fix(audit): address C2, C3, M4, M5 from 2026-05-25 audit

C2: Add EncryptingTransport wrapper — all media I/O now goes through
ChaChaSession encrypt/decrypt before hitting the QUIC datagram path.
cli.rs run_live/run_silence/run_file_mode accept Arc<dyn MediaTransport>
and receive a wrapped transport after the handshake.

C3: Wire VideoScorer::observe() into both plain and trunked forwarding
loops in room.rs. Packets from participants with Abusive verdict are
dropped before forwarding. last_bwe_kbps tracked from quality reports.

M4: Widen FEC repair symbol index from u8 to u16 throughout
(FecEncoder::generate_repair, FecDecoder::add_symbol, all call sites in
call.rs, bench.rs, pipeline.rs, wzp-android). Eliminates theoretical
wrapping when num_source + repair_count > 255.

M5: Track last_encrypt_timestamp in ChaChaSession. debug_assert in
encrypt() that timestamp is non-decreasing across calls (including post-
rekey). complete_rekey() explicitly preserves last_encrypt_timestamp to
prevent accidental timestamp reset regressions.

583 tests passing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

crates/wzp-client/src/bench.rs

@@ -170,7 +170,7 @@ pub fn bench_fec_recovery(loss_pct: f32) -> FecResult {
 
         // Collect all symbols: source + repair
         struct Symbol {
-            index: u8,
+            index: u16,
             is_repair: bool,
             data: Vec<u8>,
         }
@@ -180,7 +180,7 @@ pub fn bench_fec_recovery(loss_pct: f32) -> FecResult {
             // For add_symbol we need to provide the raw data; the decoder pads internally
             total_source_bytes += sym.len();
             all_symbols.push(Symbol {
-                index: i as u8,
+                index: i as u16,
                 is_repair: false,
                 data: sym.clone(),
             });

crates/wzp-client/src/call.rs

@@ -409,7 +409,7 @@ impl CallEncoder {
                                 fec_ratio: MediaHeader::encode_fec_ratio(self.profile.fec_ratio),
                                 seq: self.seq,
                                 timestamp: self.timestamp_ms,
-                                fec_block: u16::from(self.block_id) | (u16::from(sym_idx) << 8),
+                                fec_block: u16::from(self.block_id) | (sym_idx << 8),
                             },
                             payload: Bytes::from(repair_data),
                             quality_report: None,
@@ -566,7 +566,7 @@ impl CallDecoder {
         if !packet.header.codec_id.is_opus() {
             let _ = self.fec_dec.add_symbol(
                 (packet.header.fec_block & 0xFF) as u8,
-                (packet.header.fec_block >> 8) as u8,
+                packet.header.fec_block >> 8,
                 packet.header.is_repair(),
                 &packet.payload,
             );

crates/wzp-client/src/cli.rs

@@ -388,7 +388,7 @@ async fn main() -> anyhow::Result<()> {
     }
 
     // Crypto handshake — establishes verified identity + session key
-    let _crypto_session = wzp_client::handshake::perform_handshake(
+    let session = wzp_client::handshake::perform_handshake(
         &*transport,
         &seed.0,
         None, // alias — desktop client doesn't set one yet
@@ -396,10 +396,15 @@ async fn main() -> anyhow::Result<()> {
     .await?;
     info!("crypto handshake complete");
 
+    // Wrap the transport so all media I/O goes through AEAD encryption.
+    let enc_transport: Arc<dyn wzp_proto::MediaTransport> = Arc::new(
+        wzp_client::encrypted_transport::EncryptingTransport::new(transport.clone(), session),
+    );
+
     if cli.live {
         #[cfg(feature = "audio")]
         {
-            return run_live(transport).await;
+            return run_live(enc_transport).await;
         }
         #[cfg(not(feature = "audio"))]
         {
@@ -423,19 +428,19 @@ async fn main() -> anyhow::Result<()> {
         Ok(())
     } else if cli.send_tone_secs.is_some() || cli.send_file.is_some() || cli.record_file.is_some() {
         run_file_mode(
-            transport,
+            enc_transport,
             cli.send_tone_secs,
             cli.send_file,
             cli.record_file,
         )
         .await
     } else {
-        run_silence(transport).await
+        run_silence(enc_transport).await
     }
 }
 
 /// Send silence frames (connectivity test).
-async fn run_silence(transport: Arc<wzp_transport::QuinnTransport>) -> anyhow::Result<()> {
+async fn run_silence(transport: Arc<dyn wzp_proto::MediaTransport>) -> anyhow::Result<()> {
     let config = CallConfig::default();
     let mut encoder = CallEncoder::new(&config);
 
