Ghost Workflow Medium: a 1B Gemma on a CPU summons dead cron jobs and reincarnates them as n8n workflows

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine

What I Built

Every small business has ghosts in its machines: a crontab line nobody remembers writing, a Python 2 report that "just works" every Monday at 8, a disk alert that pings a chat room nobody reads. When the person who wrote them leaves, the knowledge dies with them.

Ghost Workflow Medium is a tiny, fully offline séance for those ghosts. You hand it the remains of an old script. A local Gemma 3 model running in Ollama speaks as the ghost and tells you in three sentences what it did in life. Then it reincarnates the script as an n8n workflow JSON you can import.

It's my Día de los Muertos ofrenda for the scripts that quietly kept small shops running for years.

Demo

The GIF is rendered directly from the raw run log in the repo (logs/run_20261029T143407Z_gemma3-1b.log). No face, no edits.

The first ghost is a 2009-style backup script: mysqldump, tar, scp to a NAS, find -delete, then mail to the boss, every night at 0 3 * * *. Here is the real output from gemma3:1b:

🕯  Summoning the ghost of backup_cron_2009.sh with gemma3:1b ...
👻 Alright, let's see… I was the keeper of this little business, a silent observer, and my every action was vital. I meticulously copied the shop's data, ensuring everything was safe, and then meticulously archived it, safeguarding the business's future. Without me, the shop would cease to exist, and the records would vanish into the digital void. It's a chilling thought, really, that my existence is inextricably linked to its survival.
   (confession: 97 tokens, 3.9s)
   (plan attempt 1: 149 tokens, 9.1s)
   🧿 exorcised step 'Send Notification': http://192.168.1.20:12345/status.html is not in the original script
✨ Reincarnated -> reborn/backup_cron_2009.json (3 nodes: scheduleTrigger -> executeCommand -> emailSend); structure check passed

The same ghost summoned with gemma3:4b:

👻 I awoke each morning precisely at 3:00 AM, initiating the relentless cycle of database backups and file archives. The shop owner and his assistant relied on my execution to safeguard their inventory and customer records, a silent, digital tether to their daily operations. Should I be erased, the meticulously crafted backups would vanish, plunging the shop into an immediate, irreversible chaos of lost data and fractured invoices.
   (confession: 81 tokens, 23.0s)
   (plan attempt 1: 277 tokens, 41.4s)
   🔧 re-typed step 'Copy to NAS' as a shell command (no URL in it)
✨ Reincarnated -> reborn_gemma3-4b/backup_cron_2009.json (6 nodes: scheduleTrigger -> executeCommand -> executeCommand -> executeCommand -> executeCommand -> emailSend); structure check passed

I imported the results into a local n8n 2.45.6 with the n8n CLI (Successfully imported 1 workflow. ×3 per model) and opened them in the editor:

Code

paopao-studio-ai / ghost-workflow-medium

Local Gemma reads old cron/bash scripts and reincarnates them as validated n8n workflow drafts

👻 Ghost Workflow Medium

A local, offline séance for dead scripts. Feed it an old cron job, bash script or Python 2 report. A small open-weight Gemma 3 model running in Ollama speaks as the ghost and says what the script did in life. Then the tool reincarnates the script as an n8n workflow JSON that you can import.

Built for the DEV Hacktoberfest Open-Source AI Challenge, Week 4: Ghost in the Machine.

Why

Every small business has ghosts in its machines: a crontab line nobody remembers writing, or a weekly report that "just works". When the person who wrote it leaves, the knowledge goes with them. These scripts often contain internal hostnames, paths and email addresses, so you may not want to paste them into a cloud model. Everything here runs on one CPU-only machine, with no API keys and no network calls except to localhost:11434.

How

…

View on GitHub

MIT-licensed. The Python code is ~400 lines and stdlib-only. The repo includes the three sample ghosts, the reborn outputs from both models, and every raw log.

How I Built It

Model: Gemma 3, via Ollama, 100% local on an 8-core CPU with no GPU. The default is gemma3:1b, the smallest Gemma 3 (~800 MB download); gemma3:4b is optional. There are no API keys, and the only network call goes to localhost:11434. That matters because old scripts are full of internal hostnames, paths and email addresses.

