Verify Wasm host callbacks over guest inputs

Author: eldryoth

CHANGELOG.md

@@ -47,6 +47,8 @@ behavior when the change improves security or project direction.
 - Add crate-level Wasm resource ceilings, checked execution deadlines,
   semaphore-capacity validation, fallible compile-worker creation, and
   before/after deadline checks for the finite non-blocking host-call boundary.
+- Make panic-free, total-over-`i32` behavior part of the native Wasm host-call
+  contract and property-test every current guest-ID decoder.
 
 ## 1.7.7 - 2026-07-10
 

Cargo.lock

@@ -80,6 +80,7 @@ rustix = { version = "1.1.4", features = ["fs", "net", "process"] }
 
 [dev-dependencies]
 flate2 = "1.1.5"
+proptest = "1.11.0"
 rcgen = { version = "0.14.8", default-features = false, features = ["pem", "ring"] }
 tempfile = "3.27.0"
 wat = "1.253.0"

crates/fluxheim-server/Cargo.toml

@@ -213,12 +213,15 @@ async fn native_wasm_wasi_stdio_import_remains_denied_with_other_grants() {
 async fn native_wasm_access_decision_fails_closed_on_timeout() {
     let fixture = WasmRouteFixture::new(&[("busy", WasmPluginBody::BusyLoop)]);
     let upstream = super::upstream_expect_path("/never", "unexpected").await;
-    let router = NativeHttp1HostRouter::from_config(
-        &fixture.config_with_attachments(upstream, vec![wasm_attachment("busy", "route", 100)]),
-        DownstreamHttp1Policy::default(),
-        0,
-    )
-    .unwrap();
+    let mut config =
+        fixture.config_with_attachments(upstream, vec![wasm_attachment("busy", "route", 100)]);
+    config.wasm.plugins[0]
+        .limits
+        .as_mut()
+        .expect("busy-loop test plugin has explicit limits")
+        .timeout_ms = 5;
+    let router =
+        NativeHttp1HostRouter::from_config(&config, DownstreamHttp1Policy::default(), 0).unwrap();
     let proxy = router_listener(router).await;
 
     let response = downstream_get(proxy, "/route").await;
@@ -2245,8 +2248,8 @@ fn wasm_plugin(root: &Path, name: &str, body: WasmPluginBody) -> fluxheim_config
         WasmPluginBody::BusyLoop | WasmPluginBody::CacheLookupBusy
     ) {
         Some(fluxheim_config::WasmSandboxLimitsConfig {
-            fuel: 1_000_000_000,
-            timeout_ms: 150,
+            fuel: fluxheim_config::config_wasm::MAX_WASM_FUEL,
+            timeout_ms: 50,
             compile_timeout_ms: 5_000,
             ..Default::default()
         })

crates/fluxheim-server/src/native_http1_route_proxy_tests/wasm.rs

@@ -1892,6 +1892,20 @@ impl NativeWasmAdmissionScope {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use proptest::prelude::*;
+
+    proptest! {
+        #[test]
+        fn wasm_guest_id_decoders_are_total(first in any::<i32>(), second in any::<i32>()) {
+            let _ = wasm_request_header_mutation(first, second);
+            let _ = wasm_response_header_mutation(first, second);
+            let _ = wasm_response_removable_header(first);
+            let _ = wasm_cache_key_component(first, second);
+            let _ = wasm_cache_ttl(first);
+            let _ = wasm_cache_tag(first);
+            let _ = wasm_cache_store_header(first, second);
+        }
+    }
 
     #[test]
     fn proxy_preview_namespace_does_not_receive_native_phase_functions() {

crates/fluxheim-server/src/native_http1_route_wasm.rs

@@ -49,9 +49,12 @@ pub struct FluxWasmCompiledModuleIdentity {
 #[derive(Clone)]
 /// Synchronous native host callback for Fluxheim's bounded policy ABI.
 ///
-/// Callbacks must be finite, non-blocking, and free of I/O, sleeps, IPC, and
+/// Callbacks must be finite, non-blocking, panic-free, and total over every
+/// possible `i32` input. They must use checked arithmetic and bounds-checked
+/// access and remain free of I/O, sleeps, IPC, assertion-based APIs, and
 /// contended lock acquisition. Wasmtime epoch interruption cannot preempt
-/// native Rust while a callback is running.
+/// native Rust while a callback is running, and Fluxheim releases abort on
+/// panic rather than unwind.
 pub struct WasmI32HostFunction {
     module: &'static str,
     name: &'static str,

