Refused values
Errors covers the gates on a live request. This page covers task.yaml. The platform refuses a declaration at deploy rather than run your task with a policy it cannot honour.
An unknown key is refused, never ignored
execution.cardinaliti: "many" is a typo. It is rejected, not defaulted, and the error names the field. An ignored key would hide a policy that does not apply, which is a security failure for the network allowlist.
Values whose mechanism doesn't exist yet
These are rejected, not run degraded.
Declaration
Refusal
duration: unbounded
is not supported yet (needs checkpoint/resume)
state: across-crashes
is not supported yet (needs checkpoint/resume)
The one combination accepted with a warning is on The seven axes.
Values that only make sense together
Each of these is refused however it arises. That includes the platform default, so declaring only one side of a pair can still trigger it.
Declared
Refused because
egress_allow (even []) with network: none
no egress path exists to allow or deny
inbound_port / inbound_routes / inbound rate limits with anything but network: bidirectional
no inbound path exists to configure
network: bidirectional with no inbound_port
a serving task with no declared listen port is unroutable
cardinality: one + state: across-runs
a one-shot VM has no state to carry between units
cardinality: one + residency: pinned
a one-shot VM tears down after its unit — there is nothing to pin