Lesson 1: don't ask a 1B model to write n8n JSON. A real n8n workflow has node type strings, versioned parameters, positions and a connections map keyed by node name. A 1B model can't produce that reliably. So Gemma does two smaller jobs instead:

1. Confess (temperature 0.7): speak as the script, in three sentences.
2. Plan (structured output): Ollama's format parameter takes a JSON schema, so Gemma can only answer with {workflow_name, trigger: {type, cron}, steps: [{kind, name, detail}]}, with 1–6 steps of kind command | http | email | code | readFile | writeFile.

A ~100-line deterministic compiler then turns the plan into real n8n nodes: scheduleTrigger with a cron expression, executeCommand, httpRequest, emailSend, readWriteFile and code. It also adds stable UUIDs, positions and a linear connection chain.

Lesson 2: small models hallucinate, so check their work against the source. Gemma 1B's mistakes were very consistent, so I added guardrails that don't use the LLM at all:

• 🧿 Exorcism (grounding):
  • Any step whose URL or email address doesn't appear in the original script gets removed.
  • In my final run, gemma3:1b invented a "Send Notification" step for the backup script, calling http://192.168.1.20:12345/status.html. The script only scps to that NAS address; there is no web endpoint and no port 12345. The step was removed.
  • For the sales report, it copied https://hooks.example.org/done straight from the few-shot example in my prompt. That step was removed too.
• 🔧 Repair:
  • In an early run, the model pasted the whole crontab line into the cron field. Now the field is trimmed to the 5 schedule fields.
  • An "http" step that's really scp gets re-typed as a shell command.
• Validation:
  • validate.py checks for exactly one trigger, at least one action, and unique names.
  • It checks that every node type is known and the cron expression is valid.
  • It checks that every connection points to a real node and every node is reachable from the trigger.
  • If any check fails, the errors go back to Gemma for one retry.

Results (from the logs in the repo):

ghost	gemma3:1b	gemma3:4b
backup (cron 0 3 * * *)	schedule → mysqldump → email	schedule → dump → archive → copy to NAS → clean old backups → email
disk alert (*/30 * * * *)	schedule → the curl call	schedule → df → code → HTTP POST to the real webhook
weekly sales report (0 8 * * 1)	schedule → command → email	schedule → one big code node
all 3 ghosts, wall time	~34 s	~2.5 min

Both models got every schedule right, and all six workflows passed validation and imported into n8n. 1B is fast and gives you a skeleton, but it drops steps: tar, scp and cleanup are missing from the backup. 4B gives you a real draft, though it embellishes the stories; the sales script's owner became a "Mr. Henderson" who isn't in the script. One n8n gotcha: recent versions disable the Execute Command node by default, so it shows up as a "?" node. I had to start my local instance with NODES_EXCLUDE="[]" to see the terminal icons.

What it is not: a finished migration. The output is a scaffold. It has no credentials, its Code nodes carry TODOs, and you should review every shell command before activating anything.

Why Does Open Innovation Matter?

I run a small automation studio that builds n8n workflows for small merchants and training schools. These clients can't send their internal scripts to a closed cloud model, and they can't afford enterprise migration consultants. Open-weight Gemma, open-source Ollama and n8n change that. A single developer can run the whole "AI migration" on an ordinary CPU, offline, with every step inspectable: the prompt, the plan, the guardrails, the final JSON. A 1B model wouldn't be trustworthy on its own. With the weights local and the checks open, I could see exactly where it hallucinated and fix it in code. That is the kind of control open models give you.

My Agent Session

I built this with help from an AI coding assistant. It handled the installs, the scaffolding and the debugging loop of "run Gemma, read the log, add a guardrail". Every output in this post comes from real runs on my machine, and the raw logs are in the repo.

The Spirit of It

An ofrenda remembers the dead so they are not forgotten. Old scripts deserve the same. Before you delete them, let them tell their story, then give them a new life.

Prize Categories

• Best Use of Gemma