LLM coding assistants now write a lot of the R and Python that ends up in clinical, CMC, and submission pipelines. This is especially true at smaller biotechs and academic labs that don't have a dedicated validation team. The code usually runs. The reasoning behind it is gone five minutes after the chat closes.

When a QA reviewer or 21 CFR Part 11 inspector asks the obvious follow-up — why this approach, what alternatives were considered, what evidence supports it, when was that evidence last verified — there's nothing to show. The chat is gone, the model is stateless, and you end up hand-waving through the answer.

This talk is about something that closes part of that gap: an MCP server that turns ordinary AI coding sessions into persistent reasoning trails you can actually audit. The assistant gets pushed through a five-step loop. Generate competing hypotheses. Verify them against constraints. Gather evidence — tests, citations, whatever prior decisions apply. Audit for bias and reliability. Then commit a Design Rationale Record. Every record lands in a per-project knowledge graph with cryptographically chained evidence, three-level assurance promotion, and a freshness clock that flags stale claims so they can be refreshed, deprecated, or covered by a formal waiver. It plugs into Claude Code, Cursor, Gemini CLI, and Codex CLI without lock-in.

The demo walks an LLM through drafting an admiral-style ADaM derivation in R. The reasoning layer records why one imputation strategy was chosen over two alternatives. A Python validator then reproduces the analysis. Both get rolled into a Quarto report whose appendix carries the full decision trail. I'll map each captured artifact to specific clauses of 21 CFR Part 11 (audit trail and electronic records), GAMP 5 (Cat 5 custom-code reasoning as validation evidence), FDA's December 2024 PCCP guidance for AI/ML SaMD (modification protocol with valid_until), and EU AI Act Article 14 (human makes the final decision). The point is what the regulator can verify, not just what looks good in a code review.

A few things this is not. It doesn't filter hallucinations. It doesn't replace human review. Nothing here has been validated against a real submission, and there isn't a pharma-specific benchmark yet — building one is harder than it sounds, and I'll spend a few minutes on what it would actually take. If that problem interests you, come find me after.

You'll leave with:
- a working primitive for capturing AI-assisted-code decision trails today
- a concrete crosswalk from AI-coding artifacts to regulator-recognized record requirements
- a reproducible pattern for combining R and Python under one auditable layer
- some idea of where this helps and where it doesn't

Stack: Go MCP server (single binary), SQLite, Python orchestration, R via shell wrapper. The live demo runs offline on a laptop. Repo and slides afterward.