DEV Community: Mahima

Ghost Trace: Local-First Digital Forensics Haunted by Open-Weight AI

Mahima — Fri, 30 Oct 2026 17:57:48 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine

The Spark: What is the "Ghost in the Machine"?

When I saw this week's Hacktoberfest theme—Ghost in the Machine, spanning Halloween and Día de los Muertos—I didn't want to just make another toy chatbot with purple CSS and a pumpkin icon. I wanted to build something where the ghost metaphor was real, practical, and rooted in a genuine engineering problem.

In digital forensics and incident response (DFIR), investigating a compromised server is literally hunting for ghosts. An attacker breaks into a machine, moves around, and disappears, leaving behind only forgotten digital traces: six failed logins on an internal service account, a sudden privilege leap, and a database dump accessed at 2 AM.

Security teams call these forensic artifacts; in my head, they are the lingering spirits of past system events.

That led me to build GhostTrace
: a local-first digital forensics workbench with a Día de los Muertos and Halloween atmosphere. It ingests system logs, detects attacks through deterministic rules, correlates "echoes" across past events, and uses a local open-weight model to explain the evidence without leaking data or hallucinating facts.

Why Open-Source AI Matters for Forensics

Before talking about features, this is the core reason GhostTrace exists: you cannot send breach logs to cloud LLMs.

When a server gets breached, log files contain:

Internal corporate IP addresses and network topologies.
Compromised employee usernames and service account names.
Internal database paths, API endpoints, and configuration secrets.
In many cases, plaintext passwords typed into username fields by mistake.

Copy-pasting those logs into ChatGPT or a cloud API is a massive compliance violation and an active security risk. If you are investigating a leak, you cannot risk leaking the investigation itself.

Furthermore, real incident response often happens on an air-gapped machine with the network cable pulled or Wi-Fi disabled to contain an attack.

By running open-weight models (Llama 3.2 3B and Gemma 3 4B) locally through Ollama:

Zero Data Exfiltration: The logs stay in memory on 127.0.0.1. Nothing touches the cloud.
Works With No Internet: Incident responders can analyze systems in an isolated SCIF or offline disaster zone.
Zero Token Costs: Ingesting 100 MB (over 150,000 log events) costs exactly $0.00.
Model Swappability: Users aren't locked into one vendor's pricing or availability. If you prefer Google's Gemma or Meta's Llama, you just pick it in the settings drawer.
What GhostTrace Does

Here is a walkthrough of what I built:

Ingestion and Raw File Inspection

GhostTrace accepts standard .json and .jsonl system logs (tested up to 100 MB and 200,000 records).

To make it beginner-friendly, I bundled 5 synthetic cases (brute-force bursts, routine noise, ambiguous traces, malformed records, and prompt injection attacks). On the landing page, users can click "View File" to preview line-numbered raw log records or download the .jsonl directly to see the required schema before uploading their own traces.

GhostTrace Case Cards with Raw File Preview and Download

Raw File Inspection Modal with line numbers and copy button

The 3D Séance Hall and Graveyard Timeline

I wanted the interface to honor the theme without sacrificing readability:

Séance Hall: A 3D WebGL scene rendered with Three.js featuring glowing candlelight, falling cempasúchil (marigold) petals, floating spirit wisps, and an automatic Día de los Muertos ofrenda altar (active around Oct 31 / Nov 1-2).
The Graveyard Timeline: Every log event is plotted as a digital tombstone. You can filter by severity, event type, or echo group, and click any record to inspect the untouched, raw payload in the Evidence Drawer.

GhostTrace 3D Seance Hall WebGL Scene

Procedural 3D Audio and The Speed Ghost

Instead of loading bulky audio files, I wrote a procedural audio synthesizer from scratch using the Web Audio API:

3D Binaural Doppler Panning: When whispers trigger, the sound sweeps from your left ear to your right ear in exact sync with a flying ghost dashing across the screen.
The "Haaaawwwww..." Whisper: Uses parallel vocal formant filters (850Hz open throat gliding to 470Hz rounded lips) followed by an eerie, tremoring banshee cry.
Respecting User Preferences: I added a toggle in Settings (Visuals & Apparitions) so anyone who finds the flying ghost distracting can turn it off with one click, while keeping the audio or running in silent mode.

