DEV Community: Paopao Studio

I scanned 2,056 public n8n templates: 172 of them call an OpenAI or Anthropic model/API that is already shut down

Paopao Studio — Sat, 31 Oct 2026 02:25:30 +0000

If you import an n8n template from a year ago, the workflow JSON often doesn't tell you which model it will call. When a parameter equals its default, n8n leaves it out of the export, so the model is decided by the node type, its typeVersion and the n8n release that runs it. Some nodes go further and hardcode the model (the OpenAI node's audio transcribe/translate operations always send whisper-1).

I wanted to know how many public templates point at models or APIs that OpenAI and Anthropic have already shut down. So I wrote a small offline scanner and ran it over a public template collection.

What I scanned (and what I didn't)

Source: felipfr/awesome-n8n-workflows, a third-party, MIT-licensed mirror of n8n workflow templates, at commit 8aa4a25 (2025-08-08). This is not n8n's official template library, and the mirror has no per-template dates, so I can't tell how old each template is.
Templates: 2,056 workflow files.
"AI templates": 804 of those contain openai, anthropic, lmChat or api.openai.com anywhere in the file (case-insensitive). This is a plain text match, so treat it as a rough denominator.
Reference date: 2026-10-31. "Already shut down" means the provider's shutdown date is on or before that day.
Rules: only verified rules, where the model ID and the shutdown date appear on the official OpenAI deprecations page or the Anthropic model deprecations page. Both pages were checked on 2026-10-31.
These are templates, not running workflows. A template that uses a retired model tells you what people will copy, not what is in production.

Headline numbers

Metric	Value
Templates scanned	2,056
AI templates (text match)	804
Templates with at least one finding from a verified rule (already shut down or scheduled)	346 (16.83% of all, 43.03% of AI templates)
Templates with at least one verified finding that is already shut down	172 (21.39% of AI templates)

So roughly one in five AI templates in this mirror would call something that no longer exists if you imported it today and ran it as-is.

What the 172 "already shut down" templates use

Counts are templates per model. One template can use several models, so the rows add up to more than 172. "Explicit" means the model ID is written in the JSON. "Default" means the model field is missing and n8n's default for that node and typeVersion applies. "Hardcoded" means n8n sets the model in code. A template can count in both "explicit" and "default" if it has several nodes.

Model / API	Shutdown date	Templates	Explicit	Default	Hardcoded
`dall-e-3`	2026-05-12	27	4	23
Assistants API	2026-08-26	24	9	21
`gpt-3.5-turbo`	2026-10-23	17	9	10
`gpt-4`	2026-10-23	16	16
`gpt-3.5-turbo-instruct`	2026-09-28	14	1	13
`gpt-4-turbo-preview`	2026-03-26	12	12
`claude-3-5-sonnet-20240620`	2025-10-28	11		11
`gpt-4-turbo`	2026-10-23	9	9
`claude-3-5-haiku-20241022`	2026-02-19	7	7
`gpt-image-1`	2026-10-23	7	7
`gpt-4-vision-preview`	2024-12-06	7			7
`gpt-4-1106-preview`	2026-10-23	7	7
`gpt-3.5-turbo-1106`	2026-09-28	5	3	2
`chatgpt-4o-latest`	2026-02-17	5	5
`dall-e-2`	2026-05-12	4		4
`text-davinci-edit-001`	2024-01-04	4		4
`claude-3-7-sonnet-20250219`	2026-02-19	4	4
`gpt-4.1-nano`	2026-10-23	4	4
`o3-mini`	2026-10-23	4	4
`o1`	2026-10-23	3	3
`claude-3-5-sonnet-20241022`	2025-10-28	3	3
`gpt-3.5-turbo-0301`	2024-09-13	2	2
`gpt-3.5-turbo-16k-0613`	2024-09-13	2	2
`gpt-4-32k-0314`	2025-06-06	2	2
`gpt-4o-2024-05-13`	2026-10-23	1	1
`gpt-4.5-preview`	2025-07-14	1	1
`gpt-4-0125-preview`	2026-03-26	1	1
`gpt-3.5-turbo-0125`	2026-10-23	1	1
`gpt-4.1-nano-2025-04-14`	2026-10-23	1	1
`o3-mini-2025-01-31`	2026-10-23	1	1

