---
id: MAN-3
family: GR-MAN
level: extended
profiles: [storage-api]
posture: normative-target
added: "1.0"
changed: "1.0"
source: https://flowdrop.io/spec/rules/gr-man/man-3
specification: FlowDrop Workflow Specification 1.0-draft
licence: CC BY 4.0
---

# MAN-3 — However the manifest was written, one validator refuses a bad entry

*GR-MAN (Part I) · level: extended · profiles: storage-api · added in 1.0*

An authoring surface can offer only the ports it knows are valid; an API caller submits whatever it likes. Both land on the same stored shape, so the refusal has to live in one place.

## The rule

> **Normative.** This is the rule.
>
> 1. A manifest may be written by more than one door: an authoring surface that offers the author a filtered choice of ports, or an API mapping a caller-supplied contract.
>
> 2. Both write the same stored shape and are refused by the same workflow validation, so an entry naming an unknown node, or a port the instance hides, is refused whichever door submitted it.
>
> 3. Exposure is resolved the same way in both cases: an instance-level port setting overrides the port's declared default, and a port with neither is exposed.

## Related rules

- Names: MAN-1, MAN-20
- Referenced by: MAN-1, MAN-20

---

Rule identifiers are permanent and are never renumbered. This specification carries
no implementation status: each implementation publishes its own standing against
these rules. Licensed CC BY 4.0.