feat(mirror): Phase-1 local delivery — replay captured traffic to the local process

[devantler]

🤖 Generated by the Daily AI Assistant

Part of #4521 (Phase 1 — mirror-only). Next increment after #5702/#5703 (capture spec) and the capture session + workload mirror command landing.

Problem

ksail workload mirror <deployment> today resolves the target, injects the NET_RAW tap, streams the pcap over the exec channel, writes it to a file, and summarizes it. But mirror-only mode's headline promise — the locally-running service receives the mirrored traffic — is still unfulfilled: nothing delivers the captured requests to the developer's local port. The pcap file is forensics, not a dev bridge.

Proposed direction

Add a live replay sink to the capture session:

• Parse the pcap stream as it arrives (gopacket/pcapgo are already embedded — pkg/svc/mirror/pcap.go, dep gopacket v1.6.1).
• Reassemble inbound TCP payload streams addressed to the tap target's port (per-flow ordering; evaluate gopacket/reassembly vs a minimal per-flow sequencer — decide in the PR, smallest correct option wins).
• Write each reconstructed inbound byte stream to a configurable local address via a new --to localhost:<port> flag, one local connection per mirrored flow, live (replay while capture runs, not post-hoc).
• Read-only stays read-only: the local process's responses are read and discarded; nothing flows back into the cluster (the reverse tunnel is Phase 2 by design — see the [Repo Assist] [feature]: add local-remote service mirroring (Telepresence/mirrord-style dev bridge) #4521 design comment).

Acceptance criteria

• ksail workload mirror <deployment> --to localhost:8080 replays mirrored inbound TCP payloads to the local address while the capture session runs; file output + summary keep working unchanged (--to is additive).
• Pure in-process Go (client-go + gopacket) — no new external binary, per the package's native house rule.
• Unit-tested with the existing CaptureExecutor stub feeding a synthetic pcap stream and a local net.Listener asserting the exact replayed bytes; error paths (unreachable local addr, malformed pcap) covered.
• docs/src/content/docs/cli-flags/workload/workload-mirror.mdx regenerated + the mirror docs updated in the same PR.

Rough size: M — one focused PR (new replay.go + flag wiring + tests + docs).

[coderabbitai]

🔗 Related PRs

#5534 - feat(workload): add native mirror target resolution [closed]
#5539 - feat(workload): stream live Hubble flows with ksail workload network --follow [closed]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[devantler]

🤖 Generated by the Daily AI Assistant

Implementing this now on branch claude/mirror-live-replay (574th run) — draft PR to follow.

[devantler]

🤖 Generated by the Daily AI Assistant

Dedup record: two concurrent sessions built this — #5793 (closed, superseded) and #5794 (the open draft).