How I built a self-hosted semantic proxy over dbt-core and MetricFlow that speaks the PostgreSQL wire protocol, so Amazon QuickSight and LLM agents can query governed metrics with the guardrails in the YAML enforced automatically. Covers the wire-protocol emulation, the semi-additive guardrail proof, auto-cube exploration, an embedded MCP server, an air-gapped CI/CD deploy model with blue/green manifest hot-swap, and the nine bugs it took to get a live QuickSight demo on AWS working end to end.