{
  "slug": "project-status",
  "baseline_sha256": "fcaeb9ee85b88ea4d98d92b553efd23e8a1dd792bf36c8b5a48b5ab8ac71c6a1",
  "preview_sha256": "d8f0db0a085f20cf58bcdff20c04b1525e4e41f19fb17218cbfd7d41c16f484f",
  "source_text_nodes": 106,
  "text_node_multiset_equal": true,
  "missing_text_nodes": [],
  "added_text_nodes": [],
  "numeric_multiset_equal": true,
  "numeric_occurrences": 67,
  "keyed_record_checks": {
    "//body//p": true,
    "//body//h1": true,
    "//body//h2": true,
    "//body//h3": true,
    "//body//footer": true,
    "//body//dt": true,
    "//body//dd": true,
    "//body//th": true,
    "//body//td": true,
    "//body//figcaption": true,
    "//body//code": true,
    "milestones": true,
    "blockers": true,
    "asks": true,
    "scope": true,
    "counts": true
  },
  "links_unchanged": true,
  "source_svg_byte_identical": true,
  "svg_count": 0,
  "meter_style_values_unchanged": true,
  "added_labels": {
    "visible_DOM_text": [],
    "CSS_mobile_labels": {},
    "note": "Repeated existing table column headings via data-mobile-label/::before; no new factual copy. Only relevant labels are painted at mobile. All original table header text remains in the semantic DOM."
  },
  "all_pass": true,
  "original_records": {
    "//body//p": [
      "",
      "",
      "",
      "1 needs a decision this week",
      "100% · signed off 24 July, no changes since",
      "59% · target is 75 by the window opening",
      "84% · the remaining 17 are all access-related",
      "Break-glass only, or named exceptions with a quarterly review — both are built. The access review cannot close until one is chosen, and it is the last thing between us and 104 of 104 controls.",
      "Controls implemented87 / 104",
      "Decision by Marcus Lee & Security Needed by 19 September",
      "Decision by Priya Raman Needed by 12 September",
      "Evidence collected automatically61 / 104",
      "Needs: approval to run the test with our second vendor at +£9,400, or a decision to move the observation window to 15 November.",
      "Needs: countersignature from both vendors. Chased three times; escalate to their account teams if open on 22 September.",
      "Needs: the standing-access model signed off. Break-glass tooling has been built and tested since 2 September — this is waiting on a decision, not on engineering.",
      "Owner Dana WhitfieldOpen 11 days Blocks 2 milestones",
      "Owner LegalOpen 23 days Blocks nothing yet",
      "Owner Marcus LeeOpen 4 days Blocks Q3 access review",
      "Policies approved22 / 22",
      "Since last week: evidence automation closed on 21 August and the access review passed 60%. The pen test moved from 22 September to 6 October when the vendor reassigned our team — that one change is why this is amber.",
      "The penetration test is now the entire critical path. Our vendor cannot start before 6 October and the 10 October readiness assessment needs their report, so a two-week slip in the test is a two-week slip in the window. Everything else is on or ahead of schedule.",
      "The second vendor can start 22 September for £9,400 more. Doing nothing moves the window to 15 November, pushing the report past the two enterprise renewals that asked for it.",
      "complete · 1 in progress",
      "opens 1 November",
      "£61K of £90K"
    ],
    "//body//h1": [
      "SOC 2 Type II readiness"
    ],
    "//body//h2": [
      "At risk",
      "Blockers",
      "Milestones",
      "Needs a human",
      "Scope"
    ],
    "//body//h3": [
      "Approve the second pen-test vendor, or accept the slip",
      "Evidence automation",
      "Nine engineers still hold standing production access",
      "Observation window opens",
      "Pen-test vendor cannot start before 6 October",
      "Penetration test",
      "Policy set approved",
      "Q3 access review",
      "Readiness assessment",
      "Scope & control mapping",
      "Sign off the standing-access model",
      "Two subprocessors have no countersigned DPA"
    ],
    "//body//footer": [
      "Compiled 8 September 2026, 07:00 UTC from the compliance tracker, the access-review export and the project ledger. Milestone dates are committed dates, not forecasts; budget is spend to date against the approved £90,000."
    ],
    "//body//dt": [
      "Budget used",
      "Days to window",
      "Milestones",
      "Next review",
      "Open blockers",
      "Owner",
      "Reported",
      "Window opens"
    ],
    "//body//dd": [
      "1 Nov 2026",
      "15 Sep",
      "3",
      "3 of 7",
      "54",
      "68%",
      "8 Sep 2026",
      "Priya Raman"
    ],
    "//body//th": [],
    "//body//td": [],
    "//body//figcaption": [],
    "//body//code": [],
    "milestones": [
      [
        "12 JUN",
        "Scope & control mapping",
        "Done",
        "done"
      ],
      [
        "24 JUL",
        "Policy set approved",
        "Done",
        "done"
      ],
      [
        "21 AUG",
        "Evidence automation",
        "Done",
        "done"
      ],
      [
        "19 SEP",
        "Q3 access review",
        "In progress · 60%",
        "now"
      ],
      [
        "6 OCT",
        "Penetration test",
        "At risk · slipped 14d",
        "risk"
      ],
      [
        "10 OCT",
        "Readiness assessment",
        "Planned",
        null
      ],
      [
        "1 NOV",
        "Observation window opens",
        "Planned",
        null
      ]
    ],
    "blockers": [
      [
        "Pen-test vendor cannot start before 6 October Blocking",
        "Owner Dana WhitfieldOpen 11 days Blocks 2 milestones",
        "Needs: approval to run the test with our second vendor at +£9,400, or a decision to move the observation window to 15 November."
      ],
      [
        "Nine engineers still hold standing production access Blocking",
        "Owner Marcus LeeOpen 4 days Blocks Q3 access review",
        "Needs: the standing-access model signed off. Break-glass tooling has been built and tested since 2 September — this is waiting on a decision, not on engineering."
      ],
      [
        "Two subprocessors have no countersigned DPA Watching",
        "Owner LegalOpen 23 days Blocks nothing yet",
        "Needs: countersignature from both vendors. Chased three times; escalate to their account teams if open on 22 September."
      ]
    ],
    "asks": [
      [
        "01",
        "Approve the second pen-test vendor, or accept the slip",
        "The second vendor can start 22 September for £9,400 more. Doing nothing moves the window to 15 November, pushing the report past the two enterprise renewals that asked for it.",
        "Decision by Priya Raman Needed by 12 September"
      ],
      [
        "02",
        "Sign off the standing-access model",
        "Break-glass only, or named exceptions with a quarterly review — both are built. The access review cannot close until one is chosen, and it is the last thing between us and 104 of 104 controls.",
        "Decision by Marcus Lee & Security Needed by 19 September"
      ]
    ],
    "scope": [
      "Controls implemented87 / 104 84% · the remaining 17 are all access-related",
      "Evidence collected automatically61 / 104 59% · target is 75 by the window opening",
      "Policies approved22 / 22 100% · signed off 24 July, no changes since"
    ],
    "counts": [
      "Milestones3 of 7complete · 1 in progress",
      "Open blockers31 needs a decision this week",
      "Days to window54opens 1 November",
      "Budget used68%£61K of £90K"
    ]
  }
}