Why your AI assistant can't tell you why your code changed
Ask an AI coding assistant where a function is defined and it will find it. Ask it what a regex does and it will explain it. But the question you actually have at 2 a.m. during an incident is why is this line here, and when did this behavior change? On that one it goes quiet, or worse, it guesses.
The gap comes from how these tools index code, and once you see the mechanism it's obvious why every cloud assistant has it.
Assistants only see the current snapshot
Cloud coding assistants build their index from the current state of your repository: they chunk the files on the default branch, embed those chunks, and retrieve them at query time. That's genuinely useful for "where" and "what" questions, because the answer is sitting in the code as it exists right now.
"Why" and "when", though, live in the history: the commit that introduced the line, the message explaining the tradeoff, the pull request that referenced the incident, the five-year trail of upgrades that led to the version pinned today. None of that is in a snapshot index, because a snapshot has already thrown the history away.
An assistant could close the gap by ingesting your full git history. Almost none do, and the reason goes beyond engineering effort. Your history is a larger and more revealing artifact than your current code. It contains the security fix and the commit message describing the vulnerability it patched. It records who touched what, when, and why. Shipping all of that to a third party so it can be searched is a much bigger ask than shipping the current tree, and for a lot of teams it's a non-starter.
What it looks like when the history is queryable
The fix is to treat commit history as a first-class retrieval layer, indexed alongside the code but kept distinct from it. To make this concrete, here's a real question answered against the public Express repository, six thousand commits of genuine history indexed locally:
Q: When was serve-static last changed, and why?
The last change to serve-static was on 2024-09-10, in commit 4c9ddc1: "upgrade to serve-static@0.16.0." The trail goes back further: 620df0e moved it to 2.0.0-beta.1 in 2022, and 88f9733 took it to 1.14.1 in 2019.
Every claim there carries a commit SHA you can click straight through to the diff. The answer came from retrieving the actual commits, not from training data or a guess about what a common dependency usually does.
Mechanically it's not exotic. Commit messages and their changed-file lists are embedded into their own index, separate from the code chunks so they don't muddy ordinary code search. A question shaped like "why did X change" or "when did Y break" pulls the most relevant commits into context, and the answer cites them by hash, the same way a code answer cites a file and line range.
The part that matters for regulated teams
If you accept that history is the missing layer, you also have to reckon with what history contains. The current code shows what your system does; the history shows how you got there, including the incidents, the reasoning, the names, and the fixes nobody announced. A security team that objects to sending code to the cloud should object harder to sending the commit log.
So the only comfortable way to make history queryable is to leave it where it is. Index it on your own infrastructure and generate the answers, commit SHAs and all, locally. You don't have to take that on faith the way you take a retention policy on faith; you can watch the network and confirm nothing leaves.
"Why is this here?" is one of the most common questions a developer asks, and one of the few an AI assistant still can't answer. Answering it well means reading the one part of your repository you'd least want to upload, so the tooling has to come to the history rather than the other way around.
Postscript, July 2026: since this was written, the question has grown a second half: not just "why is this here?" but "did a human or an AI put it here?" SourceVault now ships AI-change provenance: commits classified for AI authorship and security relevance, with signed attestations you can verify independently.
See it grounded
SourceVault indexes your code and its history locally, and answers with file-and-line and commit-level citations. On a public benchmark it scored 100% grounded, with zero source code leaving the machine.