Public workflow-template sharing

Public workflow templates are immutable, reviewed copies—not live workspace shares. A snapshot binds to one 64-character workflow revision and schema version. Its allowlisted payload contains portable native/plugin node definitions, topology, public input schemas, dependencies, placeholders, permission declarations, compatibility, creator attribution, license, and a deterministic digest.

The snapshot excludes source project IDs, user IDs, credentials, secrets, environment values, private URLs, execution data, pins, evaluations, tests, chat, comments, and run history. Publication validates both the allowlist and a sensitive-data scan. The source workspace is not consulted by catalog reads or imports.

Import requires explicit dependency and permission consent, validates the immutable digest, and creates a new destination workflow and node records without executing them. Installed copies have no link or update authority over the source template. Updates are new catalog revisions and remain opt-in. Internal workspace visibility continues to use normal workflow membership; it is not a public-template mechanism.

n8n-informed boundaries

The model keeps the two sharing modes that n8n also treats differently: project access follows project membership, while portable promotion copies data between authorities. n8n's workflow-sharing guidance makes credential access a separate least-privilege concern, and its source-control workflow exports credential and variable stubs rather than secret values and recommends one-way promotion between environments. Octonode's public catalog is stricter: snapshots contain placeholders only, imports never inherit credentials or execution history, and an imported workflow cannot mutate or receive automatic changes from the catalog source.