Complete runnable VCL-style cache policy example

Author: eldryoth

CHANGELOG.md

@@ -21,6 +21,8 @@ behavior when the change improves security or project direction.
 - Add the checked-in HAProxy Lua/SPOE-style symbolic route policy and config
   example, with live canary, load-balancer, persistence, mirror, and selected
   route-policy coverage.
+- Complete the VCL-like cache-policy example gate with schema validation and
+  live pass, variant, TTL, metadata, tag-purge, and negative mutation coverage.
 
 ### Security
 

crates/fluxheim-config/src/config_tests_wasm.rs

@@ -66,6 +66,15 @@ fn haproxy_spoe_routing_policy_example_config_validates() {
     assert_eq!(config.validate(), Ok(()));
 }
 
+#[cfg(feature = "wasm")]
+#[test]
+fn vcl_cache_policy_example_config_validates() {
+    let config: Config =
+        toml::from_str(include_str!("../../../examples/wasm/cache-policy.toml")).unwrap();
+
+    assert_eq!(config.validate(), Ok(()));
+}
+
 #[cfg(feature = "wasm")]
 fn proxy_preview_wasm_config(plugin_fields: &str) -> Config {
     toml::from_str(&format!(

crates/fluxheim-server/src/native_http1_route_proxy_tests/wasm.rs

@@ -1310,27 +1310,35 @@ async fn native_wasm_cache_policy_example_matches_documented_behavior() {
         ("/static/example.png", "mobile-body"),
         ("/static/example.png", "desktop-body"),
         ("/static/example.png", "mobile-refill"),
+        ("/static/example.png", "mobile-after-tag-purge"),
     ])
     .await;
     let mut config = fixture.config_with_attachments(
         upstream,
         vec![
             wasm_attachment_phase(
                 "cache_lookup",
-                "route",
+                "vcl-static",
                 100,
                 fluxheim_config::WasmPluginPhase::CacheLookup,
             ),
             wasm_attachment_phase(
                 "cache_store",
-                "route",
+                "vcl-static",
                 100,
                 fluxheim_config::WasmPluginPhase::CacheStore,
             ),
         ],
     );
     config.vhosts[0].routes[0].path_exact = None;
     config.vhosts[0].routes[0].path_prefix = Some("/".to_owned());
+    config.vhosts[0].name = "vcl.test".to_owned();
+    config.vhosts[0].hosts = vec!["vcl.test".to_owned()];
+    config.vhosts[0].routes[0].name = "vcl-static".to_owned();
+    config.server.default_vhost = Some("vcl.test".to_owned());
+    for attachment in &mut config.wasm.attachments {
+        attachment.vhost = "vcl.test".to_owned();
+    }
     config.vhosts[0].routes[0].redirect = None;
     config.vhosts[0].routes[0].proxy = Some(fluxheim_config::ProxyConfig {
         upstreams: vec![upstream.to_string()],
@@ -1343,23 +1351,23 @@ async fn native_wasm_cache_policy_example_matches_documented_behavior() {
 
     let mobile = downstream_request(
         proxy,
-        "GET /static/example.png HTTP/1.1\r\nHost: route.test\r\nX-Device-Class: mobile\r\nConnection: close\r\n\r\n",
+        "GET /static/example.png HTTP/1.1\r\nHost: vcl.test\r\nX-Device-Class: mobile\r\nConnection: close\r\n\r\n",
     )
     .await;
     let desktop = downstream_request(
         proxy,
-        "GET /static/example.png HTTP/1.1\r\nHost: route.test\r\nX-Device-Class: desktop\r\nConnection: close\r\n\r\n",
+        "GET /static/example.png HTTP/1.1\r\nHost: vcl.test\r\nX-Device-Class: desktop\r\nConnection: close\r\n\r\n",
     )
     .await;
     let mobile_hit = downstream_request(
         proxy,
-        "GET /static/example.png HTTP/1.1\r\nHost: route.test\r\nX-Device-Class: mobile\r\nConnection: close\r\n\r\n",
+        "GET /static/example.png HTTP/1.1\r\nHost: vcl.test\r\nX-Device-Class: mobile\r\nConnection: close\r\n\r\n",
     )
     .await;
     tokio::time::sleep(Duration::from_millis(1200)).await;
     let mobile_expired = downstream_request(
         proxy,
-        "GET /static/example.png HTTP/1.1\r\nHost: route.test\r\nX-Device-Class: mobile\r\nConnection: close\r\n\r\n",
+        "GET /static/example.png HTTP/1.1\r\nHost: vcl.test\r\nX-Device-Class: mobile\r\nConnection: close\r\n\r\n",
     )
     .await;
 
