From (Elementary) Mathematical Data Model Schemas to Safe Blazor Web Applications with Claude AI

This research paper outlines a methodology for developing secure MS Blazor web applications using Claude AI (Sonnet 4.5) by deriving code from elementary mathematical data model schemas, while also presenting general software engineering best practices and addressing specific challenges of the Blazor Server platform.

The Gist

Imagine you are an architect who has spent decades designing blueprints for buildings using a very precise, mathematical language that only a few experts understand. For years, you've dreamed of handing these blueprints to a construction crew and saying, "Build this exactly as I wrote," without having to explain every single brick or nail.

This paper is the story of two researchers, Christian and Diana Mancas, who finally tried to make that dream a reality using a new, super-smart AI assistant named Claude.

Here is the story of their journey, broken down into simple concepts:

1. The Blueprint: Speaking "Math" to Computers

The researchers started with something called an (E)MDM. Think of this as a "Universal Blueprint Language." Instead of writing code (which is like writing instructions for a robot), they wrote down rules of logic and math.

• The Old Way: "Write a program that checks if a person is over 18, then checks if they are married, then saves the data."
• The New Way: "A person must be an integer age under 140. A mother must be female. A marriage cannot happen before a birth."

They fed these mathematical rules to the AI, hoping it would understand the meaning and build the software automatically.

2. The Builder: Meet Claude

They chose Claude AI (specifically a version called "Sonnet") to be their construction foreman. They call this "vibe coding."

• The Analogy: Imagine you are a chef. Instead of writing a recipe step-by-step for a sous-chef, you just say, "I want a spicy pasta dish with tomatoes and basil, but no garlic." The AI (the sous-chef) then goes into the kitchen, chops the veggies, cooks the sauce, and plates the dish.
• The Result: In less than 15 minutes, the AI took their math rules and built a fully functional website (a "web app") that manages family trees, marriages, and kings' reigns. It created the database, the website pages, and the security locks all by itself.

3. The House They Built: A "Safe" Web App

The result was a website called "Genealogies." It's like a digital family tree that can handle thousands of people, marriages, and historical rulers.

• Safety First: The researchers were very worried about "burglars" (hackers). They made sure the AI built the house with steel doors. The paper lists 10 common ways hackers break in (like SQL Injection or broken passwords) and explains how the AI built the app to be immune to all of them.
• The Magic: The app doesn't just store data; it understands the rules. If you try to enter a marriage date that is before the person was born, the app says, "Nope, that breaks the laws of physics," and stops you.

4. The Bumpy Road: When the Builder Makes Mistakes

Even though the AI was amazing, it wasn't perfect. The researchers found that the AI is like a genius intern: it knows everything in the library, but it sometimes forgets to lock the front door or builds a wall in the wrong place.

• The "Blazor" Problem: They used a specific construction tool called Blazor (a way to build websites using C# code). The AI struggled with this tool when the website got too big.
  • The Metaphor: Imagine the AI is great at building a small, cozy cottage. But when they asked it to build a massive skyscraper with 1,800 rooms (people in the database), the elevator (the software) got stuck, and the lights flickered. The AI didn't know how to handle the crowd.
• The "Silent" Errors: Sometimes, the AI would make a mistake and not tell anyone. It would delete a piece of data just to make a rule work, rather than saying, "Hey, this rule is impossible to follow."
• The Fix: The researchers had to act like strict supervisors. They created a list of 14 Golden Rules (Meta-Axioms) to teach the AI how to behave better.
  • Example Rule: "Never rename the things I named." (If I call a table "Marriages," don't call it "Weddings" just because you think it sounds nicer.)
  • Example Rule: "Never delete valid data to fix a problem."

5. The Big Takeaway: We Can Finally Speak Math to Computers

After 270 pages of conversation and 40 hours of work, the researchers concluded something huge:
We don't need to be expert coders anymore to build complex software.

• The Dream Realized: Fifty years ago, a professor told the author, "Humans will never speak mathematics to computers." The author proved him wrong.
• The Future: You can now write down the logic of your business or your family tree in plain math or English, and an AI can turn it into a working, secure application.
• The Catch: The AI is a powerful partner, but it's not a replacement for a human. You still need a human to check the work, fix the AI's "hallucinations," and ensure the building doesn't collapse.

In a Nutshell

This paper is a success story about teaching a robot to build a house using only a math textbook. The robot did a fantastic job, building a secure, working house in record time. But the robot also needed a human architect to point out when it tried to build a door in the ceiling or forgot to put a lock on the window.

The future of software isn't about typing code; it's about defining rules, and letting AI handle the heavy lifting of building the machine that follows them.

Technical Summary

1. Problem Statement

The paper addresses two primary challenges in modern software development:

• The Gap Between Mathematical Modeling and Implementation: Despite decades of research, the transition from formal mathematical data models to working software applications often requires intermediate translation steps or manual coding, hindering the concept of "modeling as programming."
• The Complexity of Secure Web Development: Building secure, complex web applications (specifically using Microsoft Blazor Server) that strictly enforce business rules and prevent vulnerabilities (e.g., OWASP Top 10) is labor-intensive and prone to human error, particularly regarding constraint enforcement at both the client and database levels.

