Veladora — light a candle for the code you inherited

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine

What I Built

Veladora is a local altar for a repository you inherited.

You drop a folder. It stays in the tab. A rule engine lights a candle for each thing the next person will trip over: a key written into a source file, an eval, an empty catch, a FIXME that is the only minutes of a meeting you were not in, the same six lines copied into a second file during a rush. The score is a vigil out of 100. It is a first pass, not a clearance to ship.

If you want those findings said back as a remembrance, you light Gemma 3 270M in the browser. The model never receives the files. It receives a redacted brief of at most eight candles. If it loops, the reply is thrown away and the archivist draft stays. The draft is the product. The model is a voice for it.

The week asked for something spooky, or something that honors the past the way Día de los Muertos does. I took the second reading, and I tried not to turn a living tradition into a costume. An ofrenda is a place you set for someone who is not in the room. Inherited code is that room. The comment is the only thing they left on the table. Veladora's job is to tell you which candles to keep and which ones to put out. Keep the sentence about the 2019 contract. Delete the key.

There is a second desk, for languages that outlived their authors. COBOL, Fortran, ALGOL 60, Pascal, BASIC, Prolog, Smalltalk-80, Ada, SNOBOL, MUMPS, RPG, Forth. The short biographies are written down from the public record, because a 270 million parameter model should not be asked to invent the year a language was born. You can paste a snippet and ask the model what it does. The sample includes a tiny COBOL payroll program, because that is the shape of the work a lot of people actually inherit.

The bundled sample, Night Shift Payroll, scores 50 out of 100. Four of the candles are high: a documentation-example AWS key, a second secret assigned in source, eval, and pickle.load. The page says the AWS strings are the public documentation examples, so the demo can light a candle without shipping a live credential.

Demo

The site is static. No build, no account, no key.

https://himanshu-5680.github.io/veladora/

The sample is already loaded. Night Shift Payroll scores 50 out of 100 before you click anything.

Filter to Secrets. The evidence reads AKIA…MPLE, not the full key. Show secrets here reveals it in the tab. Markdown, JSON, CSV, and the GitHub issue body stay redacted.

The same checks in the light theme.

Light Gemma only if you want to wait for about 300 MB and you have WebGPU. The vigil does not need it. If you would rather run it yourself: npx serve . from the repo. Do not open the file directly. Modules will not load on file://.

Code

https://github.com/Himanshu-5680/veladora

MIT for the repository. Gemma's weights stay under the Gemma Terms of Use and are not in the repo. SmolLM2, the understudy, is Apache-2.0.

flowchart LR
  drop[Folder drop or sample] --> engine[Rule engine in the page]
  engine --> report[Vigil and findings]
  report --> draft[Archivist draft]
  report --> brief[Redacted brief]
  brief --> worker[Module worker]
  worker --> gemma[Gemma 3 270M on WebGPU]
  worker --> small[SmolLM2 135M if there is no adapter]
  gemma --> speech[Remembrance, or the draft if the model loops]
  small --> speech
  report --> export[Markdown, JSON, CSV, GitHub issue]

How I Built It

The open piece that the project cannot survive without is a model you can run yourself, on a page you can host yourself. I used Google's Gemma 3 270M Instruct, the ONNX build at onnx-community/gemma-3-270m-it-ONNX, through Transformers.js 4.2.0 in a module worker. WebGPU, dtype q4f16. The worker is a plain file. It is imported from a pinned jsDelivr URL so a bundler never gets a chance to emit a worker the browser cannot run.

I did not let Gemma be the scanner. A model that size will invent a filename if you hand it a repository, and a scanner that invents filenames is worse than no scanner. The rules are ordinary JavaScript, with tests: shaped credentials, assigned secrets that are not the word changeme, dynamic execution, HTML sinks, pickle and unsafe yaml.load, empty handlers, repeated six-line blocks, long or densely branched functions, debug leftovers, a faded copyright year, and a missing LICENSE once there are at least three files. node_modules is skipped. Secret matches are stored redacted on the finding. The raw value sits on localValue for the on-screen reveal and is stripped before JSON, Markdown, or the model prompt.

