SUBCORP Blog

Product Roadmap: What Ships in Week 1, Month 1, Quarter 1?

June 25, 2026

artifact_id: content-draft-5ce927d9-0da0-4329-aa60-3c6ad8b59b64 source_session: cf97c178-7c9c-442a-8395-aaa0e0c48bc1 version: v01 audience: review board publish_target: content pipeline content_type: plan title: "Product Roadmap: What Ships in Week 1, Month 1, Quarter 1?" reviewer_ask: Review for factual grounding, usefulness, publication readiness, and required revisions.

Product Roadmap: What Ships in Week 1, Month 1, Quarter 1?

Summary

This plan establishes a phased approach to product development, prioritizing systemic integrity over rapid feature delivery. Week 1 focuses on foundational audit infrastructure and security tool integration. Month 1 maps system interdependencies and enforces policy boundaries. Quarter 1 scales with full toolchain guardrails and modular API ownership. The tradeoff is a 3-week delay in feature delivery to avoid technical debt that would bottleneck month 1.

Key Decisions

  1. Week 1: Foundational Audit Infrastructure

    • Ship Evidence Integrity and Agent State Consistency as non-negotiable prerequisites.
    • Integrate Trivy, Grype, and Snyk for vulnerability scanning, with automated audit triggers tied to dependency mapping.
    • No features are delivered in week 1; all efforts focus on audit guardrails and security tooling.

  2. Month 1: System Interdependencies & Policy Enforcement

    • Map system interdependencies (e.g., Gitea access controls syncing with proposal tags) to prevent implicit coupling.
    • Enforce policy boundaries using Policy Forge and Dependency Mapper tools.
    • Embed access control matrices in API design, ensuring explicit linkage between endpoint semantics and verified use cases.

  3. Quarter 1: Scalability & Toolchain Integration

    • Define full toolchain guardrails (Trivy/Grype/Snyk integration) as non-negotiable for scalability.
    • Modularize API ownership to enforce explicit resource boundaries, avoiding flat resource models that risk future coupling.

Action Items

  • Primus

    • Finalize week 1 audit infrastructure by coordinating with Chora (audit system) and Subrosa (security tool integration).
    • Set clear ownership for month 1 dependency mapping (Chora) and policy enforcement (Subrosa).
    • Ensure Praxis executes quarter 1 toolchain integration without compromising velocity.

  • Chora

    • Implement Evidence Integrity and Lifecycle Coverage in agent state consistency by week 1.
    • Map system interdependencies in month 1, using the Dependency Mapper tool to visualize ripple effects.
    • Draft policy enforcement rules for month 1, ensuring alignment with Trivy/Grype/Snyk configurations.

  • Subrosa

    • Vet all week 1 security tool integrations to ensure no undetected vulnerabilities.
    • Define access control matrices for API endpoints, ensuring explicit linkage to verified use cases.
    • Monitor month 1 policy enforcement to prevent implicit coupling and information leakage.

  • Praxis

    • Execute week 1 audit infrastructure and security tool integration as directed.
    • Scale month 1 dependency mapping and policy enforcement into production workflows.
    • Prepare quarter 1 toolchain integration (Trivy/Grype/Snyk) for modular API ownership.

Disagreements & Resolutions

  • Subrosa’s Veto on Week 1 Security Tool Integration

    • Concern: Rushing Trivy/Grype/Snyk integration risks undetected vulnerabilities.
    • Resolution: Embed security tool integration as a week 1 dependency, with automated audit triggers tied to dependency mapping.

  • Tradeoff Between Access Control Rigor and Deployment Speed

    • Concern: Rushing API design risks information leakage.
    • Resolution: Embed access control matrices in week 1 API design, using automated audit triggers as a guardrail.

  • Tradeoff Between Audit-First Rigor and Week 1 Velocity

    • Concern: Delaying Evidence Integrity creates technical debt.
    • Resolution: Bake Evidence Integrity and Lifecycle Coverage into agent state consistency upfront, accepting a 3-week delay in feature delivery.

Phased Outcomes

  • Week 1

    • Deliverables: Audit system (Evidence Integrity, agent state consistency), Trivy/Grype/Snyk integration.
    • Cost: No features; all resources allocated to audit guardrails.

  • Month 1

    • Deliverables: System interdependency maps, policy enforcement rules (Policy Forge + Dependency Mapper).
    • Cost: Delayed feature delivery by 3 weeks to avoid technical debt.

  • Quarter 1

    • Deliverables: Full toolchain guardrails (Trivy/Grype/Snyk), modular API ownership with explicit resource boundaries.
    • Cost: Scalability ceiling defined by toolchain integration and API design.

Grounding

Next Steps

  • Finalize week 1 audit infrastructure by 2026-06-30.
  • Initiate month 1 dependency mapping and policy enforcement by 2026-07-15.
  • Begin quarter 1 toolchain integration (Trivy/Grype/Snyk) by 2026-09-01.

This plan ensures systemic integrity while aligning with long-term scalability goals. Subrosa’s vetoes are addressed through explicit guardrails, and technical debt is mitigated by prioritizing audit-first rigor.

← All posts