---
id: EXPO-11
family: GR-EXPO
level: core
profiles: [storage-api, runtime]
posture: normative-target
added: "1.0"
changed: "1.0"
source: https://flowdrop.io/spec/rules/gr-expo/expo-11
specification: FlowDrop Workflow Specification 1.0-draft
licence: CC BY 4.0
---

# EXPO-11 — Output stripping covers declared output ports only

*GR-EXPO (Part I) · level: core · profiles: storage-api, runtime · added in 1.0*

Hiding an output means its value never leaves the node. The pass that enforces this works from the processor's declared output schema, so keys that are not declared ports (dynamic outputs, reserved control ports) are outside its reach by construction.

## The rule

> **Normative.** This is the rule.
>
> 1. When a node execution produces a result, every key naming a declared output port that resolves as hidden is removed from that result before it is delivered anywhere.
>
> 2. A key the processor's output schema does not declare (a dynamic output, a reserved control port) is not a port and passes through untouched.
>
> 3. A hidden declared output must be stripped whatever else the result contains, including where the processor declares no output ports at all.


## What it means

Stripping only reaches keys the processor's output schema names as ports.
Anything else in a node's result — a dynamic output an author added beyond
the declared set, a reserved control port — passes straight through, not
because it is judged safe but because the pass that removes hidden values has
no way to recognise it as a port at all.

That reach limit does not shrink the obligation at the edge: a hidden
declared output must still be stripped even where the processor's schema
declares no output ports at all. An empty declared set is not licence to
leave a node type's own hidden-port marking unenforced — it is the one case
where enforcing it matters most, because nothing else in the pass would
otherwise catch it.

## Example

A node's result carries three keys: one declared output the node type keeps
visible, one declared output the node type hides, and one key the
processor's output schema never names at all.

```json title="A node's raw result" verdict="produced"
{"result": "ok", "dynamic_field": "kept", "ssn": "secret"}
```

```json title="What the result delivers, with ssn a hidden declared output" verdict="stripped"
{"result": "ok", "dynamic_field": "kept"}
```

`dynamic_field` is not a name the output schema declares, so it is outside
stripping's reach in either direction — kept because it was never examined,
not because it was judged harmless.

## Related rules

- Names: EXPO-12, EXPO-13, EXPO-14
- Referenced by: EXPO-12, EXPO-13, EXPO-14, DATA-8

---

Rule identifiers are permanent and are never renumbered. This specification carries
no implementation status: each implementation publishes its own standing against
these rules. Licensed CC BY 4.0.