Add standalone Wasm policy binary smoke

Author: eldryoth

CHANGELOG.md

@@ -28,6 +28,14 @@ behavior when the change improves security or project direction.
   by the human launcher and release gate.
 - Fix the human test starter's Wasm entry so sandbox and policy scripts are no
   longer passed as unused arguments to the registry validator.
+- Add a standalone binary smoke that loads generated modules from a private
+  plugin root with exact digests and exercises all four migration families
+  through a file-based configuration and real HTTP traffic.
+
+### Fixed
+
+- Do not initialize or log errors for the native disk-cache backend when a
+  cache policy enables only the memory tier.
 
 ### Security
 

crates/fluxheim-observability/src/otlp_http.rs

@@ -49,10 +49,8 @@ impl OtlpHttpEndpoint {
     pub fn parse(endpoint: &str) -> Option<Self> {
         let (rest, default_port) = if let Some(rest) = endpoint.strip_prefix("http://") {
             (rest, 80)
-        } else if let Some(rest) = endpoint.strip_prefix("https://") {
-            (rest, 443)
         } else {
-            return None;
+            (endpoint.strip_prefix("https://")?, 443)
         };
         let (authority, path) = rest.split_once('/')?;
         if authority.is_empty() || path.is_empty() {

crates/fluxheim-observability/src/otlp_trace.rs

@@ -100,10 +100,8 @@ impl HttpEndpoint {
     fn parse(endpoint: &str) -> Option<Self> {
         let (rest, default_port) = if let Some(rest) = endpoint.strip_prefix("http://") {
             (rest, 80)
-        } else if let Some(rest) = endpoint.strip_prefix("https://") {
-            (rest, 443)
         } else {
-            return None;
+            (endpoint.strip_prefix("https://")?, 443)
         };
         let (authority, path) = rest.split_once('/')?;
         if authority.is_empty() || path.is_empty() {

crates/fluxheim-server/src/native_http1_cache.rs

@@ -112,7 +112,7 @@ pub(crate) struct NativeDiskCacheStats {
 
 impl NativeDiskCache {
     pub(crate) fn from_config(config: &CacheConfig) -> Option<Self> {
-        if !native_disk_cache_supported(config) {
+        if !config.disk.enabled || !native_disk_cache_supported(config) {
             return None;
         }
         let (root, backend) = match NativeDiskCacheBackend::from_config(config) {

crates/fluxheim-server/src/native_http1_cache_tests.rs

@@ -76,6 +76,20 @@ fn disk_cache_store_key(key: &str) -> NativeDiskCacheStoreKey {
     }
 }
 
+#[test]
+fn disabled_disk_cache_does_not_require_a_path() {
+    let config = CacheConfig {
+        enabled: true,
+        memory: fluxheim_config::CacheMemoryConfig {
+            enabled: true,
+            ..Default::default()
+        },
+        ..Default::default()
+    };
+
+    assert!(NativeDiskCache::from_config(&config).is_none());
+}
+
 #[test]
 fn native_peer_fill_cache_ttl_subtracts_upstream_age() {
     let cache = CacheConfig::default();

docs/wasm-policy-example-parity.md

@@ -206,3 +206,9 @@ source-to-module builds and digest output, while `scripts/smoke_wasm_all.sh`
 is the single orchestration entry used by both `scripts/test_starter.py` and
 the opt-in stable/deep release gate. This avoids treating multiple script paths
 as arguments to one launcher command and keeps human and CI coverage aligned.
+
+The standalone `scripts/smoke_wasm_policy_examples_binary.sh` proof also loads
+the generated files through a private plugin root and exact SHA-256 pins,
+starts the real Fluxheim binary from a file-based config, and sends HTTP
+traffic through all four vhosts. The in-process listener tests remain the
+faster detailed regressions; both layers are required by the complete smoke.

examples/wasm/README.md

@@ -19,6 +19,17 @@ digest, and keep the deployed file owner-only or otherwise protected by the
 documented plugin-root trust policy. The builder has no output-path argument;
 it cannot be redirected into a configured production root accidentally.
 
+Run the full standalone deployment proof with:
+
+```sh
+scripts/smoke_wasm_policy_examples_binary.sh
+```
+
+It copies the generated modules into a private temporary plugin root, writes a
+file-based config with exact digests, launches the actual `fluxheim` binary and
+two local origins, and sends real HTTP traffic through all four policy
+families. This is separate from the faster in-process listener regressions.
+
 `irules-access-policy.wat` and `irules-access-policy.toml` demonstrate the
 F5 iRules-style access-policy mapping. Fluxheim first classifies the request
 through configured vhosts, routes, methods, trusted-client ACLs, and TLS

packaging/rpm/fluxheim.spec

@@ -161,6 +161,8 @@ fi
 - Add the HAProxy Lua/SPOE-style bounded route and load-balancer example.
 - Complete the VCL-like cache-policy example and live operational smoke.
 - Add deterministic Wasm example builds and one shared complete Wasm gate.
+- Add standalone file-config and binary coverage for all Wasm policy examples.
+- Avoid disabled disk-cache initialization for memory-only cache policies.
 - Harden snapshot opens against pathname races and isolate corruption fixtures
   behind safe store primitives.
 

release-notes/RELEASE_NOTES_1.7.9.md

@@ -32,6 +32,14 @@ products.
 - Add one complete Wasm smoke shared by `scripts/test_starter.py` and the
   opt-in stable/deep release gate, fixing the launcher's previous multi-script
   command wiring.
+- Add a standalone binary smoke using generated modules, exact digest pins, a
+  private plugin root, file-based configuration, two local origins, and real
+  HTTP traffic through every migration family.
+
+## Fixed
+
+- Stop attempting to initialize the native disk-cache backend for memory-only
+  cache policies, avoiding an incorrect missing-path error at startup.
 
 ## Security
 

scripts/smoke_wasm_all.sh

@@ -5,5 +5,6 @@ scripts/build_wasm_policy_examples.sh
 scripts/validate-wasm-config-registry.sh
 scripts/smoke_wasm_sandbox.sh
 scripts/smoke_wasm_policy_examples.sh
+scripts/smoke_wasm_policy_examples_binary.sh
 
 echo "wasm complete smoke: ok"