---
id: R10
family: GR-VAL
level: core
profiles: [storage-api]
posture: normative-target
added: "1.0"
changed: "1.0"
source: https://flowdrop.io/spec/rules/gr-val/r10
specification: FlowDrop Workflow Specification 1.0-draft
licence: CC BY 4.0
---

# R10 — A workflow may not expose a port hidden on its node

*GR-VAL (Part I) · level: core · profiles: storage-api · added in 1.0*

Hidden means hidden in both directions. R7 stops an edge reaching a hidden port; R10 stops the workflow's public surface reaching one.

## The rule

> **Normative.** This is the rule.
>
> 1. A workflow exposure entry must name a port that is exposed on the target node instance, resolved through the same chain as R7.c: the instance's `config.ports[].exposed` where it sets one, otherwise the node type's `exposedByDefault`.
>
> 2. An entry naming a hidden port is refused with `R10_EXPOSURE_HIDDEN_PORT`, and the error names the workflow port, the node and the node's port.
>
> 3. A port the node type's metadata does not declare is out of scope, mirroring R7.d.
>
> 4. R10 and R7 are disjoint by construction (R7 judges edges, R10 judges exposure entries), so one hidden port never earns one exposure entry two reports.

## Why

Recorded under OPEN-2.

## Related rules

- Names: R7.c, R7.d, R4.d
- Referenced by: R7.c, R7.d, R4.d

---

Rule identifiers are permanent and are never renumbered. This specification carries
no implementation status: each implementation publishes its own standing against
these rules. Licensed CC BY 4.0.