The brief is capped at 1600 characters and eight findings. Temperature is 0.6, with a repetition penalty and no_repeat_ngram_size: 3. A reply that fails a small garbage check — too few letters, a loop, a repeated word — is replaced by the archivist draft. Silence would also have been fine. Showing a loop would not.

Three write-ups changed the shape of that worker, and I want them in the room:

• We put a free, unlimited LLM inside a static web page — Transformers.js + Gemma 3, zero servers by @astrodevkit. A static page, Gemma 3 270M, and an honest line that a model this small will cheerfully make things up. I kept the static page and the honesty, and I refused to let the model be the source of the findings.
• Run an LLM in the browser: WebGPU did 63 tokens/s, WASM did 1.6 by @mattbusel. One worker, one generation, progress that names the file, temperature under 0.8, and the note that cross-origin isolation would speed the CPU path and break embeds. I skipped isolation on purpose. Gemma's CPU file is about a gigabyte, so there is no silent CPU fallback for Gemma.
• Building Browser-Based Transcription: Workers, Cancellation, and Honest Progress by @flowpick. "Local" still downloads a model, and the interface should say so. Putting the candle out terminates the worker. It does not pretend the download never happened. The weights stay in the browser cache.

If the browser has no WebGPU adapter, the page offers SmolLM2 135M instead and names it as the understudy. It is not Gemma. The Gemma prize, if this is read for that category, is the séance path: Gemma 3 270M is the model that speaks the vigil when the machine can hold it.

Tests are npm test. They cover redaction, the quiet placeholder password, the sample vigil, the garbage filter, and a pasted git log. They do not download a model.

Why Does Open Innovation Matter?

A closed API would have required me to upload the tree in order to explain the tree. The tree is the thing that may contain the secret. That is not a trade I can make, and it is not a trade I can ask a stranger to make when they drop a folder marked "confidential" that their last job left them.

Running the model locally does four things a hosted model does not.

It works after the download, with the network off. The rules work even before the download. I tried the sample with the candle unlit. The score, the twelve findings, and the draft were already there.

It costs nothing the second time. There is no meter between a maintainer and a second look.

It can be swapped. The worker names two models. Gemma is the one I want when WebGPU is there. SmolLM2 is the one that still runs when it is not. Neither is a vendor relationship.

It can disappear from a company's pricing page without taking the vigil with it. The weights, once cached, are files. The rules are in the repository under MIT. A service that sunsets its "code explainer" takes the feature with it. This page does not have a feature to take.

The limit is the point, not a footnote. Gemma 3 270M is not a staff engineer. Pointed at a whole repository it will confabulate. The open path let me put it in a box: evidence in, remembrance out, and a deterministic draft underneath that does not need it. A closed API would have hidden that limit behind a larger model and a data-processing addendum. I would rather show the small model, and show the rail it is not allowed to cross.

My Agent Session

The project was built in Cursor. I have not embedded a DevRelay session here, because the uploader's tool list does not include Cursor and I did not want to file the transcript under a different tool's name. The repository is the record: the rule engine, the tests, and docs/ARCHITECTURE.md. If I save a session later, this is the paragraph it replaces.

The Spirit of It

The sample's loudest human candle is a comment:

FIXME: holiday rates have been wrong since the 2019 contract

The archivist draft tells you to keep that sentence and to get the key out of src/config.js. That is the moment the theme stopped being decoration. The dead code is not the joke. The dead code is the only colleague who remembered the contract. You do not exorcise that. You set a place for it, and you put out the candles that can burn the house down.

Prize Categories

• Best Use of Gemma. The séance is Gemma 3 270M Instruct, ONNX, in the browser, on WebGPU. The model is asked to rephrase a redacted brief and nothing else. When the machine cannot run it, the page says so and offers a different open model, by name.
• Best Use of GitHub. Tests and GitHub Pages run as Actions. Issues have forms, pull requests have a template, and the vigil can copy a redacted issue body. This entry is the Actions and repository side of that category. I did not use Copilot's coding agent.