Complete Wasm example build and acceptance workflow

Author: eldryoth

CHANGELOG.md

@@ -23,6 +23,11 @@ behavior when the change improves security or project direction.
   route-policy coverage.
 - Complete the VCL-like cache-policy example gate with schema validation and
   live pass, variant, TTL, metadata, tag-purge, and negative mutation coverage.
+- Add a deterministic builder for all migration policies that emits real Wasm
+  modules and SHA-256 sums under `target/`, plus one complete Wasm smoke shared
+  by the human launcher and release gate.
+- Fix the human test starter's Wasm entry so sandbox and policy scripts are no
+  longer passed as unused arguments to the registry validator.
 
 ### Security
 

crates/fluxheim-wasm/Cargo.toml

@@ -17,6 +17,9 @@ wasi = ["runtime", "dep:wasmtime-wasi"]
 name = "wasm_sandbox_smoke"
 required-features = ["runtime"]
 
+[[example]]
+name = "build_policy_examples"
+
 [dependencies]
 sha2 = "0.11.0"
 thiserror = "2.0.18"

crates/fluxheim-wasm/examples/build_policy_examples.rs

@@ -0,0 +1,60 @@
+use std::fmt::Write as _;
+use std::path::Path;
+use std::process::ExitCode;
+
+use sha2::{Digest as _, Sha256};
+
+const OUTPUT_DIR: &str = "target/wasm-policy-examples";
+const POLICY_SOURCES: &[(&str, &str)] = &[
+    (
+        "irules-access-policy",
+        include_str!("../../../examples/wasm/irules-access-policy.wat"),
+    ),
+    (
+        "openresty-header-policy",
+        include_str!("../../../examples/wasm/openresty-header-policy.wat"),
+    ),
+    (
+        "haproxy-spoe-routing-policy",
+        include_str!("../../../examples/wasm/haproxy-spoe-routing-policy.wat"),
+    ),
+    (
+        "cache-lookup-policy",
+        include_str!("../../../examples/wasm/cache-lookup-policy.wat"),
+    ),
+    (
+        "cache-store-policy",
+        include_str!("../../../examples/wasm/cache-store-policy.wat"),
+    ),
+];
+
+fn main() -> ExitCode {
+    match build_examples() {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(error) => {
+            eprintln!("wasm policy example build failed: {error}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+fn build_examples() -> Result<(), Box<dyn std::error::Error>> {
+    let output = Path::new(OUTPUT_DIR);
+    std::fs::create_dir_all(output)?;
+    let mut checksums = String::new();
+
+    for (name, source) in POLICY_SOURCES {
+        let bytes = wat::parse_str(source)?;
+        let file_name = format!("{name}.wasm");
+        std::fs::write(output.join(&file_name), &bytes)?;
+        let digest = Sha256::digest(&bytes);
+        for byte in digest {
+            write!(&mut checksums, "{byte:02x}")?;
+        }
+        writeln!(&mut checksums, "  {file_name}")?;
+    }
+
+    std::fs::write(output.join("SHA256SUMS"), checksums)?;
+    println!("built Wasm policy examples in {OUTPUT_DIR}");
+    Ok(())
+}

docs/wasm-policy-example-parity.md

@@ -200,3 +200,9 @@ Before `1.7` is complete:
 - every example must have a matching negative test that proves the sandbox does
   not expose filesystem, network, env, admin APIs, secrets, request bodies, or
   raw cache objects without explicit future capabilities.
+
+`v1.7.9` provides `scripts/build_wasm_policy_examples.sh` for deterministic
+source-to-module builds and digest output, while `scripts/smoke_wasm_all.sh`
+is the single orchestration entry used by both `scripts/test_starter.py` and
+the opt-in stable/deep release gate. This avoids treating multiple script paths
+as arguments to one launcher command and keeps human and CI coverage aligned.

examples/wasm/README.md

@@ -5,6 +5,20 @@ These examples are source-level policy examples. Build the `.wat` files to
 `wasm.plugin_roots`, and pin the module SHA-256 in config before enabling it in
 production.
 
+Build every checked-in migration policy and generate exact SHA-256 digests
+with:
+
+```sh
+scripts/build_wasm_policy_examples.sh
+```
+
+The command writes real modules and `SHA256SUMS` under
+`target/wasm-policy-examples/`. Copy the required modules into a configured
+plugin root, replace each example config's digest placeholder with the emitted
+digest, and keep the deployed file owner-only or otherwise protected by the
+documented plugin-root trust policy. The builder has no output-path argument;
+it cannot be redirected into a configured production root accidentally.
+
 `irules-access-policy.wat` and `irules-access-policy.toml` demonstrate the
 F5 iRules-style access-policy mapping. Fluxheim first classifies the request
 through configured vhosts, routes, methods, trusted-client ACLs, and TLS

packaging/rpm/fluxheim.spec

@@ -160,6 +160,7 @@ fi
 - Add the nginx Lua/OpenResty-style bounded header-policy example.
 - Add the HAProxy Lua/SPOE-style bounded route and load-balancer example.
 - Complete the VCL-like cache-policy example and live operational smoke.
+- Add deterministic Wasm example builds and one shared complete Wasm gate.
 - Harden snapshot opens against pathname races and isolate corruption fixtures
   behind safe store primitives.
 

release-notes/RELEASE_NOTES_1.7.9.md

@@ -27,6 +27,11 @@ products.
   parity example. The live smoke now proves pass, MISS/HIT, bounded variants,
   image-only TTL/tag/header metadata, expiry, tag purge, non-image isolation,
   and fail-closed invalid mutations.
+- Add a deterministic policy builder that emits deployable `.wasm` files and
+  `SHA256SUMS` under `target/wasm-policy-examples/`.
+- Add one complete Wasm smoke shared by `scripts/test_starter.py` and the
+  opt-in stable/deep release gate, fixing the launcher's previous multi-script
+  command wiring.
 
 ## Security
 

scripts/build_wasm_policy_examples.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env sh
+set -eu
+
+output="target/wasm-policy-examples"
+
+cargo run --locked -p fluxheim-wasm --example build_policy_examples --quiet
+
+for name in \
+    irules-access-policy \
+    openresty-header-policy \
+    haproxy-spoe-routing-policy \
+    cache-lookup-policy \
+    cache-store-policy
+do
+    test -s "$output/$name.wasm"
+    grep -q "  $name.wasm$" "$output/SHA256SUMS"
+done
+
+(cd "$output" && sha256sum -c SHA256SUMS)
+
+echo "wasm policy example build: ok"

scripts/smoke_wasm_all.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env sh
+set -eu
+
+scripts/build_wasm_policy_examples.sh
+scripts/validate-wasm-config-registry.sh
+scripts/smoke_wasm_sandbox.sh
+scripts/smoke_wasm_policy_examples.sh
+
+echo "wasm complete smoke: ok"

scripts/stable_release_gate.sh

@@ -131,10 +131,8 @@ else
 fi
 
 if [ "${FLUXHEIM_GATE_WASM:-0}" = "1" ]; then
-    echo "stable release gate: Wasm config registry and sandbox smoke"
-    scripts/validate-wasm-config-registry.sh
-    scripts/smoke_wasm_sandbox.sh
-    scripts/smoke_wasm_policy_examples.sh
+    echo "stable release gate: complete Wasm smoke"
+    scripts/smoke_wasm_all.sh
 else
     echo "stable release gate: skipping Wasm sandbox smoke; set FLUXHEIM_GATE_WASM=1 to enable"
 fi