Skip to main content
Capell home
Live demo

We use cookies for essential features and optional analytics.

Manage cookie preferences

Choose which optional cookies Capell may use.

Essential
Always on

Required for Capell to work — login, security, page rendering.

Analytics

Anonymous usage telemetry to improve editor performance.

Marketing

Personalization for the Capell marketing site.

Cookie policy

Reduce adoption risk with checks you can run

Release and compatibility · Install diagnostics · Public-output safety · Page recovery · Upgrade and removal · CI evidence · Limits

Start with failure cases before trusting the happy path. Recover a page, inspect an anonymous response, run the lifecycle commands and open the source behind each metric.

Public pages are coupled to the Laravel application; there is no delivery API or hosted Capell runtime. That limitation belongs in the adoption decision, especially when several independent frontends need the same content.

Page history and rollback Install, upgrade, and doctor Current CI evidence
See evidence in the demo Run the install checks
Diagnostic capture: operations health Health checks name the problem and the next action. A real Diagnostics package capture showing setup and operational checks before a release becomes a production incident.
CMS capture · Site health Operational health is part of the CMS workflow. This real Capell CMS capture shows launch and operations checks for cache, generated output, queues, scheduler health, and deployment readiness.
CMS capture · Activity log Audit trails show exactly what changed. A real Capell CMS capture showing a nested JSON update expanded into readable field-level before-and-after rows for review.

Actual Capell Diagnostics system health screen showing setup requirements, operational checks, statuses, and remediation actions.

Adopting a CMS means trusting future upgrades, recovery paths and the boundary between editor work and public output. Those claims should survive a test, not rely on a brochure.

Verify release and compatibility

Use the current tagged 1.x release and verify PHP 8.4, Laravel 12.41.1 or later or Laravel 13, Filament 5, and the chosen PHP-FPM or Octane runtime against the actual application. A roadmap state, branch name, or undated package page is not release evidence.

Test page recovery

Core appends a full-state revision after PageSaved. Admin provides Page History, diff preview, integrity validation, rollback and roll-forward without deleting later history. This history is page-only. Other CMS records do not automatically share the same recovery model.

Publishing Studio is optional licensed software. It adds isolated workspaces, assignments, comments, approvals, scheduling, atomic releases and cross-entity recovery around that foundation.

Run install diagnostics

  • capell:install follows the supported CMS setup path.
  • capell:upgrade applies the supported version and migration sequence.
  • capell:doctor reports missing configuration and runtime problems.

Inspect public-output safety

Request a published page anonymously and check that the response contains no editor state, internal IDs, field paths, permissions, signed preview URLs or package internals. Capell remains a coupled Laravel CMS: there is no delivery API or managed Capell runtime.

Practise upgrade and removal

Run the supported upgrade path in staging, inspect package migrations and jobs, and test the documented removal effect before production adoption. Installed paid packages continue running after entitlement expiry, but protected downloads, updates, and support stop after the grace period.

Check the date behind a number

Engineering cards render only when the public projection and operator manifest agree on the result, method, attestation, date and allowlisted CI run. A stale or mismatched claim disappears instead of being shown as current.

Keep the limits visible

Capell does not supply a hosted runtime or delivery API. Capell Membership covers five named users, one production domain, and two non-production environments for the stated term. Optional packages add their own data, migrations, jobs, and operating responsibilities; the suite does not bulk-install them.

A security-minded team at a calm desk.

Recover a page without hiding its history

Core appends a full-state revision after PageSaved. Admin provides Page History, diff preview, integrity validation, rollback, and roll-forward without erasing later history. This history is page-only. Capell does not imply the same recovery model for every CMS record.

Publishing Studio is an optional licensed companion package. It adds isolated workspaces, assignments, comments, approvals, scheduling, atomic releases, and cross-entity recovery.

Run in your app

Run maintenance before it becomes an incident

Use the commands in CI, a staging environment or the application shell to expose missing configuration and unsupported changes early.

Install
capell:install

Checks the application and installs the CMS through the supported Laravel setup path.

Upgrade
capell:upgrade

Runs the supported upgrade sequence so version changes and migrations stay visible.

Diagnose
capell:doctor

Reports missing configuration and operational problems before they become guesswork.

Each command runs against the customer-owned Laravel application.