@@ -1407,6 +1415,27 @@ async fn native_wasm_cache_policy_example_matches_documented_behavior() {
         response_header(&mobile_expired, "x-cache-status").as_deref(),
         Some("MISS")
     );
+
+    let purged = crate::purge_native_memory_cache_tag(
+        "vcl.test",
+        Some("vcl-static"),
+        "vcl.test:route:vcl-static",
+        "wasm-policy",
+        16,
+        false,
+    );
+    assert_eq!(purged.matched, 2);
+    assert_eq!(purged.purged, 2);
+    let after_purge = downstream_request(
+        proxy,
+        "GET /static/example.png HTTP/1.1\r\nHost: vcl.test\r\nX-Device-Class: mobile\r\nConnection: close\r\n\r\n",
+    )
+    .await;
+    assert!(after_purge.ends_with("mobile-after-tag-purge"));
+    assert_eq!(
+        response_header(&after_purge, "x-cache-status").as_deref(),
+        Some("MISS")
+    );
 }
 
 #[tokio::test]

docs/wasm-policy-example-parity.md

@@ -179,6 +179,13 @@ checked-in `examples/wasm/cache-lookup-policy.wat` and
 native HTTP/1 test suite compiles the example sources directly. Richer
 store-admission mutation remains follow-up `1.7.x` cache-policy work.
 
+For `v1.7.9`, the example TOML is schema-validated and the shared live policy
+smoke proves pass versus MISS/HIT behavior, bounded device-class variants,
+image-only TTL/tag/stored-header mutation, TTL expiry, non-image isolation,
+tag-based purge through Fluxheim's cache tooling, and fail-closed unknown or
+duplicate mutation IDs. This is typed VCL-like capability parity; it does not
+embed VCL or expose raw cache objects.
+
 ## Stabilization Requirements
 
 Before `1.7` is complete:

examples/wasm/README.md

@@ -59,6 +59,13 @@ uses fixed Fluxheim host-call IDs. Plugins cannot emit arbitrary cache-key
 bytes, TTLs, tags, response headers, upstream targets, or filesystem paths
 through this ABI.
 
+Together, these files are the VCL-like cache-policy migration example. The
+live example smoke proves cache pass versus MISS/HIT behavior, bounded
+mobile/desktop key variants, image-only TTL/tag/header mutation, expiry,
+non-image isolation, tag-based purge through normal Fluxheim tooling, and
+fail-closed rejection of unknown or duplicate mutation IDs. Fluxheim does not
+embed VCL and the guest never receives raw cache objects.
+
 `wasi-random-policy.wat` and `wasi-random-policy.toml` demonstrate the opt-in
 `1.7.8` WASI Preview 1 boundary. The module imports only `random_get`, and the
 config grants only randomness. Clocks require their own explicit grant.

packaging/rpm/fluxheim.spec

@@ -159,6 +159,7 @@ fi
 - Add the F5 iRules-style route access example and real listener smoke.
 - Add the nginx Lua/OpenResty-style bounded header-policy example.
 - Add the HAProxy Lua/SPOE-style bounded route and load-balancer example.
+- Complete the VCL-like cache-policy example and live operational smoke.
 - Harden snapshot opens against pathname races and isolate corruption fixtures
   behind safe store primitives.
 

release-notes/RELEASE_NOTES_1.7.9.md

@@ -23,6 +23,10 @@ products.
   fixture. Live coverage proves symbolic canary/mirror selection, unavailable
   branch rejection, selected-route policy enforcement, native load balancing,
   and managed-cookie persistence without exposing backend addresses.
+- Promote the existing cache lookup/store WAT pair to the validated VCL-like
+  parity example. The live smoke now proves pass, MISS/HIT, bounded variants,
+  image-only TTL/tag/header metadata, expiry, tag purge, non-image isolation,
+  and fail-closed invalid mutations.
 
 ## Security
 

scripts/smoke_wasm_policy_examples.sh

@@ -12,5 +12,6 @@ cargo test --locked -p fluxheim-server --features wasm \
 cargo test --locked -p fluxheim-server \
     --features "wasm,load-balancer,traffic-mirror" \
     native_wasm_route_decision
+cargo test --locked -p fluxheim-server --features wasm native_wasm_cache_
 
 echo "wasm policy examples smoke: ok"

scripts/validate-wasm-example-plan.sh

@@ -18,6 +18,9 @@ for file in \
     examples/wasm/openresty-header-policy.toml \
     examples/wasm/haproxy-spoe-routing-policy.wat \
     examples/wasm/haproxy-spoe-routing-policy.toml \
+    examples/wasm/cache-lookup-policy.wat \
+    examples/wasm/cache-store-policy.wat \
+    examples/wasm/cache-policy.toml \
     scripts/smoke_wasm_policy_examples.sh
 do
     if [ ! -f "$file" ]; then