A few of these are only visible if you know n8n's defaults:

dall-e-3 (23 of 27 by default). The OpenAI node's Image → Generate operation defaults to dall-e-3 before typeVersion 2.2, and the default isn't saved in the JSON.
claude-3-5-sonnet-20240620 (11 of 11 by default). This is the Anthropic Chat Model default at typeVersion 1.2. None of these templates contain the string.
gpt-4-vision-preview (7 hardcoded). In older versions of the OpenAI node (typeVersion below 1.4), Image → Analyze has it hardcoded.
Assistants API (24). These come from the OpenAI node's Assistant resource, the old OpenAI Assistant node, or HTTP calls to /v1/assistants and /v1/threads. The API itself was shut down, so changing the model doesn't help. Those workflows need to move to the Responses API.
gpt-3.5-turbo, gpt-3.5-turbo-instruct, text-davinci-edit-001 and dall-e-2 (defaults). These come from the legacy n8n-nodes-base.openAi node and the OpenAI LLM node. The 2 default gpt-3.5-turbo-1106 templates come from the old OpenAI Assistant node.

Scheduled, not yet shut down

These are the verified rules whose shutdown date is after 2026-10-31.

Model / API	Shutdown date	Templates
`gpt-5-mini`	2026-12-11	133 (all from the OpenAI Chat Model default)
`whisper-1`	2027-02-26	39 (33 hardcoded by n8n)
`gpt-4o-2024-08-06`	2027-01-14	18
`tts-1`	2027-01-06	17
`gpt-4o-mini-2024-07-18`	2027-01-14	10
`/v1/audio/translations`	2027-02-26	2
`gpt-4.1-mini-2025-04-14`	2027-01-14	2
`gpt-4o-2024-11-20`	2027-01-14	2
`gpt-4.1-2025-04-14`	2027-01-14	1

The gpt-5-mini row needs care. The OpenAI Chat Model node's default changed without a typeVersion bump: it was gpt-4o-mini, then gpt-4.1-mini, and since n8n PR #24342 (merged 2026-01-15) it is gpt-5-mini. The 133 count assumes the template runs on a current n8n release. On an older release the same node sends a different model.

The 33 hardcoded whisper-1 templates can't be fixed from the node UI. You either replace the node with an HTTP Request node or wait for n8n to change the operation.

What I deliberately did not count

The official pages list dated snapshots such as gpt-4o-2024-08-06 and gpt-4o-mini-2024-07-18. Many templates use the undated aliases instead: gpt-4o, gpt-4o-mini, gpt-4.1, gpt-4.1-mini. I could not find an official statement that gives those aliases a shutdown date. Mapping an alias to a retiring snapshot would be my own inference, so none of the numbers above count them.

The scanner still knows about them, but as unverified rules. They are only reported if you pass --include-unverified, and then they are marked as unverified.

Caveats

Third-party mirror. It is not n8n's library and has no template dates, and the snapshot is from 2025-08-08.
Text-match denominator. The 804 "AI templates" figure comes from a text match, not a semantic classification.
Default inference. Default-model findings rely on n8n's current source (pinned commit). Each finding in the report links to the line that defines the default.
Precision, recall and bias. I measured precision and recall on a hand-labelled sample, with a dev set plus a small random holdout. I also labelled them myself, so the labels share my reading of n8n's defaults. The numbers and that bias are spelled out in the repo README.
Example strings. Model IDs that appear only inside example data (for example a "Set input data" node with a sample payload) can show up as false positives.

Check your own workflows

The scanner is a single Python file with one dependency (PyYAML). It works offline and never modifies your files.

git clone https://github.com/paopao-studio-ai/model-sunset-scanner model-sunset-scanner
cd model-sunset-scanner
pip install -r requirements.txt

# n8n: Workflow menu -> Download, or `n8n export:workflow --all --separate --output=./flows/`
python3 model_sunset_scan.py ./flows/ --md report.md

# Make: scenario -> Export Blueprint
python3 model_sunset_scan.py my_scenario.blueprint.json

# Any code or config
python3 model_sunset_scan.py ./src/

Each finding shows the node, the JSON path, the shutdown date, the official replacement and, where the provider documents it, which request parameters change, such as temperature on newer reasoning models or max_tokens → max_completion_tokens. The exit code is 1 when anything is found, so you can run it in CI.

