Phase 1 · applies to both scenarios

Dependencies

What engineering is blocked on from other cofounders, and what blocks what internally. The build can be fully ready and still stuck on an external box below.

flowchart TB
    subgraph EXT["Owned by other cofounders"]
        direction TB
        state["Pilot state confirmed"]
        vendor["E-sig vendor selected + contracted"]
        brokerage["Pilot brokerage identified + contracted"]
    end

    subgraph FOUND["Engineering foundations (required week 1, both scenarios)"]
        direction TB
        cicd["CI/CD + IaC + security baseline"]
    end

    subgraph BUILD["Core build"]
        direction TB
        rules["Jurisdiction rules engine"]
        esig["E-sig integration"]
        td["Transitional Document"]
        mi["Merchant Integration"]
        mobile["Native mobile, all 5 portals"]
    end

    subgraph VERIFY["Verification"]
        direction TB
        qa["QA test pyramid"]
        pen["Security review / pen test"]
    end

    subgraph LAUNCH["Pilot"]
        onboarding["Onboarding design"]
        golive["Go / no-go"]
    end

    state --> rules
    vendor --> esig
    brokerage --> onboarding

    cicd --> rules
    cicd --> esig
    cicd --> td
    cicd --> mi
    cicd --> mobile

    td --> mi
    rules --> td
    esig --> td

    td --> qa
    mi --> qa
    mobile --> qa
    esig --> qa

    qa --> pen
    pen --> golive
    onboarding --> golive

    style EXT fill:#FFEBD3,stroke:#FFD199
    style FOUND fill:#ECEFF2,stroke:#DCE1E6

Reading it

Nothing in jurisdiction rules, e-sig, or onboarding can really start until its orange-box input lands — those three are owed by Compliance/GTM, not engineering
Nothing else starts meaningfully until the CI/CD + IaC + security baseline exists — that's the point of making it a required week-1 deliverable for the tech lead and founder, in both scenarios, not an afterthought squeezed in later
Transitional Document feeds Merchant Integration directly (gap-driven recommendations) — it should be built slightly ahead, not in lockstep
QA and the pen test gate go/no-go together with onboarding being ready — both have to be true, not either

Full Pilot's mobile node covers all 5 portals over 2–3 states' worth of jurisdiction rules; Lean Pilot runs the same graph over 1 state. The dependency shape itself is identical — see Scope for what's smaller in Lean Pilot.