The assurance case fits the site's rules: description, SEO row, Next block, long-form

SEO.md

@@ -107,6 +107,7 @@ that page's frontmatter, never here.
 | `docs/faq` | ctrlrun faq, and each question verbatim | The twelve questions that come up first, answered in under eighty words each. |
 | `docs/security/receipt-chain` | tamper evident audit log AI agent | The receipt chain is a hash chain over the evidence log. |
 | `docs/security/verify-guarantees` | ctrlrun verify guarantees | `ctrlrun verify` runs eleven guarantees against the configuration in front of it. |
+| `docs/security/assurance-case` | ctrlrun assurance case security requirements | An assurance case is the argument, with its evidence, that a system meets its security requirements. |
 | `docs/security/disclosure` | ctrlrun security report | Report vulnerabilities privately to contact@arpanghoshal.com. |
 | `docs/how-this-is-built` | is ctrlrun trustworthy · how ctrlrun is tested | CTRLRun is built specification-first, every requirement in it is mutation-tested. |
 | `docs/reference/policy-yaml` | ctrlrun.yaml reference · ctrlrun policy schema | `ctrlrun.yaml` is one document: a `schema`, an `actions` map, and from v3 the `mode`, `environment` and `docs/authority` keys. |

docs/security/assurance-case.mdx

@@ -1,6 +1,6 @@
 ---
 title: "Assurance case"
-description: "Why the three guarantees hold: the threat model and its trust boundary, the design principles the kernel applies, the implementation weaknesses it counters, and where the evidence for each one sits."
+description: "Why the three guarantees hold: the threat model and its boundary, the design principles applied, the weaknesses countered, and where the evidence sits."
 ---
 
 An assurance case is the argument, with its evidence, that a system meets its security
@@ -108,3 +108,9 @@ where a regression would be caught.
 - The argument is for the kernel. An adapter or a gateway deployment adds a boundary of its
   own. The adapter conformance kit checks an adapter's behaviour; `ctrlrun verify` checks only
   the kernel guarantees the configured policy, grants and store backend can exercise.
+
+## Next
+
+- [Threat model](/docs/THREAT_MODEL): what is defended and what is not, in full.
+- [What verify guarantees](/docs/security/verify-guarantees): the eleven guarantees, replayed against your own configuration.
+- [Get started](/docs/get-started/quickstart) · [Why](/docs/why).

tests/test_docs_site.py

@@ -59,6 +59,9 @@ def walk(node: object) -> None:
     {
         "ARCHITECTURE",
         "THREAT_MODEL",
+        # The assurance case argues every requirement with its evidence; it is read beside the
+        # threat model and cited by criterion, not in one sitting.
+        "security/assurance-case",
         "CLAIMS",
         "ROADMAP",
         "verify",