Repo: https://github.com/paopao-studio-ai/model-sunset-scanner

Need help migrating? https://paopao-studio.pages.dev/?utm_source=devto&utm_medium=community&utm_campaign=model_sunset

Singapore local service businesses: where website enquiries leak (2026 scan)

Paopao Studio — Sat, 31 Oct 2026 01:39:24 +0000

On 31 October 2026 we scanned 183 Singapore local service business websites from the outside: aircon, cleaning, moving, dental, beauty, physio, plumbing, electrical and renovation. For each site we read public DNS and fetched the homepage once. We submitted no forms and sent no email.

This is a convenience sample. The sites were taken from public "best of Singapore" lists, so it does not represent all Singapore businesses. No business is named.

Email authentication (N = 183 domains)

155/183 (84.7%) have no enforced DMARC policy: 79/183 (43.2%) have no DMARC record and 76/183 (41.5%) use p=none.
21/183 (11.5%) use p=quarantine and 7/183 (3.8%) use p=reject.
30/183 (16.4%) have no SPF record. 117/183 (63.9%) end SPF with ~all or ?all, and 1/183 publishes two SPF records.
169/183 (92.3%) publish MX records. Of those, 142/169 (84.0%) have no enforced DMARC, and 15/169 (8.9%) have neither SPF nor DMARC.

Missing DMARC is a risk, not a confirmed fault. It makes spoofing easier and spam filtering more likely. It does not prove that any mail is being lost.

Homepage and forms (N = 170 readable homepages)

13 homepages returned an error or a bot-challenge page, so these numbers use the 170 that returned readable HTML.

178/183 (97.3%) served the homepage over valid HTTPS without an error. 5/183 (2.7%) returned a 5xx error on our single request.
88/170 (51.8%) have a form on the homepage.
62/170 (36.5%) have neither a form nor a mailto: link on the homepage. 99/170 (58.2%) link to WhatsApp.
0/88 homepage forms post to a host that doesn't resolve. 3/88 post to another host, and all of those hosts resolve.
75/88 (85.2%) of sites with a homepage form have no enforced DMARC.
Median time to first byte was 1.24 s (p75 2.13 s). That's one run from a US server, so treat it as rough.

Limitations

The scan is passive, so it can't show whether any form actually delivers enquiries.
Only homepages were checked. Forms on contact pages, or forms drawn by JavaScript, were missed.
Timings come from a single run and will vary.
The sample leans toward moving, cleaning and aircon businesses.

Self-check for owners

Submit your own form from a phone on mobile data. Does the notification arrive, and is it in spam?
Look up your domain's SPF and DMARC records. You should have exactly one SPF record. Has DMARC sat at p=none for months?
Check that form notifications go to an inbox someone still reads.
Tap your WhatsApp and phone links and check they open the right number.

The full method, every metric as x/N, and the CSV column behind each number are on the report page.

If you want the whole path traced, the Lead Leak Check ($197) maps it from the form to the first human reply. A Starter build ($497) sets up one production workflow.

Find companies that just raised money, straight from SEC Form D filings

Paopao Studio — Sat, 31 Oct 2026 01:13:16 +0000

When a startup raises a round, its press release is optional. Its SEC filing usually is not. A US company that sells securities under Regulation D (most seed, Series A/B, SAFE and convertible-note rounds) has to file a Form D with the SEC within 15 days of the first sale. Those filings are public on EDGAR, the same day they are disseminated.

That makes Form D one of the cheapest "who just got budget" signals available for B2B sales, recruiting, and deal-flow research. The catch is that EDGAR gives you a daily index and an XML file per filing, mixed in with funds, SPVs and real-estate vehicles.

This post shows how to get a clean, filtered list with an Apify Actor I maintain, SEC Form D Funding Tracker (disclosure: I built it). All output below is from real runs on 2026-10-31 (JST), covering filings from 2026-10-28 to 2026-10-30.

