docs/adr/0027-the-reusable-unit-is-a-loop-not-a-node.md:530-532 lists the keys a node citing a multi-node fragment may not declare as prompt, allowed_tools, success_check, retry, handoff, timeout, budget_usd, agent, permission_mode, type. The implementation is the opposite shape: internal/graph/fragment.go:439-441 declares multiNodeUsingKeys as an allow-list of exactly id, use, with, depends_on, cwd, worktree, and internal/graph/fragment.go:1194-1195 rejects every key NOT in it. So keys the ADR does not enumerate are refused as well — feedback: among them, which matters because it is the key an advisory lane would want to drop. The enumeration reads as exhaustive and is not. What needs correcting is the ADR sentence, not the code: the whitelist is the stricter and intended rule, and the error text at fragment.go:1195 already describes it as 'wiring only'.
docs/adr/0027-the-reusable-unit-is-a-loop-not-a-node.md:530-532 lists the keys a node citing a multi-node fragment may not declare as prompt, allowed_tools, success_check, retry, handoff, timeout, budget_usd, agent, permission_mode, type. The implementation is the opposite shape: internal/graph/fragment.go:439-441 declares multiNodeUsingKeys as an allow-list of exactly id, use, with, depends_on, cwd, worktree, and internal/graph/fragment.go:1194-1195 rejects every key NOT in it. So keys the ADR does not enumerate are refused as well — feedback: among them, which matters because it is the key an advisory lane would want to drop. The enumeration reads as exhaustive and is not. What needs correcting is the ADR sentence, not the code: the whitelist is the stricter and intended rule, and the error text at fragment.go:1195 already describes it as 'wiring only'.