Eight days on the board

The plan was drawn before the code: an eight-day build roadmap, one target milestone per day, each to be validated before the next. Repository audit first; a core with scanner interfaces early; the integration surface — MCP, GitHub gate, API, dashboard — in the second half; and a reproducible showcase as the finish line.

The target sequence. The diagram depicts the target design — the shipped implementation made an honest pivot along the way.

• Day 1 — repository audit: architecture, baseline tests.
• Day 2 — core + CLI: scanner interfaces, tests.
• Day 3 — real scanners: dependencies, secrets, static analysis.
• Day 4 — MCP + skill: validated tools, client setup.
• Day 5 — GitHub gate: hooks, Actions, JSON / SARIF output.
• Day 6 — API + dashboard: actual scan data, findings UI.
• Day 7 — integration hardening: end-to-end, permissions, bug fixes.
• Day 8 — showcase preparation: reproducible demo, docs.

The honest pivot

Day 2 on the board said "Rust core". What shipped first is a pnpm TypeScript monorepo: packages/core, a CLI app, an MCP server, a REST API, a Next.js dashboard, and a portable agent skill — all in TypeScript, all buildable with pnpm. The README says this plainly: the diagram depicts the target design, and the implementation kept the same engine/adapter separation with a different substrate. A working, testable MVP with real scanners beat a target-language stub. Then the Rust core came back on its own terms — not as the whole platform, but as a byte-compatible security engine (crates/veylqorix-engine) that owns the secret scanner and the gate, reached through a TypeScript adapter that degrades honestly when the binary is missing. The gate decision logic, the finding schema, and the adapter architecture — the actual ideas — made it through intact.