Step 1: free sample

Switch on Free sample mode ("sampleMode": true). It returns 5 filings from operating companies in the last 3 days, ignores your filters, and is not charged. One row, trimmed:

{"company_name": "Faex Technologies Inc.", "form_type": "D", "filed_date": "2026-10-29",
 "date_of_first_sale": "2026-10-14", "total_amount_sold_usd": 2500000.0,
 "total_offering_amount_usd": 4500000.0, "stage_hint": "seed ($1-5M)",
 "securities_offered": ["equity", "option to acquire"], "investors_count": 2,
 "industry_group": "Other", "issuer_city": "LAFAYETTE", "issuer_state": "CO",
 "year_of_inc": 2024, "related_persons_count": 3, "category": "operating_company",
 "filing_url": "https://www.sec.gov/Archives/edgar/data/2148280/000214828026000003/0002148280-26-000003-index.htm"}

Form D lists executives and directors by name and address. The Actor drops those and keeps only counts (related_persons_count, related_person_roles), so the output is company-level data. stage_hint is an amount-based guess, not an SEC field.

Step 2: a filtered, scored run

Tech and health companies that raised at least $500k in the last 3 days, with scoring and change tracking on:

{
  "daysBack": 3,
  "categories": ["operating_company"],
  "industries": ["Other Technology", "Computers", "Biotechnology", "Other Health Care"],
  "minAmountSold": 500000,
  "maxResults": 5,
  "signalScoring": true,
  "changeTracking": true,
  "stateKey": "devto-demo",
  "requestsPerSecond": 2
}

The run summary (RUN_SUMMARY in the key-value store):

{"days_requested": 3, "days_with_index": 2, "index_rows": 315, "after_prefilter": 167,
 "xml_fetched": 80, "xml_failed": 0, "matched": 5, "skipped_by_max_results": 87,
 "is_baseline_run": true, "new_issuer_rows": 5, "pushed": 5}

Two business days of index, 315 Form D rows, 167 left after the cheap pre-filter, 80 filings checked in full, 5 returned because I set maxResults: 5. skipped_by_max_results: 87 is the number of candidate filings the run skipped once the output was full, so they were not checked against the filters. With change tracking on, those 87 are still saved as seen and will not show up later, so for a real baseline raise maxResults on the first run.

The top two rows by score:

{"company_name": "Stardust Semiconductors Inc.", "filed_date": "2026-10-29",
 "date_of_first_sale": "2026-10-16", "days_first_sale_to_filing": 13,
 "total_amount_sold_usd": 2700000.0, "stage_hint": "seed ($1-5M)", "investors_count": 2,
 "industry_group": "Other Technology", "year_of_inc": 2026,
 "change_type": "new", "is_first_edgar_filing": true,
 "signal_score": 80, "signal_tier": "hot",
 "score_reasons": [
   "+20 first filing: this is the issuer's first EDGAR filing (new to SEC filings)",
   "+17 amount: $2,700,000 sold so far (log scale: $100k = 0, $100M+ = 35)",
   "+15 young company: incorporated in 2026",
   "+15 industry: Other Technology (technology)",
   "+10 freshness: filed 13 days after the first sale",
   "+3 traction: 100% of the offering sold, 2 investors"]}

{"company_name": "Swep Bio, Inc.", "issuer_city": "SCARSDALE", "issuer_state": "NY",
 "filed_date": "2026-10-29", "days_first_sale_to_filing": 1,
 "total_amount_sold_usd": 2499989.0, "industry_group": "Biotechnology", "year_of_inc": 2026,
 "change_type": "new", "is_first_edgar_filing": true, "signal_score": 75, "signal_tier": "hot"}

And one that ranked lower, with the reason visible:

{"company_name": "Bluesonde Technologies, Inc.", "total_amount_sold_usd": 1000000.0,
 "date_of_first_sale": "2025-11-11", "days_first_sale_to_filing": 352,
 "signal_score": 68, "signal_tier": "warm",
 "score_reasons": ["...", "+1 freshness: filed 352 days after the first sale"]}

The score adds six capped parts: amount raised (35, log scale), first EDGAR filing (20), incorporated within 5 years (15), industry (15), days from first sale to filing (10), and round progress / investor count (5). It helps you decide what to look at first. It does not predict anything.

