(CODUX-216) Make legacy canvas migration canonical and validation-safe

[numnx]

🧩 Task: Make legacy canvas migration canonical and validation-safe

Automated task PR opened by Code UX for T10.

📋 Summary

Sprint: Sprint 216 · Nodes Full Integration · Task: T10

Turn the existing project-scoped node-flow foundation and browser-local canvas into a canonical, secure, versioned automation control plane with registry-driven nodes, encrypted credentials, durable execution, governed integrations, isolated custom nodes, agent authoring, dashboard integration, and authenticated headless readiness.

🤖 Model & Provider

Provider	Codex CLI
Model	gpt-5.6-sol

⏱️ Timing

Started	2026-07-12 07:34:12 UTC
Finished	2026-07-12 07:51:28 UTC
Duration	17m 16s

📊 Token Usage

Metric	Value
Input tokens	186,333
Cached input tokens	7,754,496
Output tokens	30,345
Total tokens	7,971,174
Invocations	1
Tool calls	80
Active time	16m 20s

Included usage estimate (subscription/local login): $5.72

✅ QA Review

⏳ QA review runs after this PR is opened. Check the task card in the dashboard for the outcome once it lands.

📝 Full Task Prompt

## Objective
Make one-time browser canvas migration produce valid canonical Graph v2 drafts and make untrusted graph validation fail with structured issues instead of throwing.

## Scope
- `dashboard/src/v2/lib/nodes-canvas-state.ts`
- `dashboard/src/v2/NodesPage.tsx`
- `src/domain/node-flows/node-flow-migrators.ts`
- `src/domain/node-flows/node-flow-validation.ts`
- `tests/dashboard/lib/nodes-canvas-state.test.ts`
- `tests/backend/domain/node-flows/node-flow-migrators.test.ts`
- `tests/backend/domain/node-flows/node-flow-validation.test.ts`

## Requirements
1. Map legacy trigger, agent, and task canvas kinds to supported canonical definitions or preserve them explicitly as non-executable migration records that can still be saved and reviewed without making the import request fail.
2. Ensure the imported graph retains legacy snapshot data while the canonical graph is accepted by backend validation and does not become an independent browser workflow database.
3. Validate definition references, ports, credential bindings, policies, and nested graph values defensively. Inputs containing null or malformed array entries must return deterministic field-level issues rather than throw.
4. Preserve secret-shaped-key and custom-source rejection during migration and normalization.
5. Add deterministic tests for the current initial canvas graph, legacy localStorage fixtures, malformed ports/bindings, and repeated migration.

## Verification
- Prove `validateNodeFlowGraph(toCanonicalNodeFlowGraph(createInitialNodeCanvasGraph()))` is valid or produces only intentional non-blocking migration diagnostics.
- Exercise the NodesPage import path through a mocked backend and verify the imported draft is created and localStorage is removed only after persistence succeeds.
- Run focused backend/dashboard suites, both typechecks, `pnpm run build`, and `pnpm run check:docs-web`.

🌿 Branch Info

Base: feature/CODUX-216-nodes-full-integration
Head: task/feature-codux-21-t10-codex-477a963f-mrhh9h63

---

🤖 Generated by Code UX