The Salvor graph document format, strict versioned validation, and JSON Schema emission.

A graph is a declarative CONTROL document: authored once, submitted, hashed into a run, and then frozen. It coordinates nodes the runtime already knows how to execute (a full agent loop, a single tool call, a human gate, a branch, a map fan-out, a fold bounded-iteration loop, and a delay durable wait) and the typed edges between them. This crate owns four things and no more:

• the [document] model: [Graph], [Node], the payloads, and [Edge], parsed strictly (unknown fields rejected) and versioned additively;
• the [validate] pass: a set of independent checks that collect every error and name the offending node or edge;
• the [expr] language: the total, non-Turing-complete condition language a branch case's expression string is written in, parsed at the submit boundary so a malformed condition is a node-precise error, never a runtime failure;
• [graph_schema]: the graph document's JSON Schema, the single source of truth for editors and the future per-language builders.

What this crate is NOT

There is no run-time execution here. salvor-engine is the crate that drives a graph, fans a map out, and backs the POST /v1/graphs and POST /v1/graph-runs endpoints in salvor-server; none of that lives in this one. Validation PARSES a branch condition (so a bad one fails at submit) but never EVALUATES one against a routed value; the evaluator [expr::Expr::eval] exists and is total, but it is salvor-engine that calls it, not this crate. Keeping this crate to format-plus-validation is what keeps it a pure, IO-free leaf: it depends only on serde, serde_json, schemars, and thiserror, drags in no runtime, and so stays usable from a future wasm dashboard projection.

Strict in, additive out

Parsing rejects a stray field loudly, because a silently dropped field could drop a gate or an unenforced budget. Validation is likewise strict and fails at the submit boundary, not at run time. The one forward-compatibility concession is the additive schema_version discipline (see [document::SCHEMA_VERSION]): a graph recorded under an older build still parses and validates under a newer one.