Agentic security CLI that finds reachable vulnerabilities, writes the fix, and attacks its own patch in an isolated Nebius sandbox. A patch is certified only when the live exploit fails.