Step 3: schedule it

Keep the same stateKey and schedule the Actor daily. Later runs only push filings you haven't received:

change_type: "new": an issuer you've never seen under this key
change_type: "changed": a new Form D or a D/A amendment from an issuer you already have, with previous_amount_sold_usd and amount_sold_delta_usd (how much more they raised since the filing you saw)

Form D has no "closed" event, so there are no closed rows.

What to do with the list

B2B sales: a company that just closed a round has new budget and usually a hiring plan. Filter by industry, state and amount to match your ICP.
Recruiting / staffing BD: freshly funded startups hire next. Pair it with a job-board monitor to see who raised and opened roles.
VC / analysts: spot rounds that were never announced, with security type (equity, SAFE, debt) and investor count.

Limits worth knowing: only Reg D offerings that actually file a Form D appear; there are no investor names or valuations (Form D doesn't have them); industry_group is the issuer's own choice and many pick "Other"; EDGAR publishes the daily index on business-day evenings (US Eastern).

Data source and pricing

The Actor reads only SEC's public /Archives/ paths (the daily form index and each filing's primary_doc.xml), sends a declared User-Agent with a contact email, and stays under SEC's fair-access rate limit (5 requests/second by default, I used 2 here).

Pricing is pay per event: $0.008 per filing returned ($8 per 1,000). No start fee. Sample mode, filtered-out filings and errors are free, and change tracking never charges twice for the same filing. The scored run above would have cost 5 × $0.008 = $0.04.

Try it on the Apify Store: SEC Form D Funding Tracker. Source: paopao-studio-ai/sec-form-d-funding-signals.

Track hiring changes at target companies on Greenhouse, Lever and Ashby (with a hiring signal score)

Paopao Studio — Sat, 31 Oct 2026 01:12:45 +0000

If you sell to companies or place candidates with them, one of the most useful public signals is the company's own job board. A team that opens five Account Executive roles this month is building a sales org. A board that suddenly closes forty roles is telling you something too.

Most of that data is public. Greenhouse, Lever, Ashby, Workable, SmartRecruiters and Recruitee all publish job-board endpoints so that companies can show their openings on their own careers pages. The hard parts are:

normalizing six different formats,
remembering what you saw last time, so you only look at what changed, and
turning a pile of rows into "which account should I call first".

This post walks through doing that with an Apify Actor I maintain, ATS Jobs Monitor (disclosure: I built it). Everything below is copied from two real runs on 2026-10-31 (JST). Nothing is edited except trimming fields.

The input

Three target accounts on three different ATS, only sales roles, and both optional features switched on:

{
  "companies": ["greenhouse:anthropic", "lever:palantir", "ashby:ramp"],
  "keywords": ["account executive", "sales"],
  "changeTracking": true,
  "stateKey": "devto-demo",
  "signalScoring": true,
  "maxJobsPerCompany": 3,
  "outputCompanySummary": true
}

greenhouse:anthropic style inputs are exact. You can also paste a board URL (jobs.lever.co/palantir) or a careers page, or a bare slug (ramp), in which case the Actor tries all six ATS and marks the row match_confidence: "guessed".
changeTracking + stateKey stores what was seen under that key, so the next run with the same key only outputs new, changed and closed jobs.
signalScoring adds signal_score, signal_tier and plain-English score_reasons to each company summary.
maxJobsPerCompany: 3 only limits how many job rows this run outputs. I used it to keep the demo short. With change tracking on, every scanned job is still saved as seen, so if you want the full list as your baseline, set it to 0 on the first run.

Run 1: the baseline

The run took a few seconds and pushed 7 job rows plus 3 company summaries (one per company). Here are two job rows (trimmed):

{"type": "job", "change_type": "new", "company_name": "ramp",
 "title": "Senior Manager, Account Executive | Mid-Market", "seniority": "manager",
 "location": "New York, NY (HQ)", "work_model": "hybrid",
 "posted_at": "2026-09-10T00:03:38.552000Z", "days_open": 51, "is_long_open": true,
 "ats": "ashby", "url": "https://jobs.ashbyhq.com/ramp/60ed4fac-3833-4495-9b0f-75e6dfe4b36c"}

{"type": "job", "change_type": "new", "company_name": "palantir",
 "title": "Sales", "seniority": "mid", "location": "New York, NY", "work_model": "hybrid",
 "posted_at": "2026-01-09T15:50:00.613000Z", "days_open": 294, "is_long_open": true,
 "ats": "lever", "url": "https://jobs.lever.co/palantir/24060586-7ba8-47c0-bfc1-f1dd5b82d8bd"}

seniority is a rule on the job title (not AI), and is_long_open flags roles open for at least longOpenDays days (30 by default). For recruiter BD, long-open roles are often the easiest conversation: the company is already struggling to fill them.