Visuals and Apparitions toggle in Settings

Deterministic Findings with Citation-Checked AI

One of my pet peeves with "AI for security" tools is hallucination. An AI that invents fake IP addresses or accuses innocent accounts is worse than useless.

GhostTrace solves this with a two-layer architecture:

Layer 1 (The Law): 4 deterministic rules (GT-001 Brute Force, GT-002 Privileged Access, GT-003 Sensitive File Read, GT-004 Off-Hours Spikes) run mathematically against the data.
Layer 2 (The Ghost Investigator): The local open-weight model (llama3.2:3b or gemma3:4b) writes a dossier explaining why the attack happened.
The Citation Guardrail: Every explanation is verified against the case data. If the model hallucinates an event ID (EV-xxxxxx), a fake IP, or an unknown timestamp, GhostTrace automatically flags and strips it. If the evidence is insufficient, a hard sufficiency gate prevents the model from fabricating conclusions.

GhostAI Assistant ("Echo")

In the bottom-right corner sits Echo, a floating ghost avatar with a speech bubble saying "Come close to me...". Clicking Echo opens an in-app chatbot that explains how GhostTrace works, breaks down detection rules, guides you on what log formats to upload, or summons audio cues. It runs on local Ollama with an instant fallback knowledge base if the model is asleep.

Preview unavailable

Hard Problems and Real Trade-offs

A few things that were surprisingly tricky during development:

Procedural Whisper vs. Metallic Ringing: Initially, filtering white noise with high resonance (Q > 4) made the whisper sound like a high-pitched metallic whistle. I had to rebuild the vocal tract using wide bandpass formants (Q between 1.6 and 2.4) and a 5.2Hz tremolo LFO to get an organic, airy "Haaaawwwww" breath.
Handling 100 MB Uploads In-Memory: I didn't want GhostTrace writing temporary files to disk because forensic evidence shouldn't leave residual traces on the host. Streaming chunks into a bytearray in FastAPI and parsing line-by-line in memory keeps it fast while maintaining a zero-footprint guarantee.
Exorcism (Instant Purge): Clicking "Exorcise Case" triggers a deep memory wipe that clears all parsed events, findings, and timeline rows from RAM, returning the app to an unburdened clean state.
Development Journey and Agent Session

I built and iterated GhostTrace with pair-programming assistance from an agent. You can inspect the actual session transcript, thoughts, and technical iterations below:

Building GhostTrace: Local-First DFIR & Haunted Open-Source AI Workbench

You

Let's build and refine GhostTrace for Hacktoberfest Week 4: Ghost in the Machine, featuring local open-source AI (Ollama with llama3.2:3b and gemma3:4b), procedural 3D spatial horror audio, and local digital forensics.

Agent

Implemented procedural Doppler horror audio with vocal formant whisper and banshee screams in Web Audio API, built the local GhostAI chatbot assistant with Ollama llama3.2:3b, expanded upload limit to 100MB, added per-case raw file inspection/download modals, and added a visual settings toggle for the flying ghost apparition. Tested locally on RTX 3050 GPU with 60 FPS locked.

How to Run It Locally

GhostTrace is completely open source under the MIT license.

bash

1. Clone and install backend

git clone https://github.com/lohanmahima/ghosttrace.git
cd ghosttrace
pip install -r backend/requirements.txt

2. Build frontend

cd frontend && npm install && npm run build && cd ..

3. Pull an open-weight model in Ollama

ollama pull llama3.2:3b

or: ollama pull gemma3:4b

4. Start GhostTrace

python backend/api.py

Open http://127.0.0.1:8000

Happy Halloween & Feliz Día de los Muertos! May your systems stay safe and your forgotten traces speak clearly. 🕯️👻

SOWCAST — Know what to sow, right when to sow it

Mahima — Sun, 11 Oct 2026 13:57:09 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 1: Touch Grass

What I Built

Most gardening guides give you advice like "direct sow 2 weeks after the last spring frost" or "start seeds indoors 6 weeks before final thaw". But for everyday people, beginners, and urban balcony growers, this immediately brings friction: When actually IS the last frost in my neighborhood?

