Import hardening: ChatGPT export schema, privacy, and idempotency fixtures

[joshyorko]

Outcome

Harden the ChatGPT export importer with schema probes, privacy gates, idempotency, and synthetic regression fixtures.

This should land with or immediately after #185 so imported archives are safe to preview and repeat.

Acceptance

• Add schema detection for the expected conversations payload.
• Fail with a clear error when the export shape is unknown.
• Never log raw message content on parse errors.
• Reuse existing content screening before any visible turn is stored.
• Reject or redact secrets using the same policy path as /v1/turns.
• Reject unsupported message roles by default.
• Preserve enough metadata for provenance without storing unrelated account data.
• Stable idempotency keys prevent duplicate turns across repeated applies.
• Add synthetic fixtures for:
  • normal two-turn conversation
  • conversation with missing title
  • unsupported role
  • secret-like content rejection
  • duplicate apply
  • malformed export
• Tests must prove preview writes nothing.

Non-goals

• No real ChatGPT user export fixture in the repo.
• No raw private conversation data in tests.
• No hidden/internal message preservation.

[joshyorko]

September 8 audit: verify importer residuals against shipped code

Keep this as the importer hardening owner; do not create another importer or confuse ChatGPT archives with #228 live host observations. Current master is 25d617b5f08593c76d336f90b8ffd1e78f77afbd, with imports and selective portable bundles already shipped. Bundle archive safety is not evidence that ChatGPT export parsing satisfies this issue.

Before editing, map every original acceptance criterion to the current importer and tests. A fulfilled case needs verification/closure evidence, not another implementation. Add missing tests in bounded groups:

• Evolving/sharded exports; selected branch versus alternative assistant regenerations; edited messages; deleted/missing/null nodes and source IDs; malformed timestamps; Unicode and non-text attachments. Don't silently import hidden/internal message roles.
• Preview/cancel changes no durable state. Same source IDs with changed contents conflict or produce explicit revision semantics; moved file paths, overlapping shards and interrupted batches remain idempotent.
• Event/valid time is distinct from import time: a recently imported old conversation must not displace a recent correction.
• Huge archives/members/JSON depth/message counts are bounded before large allocation. Unsupported shapes explain why without echoing private content.
• Secrets, unsafe metadata and hidden-reasoning fields are screened before durable evidence, diagnostics, failed-job artifacts or previews retain them.
• Re-import after known destination withdrawal/correction follows feat(memory): make corrections and forgetting survive derived views, replay and import #234; do not claim an old backup already contains later tombstones.
• Imported conversations are attributed to their original producer/speaker/time with import provenance; never silently upgraded into the consuming agent's firsthand experience or user adoption.

Use synthetic fixtures and isolated stores, not personal ChatGPT exports. Reuse #231's exact identity decisions and #233's lineage where applicable. No automatic archive import on provider startup. Leave open until the acceptance matrix is actually executed.