---
id: EXPO-8
family: GR-EXPO
level: extended
profiles: [storage-api]
posture: descriptive
added: "1.0"
changed: "1.0"
source: https://flowdrop.io/spec/rules/gr-expo/expo-8
specification: FlowDrop Workflow Specification 1.0-draft
licence: CC BY 4.0
---

# EXPO-8 — A port with no stored decision is exposed, whatever the processor suggested

*GR-EXPO (Part I) · level: extended · profiles: storage-api · added in 1.0 · posture: descriptive*

A known seam, recorded so nobody is surprised by it. It is the price of the fail-open polarity: a port nobody has decided about shows up rather than disappearing.

## The rule

> **Normative.** This is the rule.
>
> 1. Where a processor gains a parameter after a node type's exposure values were stored, and the node type has not been re-derived, that port has no stored exposure value and resolves as exposed, even where the processor suggests hiding it.
>
> 2. A processor's suggestion reaches a node type only through the authoring-time derivation of EXPO-6.

*This rule records what implementations do rather than requiring it.*


## What it means

A port with no stored exposure value reads exactly like a port nobody has an
opinion about, even where the processor itself asked for that exact port to
ship hidden. That request only ever reaches a node type through the
one-time read of EXPO-6, and a port a node type never derived a decision for
is a port that read never happened for. Fail-open wins: the port shows up.

## Example

```json title="The processor's own schema for the port" verdict="suggested"
{ "type": "string", "x-exposed-by-default": false }
```

```json title="The node type's own stored entry for the same port" verdict="exposed"
{ "connectable": true }
```

The node type's entry carries no `exposed_by_default` at all — nothing was
ever derived for this port. What gets published for it carries no exposure
flag either, the same shape as a port nobody has decided about, regardless
of what the processor asked for.

## Related rules

- Names: CFG-2, EXPO-4, EXPO-6
- Referenced by: CFG-2, EXPO-4, EXPO-16

---

Rule identifiers are permanent and are never renumbered. This specification carries
no implementation status: each implementation publishes its own standing against
these rules. Licensed CC BY 4.0.