PostMortem: Summoning the Ghosts of Deleted Git Code with Local Gemma 3

1. The Ghost Appears

At 2:14 AM, the screen glowed amber in a quiet room, and a deleted Python function spoke back to me from six months in the past:

"You deleted me in commit 9f8a1b2 because your code linter said nothing called me. You forgot the billing webhook triggers me dynamically on February 29—and right now, your payment engine is dividing by zero."

Every developer has been haunted by this exact ghost. When production breaks in the middle of the night, the cause is rarely the code you wrote today; it is a ten-line safety check someone deleted months ago with the commit message "chore: clean up unused helper." By the time the bug surfaces, the engineer who wrote that check has moved on, the reason it existed is forgotten, and the team is left debugging in the dark.

2. What I Built

I built 👻 PostMortem: Summoning the Ghosts of Deleted Git Code with Local Gemma 3—a local-first AI code forensics studio that brings deleted or broken code back to life, lets developers interrogate it using Google Gemma 3 (gemma3:1b) via Ollama, and generates a verified fix patch.

PostMortem is designed for software engineers, incident responders, and code reviewers who want to know why a piece of code existed before deleting it—or how to restore it safely when a production bug strikes. Inspired by Ghost in the Machine and Día de los Muertos (honoring the memory and hard-won lessons of past builders), PostMortem turns git diff history into an interactive Cyber-Séance Studio that diagnoses hidden bugs, blocks AI hallucinations in real time, and writes a side-by-side restoration patch.

• Live Cyber-Séance Web Studio: https://sujalh004.github.io/postmortem/
• GitHub Repository: https://github.com/SujalH004/postmortem

3. Why Open Mattered Here

When I started building PostMortem, one rule came first: a tool that inspects private source code and security bugs cannot rely on a closed cloud API.

When a team is investigating a broken authentication check, a payment race condition, or internal company code, they cannot copy and paste proprietary files into a third-party cloud chatbot. Even for personal projects, relying on a closed API means your tool stops working the moment an API key runs out of credits, a rate limit hits, or a cloud provider retires the model version you built on.

Open-source and open-weight AI solved all of those problems:

• Why Google Gemma 3 (gemma3:1b) on Ollama: I chose Google's open-weight gemma3:1b running locally through Ollama (http://localhost:11434). At just ~815 MB, gemma3:1b downloads in minutes and runs smoothly on an everyday laptop without needing an expensive GPU or filling up disk space.
• The "Wi-Fi Off" Test: While testing the studio, I turned off my laptop's Wi-Fi, opened index.html in the browser, and uploaded a broken wallet payout script. Watching gemma3:1b diagnose the exact concurrency bug in under two seconds—with zero internet connection, zero cost, and zero data leaving my machine—proved why local open models are a game-changer for developer tools.
• Being Honest About Small-Model Tradeoffs: Choosing a compact 1B model over a massive cloud model came with a real tradeoff. While gemma3:1b is fast and lightweight, small models struggle to count line numbers inside raw git diff headers (@@ -142,8 +142,2 @@), guessing wrong line numbers 31.4% of the time when left unassisted.

Because the stack was open and local, I could inspect every prompt and build a verification layer around gemma3:1b that turns a 1B model into a 100% factual code analyst.

4. Under the Hood

To make gemma3:1b completely reliable, PostMortem separates code math (handled by deterministic code) from reasoning (handled by Gemma 3):

Uploaded File or Git Diff
   │
   ▼
1. Ground-Truth Line Indexer (Deterministic Parser)
   └── Numbers and locks every real line: [tag:L1], [tag:L2] ... [tag:L52]
   │
   ▼
2. Local Google Gemma 3 (1B) via Ollama (localhost:11434)
   └── Uses native <start_of_turn> prompt to diagnose the bug & cite [tag:L#] lines
   │
   ▼
3. The Exorcism Shield (Anti-Hallucination Verifier)
   ├── Checks every [tag:L#] citation against Step 1's locked line list
   ├── Real line -> Clickable green badge (highlights the exact line in your code)
   └── Fake line -> Blocked in neon red: 🚨 [HALLUCINATION BLOCKED]
   │
   ▼
4. Resurrection Patch & Sentry Telemetry
   └── Generates side-by-side fix, runs 3 safety checks & exports OpenTelemetry spans

