Most security tools have a finding problem. We had a triage problem. This is how we built SecHound, an agentic security loop that runs against every release, verifies its own output, and refuses to call anything confirmed without live proof. Five decisions that made it work.