirmed, but Aldergate still needs to provide the package, architecture-specific, and location decisions.

Already answered:
- A security review is mandatory before production; the assigned reviewer will decide whether a penetration test is required.
- Aldergate has an internal hardening framework, though conformance does not replace the review.
- Fernway staff may work from Ireland.
- Dependency use, including critical dependencies, will be assessed during the review.

Still needed from Aldergate:
- The approved-package list and a named date for delivery. It was promised on 12 May and again on 9 July but remains outstanding after 98 days.
- Storage, encryption, and logging requirements after Aldergate reviews Fernway’s architecture diagram.
- Confirmation whether Fernway’s Lisbon-based engineers may work on the engagement; only Ireland has been explicitly approved.
- A direct working route to S. Okafor, Aldergate’s information-security owner, rather than relaying questions through delivery.

Act today:
- Send the architecture-diagram draft to Aldergate.
- Ask S. Okafor for the approved-package list, a turnaround expectation, and written confirmation on Lisbon access.