Unbounded AI coding
User → model → documentation fragments → plausible code. The result may compile while violating architecture, authorization, localization, or component composition.
Engineering reference · 02
CodingWithEase does not make a model infallible. It makes the model work through version-true capabilities, deterministic generators, analyzers, server-enforced rules, and repeatable verification. Confidence is replaced by evidence.
$ cwe guide
$ dotnet build
$ dotnet-ai init
$ dotnet-ai list
$ dotnet-ai execute <capability>
$ dotnet cwe-gen
$ dotnet-ai execute CheckCompositionThe agent still interprets business intent. It does not invent framework syntax from stale examples or repeatedly hand-code infrastructure already owned by the toolchain.
User → model → documentation fragments → plausible code. The result may compile while violating architecture, authorization, localization, or component composition.
User → model → discovered capability → canonical framework output. Generated code and analyzers turn the framework version itself into the authority.
The claim is not that every generated feature is automatically correct. The claim is that AI output must enter an engineering system where mechanics converge, unsafe shapes are rejected, security is rechecked, and verification is reproducible.
Building first ensures capability discovery reflects the actual referenced assemblies. Regeneration and composition checks then expose drift rather than hiding it.
cwe guideRead the framework-owned workflow.
dotnet buildProduce version-true assemblies.
dotnet-ai initDiscover the installed capabilities.
dotnet-ai executeAsk a capability for canonical output.
dotnet cwe-genGenerate visible infrastructure.
build · test · CheckCompositionTurn claims into evidence.
Capability providers expose current components, generators, documents, context, and design rules directly from the installed version. The model composes within that discovered surface.
Exact component names, parameters, examples, and composition constraints.
Supported chart contracts and valid data shapes instead of guessed APIs.
Known diagram capabilities and framework-consistent output.
Canonical scaffolding for entities, pages, commands, queries, and infrastructure.
Framework-supported document creation and processing surfaces.
Application-aware retrieval instead of unconstrained context stuffing.
Guide, discover, and eager tiers provide only the context the task needs.
Shared visual and composition contracts keep generated interfaces coherent.
Roslyn diagnostics and composition analysis catch failure modes that a model, reviewer, or successful compiler can otherwise miss.
| Rule | What it rejects | Why it matters |
|---|---|---|
| CWE0204 | An invalid connected-component parameter. | Stops hallucinated APIs at build time. |
| CWE0205 | Synchronous SaveChanges paths that bypass the governed async pipeline. | Protects validation, authorization, and audit behavior. |
| CWE0209 | User-facing text outside localization. | Prevents a new page from silently becoming single-language. |
| CWE0213 | Authorization embedded inside a cached query. | Prevents cache hits from skipping the security decision. |
| CWE0214 | Unknown PascalCase Razor tags. | Stops misspelled components becoming inert custom HTML. |
| CWE0324 | Raw HttpClient in application structure. | Preserves operations, scoping, and security boundaries. |
Deterministic here means repeated infrastructure comes from pinned inputs and real generators—not that a language model produces identical prose on every run.
The agent queries the referenced framework version, avoiding documentation drift.
It can be read, searched, diffed, debugged, and reviewed like authored code.
The same semantic inputs must not keep rewriting tracked output.
Fixes occur in source intent or the generator, so every consumer receives the correction.
Convenient shortcuts become explicit diagnostics instead of permanent architecture.
Build, tests, generation, composition analysis, and clean-tree checks are rerunnable.
Development-time capabilities help an agent build the app. Runtime AI is a separate, permission-aware integration surface inside the finished application.
Only tools reachable from the current page enter the registry.
Mutations require the page upper bound and the caller’s live permission; handlers check again.
Searchable entities automatically require their generated View permission.
Tiered context limits token waste and keeps instructions relevant.
AI surfaces disappear when the configured provider is unavailable.
Browser sessions receive short-lived tokens rather than provider secrets.