Finalize Fluxheim 1.7.8 release

Author: eldryoth

CHANGELOG.md

@@ -7,7 +7,7 @@ Fluxheim follows semantic versioning once `1.0.0` is released. Before `1.0.0`,
 minor versions may still change configuration shape, feature names, and runtime
 behavior when the change improves security or project direction.
 
-## 1.7.8 - Unreleased
+## 1.7.8 - 2026-07-11
 
 ### Added
 

README.md

@@ -116,7 +116,7 @@ Fluxheim is licensed under the European Union Public Licence 1.2.
 
 | Capability | Status | Notes |
 | --- | --- | --- |
-| Admin API | ✅ | Bearer-token auth, loopback defaults, brute-force throttling, authenticated health by default, snapshots, rollback, cache operations. |
+| Admin API | ✅ | Bearer-token auth, loopback defaults, brute-force throttling, authenticated health by default, authenticated transactional snapshots, rollback, doctor/prune operations, and cache operations. |
 | Read-only ops socket | ✅ | `1.4.1`; Unix-domain local status/cache/health endpoint with owner/group-only permissions; snapshot listing requires bearer auth. |
 | Prometheus metrics | ✅ | Native metrics profile and bounded labels for edge/cache/LB/PHP events. |
 | OpenTelemetry | ✅ | OTLP metrics and tracing export profiles. |

crates/fluxheim-server/src/native_http1_cache_purge.rs

@@ -11,6 +11,34 @@ use super::{NativeDiskCache, NativeDiskCacheLocation};
 static NATIVE_DISK_CACHE_PURGE_REGISTRY: OnceLock<Mutex<Vec<NativeDiskCachePurgeHandle>>> =
     OnceLock::new();
 
+#[cfg(test)]
+std::thread_local! {
+    static PURGE_REGISTRY_LOCK_HELD: std::cell::Cell<bool> = const { std::cell::Cell::new(false) };
+}
+
+#[cfg(test)]
+struct PurgeRegistryLockObservation;
+
+#[cfg(test)]
+impl PurgeRegistryLockObservation {
+    fn enter() -> Self {
+        PURGE_REGISTRY_LOCK_HELD.with(|held| {
+            assert!(
+                !held.replace(true),
+                "nested purge registry lock observation"
+            );
+        });
+        Self
+    }
+}
+
+#[cfg(test)]
+impl Drop for PurgeRegistryLockObservation {
+    fn drop(&mut self) {
+        PURGE_REGISTRY_LOCK_HELD.with(|held| held.set(false));
+    }
+}
+
 #[derive(Clone, Debug)]
 struct NativeDiskCachePurgeHandle {
     vhost: Arc<str>,
@@ -214,10 +242,7 @@ pub(crate) fn register_native_disk_cache_purge_handle(
 
 #[cfg(test)]
 pub(super) fn native_disk_cache_purge_registry_is_unlocked_for_test() -> bool {
-    NATIVE_DISK_CACHE_PURGE_REGISTRY
-        .get()
-        .and_then(|registry| registry.try_lock().ok())
-        .is_some()
+    PURGE_REGISTRY_LOCK_HELD.with(|held| !held.get())
 }
 
 pub fn purge_native_disk_cache_primary(
@@ -419,6 +444,8 @@ fn native_disk_cache_purge_targets() -> Vec<NativeDiskCachePurgeTarget> {
             std::process::abort();
         }
     };
+    #[cfg(test)]
+    let _lock_observation = PurgeRegistryLockObservation::enter();
     registry.retain(|handle| handle.cache.upgrade().is_some());
     registry
         .iter()

crates/fluxheim-server/src/native_http1_proxy_tests.rs

@@ -241,10 +241,14 @@ fn response_header(response: &str, name: &str) -> Option<String> {
     })
 }
 
-async fn unused_local_address() -> std::net::SocketAddr {
+async fn rejecting_upstream() -> std::net::SocketAddr {
     let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
     let address = listener.local_addr().unwrap();
-    drop(listener);
+    tokio::spawn(async move {
+        while let Ok((stream, _)) = listener.accept().await {
+            drop(stream);
+        }
+    });
     address
 }
 

crates/fluxheim-server/src/native_http1_proxy_tests/h2.rs

@@ -11,8 +11,8 @@ use crate::{
 };
 
 use super::{
-    downstream_get, native_proxy_test_request_for, proxy_listener_for,
-    static_load_balance_without_health_check, unused_local_address,
+    downstream_get, native_proxy_test_request_for, proxy_listener_for, rejecting_upstream,
+    static_load_balance_without_health_check,
 };
 
 #[path = "h2_support.rs"]
@@ -278,7 +278,7 @@ async fn native_proxy_weighted_round_robins_successful_http2_static_upstreams()
 
