Can I vibecode GitLab Duo?

Build the closest honest consolation tool inspired by GitLab Duo; do not claim to replace its structural moat.
Use exactly this stack: Python 3.12 + FastAPI + React + SQLite.
Primary job: Build a repository-local AI DevSecOps assistant that indexes one codebase, calls one model, proposes diffs, runs tests, and records every change.
Start from an empty folder and create the complete working project.

Functional Requirements:
- Code Explanation & Generation: Provide an interface to highlight code and ask for explanations, refactoring, or generation of new functions.
- Vulnerability Scanning: Implement a local static analysis pipeline (e.g., using Bandit or Semgrep wrappers) that flags security issues and uses the AI model to suggest remediations.
- Test Generation: Automatically generate unit tests for selected files or functions and provide a one-click UI to execute them and parse the output.
- CI/CD Mocking: Create a local simulation of a pipeline run, where the AI reviews the proposed changes against security and style guidelines before allowing a "merge".

Architecture & State:
- Make the default mode single-user and private.
- Store user data locally unless the core job requires the declared self-hosted database.
- Do not add analytics, telemetry, ads, or third-party accounts.
- Put every secret and external credential in .env and provide .env.example.
- Use realistic sample data that is clearly labelled and easy to delete.

UI/UX & States:
- Implement the smallest polished interface that completes the core loop end to end, ideally a split-pane view with code on one side and the assistant chat on the other.
- Include clear empty, loading, validation, success, and failure states.
- Use accessible keyboard navigation, labels, focus states, and sensible contrast.

Security & Constraints:
- Validate untrusted input and never log secrets or private file contents.
- Deliberately exclude these paid-product advantages: frontier coding model quality; large-context infrastructure; IDE-wide polish and latency; enterprise role-based access control.
- Do not fake integrations, network effects, proprietary data, model quality, compliance, or security claims.

Testing & DevOps:
- Write focused unit tests for the data model and the most important workflow.
- Add one end-to-end smoke test that proves the core loop works.
- Create a README with setup, permissions, architecture, data location, backup, and limitations.
- Add scripts for install, development, test, build, and a production-style local run.
- Run the tests and build before finishing, then fix errors rather than merely describing them.