Add Wasm cache lookup policy hook

Author: eldryoth

CHANGELOG.md

@@ -7,6 +7,28 @@ Fluxheim follows semantic versioning once `1.0.0` is released. Before `1.0.0`,
 minor versions may still change configuration shape, feature names, and runtime
 behavior when the change improves security or project direction.
 
+## 1.7.4 - 2026-07-07
+
+### Added
+
+- Add live native HTTP/1 Wasm `cache-lookup` hooks under the bounded
+  `fluxheim_policy_v1` preview ABI.
+- Add `continue`, `pass`, `bypass`, and `deny` cache lookup outcomes before
+  slice lookup, normal lookup, peer-fill, request collapsing, origin-fill
+  protection, and store admission.
+- Add live listener tests proving a plugin can pass selected `/api/*` requests
+  without storing while normal cacheable paths still produce MISS then HIT.
+
+### Security
+
+- Keep cache hooks constrained to integer outcomes and coarse path context in
+  this slice; raw headers, bodies, cache-key bytes, TTL override, tag
+  assignment, and response-store mutation remain unavailable.
+- Preserve built-in access, rate-limit, route, and header-policy ordering
+  before cache-lookup hooks run.
+- Fail closed with `503` when a cache-lookup plugin errors under fail-closed
+  mode, and deny with `403` when a plugin explicitly returns deny.
+
 ## 1.7.3 - 2026-07-06
 
 ### Added

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim"
-version = "1.7.3"
+version = "1.7.4"
 edition = "2024"
 rust-version = "1.96.1"
 license = "EUPL-1.2"

Cargo.toml

@@ -136,8 +136,8 @@ Fluxheim is licensed under the European Union Public Licence 1.2.
 | Apple Silicon macOS dev builds | ✅ | `1.4.4`; Level 1 developer support with Mac-safe runtime paths while some upstream macOS support remains experimental. |
 | GeoIP/Geo-Context policy | ✅ | `1.4.5`; optional `geoip` feature with local MMDB support for MaxMind GeoIP2/GeoLite2 and CIRCL Geo Open datasets, plus vhost/route country and ASN ACLs. |
 | Pingora-free runtime | ✅ | `1.6.34`; normal Fluxheim builds no longer compile Pingora crates. Server/listener/TLS, HTTP/1, HTTP/2, WebSocket, cache, load-balancer, admin, metrics, stream, and background-service paths run through Fluxheim-owned Rust crates. |
-| HTTP/3/QUIC | ❌ | Planned as a Fluxheim-owned `1.8` protocol milestone using the Rust `quinn`/`h3` stack after the `1.7` Wasm extensibility line. |
-| WASM extensibility | 🧪 | Active `1.7.x` line. `1.7.0` added the optional `wasm` feature, strict plugin-file loading, bounded Wasmtime execution, and real-Wasm smoke coverage. `1.7.1` adds config-level plugin registry validation, deterministic attachment ordering, admission limits, metrics, and live native HTTP/1 access-decision hooks. `1.7.2` adds bounded native HTTP/1 request/response header hooks. `1.7.3` starts bounded native HTTP/1 route-decision hooks with configured canary and mirror branch selection, including selected native load-balanced and persistent routes. Direct backend choice, plugin-provided persistence keys, dynamic mirror/shadow target choice, and VCL-like cache policy hooks remain staged for later `1.7.x`. |
+| HTTP/3/QUIC | ❌ | Planned as a Fluxheim-owned `1.9` protocol milestone using the Rust `quinn`/`h3` stack after the `1.8` macOS/Windows production parity line. |
+| WASM extensibility | 🧪 | Active `1.7.x` line. `1.7.0` added the optional `wasm` feature, strict plugin-file loading, bounded Wasmtime execution, and real-Wasm smoke coverage. `1.7.1` adds config-level plugin registry validation, deterministic attachment ordering, admission limits, metrics, and live native HTTP/1 access-decision hooks. `1.7.2` adds bounded native HTTP/1 request/response header hooks. `1.7.3` starts bounded native HTTP/1 route-decision hooks with configured canary and mirror branch selection, including selected native load-balanced and persistent routes. `1.7.4` starts VCL-like cache-policy hooks with a bounded cache-lookup decision that can continue, pass, bypass, or deny before cache lookup/storage. Direct backend choice, plugin-provided persistence keys, dynamic mirror/shadow target choice, and richer cache-key/TTL/tag store policy hooks remain staged for later `1.7.x`. |
 