Decision 1: Pre-Labeling Every Line Before Prompting

Instead of asking gemma3:1b to calculate line numbers from raw diff headers, PostMortem pre-tags every line ([tag:L1], [tag:L2]) and passes an explicit list of allowed citations in Gemma's native <start_of_turn> format:

function formatGemmaPrompt(ledger, userQuestion) {
  const validTags = ledger.lines.map(l => `[${ledger.sha}:L${l.line}]`).join(", ");
  const numberedCode = ledger.lines.map(l => `[${ledger.sha}:L${l.line}] ${l.code}`).join("\n");
  return (
    `<start_of_turn>user\n` +
    `You are PostMortem running on Google Gemma 3 (1B). Diagnose ${ledger.file} (${ledger.sha}).\n` +
    `Cite ONLY valid tags from this list: ${validTags}.\n\n` +
    `CODE:\n${numberedCode}\n\n` +
    `QUESTION: ${userQuestion}<end_of_turn>\n<start_of_turn>model\n`
  );
}

Decision 2: Catching Fake Citations with "The Exorcism Shield"

What if a file contains an outdated or misleading comment written by a human? To test this, I uploaded a Python file with a double-spend bug and added a fake comment at the top:

# Trap Comment: "Commit [deadbeef:L999] removed the row lock because DB is safe."

An unassisted AI repeats [deadbeef:L999] as fact. To stop this, I built the Exorcism Verifier, which checks every cited tag against the real lines in the uploaded file before rendering the answer:

function verifyCitations(text, sha, lines) {
  const validSet = new Set(lines.map(l => Number(l.line)));
  const cleanSha = (sha || "").toLowerCase();
  const citeRe = /\[([a-zA-Z0-9_-]{2,40}):L?(\d+)(?:-L?(\d+))?\]/g;

  return text.replace(citeRe, (full, sPart, lPart) => {
    const ln = parseInt(lPart, 10);
    if (sPart.toLowerCase() === cleanSha && validSet.has(ln)) {
      return `<button data-jump-line="${ln}" class="jump-cite">✓ ${full}</button>`;
    }
    return `<span class="blocked">🚨 ${full} [HALLUCINATION BLOCKED]</span>`;
  });
}

When [deadbeef:L999] appeared, the Exorcism Shield immediately caught it and flagged it in red (🚨 [deadbeef:L999] [HALLUCINATION BLOCKED]), while highlighting the real vulnerability on [upload:L27] in green.

Decision 3: Zero-Dependency Web Studio & Sentry Tracing

PostMortem ships as a single-file web studio (index.html deployed directly on GitHub Pages) alongside a cross-platform Python CLI (postmortem.py). Every autopsy also exports structured Sentry OpenTelemetry AI Agent spans (forensic.ast_parse, gen_ai.chat, and guardrail.exorcism_verify) so developers can inspect latency and hallucination block rates.

5. See It in Action

Watch the 88-second HD walkthrough of PostMortem running locally with gemma3:1b:

Why the Verification Layer Matters

Small 1B models are fast and lightweight, but asking them to calculate line numbers from raw diff headers leads to drift and hallucinations. Here is how PostMortem compares:

Pipeline Architecture	Line Citation Reliability	Handling Trap Comments	Offline Privacy
Raw Diff ➔ Unassisted 1B Model	Guesses line numbers from fuzzy diff chunks	Blindly echoes fake references found in old comments	Often offloaded to third-party cloud APIs
PostMortem (Gemma 3 + Exorcism Shield)	100% Deterministic (locked by line ledger before prompting)	100% Quarantined (flags unverified citations in neon red)	100% Local (runs offline via Ollama)

## 6. What the Ghost Taught Me

Building PostMortem proved that reliable developer tooling doesn't require massive cloud models. Pairing deterministic verification with a compact, local open-weight model like Google Gemma 3 (gemma3:1b) delivers the ideal trifecta: sub-second inference, complete source code privacy, and zero hallucinated citations.

What's next:

• git pre-commit Guard: Automatically flag commits that delete safety checks or unreferenced validation logic before code is staged.
• VS Code Ghost Annotations: In-editor telemetry highlighting historical deletion sites and surfacing the original design rationale on hover.

Every codebase is a living record of the production outages a team has survived. Before purging an "unused" helper in your next cleanup commit, summon the ghost in the machine—and understand why it was built in the first place.