 #[tokio::test]
 async fn native_proxy_http2_safe_method_fails_over_to_second_static_upstream() {
-    let first = unused_local_address().await;
+    let first = rejecting_upstream().await;
     let (second, second_connections) = h2_upstream_with_body("h2 failover\n", 1).await;
     let proxy_config = fluxheim_config::ProxyConfig {
         upstreams: vec![first.to_string(), second.to_string()],
@@ -309,7 +309,7 @@ async fn native_proxy_http2_safe_method_fails_over_to_second_static_upstream() {
 
 #[tokio::test]
 async fn native_proxy_http2_does_not_fail_over_unsafe_method() {
-    let first = unused_local_address().await;
+    let first = rejecting_upstream().await;
     let (second, second_connections) = h2_upstream_with_body("h2 unsafe replay\n", 1).await;
     let proxy_config = fluxheim_config::ProxyConfig {
         upstreams: vec![first.to_string(), second.to_string()],

crates/fluxheim-server/src/native_http1_proxy_tests/response_features.rs

@@ -14,9 +14,7 @@ use crate::{DownstreamHttp1Policy, NativeHttp1Proxy};
 
 #[cfg(feature = "compression-gzip")]
 use super::upstream;
-use super::{
-    downstream_get, proxy_config_with_error_page, proxy_listener_for, unused_local_address,
-};
+use super::{downstream_get, proxy_config_with_error_page, proxy_listener_for, rejecting_upstream};
 
 #[cfg(feature = "compression-gzip")]
 async fn downstream_request_bytes(proxy: std::net::SocketAddr, request: &str) -> Vec<u8> {
@@ -81,7 +79,7 @@ async fn native_proxy_serves_configured_error_page_on_bad_gateway() {
     let errors = tempfile::tempdir().unwrap();
     std::fs::write(errors.path().join("502.html"), "native custom 502\n").unwrap();
     let mut config = proxy_config_with_error_page(errors.path().to_path_buf());
-    config.upstream = Some(unused_local_address().await.to_string());
+    config.upstream = Some(rejecting_upstream().await.to_string());
     let proxy = NativeHttp1Proxy::from_proxy_config(&config, DownstreamHttp1Policy::default())
         .unwrap()
         .unwrap();
@@ -104,7 +102,7 @@ async fn native_proxy_falls_back_when_configured_error_page_is_too_large() {
     let oversized = std::fs::File::create(errors.path().join("502.html")).unwrap();
     oversized.set_len(64 * 1024 * 1024 + 1).unwrap();
     let mut config = proxy_config_with_error_page(errors.path().to_path_buf());
-    config.upstream = Some(unused_local_address().await.to_string());
+    config.upstream = Some(rejecting_upstream().await.to_string());
     let proxy = NativeHttp1Proxy::from_proxy_config(&config, DownstreamHttp1Policy::default())
         .unwrap()
         .unwrap();

crates/fluxheim-server/src/native_http1_proxy_tests/static_upstream.rs

@@ -8,12 +8,12 @@ use crate::{NativeHttp1Proxy, NativeHttp1Upstream};
 
 use super::{
     counting_upstream, downstream_get, failover_proxy_listener, proxy_listener_for,
-    unused_local_address, upstream,
+    rejecting_upstream, upstream,
 };
 
 #[tokio::test]
 async fn native_proxy_fails_over_get_to_second_static_upstream() {
-    let first = unused_local_address().await;
+    let first = rejecting_upstream().await;
     let second = upstream(|request, mut stream| async move {
         let request = String::from_utf8(request).unwrap();
         assert!(request.starts_with("GET /failover HTTP/1.1\r\n"));
@@ -95,7 +95,7 @@ async fn native_proxy_weighted_round_robins_static_upstreams() {
 
 #[tokio::test]
 async fn native_proxy_weighted_failover_skips_duplicate_slots() {
-    let first = unused_local_address().await;
+    let first = rejecting_upstream().await;
     let (second, second_count) = counting_upstream("second", 1).await;
     let proxy = NativeHttp1Proxy::from_weighted_upstreams(
         vec![
@@ -121,7 +121,7 @@ async fn native_proxy_weighted_failover_skips_duplicate_slots() {
 