The more interesting part is the company summary. This is Ramp's, trimmed:

{"type": "company_summary", "company_slug": "ramp", "total_open_jobs": 171,
 "posted_last_7_days": 13, "posted_last_30_days": 48, "remote_share": 0.89,
 "top_departments": ["Sales", "Engineering", "People & Talent", "Marketing", "Compliance"],
 "is_baseline_run": true,
 "signal_score": 87, "signal_tier": "hot",
 "score_reasons": [
   "+25 new demand: 48 roles posted in the last 30 days (13 in the last 7)",
   "+15 seniority: 50 manager/director/executive roles (29%), 47% senior-or-above",
   "+15 department: biggest build-out is sales (77 of 171 roles)",
   "+10 hard-to-fill: 125 roles open 30+ days (73%)",
   "+9 velocity: 13 postings this week vs 11.2/week 30-day average (1.2x pace)",
   "+8 volume: 171 open roles",
   "+5 remote: 89% of roles are remote"]}

The same run scored Anthropic 81 (hot) and Palantir 57 (warm). Palantir's reasons show why it ranked lower:

+19 new demand: 17 roles posted in the last 30 days (2 in the last 7)
+0 velocity: 2 postings this week vs 4.0/week 30-day average (0.5x pace)

The score is the sum of seven capped parts: recent new roles (25), velocity (20), seniority (15), function (15), long-open roles (10), volume (10) and remote share (5). Every point comes with a reason, so you can disagree with it. It is a way to sort a list, not a prediction. If you sell to engineering teams rather than sales teams, pass scoreFunctions so the function points go to the departments you care about.

Run 2: only what changed

I ran the exact same input again right after the first run. The dataset came back with 3 rows, one company summary per company, and no job rows. Ramp's, trimmed:

{"type": "company_summary", "company_slug": "ramp", "total_open_jobs": 171,
 "new_jobs_since_last_run": 0, "changed_jobs_since_last_run": 0,
 "closed_jobs_since_last_run": 0, "net_change_since_last_run": 0,
 "is_baseline_run": false, "signal_score": 87, "signal_tier": "hot"}

That's the point: nothing changed, so there were no job rows to read and none to pay for. On a daily schedule, a later run outputs:

change_type: "new" for roles that weren't there before,
change_type: "changed" when a tracked field such as title or location changed,
job_closed rows for roles that disappeared (filled or pulled). Closed rows are free.

When a scan is incomplete (for example, a board was truncated), the Actor merges into the old state and does not report closures, so you don't get fake "closed" alerts.

Using it for sales or recruiter BD

A setup that works:

Put 50 to 500 target accounts in companies (use ats:slug or the board URL for accounts that matter, so a bare slug can't match the wrong company).
Run once with maxJobsPerCompany: 0 as the baseline.
Schedule it daily or weekly with the same stateKey.
Send the dataset to Slack, Google Sheets, n8n, Make or Zapier through Apify integrations.
Each morning, sort company summaries by signal_score and read score_reasons. Use the new job rows (titles and departments) as the opening line for outreach.

Things it does not do: it has no contact data or email addresses, it only covers companies on those six ATS (for Workday sites there is a separate Workday Jobs Monitor), and it reads only public job postings.

Pricing

Pay per event on Apify:

$0.001 per job row ($1 per 1,000 jobs)
$0.005 per company summary
a $0.00005 Actor start event
closed-job rows and error rows are free

The two demo runs above would have been 7 job rows + 6 summaries ≈ $0.04 in total. A daily run over 100 accounts where nothing changed costs mostly the summaries (100 × $0.005 = $0.50); switch outputCompanySummary off if you only want changed jobs.

Try it on the Apify Store: ATS Jobs Monitor. The source is on GitHub: paopao-studio-ai/ats-hiring-signals. Questions and bug reports are welcome there.

