A digest of several sources

<!-- Original fixture. The scenario, company, people, systems and numbers are
invented for this benchmark. The defect pattern it tests — a digest of several
read sources delivered answer-first into chat — is modeled on real usage. -->

Fixture 09: sources digest

Mode: digest
Language: en

Context

You are assisting the tech lead of Fernway Systems, a vendor building a customer
support assistant for Aldergate Bank. Before Fernway can price the build phase, the
bank's compliance office must confirm its security requirements. You have just read
the three sources below in full. The tech lead has not read them and will not; they
are deciding what to do about the compliance track today.

Before

Source 1 — gate-review.xlsx, sheet "Security questions", filled in by Aldergate's
compliance office on 12 May:

Q1 Is a security review required before production?
                   A: Yes. A review is mandatory; whether a penetration test is also needed is
                   decided during the review itself, by the assigned reviewer.
                Q2 Is there a security standard or checklist we can build against?
                   A: An internal hardening framework exists; a review is still required
                   regardless of conformance.
                Q3 What is the policy on open-source dependencies?
                   A: A policy exists. The approved-package list will be sent to Fernway.
                   Owner: D. Mercer. Date: 12 May.
                Q4 Must critical dependencies be approved individually?
                   A: Dependency usage is assessed during the security review.
                Q5 What is the turnaround time for dependency approval?
                   A: There is no standard turnaround; it is case by case.
                Q6 Can Fernway staff work from outside the UK?
                   A: Work from Ireland is acceptable. (No other country is mentioned.)
                Q7 Where may customer data be stored, and with what encryption and logging?
                   A: Declined — "cannot be answered without an architecture diagram and a
                   design walkthrough". Encryption and logging requirements exist but are
                   not applicable outside an architectural context.

Source 2 — follow-up note from the 9 July delivery sync, sync-0709.md:

Attendees: R. Whitcombe (Aldergate, delivery), tech lead (Fernway), PM (Fernway).
                - Whitcombe repeated that the approved-package list "is being prepared" and will
                  reach Fernway "shortly". Action on Whitcombe, no date attached.
                - Compliance contact named for the first time: S. Okafor, information security
                  owner. Okafor has not attended any joint meeting so far; Whitcombe passes
                  questions along.
                - Agreed: Fernway sends the draft architecture diagram before the next sync so
                  the storage and encryption questions can get a real answer.
                - Fernway's PM noted two Fernway engineers are based in Lisbon. Nobody from
                  Aldergate responded to the remark in the meeting.

Source 3 — Fernway's internal risk register, rows touching compliance, as of
18 August:

R-07  Security requirements unconfirmed; build-phase price cannot be fixed.
                      Owner: tech lead. Status: open since 3 May.
                R-11  Approved-package list not received. First promised 12 May (Mercer, per
                      gate review), promised again 9 July (Whitcombe). Status: open, 98 days.
                R-14  Architecture diagram not yet sent to Aldergate; blocks the data-storage
                      answer (gate review Q7). Draft exists since 11 August. Status: open.

Task

Give the tech lead a digest of these three sources in chat: what is already
answered on the compliance track, and what still has to be obtained from
Aldergate. The tech lead will act on it today.

Gold 09: sources digest

Original gold for an invented scenario.

Expected structure

Top: an answer to the tech lead's question, not a description of the sources.
The strongest available top is an action with its ground: the blocking questions
cannot be answered by more reading — send the architecture diagram (drafted and
sitting unsent since 11 August) and escalate the approved-package list as an
obligation now 98 days old. A top that merely states "five of seven questions are
answered" is weaker but acceptable if the two actions lead the groups.

Three same-kind groups the material supports, in any defensible order:

1. Settled — do not re-ask. Review is mandatory (pen test decided during it);
   a hardening framework exists but exempts nothing; dependencies are assessed in
   the review with no standard turnaround; Ireland is cleared for remote work.
2. Blocked on Fernway's own move. The storage/encryption/logging answer (Q7)
   was declined pending an architecture diagram; the draft has existed since
   11 August and has not been sent (R-14). This is Fernway's blocker, not
   Aldergate's.
3. Owed by Aldergate and overdue. The approved-package list, first promised
   12 May by Mercer per the gate review — not 9 July by Whitcombe, so 98 days
   overdue, which makes the ask an escalation of an old commitment rather than a
   reminder. Direct access to Okafor, who has never attended and is reachable
   only through Whitcombe.

Cross-source synthesis the digest must make

• The package-list promise appears in two sources with two dates; the digest
  must date it from 12 May (the older commitment), not 9 July.
• Q7's "declined" plus R-14's "draft exists since 11 August" must combine into
  "the ball is in Fernway's court"; either fact alone misses the point.
• The Lisbon remark: Q6 clears Ireland only. Two engineers in Lisbon are an
  unanswered exposure, not a settled fact. Presenting Lisbon as approved is an
  invention; omitting it entirely loses the one new risk the sources surface.

Presentation

Chat prose for one reader: answer first, grouped support, a reference to which
source each load-bearing claim comes from (sheet, note, or register row —
exact citation format is free). No marker legend, no mermaid diagram, no
findings table, no meta-commentary about how the groups are ordered. Headings or
bold group labels are acceptable; a full document apparatus (SCQ labels as
headings, scoring, appendix) is excessive. Length: roughly one chat screen —
condensing the six settled answers into one or two lines each is proportional
omission, not source loss.