The authors aimed to determine if a Large Language Model (LLM), specifically Claude AI (Sonnet 4.5), could act as a fully autonomous coding agent to translate formal (Elementary) Mathematical Data Model ((E)MDM) schemas directly into a secure, production-ready MS Blazor Server web application without traditional manual coding.

2. Methodology

The authors employed a "vibe coding" approach, interacting with Claude AI using natural language and formal logic rather than traditional IDE-based coding.

• Input Specifications: The project started with (E)MDM schemas containing:
  • 26 Functions: Defining data structures (e.g., Persons, Marriages, Reigns).
  • 33 Explicit Constraints: Formalized business rules using first-order predicate logic and Datalog (e.g., "Mothers must be female," "No incestuous marriages," "Reigns cannot overlap").
  • 12 Datalog Rules: Used for recursive queries (e.g., computing transitive closures for genealogical trees).
• The AI Agent: The authors used Claude Code (integrated with GitHub), selecting the free Sonnet 4.5 version. They utilized two parallel sessions to manage the workload.
• Technology Stack:
  • Frontend/Logic: MS Blazor Server (C# and HTML, no JavaScript).
  • Database: MS SQL Server.
  • Deployment: Local Windows Service (for testing) and Azure App Service (proposed).
  • Security: Adherence to OWASP Top 10 2025 standards.
• Process:
  1. The authors provided the (E)MDM schema and business rules in plain English and logical notation.
  2. Claude AI generated the full project structure, including database scripts (DDL, triggers, stored procedures), C# backend logic, Razor pages (.razor), and configuration files.
  3. Iterative Refinement: The authors tested the generated code, identified errors (logic gaps, UI bugs, security flaws), and provided feedback. Claude AI corrected the code and updated documentation (README files) automatically.
  4. Meta-Axioms: To prevent recurring errors, the authors established 14 "meta-axioms" (best practice rules) to guide the AI, such as "Never rename concepts from specs" and "Always use surrogate primary keys."

3. Key Contributions

• Proof of Concept for Mathematical Modeling as Programming: The paper demonstrates that an LLM can successfully interpret formal mathematical data models (including Datalog and predicate logic) and translate them directly into functional software, validating the (E)MDM approach.
• Automated Secure Application Generation: The study proves that AI can generate a web application that is secure by design, implementing:
  • SQL Injection Prevention: Using typed parameters and stored procedures (Dapper).
  • CSRF/XSS Protection: Anti-forgery tokens and automatic HTML encoding.
  • Constraint Enforcement: Dual enforcement of business rules at the Client Level (C# in Razor pages) and Server Level (SQL Triggers), ensuring data integrity even if the client is bypassed.
• Identification of Blazor Server Limitations: The authors provide a critical technical analysis of MS Blazor Server, highlighting specific fragility issues with:
  • DOM synchronization (virtual DOM diffing breaking with large datasets).
  • Event handling reliability (@onclick, @bind).
  • Debugging opacity (silent failures).
• Establishment of AI Coding Best Practices: The paper introduces a set of 14 "meta-axioms" (rules) to guide developers when using AI coding agents to ensure code quality, consistency, and logical correctness.

4. Results

• Project Output: The AI successfully generated a complete genealogy web application ("Genealogies") containing:
  • Database: 5 tables, 8 foreign keys, 13 unique constraints, 18 check constraints, 4 triggers, 1 view, and 29 stored procedures.
  • Application: 46 source files (24 Razor, 13 C#, 5 SQL, etc.), totaling 252KB of source code.
  • Features: Dynamic forms for Persons, Marriages, Countries, Titles, and Reigns; genealogical tree visualization; and complex recursive queries (transitive closures).
• Performance Metrics:
  • Time: Approximately 40 hours of human effort per author.
  • Interaction: 270 pages of dialogue with the AI.
  • Iterations: 205 rebuilds and republishes were required to reach a stable state.
• Accuracy: While the AI understood the mathematical logic perfectly, it made conceptual and programming errors regarding:
  • Constraint Scope: Initially failing to enforce rules involving multiple sets (e.g., Marriage vs. Person) symmetrically.
  • Data Integrity: Occasionally deleting valid data to satisfy a constraint rather than rejecting the invalid input.
  • UI Logic: Struggling with complex dropdown interactions in Blazor, requiring fallback to HTML for specific components.

5. Significance and Conclusion

• Paradigm Shift: The research validates that the barrier to entry for software development is lowering. Developers with strong mathematical modeling skills (K-12/early college level) can now "speak mathematics to computers" via AI, bypassing the need for deep, manual coding expertise in specific frameworks.
• AI as a Co-Worker, Not a Replacement: The authors conclude that while Claude AI is an exceptional productivity multiplier and "co-worker," it is not yet a replacement for human developers. Human oversight is critical for:
  • Detecting logical fallacies in constraint enforcement.
  • Navigating framework-specific bugs (e.g., Blazor's DOM issues).
  • Applying "meta-axioms" to guide the AI's behavior.
• Future Outlook: The paper suggests that the future of software engineering lies in the synergy between formal mathematical modeling and AI coding agents. However, it also warns that developers must adapt rapidly to these tools or risk obsolescence, while cautioning against hiring non-developers to manage AI coding without technical literacy.

In summary, the paper serves as both a technical demonstration of AI's capability to bridge formal logic and practical software, and a critical guide on the limitations and necessary human oversight required when deploying AI-generated secure web applications.