Appendix: lessons not yet scheduled

A parked page. It names what the courses do not cover and the decision that gates each item, and nothing is built for it. An entry becomes a lesson only when the decision that gates it moves.

• The org layer. A19: the OU tree, SCPs, Identity Center and the org trail reconciled from declared source on aws-warden’s cycle design (decision 16). Live only.
• A typed backend. The same repo and the same guardrails on a typed compiler such as chant instead of Terraform, which is where the state file goes away (decision 32) and where cloud-to-code reconcile becomes possible. What the change manifest makes backend-blind, and what it does not (decisions 23, 31).
• Cross-cloud. Track B stays parked under decision 19, which holds the estate to AWS IAM plus the code host’s own protection. It waits on persona equivalence across providers, with SPIFFE ID as the workload’s universal name, and one paragraph here is the whole of it.
• The threat model in full. threat-model.md read as a lesson: assets, boundaries, the attack table, what is not defended.