Start 1.7.6 Wasm runtime hardening

Author: eldryoth

CHANGELOG.md

@@ -7,6 +7,23 @@ Fluxheim follows semantic versioning once `1.0.0` is released. Before `1.0.0`,
 minor versions may still change configuration shape, feature names, and runtime
 behavior when the change improves security or project direction.
 
+## 1.7.6 - 2026-07-09
+
+### Added
+
+- Add explicit compiled WebAssembly module identities covering plugin SHA-256
+  digest, ABI version, native hook feature surface, and Fluxheim crate version.
+- Add runtime tests proving identical plugin bytes get distinct identities when
+  ABI or feature surfaces differ.
+
+### Security
+
+- Reject attempts to compile a WebAssembly module with an identity whose digest
+  does not match the loaded plugin file.
+- Wire the native HTTP/1 hook registry through manifest-derived module
+  identities so future compile-cache reuse cannot cross ABI, feature, or
+  release boundaries.
+
 ## 1.7.5 - 2026-07-08
 
 ### Added

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim"
-version = "1.7.5"
+version = "1.7.6"
 edition = "2024"
 rust-version = "1.96.1"
 license = "EUPL-1.2"

Cargo.toml

@@ -137,7 +137,7 @@ Fluxheim is licensed under the European Union Public Licence 1.2.
 | GeoIP/Geo-Context policy | ✅ | `1.4.5`; optional `geoip` feature with local MMDB support for MaxMind GeoIP2/GeoLite2 and CIRCL Geo Open datasets, plus vhost/route country and ASN ACLs. |
 | Pingora-free runtime | ✅ | `1.6.34`; normal Fluxheim builds no longer compile Pingora crates. Server/listener/TLS, HTTP/1, HTTP/2, WebSocket, cache, load-balancer, admin, metrics, stream, and background-service paths run through Fluxheim-owned Rust crates. |
 | HTTP/3/QUIC | ❌ | Planned as a Fluxheim-owned `1.9` protocol milestone using the Rust `quinn`/`h3` stack after the `1.8` macOS/Windows production parity line. |
-| WASM extensibility | 🧪 | Active `1.7.x` line. `1.7.0` added the optional `wasm` feature, strict plugin-file loading, bounded Wasmtime execution, and real-Wasm smoke coverage. `1.7.1` adds config-level plugin registry validation, deterministic attachment ordering, admission limits, metrics, and live native HTTP/1 access-decision hooks. `1.7.2` adds bounded native HTTP/1 request/response header hooks. `1.7.3` starts bounded native HTTP/1 route-decision hooks with configured canary and mirror branch selection, including selected native load-balanced and persistent routes. `1.7.4` starts VCL-like cache-policy hooks with bounded cache-lookup and cache-store decisions for continue/pass/bypass/skip-store/deny around cache lookup and storage. `1.7.5` adds bounded symbolic cache-key component hooks for low-cardinality cache variants plus fixed-ID cache-store TTL/tag/header metadata, symbolic content-type inspection, and a checked-in cache-policy example. Direct backend choice, plugin-provided persistence keys, dynamic mirror/shadow target choice, and richer store policy hooks remain staged for later `1.7.x`. |
+| WASM extensibility | 🧪 | Active `1.7.x` line. `1.7.0` added the optional `wasm` feature, strict plugin-file loading, bounded Wasmtime execution, and real-Wasm smoke coverage. `1.7.1` adds config-level plugin registry validation, deterministic attachment ordering, admission limits, metrics, and live native HTTP/1 access-decision hooks. `1.7.2` adds bounded native HTTP/1 request/response header hooks. `1.7.3` starts bounded native HTTP/1 route-decision hooks with configured canary and mirror branch selection, including selected native load-balanced and persistent routes. `1.7.4` starts VCL-like cache-policy hooks with bounded cache-lookup and cache-store decisions for continue/pass/bypass/skip-store/deny around cache lookup and storage. `1.7.5` adds bounded symbolic cache-key component hooks for low-cardinality cache variants plus fixed-ID cache-store TTL/tag/header metadata, symbolic content-type inspection, and a checked-in cache-policy example. `1.7.6` starts mature-runtime hardening with explicit compiled-module identities that isolate module reuse by plugin digest, ABI version, native feature surface, and Fluxheim version. Direct backend choice, plugin-provided persistence keys, dynamic mirror/shadow target choice, and richer store policy hooks remain staged for later `1.7.x`. |
 