@@ -485,7 +490,7 @@ async fn run_silence(transport: Arc<wzp_transport::QuinnTransport>) -> anyhow::R
 
 /// File/tone mode: send a test tone or audio file, and/or record received audio.
 async fn run_file_mode(
-    transport: Arc<wzp_transport::QuinnTransport>,
+    transport: Arc<dyn wzp_proto::MediaTransport>,
     send_tone_secs: Option<u32>,
     send_file: Option<String>,
     record_file: Option<String>,
@@ -674,7 +679,7 @@ async fn run_file_mode(
 
 /// Live mode: capture from mic, encode, send; receive, decode, play.
 #[cfg(feature = "audio")]
-async fn run_live(transport: Arc<wzp_transport::QuinnTransport>) -> anyhow::Result<()> {
+async fn run_live(transport: Arc<dyn wzp_proto::MediaTransport>) -> anyhow::Result<()> {
     use wzp_client::audio_io::{AudioCapture, AudioPlayback};
 
     let capture = AudioCapture::start()?;

crates/wzp-client/src/encrypted_transport.rs

@@ -0,0 +1,213 @@
+//! `EncryptingTransport` — wraps any `MediaTransport` with a `CryptoSession`.
+//!
+//! All outbound `send_media` calls encrypt the payload before handing off to
+//! the inner transport; all inbound `recv_media` calls decrypt after receiving.
+//! Signal, quality, and close are forwarded unchanged.
+//!
+//! The quality report travels in plaintext so the relay can make QoS decisions
+//! without being able to decrypt media content.
+
+use std::sync::{Arc, Mutex};
+
+use async_trait::async_trait;
+use bytes::Bytes;
+use wzp_proto::{
+    CryptoSession, MediaHeader, MediaPacket, MediaTransport, PathQuality, SignalMessage,
+    TransportError,
+};
+
+/// Wraps a `MediaTransport` and applies AEAD encryption/decryption to media payloads.
+pub struct EncryptingTransport {
+    inner: Arc<dyn MediaTransport>,
+    session: Mutex<Box<dyn CryptoSession>>,
+}
+
+impl EncryptingTransport {
+    pub fn new(inner: Arc<dyn MediaTransport>, session: Box<dyn CryptoSession>) -> Self {
+        Self {
+            inner,
+            session: Mutex::new(session),
+        }
+    }
+}
+
+#[async_trait]
+impl MediaTransport for EncryptingTransport {
+    async fn send_media(&self, packet: &MediaPacket) -> Result<(), TransportError> {
+        let mut header_bytes = Vec::with_capacity(MediaHeader::WIRE_SIZE);
+        packet.header.write_to(&mut header_bytes);
+
+        let mut ciphertext = Vec::new();
+        self.session
+            .lock()
+            .unwrap()
+            .encrypt(&header_bytes, &packet.payload, &mut ciphertext)
+            .map_err(|e| TransportError::Internal(format!("encrypt: {e}")))?;
+
+        let encrypted = MediaPacket {
+            header: packet.header,
+            payload: Bytes::from(ciphertext),
+            quality_report: packet.quality_report.clone(),
+        };
+        self.inner.send_media(&encrypted).await
+    }
+
+    async fn recv_media(&self) -> Result<Option<MediaPacket>, TransportError> {
+        let packet = match self.inner.recv_media().await? {
+            Some(p) => p,
+            None => return Ok(None),
+        };
+
+        let mut header_bytes = Vec::with_capacity(MediaHeader::WIRE_SIZE);
+        packet.header.write_to(&mut header_bytes);
+
+        let mut plaintext = Vec::new();
+        self.session
+            .lock()
+            .unwrap()
+            .decrypt(&header_bytes, &packet.payload, &mut plaintext)
+            .map_err(|e| TransportError::Internal(format!("decrypt: {e}")))?;
+
+        Ok(Some(MediaPacket {
+            header: packet.header,
+            payload: Bytes::from(plaintext),
+            quality_report: packet.quality_report,
+        }))
+    }
+
+    async fn send_signal(&self, msg: &SignalMessage) -> Result<(), TransportError> {
+        self.inner.send_signal(msg).await
+    }
+
+    async fn recv_signal(&self) -> Result<Option<SignalMessage>, TransportError> {
+        self.inner.recv_signal().await
+    }
+
+    fn path_quality(&self) -> PathQuality {
+        self.inner.path_quality()
+    }
+
+    async fn close(&self) -> Result<(), TransportError> {
+        self.inner.close().await