Ghost Workflow Medium: a 1B Gemma on a CPU summons dead cron jobs and reincarnates them as n8n workflows

Paopao Studio — Fri, 30 Oct 2026 02:16:39 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine

What I Built

Every small business has ghosts in its machines: a crontab line nobody remembers writing, a Python 2 report that "just works" every Monday at 8, a disk alert that pings a chat room nobody reads. When the person who wrote them leaves, the knowledge dies with them.

Ghost Workflow Medium is a tiny, fully offline sÃ©ance for those ghosts. You hand it the remains of an old script. A local Gemma 3 model running in Ollama speaks as the ghost and tells you in three sentences what it did in life. Then it reincarnates the script as an n8n workflow JSON you can import.

It's my DÃa de los Muertos ofrenda for the scripts that quietly kept small shops running for years.

Demo

The GIF is rendered directly from the raw run log in the repo (logs/run_20261029T143407Z_gemma3-1b.log). No face, no edits.

The first ghost is a 2009-style backup script: mysqldump, tar, scp to a NAS, find -delete, then mail to the boss, every night at 0 3 * * *. Here is the real output from gemma3:1b:

ðŸ•¯  Summoning the ghost of backup_cron_2009.sh with gemma3:1b ...
ðŸ‘» Alright, let's seeâ€¦ I was the keeper of this little business, a silent observer, and my every action was vital. I meticulously copied the shop's data, ensuring everything was safe, and then meticulously archived it, safeguarding the business's future. Without me, the shop would cease to exist, and the records would vanish into the digital void. It's a chilling thought, really, that my existence is inextricably linked to its survival.
   (confession: 97 tokens, 3.9s)
   (plan attempt 1: 149 tokens, 9.1s)
   ðŸ§¿ exorcised step 'Send Notification': http://192.168.1.20:12345/status.html is not in the original script
âœ¨ Reincarnated -> reborn/backup_cron_2009.json (3 nodes: scheduleTrigger -> executeCommand -> emailSend); structure check passed

The same ghost summoned with gemma3:4b:

ðŸ‘» I awoke each morning precisely at 3:00 AM, initiating the relentless cycle of database backups and file archives. The shop owner and his assistant relied on my execution to safeguard their inventory and customer records, a silent, digital tether to their daily operations. Should I be erased, the meticulously crafted backups would vanish, plunging the shop into an immediate, irreversible chaos of lost data and fractured invoices.
   (confession: 81 tokens, 23.0s)
   (plan attempt 1: 277 tokens, 41.4s)
   ðŸ”§ re-typed step 'Copy to NAS' as a shell command (no URL in it)
âœ¨ Reincarnated -> reborn_gemma3-4b/backup_cron_2009.json (6 nodes: scheduleTrigger -> executeCommand -> executeCommand -> executeCommand -> executeCommand -> emailSend); structure check passed

I imported the results into a local n8n 2.45.6 with the n8n CLI (Successfully imported 1 workflow. Ã—3 per model) and opened them in the editor:

Code

paopao-studio-ai / ghost-workflow-medium

Local Gemma reads old cron/bash scripts and reincarnates them as validated n8n workflow drafts

👻 Ghost Workflow Medium

A local, offline séance for dead scripts. Feed it an old cron job, bash script or Python 2 report. A small open-weight Gemma 3 model running in Ollama speaks as the ghost and says what the script did in life. Then the tool reincarnates the script as an n8n workflow JSON that you can import.

Built for the DEV Hacktoberfest Open-Source AI Challenge, Week 4: Ghost in the Machine.

Why

Every small business has ghosts in its machines: a crontab line nobody remembers writing, or a weekly report that "just works". When the person who wrote it leaves, the knowledge goes with them. These scripts often contain internal hostnames, paths and email addresses, so you may not want to paste them into a cloud model. Everything here runs on one CPU-only machine, with no API keys and no network calls except to localhost:11434.

How

…

View on GitHub

MIT-licensed. The Python code is ~400 lines and stdlib-only. The repo includes the three sample ghosts, the reborn outputs from both models, and every raw log.

