fix(bolt): replace WSL mirrored-networking with a host UDP forwarder

[hyperpolymath]

Why

The WSL2 dev path for the Bolt server was incredibly unstable. Mirrored
mode (networkingMode=mirrored + dnsTunneling/autoProxy/
hostAddressLoopback), which docs/developer/wsl-mirrored-networking.adoc
instructed every contributor to enable, causes recurring Hyper-V
VmSwitch Failed to restore configuration for port … Object Name not found errors and intermittent Wsl/Service/E_UNEXPECTED catastrophic
failures (vNIC flap / VM bounce) on Windows 11 24H2 and Insider builds.

What (3 commits)

• scripts/wsl-bolt-udp-forward.ps1 (new) — bidirectional userspace
  UDP relay on the Windows host for udp/7373 + udp/9, per-client
  ephemeral upstream with idle expiry (QUIC/ack returns work, not just
  fire-and-forget cold pokes), re-resolves the WSL NAT IP every 15s.
  -Install registers a logon scheduled task; optional -Firewall.
  netsh portproxy is TCP-only and cannot do this.
• docs/developer/wsl-mirrored-networking.adoc — rewritten: NAT +
  forwarder recommended; bridged = wired alternative; mirrored demoted
  to last-resort with a 24H2/Insider warning. Filename kept (5 inbound
  refs incl. machine-readable state).
• docs/decisions/0005-wsl-bolt-inbound-udp-no-mirrored.adoc (new)
  — ADR; also turns the stub docs/decisions/README.adoc into a real
  ADR index/decision log.
• CHANGELOG.md, .machine_readable/6a2/STATE.a2ml, CLAUDE.md,
  README.adoc, router-port-forward.adoc, bolt-ddns.adoc — synced
  so human + machine docs no longer assert mirrored mode.

Verification

Script statically parse-checked (0 errors). End-to-end check is an
operator step: revert ~/.wslconfig to plain NAT, wsl --shutdown,
just server, then a test datagram to <host-lan-ip>:7373 (or
scripts/check-bolt-reachability.sh). Tracked outside this PR.

Considered and rejected

• proven-stun NAT traversal — cold bolts target peers not in a
  session, so hole-punching is structurally impossible (recorded in
  ADR-0005).
• proven-frame hardening of Burble.Bolt.Packet — separate, low
  priority.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 21 issues detected

Severity	Count
🔴 Critical	4
🟠 High	6
🟡 Medium	11

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action ocaml/setup-ocaml@v3 needs attention",
    "type": "unpinned_action",
    "file": "affinescript-canary.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "No permissions declaration -- add permissions: read-all",
    "type": "missing_permissions",
    "file": "elixir-ci.yml",
    "action": "add_permissions",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "binary_to_term without :safe option -- deserialization attack (1 occurrences, CWE-502)",
    "type": "elixir_send_unsanitised",
    "file": "/home/runner/work/burble/burble/server/lib/burble/media/lmdb_playout.ex",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "SSL verify_none disables certificate validation -- MITM risk (1 occurrences, CWE-295)",
    "type": "elixir_no_ssl_verify",
    "file": "/home/runner/work/burble/burble/server/lib/burble/bridges/mumble.ex",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "believe_me undermines formal verification (2 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/burble/burble/src/interface/abi/Foreign.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Nickel file missing SPDX-License-Identifier header (1 occurrences, CWE-1104)",
    "type": "ncl_missing_spdx",
    "file": "/home/runner/work/burble/burble/configs/config.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "Lock.unwrap() without poison handling (14 occurrences, CWE-754)",
    "type": "lock_unwrap",
    "file": "/home/runner/work/burble/burble/tools/selur-compose/crates/selur-compose-driver/src/mock.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence