This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine

On the machine I build on, line 6 of dpkg's copyright file says this:

$ sed -n 6p /usr/share/doc/dpkg/copyright Copyright © 1994 Ian Murdock <email removed> 

I removed the email address. The tool does the same to every line it shows.

Ian Murdock started Debian. He died in 2015. His name is still on every Debian machine, because open-source licenses and Debian's own rules keep the notice with the code. So I went looking for the others.

What I Built

nitm is a command line tool and the one static page it makes. It reads the Debian copyright files in /usr/share/doc and the METADATA of the Python packages it's pointed at. It finds the people named there and checks them against a CC0 Wikidata snapshot of people who have died. Every match that passes a homonym gate goes to review, and an approval needs a reason and a second source. Each approved person gets a card: name, years, the exact file and line where the name still sits, and, where an honest one exists, one thing measured on this machine, with the command that produced it.

Gemma 3 1B reads the free-text credit lines, one per call, because a regex can't parse them reliably. It only proposes names, and a validator decides which proposals count. Gemma never writes a word about a person. Each card is a template filled with verified fields and quoted lines.

On this machine the scan read 1,682 files. 21 names matched someone on Wikidata who has died. 11 people are on the page.

"Not measured" means nothing here could be measured honestly. Chernov's notice is for newlib code in GCC's sources, and no newlib is installed. Thomas Lord's sdiff ships in diffutils, which Debian marks Essential, so no package declares a dependency on it.

A twelfth person passed review. I took that card off the page myself, because I judged it too soon to show. The log records the withdrawal.

Demo

The page is one HTML file, with no server or JavaScript.

The scan prints counts only. This is its output, trimmed:

 files scanned 1,682: 800 copyright files + 882 METADATA files name-like strings 48,247 from the regex Gemma (gemma3:1b) 269 lines, one per call · 307 names proposed · 60 rejected names after validator 5,569 unique (only Gemma found 14) Wikidata matches 21 names match someone who died homonym gate removed 3 · 18 names go to review no death date 579 names match only people with no death date: left off 

nitm verify shows the receipts, the file lines that name the person. For Phil Katz it shows zlib1g/copyright:10, found by both the regex and Gemma, and the gate note "software link in receipt: DEFLATE".

Code

Copyright © 1994 Ian Murdock <email removed&gt 

git clone https://github.com/Anandb71/names-in-the-machine cd names-in-the-machine python3 -m venv .venv && . .venv/bin/activate pip install -e '.[test]' ollama pull gemma3:1b nitm scan 

python -m pytest -q runs 151 tests. They never call the model or the network. Every name in the fixtures is a person who has died or an invented one.

How I Built It

The tools. Claude Code wrote the code and the tests. It also ran the identity checks and labelled the eval, as separate agents. gemma3:1b through Ollama, on this CPU-only box, extracts names from the free-text lines. I set the rules: code finds the facts, the model only proposes, the validator decides, and every card goes through review. Gemma never writes about a person, nothing says how anyone died, and living people appear only as counts.

Free text. zlib's copyright file says "The deflate format used by zlib was defined by Phil Katz." That isn't a Copyright line, so the Copyright regex never sees it. A second regex catches "…by " but misses sentences that open with the name, so Gemma reads every free-text line too, at temperature 0, with emails removed.

I froze the eval first. Before the scan sent Gemma any line, I froze 307 lines: 267 free-text credit lines plus 40 negatives, with 260 real names labelled. Three independent AI-agent passes made the labels, and they agreed on all 307 lines. nitm eval run refuses to score if anything changes after the freeze.

Gemma found 59 true names the regex missed. The regex found 5 that Gemma missed.

Where Gemma failed. Given the GPL's sample disclaimer, it answered "James Hacker", the license's example programmer, who never lived. It also offered Ty Coon and Gnomovision. The denylist stopped all three. Twice it echoed the invented names from my own prompt, and the rule that a name must appear in the line exactly threw both out. One wrong name did get past the validator: a real name with the next capitalised word glued on.

Timing. Over 265 fresh calls, a call took between 0.42 and 42.23 seconds, with a median of 1.19. The box was busy: the 5-minute load average read 188.43 on 8 CPUs.

The snapshot. My first Wikidata fetch failed with an HTTP 504. The fix was retries with backoff and jitter, and smaller queries. The final fetch ran 288 queries, and 5 attempts failed and were retried. It holds 3,110 people, committed with every query, and after that the tool runs offline.

The homonym gate. Names must match exactly, with no fuzzy matching and no surnames alone. The item must be a human with a death date and a software occupation or a link to the software in the receipt. A name that matches only people with no death date is left off: 579 names here.

Review. 18 names passed the gate. They were 17 people, because Thomas Lord and Tom Lord are one Wikidata item. An AI agent checked each match against the receipt, the Wikidata item and a second source, and a separate agent tried to refute every approval. Five were turned down: the same name on a different person. The one match Gemma found on its own was among them, so Gemma alone found 0 of the people on the page.

None of those checks were done by hand yet. verified.json and the page say the checks were AI-assisted, and that my final review is pending.

What the page won't do. It never says how anyone died. If a quoted line names someone else, the name becomes <name removed>, the way emails become <email removed>. grep -c @ docs/ofrenda.html prints 0.

Every measurement is in logs/run_2026-10-27.txt.

Why Does Open Innovation Matter?

Most of these names are there because of open licenses. The MIT license says the notice "shall be included in all copies or substantial portions of the Software." The zlib license says "This notice may not be removed or altered from any source distribution." And Debian ships a copyright file for every package. A closed vendor can strip its authors' names. Anyone who ships code under these licenses has to keep the notices, and that's why a notice from 1994 is still on line 6.

Wikidata is CC0, so I can ship the snapshot and every query behind it. An open-weight model reads your package list on localhost: nothing uploaded, no API key. With pinned weights and temperature 0, I could measure exactly where the model fails and build the validator around it.

The most important open piece here is the licenses, not the model. The licenses are why most of the names were there to find.

The Spirit of It

On Día de los Muertos you say their names. This is a small version of that: the name, the line where it sits, and one number measured next to it. I kept it quiet: no photos, no ghost puns, no séance.

Corrections: if a card is wrong, or a family asks, it comes down at once. Open an issue on the repo.

Prize Categories

Overall. It finds real people through license notices, checks them against a CC0 snapshot, and shows only those who passed the homonym gate and a review. Every number here comes from the run log.

Best Use of Gemma. gemma3:1b runs locally through Ollama as the scored free-text name extractor, behind a validator. Precision and recall are in the table above, against frozen labels. It never writes a word on the page.