That confusion keeps people glued to screens reading conflicting blog posts and confusing agricultural charts instead of stepping outside into the dirt.

I built SOWCAST to bridge that gap and get people off their screens and into the real world with soil on their hands.

SOWCAST is an offline-first, botanical smart garden planner that tells you exactly what to plant THIS WEEK, based on real 20-year historical climate normals for your exact coordinates.

Key Capabilities:

What SOWCAST Can Do:
"This Week" Dashboard: Tells you exactly what to sow right now, what to start indoors, and what to wait on — with clear reasons based on your local soil temperatures.
Frost Countdown & Alerts: Shows a live countdown to your last frost, plus a 48-hour warning before sudden cold snaps so you can protect your young plants.
Works Anywhere on Earth: Automatically adjusts for cold climates with frost dates, or warm/tropical areas with monsoon and dry seasons.
Interactive Garden Bed Planner: Drag and drop plants into a square-foot grid. It warns you about bad plant neighbors and highlights friendly plants that help each other grow.
64+ Curated Plant Guides: Step-by-step instructions for popular vegetables, herbs, and flowers — including spacing, sunlight, watering, and harvest times.
100% Offline & Private: Saves everything directly on your device. Works without internet, needs no login or backend, and installs right onto your phone like a native app.

Demo

Live Deployed App:

sowcast.vercel.app

Try Demo Garden: You can launch the app and click "Try Demo Garden" on the landing page or dashboard to test it with pre-populated beds and local weather intelligence instantly!
Code

Code

The complete source code is open-source on GitHub:

👉 https://github.com/lohanmahima/SOW_CAST

How I Built It

SOWCAST was crafted with a modern, zero-cost, open-source stack designed for 60fps responsiveness and zero maintenance overhead:

Framework & Language: Next.js 14 (App Router) with strict TypeScript, delivering statically optimized pages and seamless client-side hydration.
Design & Micro-interactions: Tailwind CSS with custom editorial botanical typography (Playfair Display + Plus Jakarta Sans), warm cream paper palettes (#F6F1E7), deep moss greens (#2F4A3A), and Framer Motion spring physics for sprout animations, confetti celebrations, and bed drag-and-drop interactions.
The Frost Engine: Connects to the free, keyless Open-Meteo APIs (Geocoding API, 7-Day Weather Forecast, and the 20-Year Historical Weather Archive). It analyzes decades of daily minimum temperatures to calculate the exact 50% probability freeze-thaw boundary.
Client-Side Storage Engine: Powered by Dexie.js (IndexedDB) with relational reactive live queries (useLiveQuery). All user beds, custom plantings, journal photos, growth milestones, and care checklists persist locally on device.
_Autonomous AI Agent Harness: _Built in deep collaboration with an autonomous agentic pair programming harness (Google Antigravity). The agent assisted with mathematical frost curve modeling, synthesizing the companion planting conflict matrix for 64 botanical species, and architecting the square-foot grid coordinate system.

Why Does Open Innovation Matter?

Food growing and climate resilience shouldn't be locked behind proprietary paywalls, opaque subscriptions, or corporate garden apps that sell your data.

_Open innovation made SOWCAST possible in two fundamental ways:
_
Open Meteorological Science: The Open-Meteo project provides open-access historical weather data and global forecasts without API keys or rate-limit paywalls. Closed APIs typically charge thousands of dollars for decades of archived minimum temperature readings, pricing out independent developers and hobbyist gardeners.
Browser-Native Standards: Using open web standards—IndexedDB for zero-cloud client storage, Web Push / Notification APIs, Service Workers for PWA offline capabilities, and SVG vector graphics—SOWCAST runs entirely on the user's hardware with zero operational infrastructure costs.

Open innovation proves that individual developers can build production-quality tools that empower people to grow their own organic food and reconnect with nature.