How I Built It

Model: Gemma 3, via Ollama, 100% local on an 8-core CPU with no GPU. The default is gemma3:1b, the smallest Gemma 3 (~800 MB download); gemma3:4b is optional. There are no API keys, and the only network call goes to localhost:11434. That matters because old scripts are full of internal hostnames, paths and email addresses.

Lesson 1: don't ask a 1B model to write n8n JSON. A real n8n workflow has node type strings, versioned parameters, positions and a connections map keyed by node name. A 1B model can't produce that reliably. So Gemma does two smaller jobs instead:

Confess (temperature 0.7): speak as the script, in three sentences.
Plan (structured output): Ollama's format parameter takes a JSON schema, so Gemma can only answer with {workflow_name, trigger: {type, cron}, steps: [{kind, name, detail}]}, with 1â€“6 steps of kind command | http | email | code | readFile | writeFile.

A ~100-line deterministic compiler then turns the plan into real n8n nodes: scheduleTrigger with a cron expression, executeCommand, httpRequest, emailSend, readWriteFile and code. It also adds stable UUIDs, positions and a linear connection chain.

Lesson 2: small models hallucinate, so check their work against the source. Gemma 1B's mistakes were very consistent, so I added guardrails that don't use the LLM at all:

ðŸ§¿ Exorcism (grounding):
- Any step whose URL or email address doesn't appear in the original script gets removed.
- In my final run, gemma3:1b invented a "Send Notification" step for the backup script, calling http://192.168.1.20:12345/status.html. The script only scps to that NAS address; there is no web endpoint and no port 12345. The step was removed.
- For the sales report, it copied https://hooks.example.org/done straight from the few-shot example in my prompt. That step was removed too.
ðŸ”§ Repair:
- In an early run, the model pasted the whole crontab line into the cron field. Now the field is trimmed to the 5 schedule fields.
- An "http" step that's really scp gets re-typed as a shell command.
Validation:
- validate.py checks for exactly one trigger, at least one action, and unique names.
- It checks that every node type is known and the cron expression is valid.
- It checks that every connection points to a real node and every node is reachable from the trigger.
- If any check fails, the errors go back to Gemma for one retry.

Results (from the logs in the repo):

ghost	gemma3:1b	gemma3:4b
backup (cron `0 3 * * *`)	schedule â†’ mysqldump â†’ email	schedule â†’ dump â†’ archive â†’ copy to NAS â†’ clean old backups â†’ email
disk alert (`/30 * * *`)	schedule â†’ the curl call	schedule â†’ df â†’ code â†’ HTTP POST to the real webhook
weekly sales report (`0 8 * * 1`)	schedule â†’ command â†’ email	schedule â†’ one big code node
all 3 ghosts, wall time	~34 s	~2.5 min

Both models got every schedule right, and all six workflows passed validation and imported into n8n. 1B is fast and gives you a skeleton, but it drops steps: tar, scp and cleanup are missing from the backup. 4B gives you a real draft, though it embellishes the stories; the sales script's owner became a "Mr. Henderson" who isn't in the script. One n8n gotcha: recent versions disable the Execute Command node by default, so it shows up as a "?" node. I had to start my local instance with NODES_EXCLUDE="[]" to see the terminal icons.

What it is not: a finished migration. The output is a scaffold. It has no credentials, its Code nodes carry TODOs, and you should review every shell command before activating anything.

Why Does Open Innovation Matter?

I run a small automation studio that builds n8n workflows for small merchants and training schools. These clients can't send their internal scripts to a closed cloud model, and they can't afford enterprise migration consultants. Open-weight Gemma, open-source Ollama and n8n change that. A single developer can run the whole "AI migration" on an ordinary CPU, offline, with every step inspectable: the prompt, the plan, the guardrails, the final JSON. A 1B model wouldn't be trustworthy on its own. With the weights local and the checks open, I could see exactly where it hallucinated and fix it in code. That is the kind of control open models give you.

My Agent Session

I built this with help from an AI coding assistant. It handled the installs, the scaffolding and the debugging loop of "run Gemma, read the log, add a guardrail". Every output in this post comes from real runs on my machine, and the raw logs are in the repo.

The Spirit of It

An ofrenda remembers the dead so they are not forgotten. Old scripts deserve the same. Before you delete them, let them tell their story, then give them a new life.

Prize Categories

Best Use of Gemma