crates/fluxheim-wasm/src/runtime.rs

@@ -3167,11 +3167,14 @@ Stable scope:
   families must run through `scripts/test_starter.py`, the stable/deep release
   gates must include the appropriate Wasm checks, and the docs must clearly
   describe supported capability parity and unsupported syntax/runtime parity.
-  Keep all in-process native host callbacks finite and non-blocking. Before any
-  host-call capability introduces blocking I/O, IPC, sleeps, contended waits,
+  Keep all in-process native host callbacks finite, non-blocking, panic-free,
+  and total over arbitrary guest inputs, with property tests for every ID
+  decoder. Before any host-call capability introduces blocking I/O, IPC, sleeps,
+  contended waits, assertion-based operations, unchecked indexing/arithmetic,
   or third-party native callback code, design and prove a killable subprocess
   runner with bounded authenticated IPC, process admission, timeout termination,
-  and crash cleanup; do not represent thread timeouts as hard preemption.
+  and crash cleanup; do not represent thread timeouts or `catch_unwind` as hard
+  isolation in an abort-on-panic release.
 - `v1.7.11`: zero-downtime upgrade planning and first implementation slice
   after the Wasm line is stable. Add a documented design for native binary and
   Podman deployments that can swap Fluxheim versions without a listener gap:

docs/versioning-plan.md

@@ -152,14 +152,18 @@ before semaphore construction, and execution deadlines use checked arithmetic.
 
 Native host callbacks execute synchronously while Wasmtime is inside native
 Rust and therefore cannot be forcibly preempted by epoch interruption. Every
-current Fluxheim callback is a finite in-memory operation; callbacks that
-perform filesystem/network I/O, IPC, sleeps, or potentially contended waits are
-prohibited. Fluxheim checks the absolute execution deadline before and after
-each callback, so a late result fails as a timeout. A callback that never
-returns still cannot be killed safely inside the process. Before Fluxheim adds
+current Fluxheim callback is a finite, panic-free in-memory operation that is
+total over every possible guest `i32` input. Callback implementations use
+explicit matching, checked arithmetic, bounds-checked access, and fallible lock
+handling; property tests exercise arbitrary guest IDs. Callbacks that perform
+filesystem/network I/O, IPC, sleeps, assertion-based operations, unchecked
+indexing/arithmetic, or potentially contended waits are prohibited. Fluxheim
+checks the absolute execution deadline before and after each callback, so a
+late result fails as a timeout. A callback that never returns or panics still
+cannot be isolated safely inside an abort-on-panic process. Before Fluxheim adds
 any blocking or third-party native host callback, that capability requires a
-killable subprocess runner with bounded IPC; thread-based timeout wrappers are
-not an acceptable substitute.
+killable subprocess runner with bounded IPC; thread-based timeout wrappers and
+`catch_unwind` are not acceptable substitutes.
 
 Compiled modules carry a stable identity that includes the loaded plugin digest,
 the manifest ABI version, the host-call namespace, the native hook feature
@@ -439,9 +443,10 @@ native `fluxheim-policy-v1` admission or blocking capacity.
 - Host calls must never expose admin tokens, ACME/EAB secrets, private keys,
   authorization headers, cookies, raw request bodies, or filesystem paths unless
   explicitly allowed and redacted.
-- Host callbacks must remain finite and non-blocking. Adding I/O, IPC, sleeps,
-  or contended waits requires process isolation rather than an in-process
-  callback timeout.
+- Host callbacks must remain finite, non-blocking, panic-free, and total for all
+  guest integers. Adding I/O, IPC, sleeps, contended waits, unchecked
+  indexing/arithmetic, assertion-based operations, or third-party native code
+  requires process isolation rather than an in-process callback timeout.
 - Plugins must not control routing destinations or upstream TLS verification
   directly. Cache-key influence is allowed only through constrained typed hook
   outputs that Fluxheim validates, bounds, and records.

docs/wasm-extensibility.md

@@ -83,6 +83,10 @@ general-purpose WASI application hosting.
 - Check the absolute execution deadline before and after every synchronous host
   callback so late callback results fail as timeouts. Keep blocking callbacks
   prohibited until a killable subprocess runner exists.
+- Require in-process native Wasm callbacks to be panic-free and total for every
+  guest integer, and property-test all current guest-ID decoders over arbitrary
+  `i32` inputs. Keep panic-prone or third-party native callbacks behind the
+  future subprocess-isolation boundary.
 
 ## Validation