feat(server): canonicalize transcripts at ingest v1

[wileland]

Motivation

• Prevent transcript identity wobble by canonicalizing user transcripts at ingest and making the canonical form the hashing source-of-truth.
• Preserve raw user text while storing a deterministic, idempotent canonical view and a stable transcriptHash so receipts and downstream workers remain stable.
• Apply canonicalization consistently at all write boundaries (upload placeholder, GraphQL add/update, scribe worker) and let reflection worker consume the persisted canonical view.

Description

• Add a canonicalization v1 helper and helpers in server/models/Entry.js: canonicalizeTranscriptV1, sha256Hex, buildCanonicalTranscriptPayload, and TRANSCRIPT_CANONICALIZATION_VERSION_V1.
• Extend the Entry model schema with rawTranscript, canonicalTranscript, transcriptHash, and canonicalizationVersion and update setTranscriptState to populate these fields on transcript writes.
• Wire ingest-time canonicalization into all write paths: server/routes/upload.js (placeholder entry creation), GraphQL addEntry/updateEntry (server/graphql/resolvers/index.js), and scribe worker persistence (server/src/workers/scribe.worker.js) to consistently store the canonical payload and version.
• Update reflection worker (server/src/workers/reflection.worker.js) to prefer persisted canonicalTranscript when canonicalizationVersion === '1' and fall back to canonicalizeTranscriptV1 for legacy entries, and include canonical fields in recent-history queries.
• Add/adjust deterministic tests and test mocks: canonicalization/idempotency and hashing tests in server/models/__tests__/Entry.test.js, and updated worker/route tests to mock or exercise the new named exports and behavior.

Testing

• Ran the task sanity check: node -e "JSON.parse(require('fs').readFileSync('codex/tasks/latest.json','utf8')); console.log('latest.json ok')" which printed latest.json ok (success).
• Ran preflight: node scripts/codex_preflight.mjs --ci which passed (Codex Web context; preflight warnings about missing remote were expected and non-blocking).
• Ran server tests: pnpm -C server test and observed the test suite complete with the updated test surface (final run: 219 tests passed, 5 skipped), indicating the canonicalization behavior and worker integration are covered and green.
• Ran linter pnpm -C server lint:ci which failed in this environment due to an ESLint/AJV runtime incompatibility (TypeError: Cannot set properties of undefined (setting 'defaultMeta')) that is unrelated to these code changes; lint failure is environmental and not caused by the canonicalization edits.

---

Codex Task

[github-actions]

Audit

Audit artifacts not found.

Schema

No drift detected ✅

Codex

No Codex outputs yet.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f5c9c9a888

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".