 #[tokio::test]
 async fn native_proxy_does_not_fail_over_unsafe_method() {
-    let first = unused_local_address().await;
+    let first = rejecting_upstream().await;
     let second = upstream(|_, mut stream| async move {
         stream
             .write_all(b"HTTP/1.1 200 OK\r\ncontent-length: 6\r\n\r\nsecond")

docs/modularity-exceptions.md

@@ -32,3 +32,14 @@ line adds broader Wasm phases.
 | `crates/fluxheim-server/src/native_http1_route_wasm.rs` | 2043 | The native hook bridge now owns registry lookup, pre-submission security/cache admission, access decisions, bounded header host calls, bounded route/cache ABIs, and cache metadata aggregation. | Split header host-call state/mutation helpers, route-decision helpers, and cache-policy helpers into focused `native_http1_route_wasm_headers`, `native_http1_route_wasm_route_decision`, and `native_http1_route_wasm_cache_policy` modules. |
 | `crates/fluxheim-wasm/src/runtime.rs` | 1061 | Runtime construction now includes host bindings, compile-slot coordination, bounded async admission, shared epoch interruption, and execution policy checks. | Split admission, engine/ticker, compile-slot, execution, and host-call helpers into separate runtime submodules. |
 | `src/metrics.rs` | 505 | Root metrics compatibility wrappers remain just over the target after native/Wasm additions. | Move remaining Wasm metric wiring into the observability crate or a focused root adapter. |
+
+The following files crossed the target during the broader `1.7.8` security and
+WASI integration pass. They remain temporary release exceptions with explicit
+split destinations; new functionality must not use them as precedent.
+
+| File | Baseline lines | Reason | Split target |
+| --- | ---: | --- | --- |
+| `crates/fluxheim-geoip/src/lib.rs` | 567 | Runtime policy integration and CIRCL combined-schema support currently share the public model module. | Move runtime loading and provider-specific decoding into focused modules while preserving the public GeoIP types. |
+| `crates/fluxheim-server/src/native_http1_host_router.rs` | 545 | Trusted-client GeoIP context and Wasm policy construction expanded the central host-router assembly boundary. | Move GeoIP/Wasm policy assembly into a dedicated router policy builder. |
+| `crates/fluxheim-server/src/native_http1_host_router_tests.rs` | 516 | Host-router tests now cover trusted-proxy GeoIP and Wasm policy wiring alongside base routing. | Split GeoIP and Wasm construction regressions into focused test modules. |
+| `src/cli.rs` | 531 | Snapshot command dispatch and validated runtime loading remain together in the root CLI adapter. | Move snapshot subcommand execution into a dedicated CLI snapshot module. |

packaging/rpm/fluxheim.spec

@@ -159,6 +159,11 @@ fi
 - Require separate clock and randomness grants and reject all other WASI
   imports before module instantiation.
 - Add real WASI smoke and native listener coverage.
+- Add authenticated transactional snapshots with generation witnesses,
+  provider-backed integrity, resilient doctor/prune operations, and safe legacy
+  manifest bootstrap and migration.
+- Harden stream forwarding, PHP-FPM lifecycle and body handling, TLS input
+  parsing, GeoIP database loading, and static-path invariants.
 
 * Fri Jul 10 2026 Fluxheim Maintainers <1921261+eldryoth@users.noreply.github.com> - 1.7.7-1
 - Add opt-in wasm-proxy-abi compatibility preview namespace validation.

release-notes/RELEASE_NOTES_1.7.8.md

@@ -48,6 +48,20 @@ general-purpose WASI application hosting.
 - Add optional HMAC-SHA-256 manifests backed by an external bounded key file.
   Config and metadata are verified before rollback parsing; legacy stores are
   reported as unverified rather than silently authenticated.
+- Persist an authenticated generation high-water mark and per-manifest
+  generation witnesses so pruning cannot reuse audit generations and freshness
+  scans remain bounded without rereading complete snapshot configurations.
+- Preserve authenticated manifests created before generation witnesses. A
+  fully verified all-legacy store with no generation counter bootstraps from
+  its highest generation, persists authenticated state first, migrates its
+  manifests, and publishes the next snapshot at `max + 1`. Missing state still
+  fails closed for V2 and mixed stores.
+- Route snapshot SHA-256 and HMAC-SHA-256 through the selected Ring,
+  OpenSSL-FIPS, or AWS-LC-FIPS provider, returning provider failures to the
+  administrative caller instead of aborting the data plane.
+- Require owner-only snapshot state and integrity-key files, keep integrity
+  keys outside the snapshot store, and authenticate intentional pruning
+  boundaries.
 - Add resilient listing plus snapshot `show`, `diff`, `verify`, `doctor`, and
   protected `prune` operations. Snapshot TOML remains plaintext and needs
   encrypted storage or backups when confidentiality is required.
@@ -167,6 +181,10 @@ scripts/smoke_admin_listener.sh
 - Document the rootless Podman ownership mapping required for trusted read-only
   config mounts, including explicit `podman unshare chown`, an opt-in `:U`
   alternative, and an in-container verification command.
+- Existing authenticated snapshot stores created before generation witnesses
+  upgrade automatically on their next locked snapshot creation only when every
+  retained legacy manifest verifies. See `docs/config-snapshots.md` for the
+  fail-closed mixed-store and external anti-rollback requirements.
 - CIRCL Geo Open users should follow `docs/geoip.md` for dataset attribution,
   trusted installation, pinned checksums, schema details, and the opt-in live
   database proof. The large network download remains outside normal CI gates.