One review standard for every first-party release

Automated checks, adversarial AI-assisted analysis and accountable human sign-off are separate stages.

We review the exact package version and artifact, not a publisher label or a permanent claim of security. When code changes, we review it again. Catalogue-wide claims remain hidden until every eligible first-party extension and theme has current evidence.

AI-assisted source inspection is limited to the code and behaviour examined. It can identify implementation paths, unsafe assumptions and unsupported claims, but it does not replace current release evidence or the accountability of the people who approve and operate the software.

1 of 45 eligible first-party releases currently carry exact-release review evidence.

  1. Strict, maintainable PHP

    Strict types, explicit signatures, Pint and PHPStan keep package code predictable and UI layers thin.

    Automated AI-assisted

  2. No database queries in public views

    Public Blade receives complete hydrated data without Eloquent, query-builder, DB or lazy-loading fallbacks.

    Automated AI-assisted

  3. Actions and typed boundaries

    Domain work belongs in Actions or services, with structured input and output crossing layers through Data objects.

    Automated AI-assisted

  4. Clean public output

    Anonymous HTML is checked for editor controls, internal IDs, field paths, permissions, package internals and signed URLs.

    Automated AI-assisted

  5. Authorisation and input safety

    Permissions, validation, rate limits, signed routes, escaping, uploads and raw queries receive explicit scrutiny.

    Automated AI-assisted Human sign-off

  6. Declared package boundaries

    Packages use Capell extension points, declare real dependencies and degrade safely when optional companions are absent.

    Automated AI-assisted

  7. Manifest and migration integrity

    Declared commands, settings, contributions, migrations and health checks must match reachable code and lifecycle guidance.

    Automated AI-assisted

  8. Compatibility and interoperability

    Supported release families, dependency closure and cross-package behaviour are exercised together as well as in isolation.

    Automated AI-assisted Human sign-off

  9. Meaningful tests

    Primary behaviour, failure paths, permissions, public output and package contracts need behavioural evidence.

    Automated AI-assisted

  10. Security and supply chain

    Dependency audits, secret scans, artifact hashes and public-output contracts protect the exact reviewed release.

    Automated AI-assisted Human sign-off

  11. Performance and operations

    Hot paths, job retries, bounds, cache interactions and diagnostics are reviewed for production behaviour.

    Automated AI-assisted

  12. Theme delivery quality

    Responsive layouts, keyboard access, reduced motion, light and dark modes, content portability and screenshot truth are inspected.

    Automated AI-assisted Human sign-off

  13. Claims match reality

    Marketplace copy, screenshots, setup, support, data access, compatibility and removal guidance must match reachable behaviour.

    AI-assisted Human sign-off

  14. AI analysis plus human accountability

    AI searches for missed interactions and unsupported claims; an authorised human resolves findings and owns the exact-release decision.

    AI-assisted Human sign-off

Treat an undated metric as no metric

Strict types, PHPStan, Pest and package checks run in the release pipeline. Every visible card carries its observation date and allowlisted workflow source. Missing, stale, future-dated or mismatched results are omitted individually.

Role scenarios

What to inspect before launch

Checks for security claims, release readiness, operations, and known limits before launch.

Role-based checks drawn from product capabilities and fit boundaries.

Laravel developer representing this editorial scenario.

Trust: evidence for the Laravel technical lead role

Render public HTML containing editor markup, a signed admin URL and an encoded form of the same URL. The output inspector should block every leak and record the responsible extension without storing the secret.

Read more

Inspect this behaviour: It does not just string-match once: it normalizes encodings, catching a signed URL that was JSON-escaped inside an inline script, which is far more paranoid than most guards. The scenario pipeline even throws on fabricated testimonial wording, so the project is structurally set up not to invent endorsements.

A different tool may fit when: None of this replaces their own threat modelling or a real pen test on the parts teams build. It is a strong floor and a set of checks developers could read, not a certificate of total safety.

Laravel Technical Lead

Evaluator scenario for a Laravel technical lead

Next step

Try the failure-path checks yourself

Use the demo to inspect page history and public output before repeating the same checks in a local foundation install.

Look for what an anonymous visitor can see, what a page recovery preserves, and which claims link back to current engineering results.

See page recovery in the demo Verify a local foundation
Loading footer