A workflow may not expose a port hidden on its node
Hidden means hidden in both directions. R7 stops an edge reaching a hidden port; R10 stops the workflow's public surface reaching one.
The rule
Normative: this is the rule
- A workflow exposure entry must name a port that is exposed on the target node instance, resolved through the same chain as R7.c: the instance's
config.ports[].exposedwhere it sets one, otherwise the node type'sexposedByDefault. - An entry naming a hidden port is refused with
R10_EXPOSURE_HIDDEN_PORT, and the error names the workflow port, the node and the node's port. - A port the node type's metadata does not declare is out of scope, mirroring R7.d.
- R10 and R7 are disjoint by construction (R7 judges edges, R10 judges exposure entries), so one hidden port never earns one exposure entry two reports.
Why
Recorded under OPEN-2.
Rule identifiers are permanent and are never renumbered. Each implementation publishes its own standing against these rules; this specification does not.spec 1.0-draft · R10 · changed in spec 1.0