Problem
A repo an AI just wrote usually runs — the question was never whether it runs, but whether anyone can say what was actually tested, where the security evidence is, and who fixes it when it breaks.
Decisions
Use a local-first CLI/MCP architecture that connects analysis, boot, exploration, testing, reports, and repair artifacts.
Outcome
The local repo already has a working CLI/MCP layer, browser exploration, security-evidence import, and a repair handover contract.
Reflection
After AI coding, the scarce capability is turning “looks done” into verifiable delivery.