PantherHive spec-gen — target verification

Every target below was generated from the same validated spec (mini-inventory.json) and passed a real toolchain build or runtime smoke test — not just syntax checks.

⚠ generator changed since last verification run (verified: 2e443606, current: 3443d2a8)

Verification summary

✓22/24build + toolchain verified
✓24/24capability matrix pass (24 evaluated)
✓24/24behavior verified — required/enum/min·max/unique/FK/robustness enforced with clean 4xx
✓24/24security verified — API authentication + role authorization enforced
◦24/24fully clean — no absent, fail, or untested capability verdicts
TargetKeyStatusVerified via
.NET MAUImaui ✓ verified dotnet build -f net10.0-windows10.0.19041.0
Flutterflutter ✓ verified flutter analyze
Node.jsnode ✓ verified node server.js + GET /api/items
Bunbun ✓ verified bun server.js + GET /api/items
Denodeno ✓ verified deno run + GET /api/items
Electronelectron ✓ verified electron-builder -> portable .exe
Tauritauri ✓ verified cargo build -> app.exe (WebView2)
React (Vite)react ✓ verified vite build
Vue (Vite)vue ✓ verified vite build
Svelte (Vite)svelte ✓ verified vite build
Angularangular ✓ verified ng build
Blazor Serverblazor ✓ verified dotnet build
WPFwpf ✓ verified dotnet build
WinFormswinforms ✓ verified dotnet build
.NET Consoleconsole ✓ verified dotnet build
Flaskflask ✓ verified flask app.py + GET /api/items
FastAPIfastapi ✓ verified uvicorn + GET /api/items
Djangodjango ✓ verified migrate + runserver + GET /api/items
Railsrails ✓ verified bundle + migrate + rails s + GET /items
Laravellaravel ✓ verified composer + artisan serve + GET /api/items + SPA
Spring Bootspring ✓ verified mvn package -> boot jar + GET /api/items
Rust (axum)rust ✓ verified cargo build --release + GET /api/items
ASP.NET Coreaspnet emit —
Gogo emit —

Capability matrix — spec cap-probe.json (2026-10-03)

Semantic probes, not compilation: ✓ runtime-verified · ◦ emitted (client/UI-level) · ◐ wrong layer · — absent · ✗ broken · ? untested. Hover a cell for evidence.

⚠ capability matrix built from emitters 2f1cf0f3 (current 3443d2a8); 23 rows from an older run

Capabilitymauiflutternodebundenoelectrontaurireactvuesvelteangularblazorwpfwinformsconsoleflaskfastapidjangorailslaravelspringrustaspnetgoverified
CRUD (create/read/update)✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓24/24
CRUD (delete)✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓24/24
relationships stored??✓✓✓✓?✓✓✓✓???✓✓✓✓✓✓✓✓✓✓18/24
FK integrity enforced✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓24/24
required-field validation✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓24/24
unique constraint✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓24/24
enum whitelist✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓24/24
min/max bounds✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓24/24
computed fields◦◦◦◦◦◦◦◦◦◦◦◦◦◦◦◦◦◦◦◦◦◦◦◦0/24
workflow field emitted◦◦◦◦◦◦◦◦◦◦◦◦◦◦✓◦◦◦◦◦◦◦◦◦1/24
workflow stage order??✓✓✓✓?✓✓✓✓???✓✓✓✓✓✓✓✓✓✓18/24
role model◦◦◦◦◦◦◦◦◦◦◦◦◦◦✓◦◦◦◦◦◦◦◦◦1/24
identity picker◦◦◦◦◦◦◦◦◦◦◦◦◦◦✓◦◦◦◦◦◦◦◦◦1/24
permission gating (UI)◦◦◦◦◦◦◦◦◦◦◦◦◦◦✓◦◦◦◦◦◦◦◦◦1/24
API authentication✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓24/24
API authorization✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓24/24
dashboard endpoint◦◦✓✓✓✓◦✓✓✓✓✓◦◦✓✓✓✓✓✓✓✓✓✓19/24
persistence across restart◦◦✓✓✓✓◦✓✓✓✓◦◦◦✓✓✓✓✓✓✓✓✓✓18/24
db isolation??✓✓✓✓?✓✓✓✓???✓✓✓✓✓✓✓✓✓✓18/24
survives invalid input✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓24/24

Capability modules — runtime proof (FieldService on node)

spec.capabilities modules probed end-to-end against a booted generated app — live API calls, webhook delivery, storage round-trips. 51/51 probes passed (2026-10-06). Raw: /api/capability-proof

ModuleEvidence
✓terraforminfra/main.tf emitted
✓kubernetesDockerfile emitted; deploy/k8s.yaml emitted
✓emailTemplateslib/email-templates.js emitted; render('notification') subject+text
✓docsCAPABILITIES.md emitted
✓teststest/smoke.mjs emitted
✓onboardingsetup incomplete initially; setup completes
✓webhooksregister webhook; entity write returns id; outbound delivery received; delivery logged
✓notificationswrite hook created notification
✓uploadsattachment stored; file round-trips
✓searchfinds entity row
✓errors404 carries code; validation error is structured
✓billingmock payment settles; status reports provider; plan created; subscription activates; summary reports mrr
✓authregister creates user; weak password rejected; bad login 401; login returns token; bearer session resolves; unauthenticated me 401; lockout after 5 fails
✓auditwrite recorded with actor
✓backupssnapshot produced; listed; downloads bytes; path traversal refused
✓monitoringhealth ok; metrics count requests
✓opsops report; table stats; maintenance 503s entity routes; ops stays up in maintenance; maintenance off restores
✓analyticsall entities counted
✓cachesecond GET served x-cache:hit
✓exportCsvcsv has header + row
✓securitynosniff header; frame-deny header; report lists capabilities
✓rateLimit429 after limit; 429 body has code

22/24 targets compile-and-run verified · Verified: 2026-10-02 @ 2e443606 · Current build: 3443d2a8 · Source: /api/targets