 See [Production Readiness](docs/production-readiness.md) for the precise
 stable-core promise and deployment checks. See
@@ -258,7 +258,7 @@ Individual module features:
 | `php-fpm` | No | PHP-FPM FastCGI bridge for WordPress-style PHP applications. Implies `proxy` and `web`; not included in default/focused images. |
 | `privacy-mode` | No | Zero-retention static/proxy build profile. |
 | `security` | Yes | Compile-time security profile marker plus release hardening checks. Runtime enforcement lives in the concrete config, TLS, filesystem, admin, and request-handling modules. |
-| `wasm` | No | Optional `1.7.x` WebAssembly policy runtime. `1.7.3` supports live native HTTP/1 access-decision hooks, bounded request/response header hooks, and constrained route-decision hooks with configured canary and mirror branch selection, including selected native load-balanced and persistent routes. Later `1.7.x` releases add direct backend choice, plugin-provided persistence keys, dynamic mirror/shadow target choice, and cache-policy hooks. |
+| `wasm` | No | Optional `1.7.x` WebAssembly policy runtime. `1.7.4` supports live native HTTP/1 access-decision hooks, bounded request/response header hooks, constrained route-decision hooks with configured canary and mirror branch selection, selected native load-balanced/persistent routes, and bounded cache-lookup hooks. Later `1.7.x` releases add direct backend choice, plugin-provided persistence keys, dynamic mirror/shadow target choice, and richer cache-key/TTL/tag store policy hooks. |
 | `wasm-proxy-abi` | No | Reserved compatibility preview for a reviewed safe subset of proxy-oriented Wasm ABI calls; depends on `wasm` and remains off by default. |
 | `wasm-wasi` | No | Reserved WASI capability preview; depends on `wasm` and remains off by default with no filesystem/network/process capabilities unless explicitly granted in a later release. |
 | `tls` | No | Internal TLS marker used by TLS/ACME code; select a concrete backend for serving. |
@@ -351,8 +351,8 @@ Release tags use the same profile/OS suffixes on both registries. The first
 `1.7.x` image tags include `v1.7.0-wolfi`, `v1.7.0-cache-wolfi`,
 `v1.7.0-proxy-wolfi`, `v1.7.0-load-balancer-wolfi`, and `v1.7.0-php-wolfi`;
 follow-up `1.7.x` releases use the same suffix pattern, for example
-`v1.7.3-wolfi`, `v1.7.3-cache-wolfi`, `v1.7.3-proxy-wolfi`,
-`v1.7.3-load-balancer-wolfi`, and `v1.7.3-php-wolfi`.
+`v1.7.4-wolfi`, `v1.7.4-cache-wolfi`, `v1.7.4-proxy-wolfi`,
+`v1.7.4-load-balancer-wolfi`, and `v1.7.4-php-wolfi`.
 
 Release note for `1.5.15`: the signed git tag `v1.5.15` is the canonical code
 tag. The GitHub Release page is published under `v1.5.15-release` because the
@@ -491,9 +491,10 @@ coverage are documented in [Cache Backends](docs/cache-backends.md),
 [Config Reference](docs/config-reference.md), and
 [Production Readiness](docs/production-readiness.md).
 
-The `1.8` line remains HTTP/3/QUIC based on the Rust `quinn`/`h3` stack. See
-[Versioning Plan](docs/versioning-plan.md) and [Roadmap](ROADMAP.md) for the
-full release ladder.
+The `1.8` line is the macOS/Windows production-parity line, and HTTP/3/QUIC
+moves to the following Fluxheim-owned `1.9` protocol line based on the Rust
+`quinn`/`h3` stack. See [Versioning Plan](docs/versioning-plan.md) and
+[Roadmap](ROADMAP.md) for the full release ladder.
 
 ## Documentation
 

README.md

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-acme"
-version = "1.7.3"
+version = "1.7.4"
 edition = "2024"
 rust-version = "1.96.1"
 license = "EUPL-1.2"

crates/fluxheim-acme/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-cache"
-version = "1.7.3"
+version = "1.7.4"
 edition = "2024"
 rust-version = "1.96.1"
 license = "EUPL-1.2"

crates/fluxheim-cache/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-common"
-version = "1.7.3"
+version = "1.7.4"
 edition = "2024"
 rust-version = "1.96.1"
 license = "EUPL-1.2"

crates/fluxheim-common/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-compression"
-version = "1.7.3"
+version = "1.7.4"
 edition = "2024"
 rust-version = "1.96.1"
 license = "EUPL-1.2"

crates/fluxheim-compression/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-config"
-version = "1.7.3"
+version = "1.7.4"
 edition = "2024"
 rust-version = "1.96.1"
 license = "EUPL-1.2"

crates/fluxheim-config/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-geoip"
-version = "1.7.3"
+version = "1.7.4"
 edition = "2024"
 rust-version = "1.96.1"
 license = "EUPL-1.2"