varnishcache
http_conn is not really private
TL;DR: in master, even though http_conn is private, backends are expected to know about it.
http_conn is located in a file saying Stuff that should never be exposed to a VMOD, however, both cache_fetch.c and cache_vrt_filter.c use it (and don't even check it exists before accessing it)
This is problematic notably for vmods as they need to create a dummy http_conn that they should not know about.
FWIW cache_varnishd.h says that, but it is also installed as a header so you can use it from a VMOD. One could say you may manage your htc but here be dragons, for now. As you pointed out, a VMOD implementing its own backend transport needs a clear http_conn contract before it can move to cache.h or some other public header for VMODs.
in the same vein: vcldiir->health_changed is a bit murky too. It's obviously there, and we can modify it with VRT_SetChanged, but we can't retrieve it's value, which would be useful when implementing the healthy method