07 · Sequencing

Critical Path + Parallel Lanes

Dependency graph showing what blocks what, and what can run in parallel. The bold spine is the critical path — every day shaved from any node on it slips the whole release. Six quality gates punctuate the sequence.

Dependency graph · spine + parallel branches + gates Click to expand

Reading this graph

Bold path (black nodes, solid arrows) = critical path spine. Nothing ships without it.
Outlined nodes (dashed arrows) = parallel contributors. These unblock the spine but can be worked on concurrently by separate teams.
◆Gates are named pass/fail checkpoints. Definitions below.

Six gates · pass/fail checkpoints on the spine

G-F

W2 endFoundation

Exit: Tenancy + RBAC middleware live · audit-log writer live · seed loader live.
If missed: Every module downstream builds on an unfrozen spine.
Owner: Tech Lead

G-AZ

W3 midAuthorization engine

Exit: 7-step pipeline passes fuzzer · SoD matrix loaded · 18-role catalog frozen · step-up AAL enforced end-to-end.
If missed: Modules can write without safe guardrails → data-leak surface.
Owner: Security engineer

G-IC

W3 endIntegration contracts

Exit: Connector SDK frozen · check-rule schema frozen · event envelope + auto-evidence hook signed off.
If missed: W4 Module Wave teams build incompatible surfaces.
Owner: Tech Lead

G-MW

W6 endModule Wave complete

Exit: All four detailed modules merged to main · auto-evidence emitting · E2E smoke green.
If missed: Harden + UAT + RC windows compress.
Owner: Delivery Lead

G-S

W7 endSecurity sign-off

Exit: Internal review pass 2 complete · pen-test remediation closed · WCAG AA pass · REQ-PERF p95 met.
If missed: RC cannot be cut. Client UAT slips.
Owner: External security reviewer

G-U

W8 endClient UAT + RC

Exit: Client signs off v1.0-Core scope · upgrade rehearsal clean · RC1 published.
If missed: v1.0-Core delivery slips. Extended phase (W9) deferred.
Owner: Delivery Lead + client sponsor