Timeline and Dependencies

This document maps dependencies between epics and tasks across all Integration Architecture projects. Use this to identify the critical path, parallel work opportunities, and blocking relationships.

---

---

Epic-to-Epic Dependencies

Critical Path (must be built in order)

Gateway Foundation
        │
        ├──► Authentication System
        │         │
        │         ├──► Rate Limiting and Quotas
        │         │
        │         └──► Error Handling and Resilience
        │
        ├──► Containerization
        │         │
        │         └──► CI/CD Pipeline
        │
        └──► REST API Design
                  │
                  ├──► API Documentation
                  │
                  └──► Inbound/Outbound Webhooks
                            │
                            └──► Observability Pipeline
                                      │
                                      └──► Security Hardening

Dependency Matrix

Epic	Depends On	Blocked By	Enables
API Gateway Core
Gateway Foundation	—	—	Auth, Error Handling, Rate Limiting
Authentication System	Gateway Foundation	—	Rate Limiting, Connectors
Error Handling and Resilience	Gateway Foundation	—	Connectors, Webhooks
Rate Limiting and Quotas	Authentication System	—	Production readiness
API Surface
REST API Design	Gateway Foundation	Salesforce custom fields	API Documentation
API Documentation	REST API Design	—	Consumer integration
Webhook Infrastructure
Inbound Webhook Processing	Gateway Foundation, Auth	—	Event processing
Outbound Webhook Delivery	Gateway Foundation, Auth	—	Consumer notifications
Observability and Security
Observability Pipeline	Gateway Foundation	—	Alerting, Health checks
Security Hardening	Auth, Rate Limiting	—	Production readiness
Deployment and Operations
Containerization	Gateway Foundation	—	CI/CD Pipeline
CI/CD Pipeline	Containerization	—	Production deployment
Salesforce Connector Production Readiness	Auth, Error Handling, Rate Limiting	Salesforce custom fields	Full API functionality

---

Task-Level Dependencies Within Epics

Gateway Foundation

Task	Depends On	Notes
Build stateless request routing	—	Start here
Implement connector abstraction	Routing
Build request flow pipeline (9 steps)	Connector abstraction
Implement Salesforce connector	Connector abstraction
Add partner/payment connector stubs	Connector abstraction	Can parallel with Salesforce

Authentication System

Task	Depends On	Notes
Implement inbound consumer auth (API key)	Gateway Foundation
Build per-consumer credential management	Inbound auth
Implement key rotation with grace window	Credential management
Implement outbound vendor auth (JWT Bearer)	Gateway Foundation	Parallel with inbound
Build token refresh worker	Outbound auth
Implement JWT token cache in Redis	Token refresh
Store credentials in Doppler	Credential management
Add mTLS option	Inbound auth	Can parallel with key rotation

Error Handling and Resilience

Task	Depends On	Notes
Implement error categorization	Gateway Foundation
Build bounded retry strategy	Error categorization
Implement idempotency key requirement	Redis setup
Build circuit breaker	Error categorization
Implement uniform error response shape	Error categorization	Parallel with circuit breaker

Rate Limiting and Quotas

Task	Depends On	Notes
Implement per-consumer inbound limits	Authentication
Build per-resource outbound quota tracking	Connectors
Implement Salesforce per-user connection pool	Quota tracking
Build pre-flight budget check	Quota tracking
Implement backpressure with 429 + Retry-After	Inbound limits

REST API Design and Implementation

Task	Depends On	Notes
Implement versioned REST API (/v1)	Gateway Foundation
Build Members endpoint	REST API, Salesforce connector	Blocked on SF custom fields
Build Quotes CRUD	REST API, Salesforce connector	Blocked on SF custom fields
Build Bookings CRUD	REST API, Salesforce connector	Blocked on SF custom fields
Implement health endpoint	REST API	Can parallel with others
Implement cursor-based pagination	REST API

Inbound Webhook Processing

Task	Depends On	Notes
Implement webhook termination point	Gateway Foundation, Auth
Build signature verification	Auth
Implement deduplication via event ID	Redis
Build async processing pipeline	Queue setup
Return 202 Accepted	Pipeline

Outbound Webhook Delivery

Task	Depends On	Notes
Implement event subscription model	Gateway Foundation
Build vendor-specific subscription handling	Connectors
Normalize event format	Subscription model
Implement at-least-once delivery	Normalized format
Build idempotency keys on delivery	Delivery

Observability Pipeline

Task	Depends On	Notes
Implement OpenTelemetry tracing	Gateway Foundation
Build structured JSON logging	Tracing
Implement 8 defined metrics	Tracing, Logging
Build alert rules	Metrics
Implement health endpoint with external check	Metrics

Security Hardening

Task	Depends On	Notes
Implement PII field-level scrubbing	Logging
Build audit log of PII access	Scrubbing
Enforce TLS 1.2 minimum	—	Can start early
Implement webhook replay protection	Webhooks
Build input validation against JSON Schema	Gateway Foundation

Containerization

Task	Depends On	Notes
Build multi-stage Dockerfile	Gateway Foundation
Implement health/readiness checks	Health endpoint
Configure environment-based secrets	Doppler

CI/CD Pipeline

Task	Depends On	Notes
Build lint and unit test stages	—	Can start early
Build integration test stage	SF sandbox
Implement container build and push	Dockerfile
Build staging deployment	Container build
Implement manual approval gate for prod	Staging deployment

Salesforce Connector Production Readiness

Task	Depends On	Notes
Complete endpoints blocked on SF custom fields	Auth, REST API	External blocker
Move JWT private key to Doppler	Doppler
Implement per-environment credentials	Credential management
Build rate limiting and quota tracking	Rate Limiting epic

---

Parallel Work Opportunities

Wave 1 (can start immediately)

• Gateway Foundation (routing, connectors, pipeline)
• Containerization (Dockerfile)
• CI/CD Pipeline (lint, unit tests)

Wave 2 (after Gateway Foundation)

• Authentication System (inbound + outbound)
• Error Handling and Resilience
• REST API Design
• Observability Pipeline

Wave 3 (after Wave 2)

• Rate Limiting and Quotas (needs Auth)
• API Documentation (needs REST API)
• Inbound/Outbound Webhooks (needs Auth)
• Security Hardening (needs Auth + Logging)

Wave 4 (after Wave 3)

• Salesforce Connector Production Readiness (needs Auth + Rate Limiting)
• Integration Testing (needs all above)

Wave 5 (after Wave 4)

• Production Deployment

---

Critical Path Summary

The minimum viable path to a production-ready API Gateway:

1. Gateway Foundation (routing, connectors, pipeline)
2. Authentication System (API key + JWT Bearer)
3. Error Handling and Resilience (retry, circuit breaker)
4. Containerization (Dockerfile)
5. CI/CD Pipeline (build, test, deploy)
6. Observability Pipeline (tracing, logging, metrics)
7. Rate Limiting and Quotas (production requirement)
8. Production Deployment

Estimated critical path: ~8-10 weeks if fully staffed and unblocked.

---

Risk Areas

Risk	Impact	Mitigation
Salesforce custom fields block endpoints	High	Start non-SF endpoints first, escalate SF field creation
Redis is critical dependency	High	Provision Redis early, use managed service
Doppler integration delayed	High	Use env vars for dev/staging, plan migration
On-disk JWT key in spike	High	Move to Doppler before production
Rate limiting not in spike	Medium	Build rate limiting early in Wave 2
Partner API integration delays	Medium	Use connector stubs, integrate incrementally