My Agent Session

This project was built from conception to production using the Antigravity agentic coding environment. The agent executed end-to-end full-stack workflows:

Initialized the Next.js 14 App Router architecture and Dexie database schema.
Researched companion planting matrices and built the spatial conflict engine.
Wrote the Open-Meteo statistical freeze calculation algorithms.
Iteratively tested production builds (npm run build), eliminated all TypeScript errors, and packaged PWA service worker manifests.

Prize Categories

Best Overall Project
Getting People Out into the Real World (Bridging technology to dirt, soil, and organic food cultivation)
Best Use of Open-Source AI / Open Innovation Tools

I built a strict local AI for my friend so he could actually learn to code

Mahima — Mon, 05 Oct 2026 07:53:46 +0000

This is a submission for the Hacktoberfest Weekend Challenge: Build for a Friend

What I Built

I built RootCause for my friend, Ojju. Ojju is learning how to code and kept getting stuck on logic problems. Every time he asked AI tools for help, they would just hand him the entire correct code. It solved the problem, but it ruined his learning process because it didn't teach him how to think.

RootCause is an AI learning companion that strictly refuses to give you the answer. Instead, you paste your broken code and explain your thought process. It diagnoses exactly why you are stuck (e.g., a logic flaw, a missing concept, or a missed edge case) and guides you back to the right path with progressive Socratic hints. It also tracks your weak spots and generates micro-exercises in a "Logic Gym" so you can practice your mistakes.

Code

lohanmahima / RootCause

AI learning companion that diagnoses WHY you're stuck on coding problems instead of handing you answers. Socratic hints, targeted micro-exercises, and learning memory. Runs locally with Ollama + Gemma.

RootCause

RootCause is a coding companion that diagnoses why you are stuck instead of giving you the answer.

I built this for a friend, Ojju, who was learning to code but kept getting stuck on logic errors. When he used standard tools, they handed him the corrected code immediately, which solved the problem but didn't help him learn how to fix it himself next time. RootCause forces you to explain your approach first, reads your broken code, and points out the specific conceptual or logic gap you are missing.

[TODO: one real thing Ojju said after trying it]

Live Demo

You can access the live version of this application here ?? Live Demo (Note: Initial startup may show a security warning. Click "Continue" to proceed. This URL requires the host laptop to be online).

Screenshots

What it does

Solve flow: You explain your approach, paste your broken code, and provide…

View on GitHub

How I Built It

RootCause is built entirely around local inference using open-weight models.

Frontend & App Logic: Python with Streamlit. I built a custom sandboxed Python environment to safely evaluate the user's Logic Gym code using subprocess and ast.
AI Engine: Google's Gemma 3 (4B) model, running locally via Ollama.
Data Persistence: SQLite for tracking topics, XP, and daily streaks locally.

The app uses Gemma 3 through Ollama's Python client to act as a strict tutor. I designed specific system prompts to force the model to output JSON judgments ({"met": false, "feedback": "...", "thinking_trick": "..."}) instead of free text. If the local Ollama instance crashes or runs out of memory, I built a silent fallback mechanism that automatically switches the Logic Gym to a verified offline bank of hand-written exercises so the user's workflow is never interrupted.

Why Does Open Innovation Matter?

Open innovation made RootCause possible because a learning tool for students needs to be free and private. If I built this on a closed API, Ojju would eventually have to pay per prompt, or I would have to pay a server bill to keep it running for him. By using an open model like Gemma 3 running locally via Ollama, it costs absolutely nothing. Ojju can use it offline on an airplane, and his messy, broken code never leaves his laptop.

Prize Categories
Open Innovation

From AI/ML Student to AI Agent Builder

Mahima — Sun, 23 Aug 2026 15:02:45 +0000

I’m a B.Tech CSE (AI & ML) student focused on building practical software and AI-driven applications. Interested in Artificial Intelligence, cloud computing, and emerging technologies, with a strong focus on continuous learning and hands-on development. Currently exploring different technologies and development approaches to strengthen my technical skills and build scalable, real-world solutions.

LinkedIn
GitHub