The scan
CodeExam examines source code and compiled code with a deterministic engine and an optional AI layer, including a fully air-gapped local model. On October 10 and 11, Ghost Architect™ Local ran two scans of it: Points of Interest, which looks for defects, and Load Qualifying, which looks for code that slows down as data or traffic grows. The models were small Qwen models served by Ollama on two of our own hubs, a 9B on one and a 4B on the other. No code left our network.
Before sending anything, we checked every finding against the code ourselves. The Points of Interest report kept eight findings. Four held up and four did not, so we sent Andrew only what held up, as a Ghost Brief™: five fixes, each with a prompt a coding assistant can apply. (The fifth was a real defect our review found next to a finding the scan had set aside.)
What his review found
Andrew posted his review on the project, as issue #344. His Claude Code checked each fix against the current head of the repository:
“All five hold at HEAD, and none was in the project’s history.”
Two of the five are real defects rated HIGH: one in how the GUI console puts server logging back after a command, and one in how chat answers are turned into HTML. One is a MEDIUM pair of gaps in how a diagnostic output handles credentials and settings. Two are LOW: a save that reported success after it failed, and a route that read a file from where it used to live. For each one the review proposed its own fix, and for two of them it widened the search to look for the same shape elsewhere in the code. We are not describing the details here until the fixes land.
The Load Qualifying report held up too. The review found its cited facts accurate at the lines it cited, and named one change worth making: three outbound calls to cloud models with no timeout, a one-line fix each.
One substantive point in that report was already known to the project in another form. Two MEDIUM findings said that on an index too large to hold in memory, every search and callers lookup rereads the whole file with no cache. The review agreed that is a real cost on very large indexes, and the trade-off that path exists for, since the file does not fit in memory. Its visible effect, the GUI freezing while a long request runs, is already listed among the project’s known limitations, with a non-blocking redesign as the direction.
The one thing it got wrong, fixed the next day
The review made a fair criticism. Load Qualifying gave CodeExam a health score of 34 out of 100, as if it were a web service for many users. CodeExam’s server is a local interface on one person’s own machine, and the report itself said so in every finding. The score was measuring the wrong thing.
We agreed. Ghost Architect™ Local 8.0.46, released October 13, scores a single-user tool for what it is: small per-action costs that only its own user can trigger count little or nothing, and anything that freezes that user’s own screen keeps its full weight. The report now says it was scored as a single-user tool on this machine, and a score made the old way is named, not compared.
How the work is split between code and model
Andrew asked a good question: how much of a finding comes from the model, and how much from deterministic code? It depends on the scan. In Load Qualifying, a fixed catalogue of patterns finds the candidates, and our own code traces each one back to the route that reaches it and reads what it can see, such as loop and data sizes, caching, and who can reach the server. The local models then judge each candidate in that context. In Points of Interest it runs the other way: the models read the code itself, pass by pass, and raise the findings, and our deterministic checks then test each one against the code and set aside what the code contradicts.
Why this matters
The strongest test of a report is the code owner checking it against code that has moved on since the scan, with his own tools. This one held up: five fixes, none of them in the project’s history, from small models running on hardware we own. Where the report was wrong, the criticism became a fix in the product a day later. That is how it is supposed to work.
Ghost Architect™ Local runs on your own machines.
If you want an evaluation trial, the download page tells you how to get the tarball, verify it, and start the evaluation on your own hardware.
Request Ghost Architect™ LocalEJ Wisner, founder of Ghost Architect™. Our thanks to Andrew Schulman for the review, and for letting us tell the story.