GDC contract redline - air-gapped scope only, FIPS module is priced (75K plus lab fee) or dropped, 14-day critical/high SLA with the clock starting when a patch is identified upstream

Situation

On 10/27 Peter reviewed the GDC amendment line by line with Kelly and resolved Nathan comments: scope narrowed to deployed in GDC air-gapped environments (not connected GDC); the FIPS loadable module is new work and not at no additional cost - 75K plus lab fee, which forces the 250K expense cap up, or Google drops it or it moves to the next round; accepted a 14-day SLA for critical and high CVEs with the clock starting when a patch is identified upstream (per Peter conversation with Tissa), with a communication plan owed before a patch exists - a mitigation plan and a communication are the same thing; dropped dev-build language and did not care about support duration for the build Google is leaving.

Reasoning

Every scope expansion is either priced or struck, and the fallback that they will just drop it shows most such asks evaporate once priced. Peter moves where the SLA clock starts instead of fighting the number: once a patch exists 14 days is easy, and the real risk (no upstream fix) is handled by communication. Resolving engineering comments in one sitting keeps the contract moving days before signature.

Additional Context

Confirmed by Peter without changes.

Observed Evidence

So just get rid of word module... If they want a module, it is additional work. / It is not the at no additional cost. / the clock starts... when a patch is identified upstream. / I think a mitigation plan and communication are the same thing. We can have a plan in 48 hours.

Confidence Breakdown

Reasoning Depth Analysis