docs: group the workflow instances under the model

The model section had grown two genres: pages 1-4 are the machinery,
while waterfall and the catalog are instances expressed in it as evidence,
leaving Open questions stranded behind three pages it does not follow
from. Nest the instances as a Formal workflows group with the catalog as
its index.

Kept under model/ rather than promoted top-level: these pages exist to
test whether the vocabulary generalises, and a peer section would read as
a product surface cyber-truss does not have. Relationship to SDD stays
outside the group — it is half instance and half positioning, and its
peer-versus-beneath framing is not a catalog entry.

Records the rule behind the asymmetry: an entry earns a page when
expressing it changes the model, and stays a row when it confirms it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: unional

apps/web/astro.config.mjs

@@ -35,8 +35,13 @@ export default defineConfig({
 						{ label: 'Confluence', link: '/model/confluence/' },
 						{ label: 'Canonical execution', link: '/model/canonical-execution/' },
 						{ label: 'Relationship to SDD', link: '/model/relationship-to-sdd/' },
-						{ label: 'Waterfall in the model', link: '/model/waterfall/' },
-						{ label: 'Formal workflows', link: '/model/formal-workflows/' },
+						{
+							label: 'Formal workflows',
+							items: [
+								{ label: 'The catalog', link: '/model/workflows/' },
+								{ label: 'Waterfall in the model', link: '/model/workflows/waterfall/' },
+							],
+						},
 						{ label: 'Open questions', link: '/model/open-questions/' },
 					],
 				},

apps/web/src/content/docs/model/index.md

@@ -53,8 +53,8 @@ documentation are raised and discharged out-of-band.
 | [Confluence](/cyber-truss/model/confluence/) | What path-independence means precisely, and what it is claimed over |
 | [Canonical execution](/cyber-truss/model/canonical-execution/) | How confluence is bought: distill, replay, compare |
 | [Relationship to SDD](/cyber-truss/model/relationship-to-sdd/) | SDD as the two-set instance of this model |
-| [Waterfall in the model](/cyber-truss/model/waterfall/) | A staged, gated process expressed here — and the half of it that turns out to be unnecessary |
-| [Formal workflows](/cyber-truss/model/formal-workflows/) | The same exercise across eight fields, and the four parameters they all reduce to |
+| [Formal workflows](/cyber-truss/model/workflows/) | Staged processes across eight fields, and the four parameters they all reduce to |
+| [Waterfall in the model](/cyber-truss/model/workflows/waterfall/) | One of them worked in full — and the half of it that turns out to be unnecessary |
 | [Open questions](/cyber-truss/model/open-questions/) | What is unresolved, and what breaks if it resolves badly |
 
 ## What this model is not

…c/content/docs/model/formal-workflows.md …rc/content/docs/model/workflows/index.mdapps/web/src/content/docs/model/formal-workflows.md renamed to apps/web/src/content/docs/model/workflows/index.md apps/web/src/content/docs/model/formal-workflows.md renamed to apps/web/src/content/docs/model/workflows/index.md

@@ -10,7 +10,7 @@ rather than a ratified part of it. See [the model overview](/cyber-truss/model/)
 
 ## What a formal workflow is
 
-Expressing [waterfall](/cyber-truss/model/waterfall/) produced a reusable shape. Every
+Expressing [waterfall](/cyber-truss/model/workflows/waterfall/) produced a reusable shape. Every
 staged process examined since has fit it, which makes it worth stating as a definition:
 
 > A **formal workflow** is a named policy over a lattice. It fixes four things: which
@@ -29,7 +29,7 @@ it was derived from has not been tested.
 
 | Workflow | Field | Sets it spans | Shape | Strain policy |
 | --- | --- | --- | --- | --- |
-| [Waterfall](/cyber-truss/model/waterfall/) | software | requirements, design, code, verification | chain | zero at every gate |
+| [Waterfall](/cyber-truss/model/workflows/waterfall/) | software | requirements, design, code, verification | chain | zero at every gate |
 | [SDD](/cyber-truss/model/relationship-to-sdd/) | software | spec unit, implementation unit | one link | zero at the impl gate |
 | Trunk-based development | software | code, test, docs | star on `{code, test}` | completeness zero at merge; obligation carried |
 | Safety certification | avionics, medical devices | requirements, design, code, tests, review evidence | chain, traced both ways | zero, and the *edge set itself* is an artifact |
@@ -145,6 +145,30 @@ property without the constraint.
 depend on this catalog. It is evidence about whether the vocabulary generalises, which
 was the one thing running eight instances could establish.
 
+## When an entry earns its own page
+
+Only [waterfall](/cyber-truss/model/workflows/waterfall/) has one, and the rule that
+produced that asymmetry is worth stating so the catalog does not drift into eight thin
+pages.
+
+> An entry earns a page when expressing it **changes** the model. Entries that confirm it
+> stay rows.
+
+Waterfall changed it: the four-parameter definition at the top of this page came out of
+that exercise, along with the phases-are-not-sets distinction and the finding about entry
+restrictions. The remaining six confirm — each is evidence that the vocabulary reaches a
+field it was not derived from, and that evidence lives in the *comparison*. Split across
+pages, the strain-policy column can no longer be read down, which is where the first
+finding below actually comes from.
+
+Two are the likeliest to be promoted if pushed further. **Safety certification** treats
+the edge set as a deliverable in its own right, which raises a question the model has not
+answered — whether a connection can itself be an artifact-set. **Double-entry
+bookkeeping** is the smallest complete instance in the catalog, which makes it the
+natural first thing an implementation is tested against.
+
+**Status: Settled** as this section's editorial rule. Neither promotion has been argued.
+
 ## What has not been tested
 
 The instances here are all **staged** — they exist because someone wanted a gate. That is

…/web/src/content/docs/model/waterfall.md …ontent/docs/model/workflows/waterfall.mdapps/web/src/content/docs/model/waterfall.md renamed to apps/web/src/content/docs/model/workflows/waterfall.md apps/web/src/content/docs/model/waterfall.md renamed to apps/web/src/content/docs/model/workflows/waterfall.md

@@ -211,5 +211,5 @@ makes it worse, which is the outcome that mattered.
 
 The four parameters this exercise settled on — sets, shape, discharge, strain policy —
 turn out to describe staged processes well outside software.
-[Formal workflows](/cyber-truss/model/formal-workflows/) runs the same exercise across
+[Formal workflows](/cyber-truss/model/workflows/) runs the same exercise across
 eight fields.