 See [Production Readiness](docs/production-readiness.md) for the precise
 stable-core promise and deployment checks. See
@@ -258,7 +258,7 @@ Individual module features:
 | `php-fpm` | No | PHP-FPM FastCGI bridge for WordPress-style PHP applications. Implies `proxy` and `web`; not included in default/focused images. |
 | `privacy-mode` | No | Zero-retention static/proxy build profile. |
 | `security` | Yes | Compile-time security profile marker plus release hardening checks. Runtime enforcement lives in the concrete config, TLS, filesystem, admin, and request-handling modules. |
-| `wasm` | No | Optional `1.7.x` WebAssembly policy runtime. `1.7.5` supports live native HTTP/1 access-decision hooks, bounded request/response header hooks, constrained route-decision hooks with configured canary and mirror branch selection, selected native load-balanced/persistent routes, bounded cache-lookup hooks, bounded cache-store skip/deny hooks, bounded symbolic cache-key component hooks, and fixed-ID cache-store TTL/tag/header metadata. Later `1.7.x` releases add direct backend choice, plugin-provided persistence keys, dynamic mirror/shadow target choice, and richer store policy hooks. |
+| `wasm` | No | Optional `1.7.x` WebAssembly policy runtime. `1.7.6` supports live native HTTP/1 access-decision hooks, bounded request/response header hooks, constrained route-decision hooks with configured canary and mirror branch selection, selected native load-balanced/persistent routes, bounded cache-lookup hooks, bounded cache-store skip/deny hooks, bounded symbolic cache-key component hooks, fixed-ID cache-store TTL/tag/header metadata, and compiled-module identities scoped by plugin digest, ABI version, feature surface, and Fluxheim version. Later `1.7.x` releases add direct backend choice, plugin-provided persistence keys, dynamic mirror/shadow target choice, and richer store policy hooks. |
 | `wasm-proxy-abi` | No | Reserved compatibility preview for a reviewed safe subset of proxy-oriented Wasm ABI calls; depends on `wasm` and remains off by default. |
 | `wasm-wasi` | No | Reserved WASI capability preview; depends on `wasm` and remains off by default with no filesystem/network/process capabilities unless explicitly granted in a later release. |
 | `tls` | No | Internal TLS marker used by TLS/ACME code; select a concrete backend for serving. |
@@ -351,8 +351,8 @@ Release tags use the same profile/OS suffixes on both registries. The first
 `1.7.x` image tags include `v1.7.0-wolfi`, `v1.7.0-cache-wolfi`,
 `v1.7.0-proxy-wolfi`, `v1.7.0-load-balancer-wolfi`, and `v1.7.0-php-wolfi`;
 follow-up `1.7.x` releases use the same suffix pattern, for example
-`v1.7.5-wolfi`, `v1.7.5-cache-wolfi`, `v1.7.5-proxy-wolfi`,
-`v1.7.5-load-balancer-wolfi`, and `v1.7.5-php-wolfi`.
+`v1.7.6-wolfi`, `v1.7.6-cache-wolfi`, `v1.7.6-proxy-wolfi`,
+`v1.7.6-load-balancer-wolfi`, and `v1.7.6-php-wolfi`.
 
 Release note for `1.5.15`: the signed git tag `v1.5.15` is the canonical code
 tag. The GitHub Release page is published under `v1.5.15-release` because the

README.md

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-acme"
-version = "1.7.5"
+version = "1.7.6"
 edition = "2024"
 rust-version = "1.96.1"
 license = "EUPL-1.2"

crates/fluxheim-acme/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-cache"
-version = "1.7.5"
+version = "1.7.6"
 edition = "2024"
 rust-version = "1.96.1"
 license = "EUPL-1.2"

crates/fluxheim-cache/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-common"
-version = "1.7.5"
+version = "1.7.6"
 edition = "2024"
 rust-version = "1.96.1"
 license = "EUPL-1.2"

crates/fluxheim-common/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-compression"
-version = "1.7.5"
+version = "1.7.6"
 edition = "2024"
 rust-version = "1.96.1"
 license = "EUPL-1.2"

crates/fluxheim-compression/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-config"
-version = "1.7.5"
+version = "1.7.6"
 edition = "2024"
 rust-version = "1.96.1"
 license = "EUPL-1.2"

crates/fluxheim-config/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-geoip"
-version = "1.7.5"
+version = "1.7.6"
 edition = "2024"
 rust-version = "1.96.1"
 license = "EUPL-1.2"