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::Mutex as StdMutex;
+    use wzp_crypto::ChaChaSession;
+    use wzp_proto::{CodecId, MediaType};
+
+    struct LoopbackTransport {
+        sent: StdMutex<Vec<MediaPacket>>,
+    }
+
+    impl LoopbackTransport {
+        fn new() -> Arc<Self> {
+            Arc::new(Self {
+                sent: StdMutex::new(Vec::new()),
+            })
+        }
+        fn take_sent(&self) -> Vec<MediaPacket> {
+            self.sent.lock().unwrap().drain(..).collect()
+        }
+    }
+
+    #[async_trait]
+    impl MediaTransport for LoopbackTransport {
+        async fn send_media(&self, packet: &MediaPacket) -> Result<(), TransportError> {
+            self.sent.lock().unwrap().push(packet.clone());
+            Ok(())
+        }
+        async fn recv_media(&self) -> Result<Option<MediaPacket>, TransportError> {
+            Ok(None)
+        }
+        async fn send_signal(&self, _msg: &SignalMessage) -> Result<(), TransportError> {
+            Ok(())
+        }
+        async fn recv_signal(&self) -> Result<Option<SignalMessage>, TransportError> {
+            Ok(None)
+        }
+        fn path_quality(&self) -> PathQuality {
+            PathQuality::default()
+        }
+        async fn close(&self) -> Result<(), TransportError> {
+            Ok(())
+        }
+    }
+
+    fn make_header(seq: u32) -> MediaHeader {
+        MediaHeader {
+            version: 2,
+            flags: 0,
+            media_type: MediaType::Audio,
+            codec_id: CodecId::Opus24k,
+            stream_id: 0,
+            fec_ratio: 0,
+            seq,
+            timestamp: seq * 20,
+            fec_block: 0,
+        }
+    }
+
+    #[tokio::test]
+    async fn payload_is_encrypted_on_wire() {
+        let key = [0x42u8; 32];
+        let session: Box<dyn CryptoSession> = Box::new(ChaChaSession::new(key));
+        let loopback = LoopbackTransport::new();
+        let enc = EncryptingTransport::new(loopback.clone(), session);
+
+        let header = make_header(1);
+        let plaintext = b"secret audio frame";
+        let pkt = MediaPacket {
+            header,
+            payload: Bytes::from_static(plaintext),
+            quality_report: None,
+        };
+
+        enc.send_media(&pkt).await.unwrap();
+
+        let sent = loopback.take_sent();
+        assert_eq!(sent.len(), 1);
+        assert_eq!(sent[0].header, header, "header must be preserved");
+        assert_ne!(
+            sent[0].payload.as_ref(),
+            plaintext.as_ref(),
+            "plaintext must not appear on wire"
+        );
+        // Ciphertext is longer by exactly the AEAD tag (16 bytes)
+        assert_eq!(sent[0].payload.len(), plaintext.len() + 16);
+    }
+
+    #[tokio::test]
+    async fn encrypt_then_decrypt_roundtrip() {
+        let key = [0x42u8; 32];
+        let send_session: Box<dyn CryptoSession> = Box::new(ChaChaSession::new(key));
+        let mut recv_session = ChaChaSession::new(key);
+
+        let loopback = LoopbackTransport::new();
+        let enc = EncryptingTransport::new(loopback.clone(), send_session);
+
+        let header = make_header(5);
+        let plaintext = b"hello encrypted world";
+        let pkt = MediaPacket {
+            header,
+            payload: Bytes::from_static(plaintext),
+            quality_report: None,
+        };
+
+        enc.send_media(&pkt).await.unwrap();
+
+        let sent = loopback.take_sent();
+        let wire_pkt = &sent[0];
+
+        let mut header_bytes = Vec::new();
+        header.write_to(&mut header_bytes);
+        let mut decrypted = Vec::new();
+        recv_session
+            .decrypt(&header_bytes, &wire_pkt.payload, &mut decrypted)
+            .expect("decrypt should succeed with matching key");
+        assert_eq!(&decrypted[..], plaintext);
+    }
+}

crates/wzp-client/src/lib.rs

@@ -29,6 +29,7 @@ pub mod audio_linux_aec;
 pub mod bench;
 pub mod birthday;
 pub mod call;
+pub mod encrypted_transport;
 pub mod drift_test;
 pub mod dual_path;
 pub mod echo_test;